Reflections on the White House Privacy Office Peter P. Swire Ohio State University Center for American Progress N.C. State Privacy Day January 29, 2008

Overview Privacy actions in the Bill Clinton years Privacy actions in the Bill Clinton years Structure of the privacy office Structure of the privacy office Possible reasons to care: Possible reasons to care: Role of the CPO Role of the CPO History of what happened History of what happened Preview of what might happen? Preview of what might happen?

I. Clinton Administration Privacy Actions Privacy hot buttons before I entered government in 2/99: Privacy hot buttons before I entered government in 2/99: Clipper Chip & encryption Clipper Chip & encryption CALEA CALEA Know Your Customer (banking) Know Your Customer (banking)

Medical Privacy Rule HIPAA in 1996 HIPAA in 1996 Support for legislation through 8/99 Support for legislation through 8/99 Proposed rule 10/99 Proposed rule 10/99 52,000 comments by 2/00 52,000 comments by 2/00 Final rule 12/00 Final rule 12/00 Executive Order 12/00: limits on using health oversight record for law enforcement Executive Order 12/00: limits on using health oversight record for law enforcement

Financial Privacy Clinton speech 5/99 Clinton speech 5/99 House bill with half that 6/99 House bill with half that 6/99 Significant Administration push for privacy Significant Administration push for privacy Gramm-Leach-Bliley 11/99 Gramm-Leach-Bliley 11/99 Administration proposal for more, 4/00 Administration proposal for more, 4/00 GLB regs 2000 GLB regs 2000

Federal Government Privacy 6/99 OMB memorandum to post clear privacy policies on agency sites 6/99 OMB memorandum to post clear privacy policies on agency sites 6/00 OMB memorandum presumption against cookies on federal sites & reports to OMB on privacy in the budget process 6/00 OMB memorandum presumption against cookies on federal sites & reports to OMB on privacy in the budget process 12/00 OMB memorandum on agency data sharing, including push for privacy impact assessments (E-Gov Act 2002) 12/00 OMB memorandum on agency data sharing, including push for privacy impact assessments (E-Gov Act 2002) Federal CIO Council privacy committee Federal CIO Council privacy committee

Some other privacy actions Crypto policy change 9/99 Crypto policy change 9/99 Genetic Discrimination E.O. 2/00 Genetic Discrimination E.O. 2/00 NAS study on authentication and privacy NAS study on authentication and privacy Bankruptcy and privacy study 1/01: public records and privacy issue Bankruptcy and privacy study 1/01: public records and privacy issue

Other privacy actions Safe Harbor Safe Harbor DoubleClick & Network Advertising Code 6/00 DoubleClick & Network Advertising Code 6/00 SSN bill proposed 6/00, and fought Gregg bill SSN bill proposed 6/00, and fought Gregg bill Bill to update wiretap laws for the Internet, summer 2000; proposed higher standards for trap-and-trace and wiretaps (Patriot Act 2001) Bill to update wiretap laws for the Internet, summer 2000; proposed higher standards for trap-and-trace and wiretaps (Patriot Act 2001)

II. The Privacy Office in the U.S. Chief Counselor for Privacy, Chief Counselor for Privacy, U.S. Office of Management and Budget U.S. Office of Management and Budget Executive Office of the President Executive Office of the President Old Executive Office Building Old Executive Office Building 4 functions: 4 functions: Government data handling Government data handling Clearance Clearance Enforcement/Ombudsman Enforcement/Ombudsman Bully Pulpit Bully Pulpit

Government Data Handling Big advantage if in OMB Big advantage if in OMB Management Management Office of Information & Technology Policy Office of Information & Technology Policy Budget Budget Cant do that way in an independent agency – imagine a corporate CPO that was outside of the company Cant do that way in an independent agency – imagine a corporate CPO that was outside of the company

Clearance Testimony, legislative proposals cleared in OMB Testimony, legislative proposals cleared in OMB Less formal statements also cleared Less formal statements also cleared Examples: Examples: FIDNet FIDNet Money laundering Money laundering New hire data base (information sharing) New hire data base (information sharing) Cant do as well in independent agency Cant do as well in independent agency

Enforcement Cant do in OMB Cant do in OMB HHS and financial agencies HHS and financial agencies FTC for consumer protection FTC for consumer protection Web seals & CPAs (expand scale)? Web seals & CPAs (expand scale)? Private rights of action? Private rights of action?

Bully pulpit Cons: Cons: Fishbowl in White House therefore cautious about statements Fishbowl in White House therefore cautious about statements Cant comment on individual products or companies Cant comment on individual products or companies Pro: Pro: Big impact if President or Cabinet speak Big impact if President or Cabinet speak Any White House official can raise the issues visibility & help on the Hill Any White House official can raise the issues visibility & help on the Hill Independent agency has more flexibility Independent agency has more flexibility

Ombudsman/Investigator No subpoena power at OMB No subpoena power at OMB Limited ability to blow the whistle externally to force change internally Limited ability to blow the whistle externally to force change internally W.H. Privacy & Civil Liberties Board W.H. Privacy & Civil Liberties Board Version 1 Version 1 Version 2 Version 2 What role for this beyond GAO, IGs, Congress, and the press? What role for this beyond GAO, IGs, Congress, and the press?

Conclusion Episodes of privacy activity Episodes of privacy activity What might happen in a next Administration? What might happen in a next Administration? Many issues could be open for revisiting, perhaps pretty soonNew Administration has made encouraging statements but we need to watch their actions Many issues could be open for revisiting, perhaps pretty soonNew Administration has made encouraging statements but we need to watch their actions