Privacy Profile - Revision history

Tomjones: /* Problems */

2020-04-22T04:58:36Z

Problems

← Older revision		Revision as of 04:58, 22 April 2020
Line 27:		Line 27:
	==Problems==		==Problems==
	* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose what to include and exclude? Most people appear to go out of their way to avoid making choices about information collection and use; if forced to, they are often ill-equipped to appreciate the risks either to our privacy or the benefits that may be lost if information is not available.</blockquote>		* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose what to include and exclude? Most people appear to go out of their way to avoid making choices about information collection and use; if forced to, they are often ill-equipped to appreciate the risks either to our privacy or the benefits that may be lost if information is not available.</blockquote>
	* The GDPR is in a similar thrall to lawyers. People with legitimate concerns at not part of the mix, just regulators trying to find the best corporation to fine the largest amount possible.		* The GDPR is in a similar thrall to lawyers. People with legitimate concerns are not part of the mix, just regulators trying to find the best corporation to fine the largest amount possible.

	==Solutions==		==Solutions==

Tomjones: /* Problems */

2020-04-22T04:57:10Z

Problems

← Older revision		Revision as of 04:57, 22 April 2020
Line 26:		Line 26:

	==Problems==		==Problems==
	* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose</blockquote>		* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose what to include and exclude? Most people appear to go out of their way to avoid making choices about information collection and use; if forced to, they are often ill-equipped to appreciate the risks either to our privacy or the benefits that may be lost if information is not available.</blockquote>
	* The GDPR is in a similar thrall to lawyers. People with legitimate concerns at not part of the mix, just regulators trying to find the best corporation to fine the largest amount possible.		* The GDPR is in a similar thrall to lawyers. People with legitimate concerns at not part of the mix, just regulators trying to find the best corporation to fine the largest amount possible.

Tomjones: /* Problems */

2020-04-22T04:54:44Z

Problems

← Older revision		Revision as of 04:54, 22 April 2020
Line 27:		Line 27:
	==Problems==		==Problems==
	* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose</blockquote>		* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose</blockquote>
			* The GDPR is in a similar thrall to lawyers. People with legitimate concerns at not part of the mix, just regulators trying to find the best corporation to fine the largest amount possible.

	==Solutions==		==Solutions==

Tomjones: /* Problems */

2020-04-22T04:52:28Z

Problems

← Older revision		Revision as of 04:52, 22 April 2020
Line 26:		Line 26:

	==Problems==		==Problems==
	* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf ~~<blockquote>~~The Failure of Fair Information Practice Principles] on their website. Some Quotes ~~<blockquote>~~<blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose</blockquote>		* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose</blockquote>

	==Solutions==		==Solutions==

Tomjones: /* Problems */

2020-04-22T04:51:25Z

Problems

@@ Line 26: / Line 26: @@
 ==Problems==
-* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf  The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote><blockquote>Modern data protection law is built on “fair information practice principles”
+* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf  <blockquote>The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote><blockquote>Modern data protection law is built on “fair information practice principles” (FIPPS). At their inception in the 1970s and early 1980s, FIPPS were broad, aspirational, and included a blend of substantive (e.g., data quality, use limitation) and procedural (e.g., consent, access) principles. They reflected a wide consensus about the need for broad standards to facilitate both individual privacy and the promise of information flows in an increasingly technology-dependent, global society. As translated into national law in the United States, Europe, and elsewhere during the 1990s and 2000s, however, FIPPS have increasingly been reduced to narrow, legalistic principles (e.g., notice, choice, access, security, and enforcement). These principles reflect a procedural approach to maximizing individual control over data rather than individual or societal welfare. As theoretically appealing as this approach may be, it has proven unsuccessful in practice. Businesses and other data users are burdened with legal obligations while individuals endure an onslaught of notices and opportunities for often limited choice. Notices are frequently meaningless because individuals do not see them or choose to ignore them, they are written in either vague or overly technical language, or they present no meaningful opportunity for individual choice. Trying to enforce notices no one reads has led in the United States to the Federal Trade Commission’s tortured legal logic that such notices create enforceable legal obligations, even if they were not read or relied upon as part of the deal. Moreover, choice is often an annoyance or even a disservice to individuals. For example, the average credit report is updated four times a day in the United States. How many people want to be asked to consent each time? Yet how meaningful is consent if it must be given or withheld for all updates as a group? How meaningful is a credit reporting system if individuals can selectively choose</blockquote>
 ==Solutions==

