1. Can the US Meet International Privacy Standards in an Era of Personal Health Records, Consumer Scores and Watch Lists? UNSW's Cyberspace Law and Policy Centre Seminar June 7, 2007 Robert Gellman Privacy and Information Policy Consultant Washington, DC bob@bobgellman.com www.bobgellman.com © Robert Gellman 2007

2. 2 US Method of Privacy Regulation Federal laws State laws (especially California) Self regulation (e.g., TrustE, BBBOnline) Common Law (privacy torts) No law (data brokers, marketers, merchants)

3. © Robert Gellman 20073 Selected Federal Laws Fair Credit Reporting Act Privacy Act of 1974 Gramm-Leach-Bliley (banking) Health Insurance Portability and Accountability Act (HIPAA) Family Educational Rights and Privacy Act Driver’s Privacy Protection Act Children’s Online Privacy Protection Act More….10-20 laws

4. © Robert Gellman 20074 COVERAGE OF US PRIVACY LAWS RECORDS RECORDKEEPEERSRECORDKEEPEERS

5. © Robert Gellman 20075 Official View: Regulate when necessary Another View: Pass privacy laws randomly, largely in response to horror stories Sectoral vs. Horror Story

6. © Robert Gellman 20076

7. 7 Gaps Inconsistencies Sectoral Borders Geographic Borders Major Shortcomings

8. © Robert Gellman 20078 Can exist totally separately from regulated health records PHR record keepers not regulated Data obtained with consent of data subjects Only company policies apply, and they can be changed Completely open to commercial exploitation Personal Health Records

9. © Robert Gellman 20079 Newly identified category of data –Passenger Screening –Credit Score –Insurance Score –Bankruptcy Score –ID Score –Consumption/Marketing Score –Health Score See WorldPrivacyForum.org for more Consumer Scoring

10. © Robert Gellman 200710 Round up or round down? –Existing laws establish varying policies (bank records can be used for marketing; health records cannot) –Some records will necessarily receive a lower level of protection than today –Widely variable accountability measures Barriers to Common Rules I

11. © Robert Gellman 200711 Legislative Committee Jurisdictions –Banking Committee vs. Commerce Committee vs. other committees –Security breach legislation referred to many committees –Need strong political force to overcome entrenched jurisdictional rules Barriers to Common Rules II

12. © Robert Gellman 200712 Enforcement –Federal Trade Commission –State Attorneys General –Federal agency enforcement –Private right of action –Other approaches: ISPs enforce CAN-SPAM Barriers to Common Rules III

13. © Robert Gellman 200713 Preemption –Allow stronger state laws? –Replace all state laws? –What to do with existing privacy torts (a wholly state activity)? –Cut off innovations at the state level? Barriers to Common Rules IV

14. © Robert Gellman 200714 Conclusion Microsoft proposal for EU style law No precedent for federal preemption in such a widespread area Would require major public or Presidential support Some consensus, but not on enforcement How to stop a “Privacy Prevention Act”