Tomjones: /* Problems */

2020-04-22T04:47:50Z

Problems

@@ Line 26: / Line 26: @@
 ==Problems==
+* Privacy started and remains a realm created, defined and adjudicated by lawyers, not users. It is most interesting that even the US FTC understands the problem and has posted [https://www.ftc.gov/system/files/documents/public_comments/2018/12/ftc-2018-0098-d-0036-163372.pdf  The Failure of Fair Information Practice Principles] on their website. Some Quotes <blockquote><blockquote>Modern data protection law is built on “fair information practice principles”
 ==Solutions==

Tomjones: /* Preconditions */

2020-04-22T00:47:23Z

Preconditions

← Older revision		Revision as of 00:47, 22 April 2020
Line 23:		Line 23:
	==Preconditions==		==Preconditions==
	* The primary use case for this profile is a user navigating to the web site of a [[Relying Party]] and deciding whether to share personal information with that website.		* The primary use case for this profile is a user navigating to the web site of a [[Relying Party]] and deciding whether to share personal information with that website.
	* See the wiki page for [[Patient_Choice#Expected_Types_of_Access_Methods\Patient Choice]] to see more information about the different user access methods where privacy consent is established.		* See the wiki page for [[Patient_Choice#Expected_Types_of_Access_Methods\|Patient Choice]] to see more information about the different user access methods where privacy consent is established.

	==Problems==		==Problems==

Tomjones: /* Preconditions */

2020-04-22T00:47:04Z

Preconditions

← Older revision		Revision as of 00:47, 22 April 2020
Line 23:		Line 23:
	==Preconditions==		==Preconditions==
	* The primary use case for this profile is a user navigating to the web site of a [[Relying Party]] and deciding whether to share personal information with that website.		* The primary use case for this profile is a user navigating to the web site of a [[Relying Party]] and deciding whether to share personal information with that website.
	* See the wiki page for [[Patient Choice]] to see more information about the different user access methods where privacy consent is established.		* See the wiki page for [[Patient_Choice#Expected_Types_of_Access_Methods\Patient Choice]] to see more information about the different user access methods where privacy consent is established.

	==Problems==		==Problems==

Tomjones: /* Preconditions */

2020-04-22T00:45:47Z

Preconditions

← Older revision		Revision as of 00:45, 22 April 2020
Line 23:		Line 23:
	==Preconditions==		==Preconditions==
	* The primary use case for this profile is a user navigating to the web site of a [[Relying Party]] and deciding whether to share personal information with that website.		* The primary use case for this profile is a user navigating to the web site of a [[Relying Party]] and deciding whether to share personal information with that website.
			* See the wiki page for [[Patient Choice]] to see more information about the different user access methods where privacy consent is established.

	==Problems==		==Problems==

Tomjones: /* Context */

2020-04-22T00:19:16Z

Context

← Older revision		Revision as of 00:19, 22 April 2020
Line 14:		Line 14:
	## with the consent of the data subject; or		## with the consent of the data subject; or
	## by the authority of law.		## by the authority of law.
	* The [https://www.nist.gov/privacy-framework NIST Privacy Framework] includes several resources with these functions defined(within the data controller)		* The [https://www.nist.gov/privacy-framework NIST Privacy Framework] includes several resources with these functions defined (within the data controller)
	# Identify = Develop the organizational understanding to manage privacy risk for individuals arising from data processing.		# Identify = Develop the organizational understanding to manage privacy risk for individuals arising from data processing.
	# Govern = Develop and implement the organizational governance structure to enable an ongoing understanding of the organization’s risk management priorities that are informed by privacy risk.		# Govern = Develop and implement the organizational governance structure to enable an ongoing understanding of the organization’s risk management priorities that are informed by privacy risk.