[12064] in Commercialization & Privatization of the Internet
NTIA privacy notice (fwd) (long!)
daemon@ATHENA.MIT.EDU (DAN L. BURK)
Tue May 3 23:27:03 1994
Date: 3 May 94 20:10:00 EST
From: "DAN L. BURK" <DBURK@gmuvax.gmu.edu>
To: "com-priv" <com-priv@psi.com>
>From: GMUVAX::WINS%"cyberia-l@birds.wm.edu" 3-MAY-1994 17:56:36.25
To: DBURK
CC:
Subj: (Fwd) NTIA notice re privacy and the NII
Return-Path: <cyberia-l@birds.wm.edu>
Received: from eagle.birds.wm.edu by gmuvax.gmu.edu with SMTP ;
Tue, 3 May 94 17:56:01 EST
Received: from localhost.0.0.127.in-addr.arpa by eagle.birds.wm.edu (AIX 3.2/UCB 5.64/4.03)
id AA22137; Tue, 3 May 1994 16:33:12 -0400
Date: Tue, 3 May 1994 16:33:12 -0400
Message-Id: <MAILQUEUE-101.940503161853.448@cite.esusda.gov>
Errors-To: thardy@mail.wm.edu
Reply-To: cyberia-l@birds.wm.edu
Originator: cyberia-l@listserv.cc.wm.edu
Sender: cyberia-l@birds.wm.edu
Precedence: bulk
>From: "MICHAEL SPENCER OF CIT" <MSPENCER@cite.esusda.gov>
To: Multiple recipients of list <cyberia-l@birds.wm.edu>
Subject: (Fwd) NTIA notice re privacy and the NII
X-Listserver-Version: 6.0 -- UNIX ListServer by Anastasios Kotsikonas
Dear Cyberians,
I don't recall seeing this posted in this forum previously. There may still be
time to add your comments. If your in the Washington area and have an
interest, you might try to attend the hearing.
Mike Spencer
mspencer@esusda.gov
------- Forwarded Message Follows -------
Date: Thu, 21 Apr 1994 11:40:47 -0500
Reply-to: telecomreg@relay.adp.wisc.edu
>From: borton@macc.wisc.edu (Barry Orton)
To: Multiple recipients of list <telecomreg@relay.adp.wisc.edu>
Subject: NTIA notice re privacy and the NII
reposted for CMATTEY@NTIA.DOC.GOV follows:
-------------------------------------------------------------------------------
The National Telecommunications and Information Administration is
seeking comments on issues relating to privacy and the National
Information Infrastructure. The attached files are a press
release and full text of NTIA's Notice of Inquiry and Request for
Comments. Please repost and disseminate as you think
appropriate. Thanks!
------------------- EX2PR.DOS follows --------------------
CONTACT: Larry Williams NTIA EXTENDS NOTICE OF
(202) 482-1551 INQUIRY ON PRIVACY ISSUES
TECHNICAL NEWS ADVISORY
The National Telecommunications and Information
Administration (NTIA) has extended the deadline for filing
comments in its privacy Notice of Inquiry (NOI) to May 23, 1994.
On February 11, 1994, NTIA published a Notice of Inquiry and
Request for Comments in the Federal Register entitled "Inquiry on
Privacy Issues Relating to Private Sector Use of
Telecommunications-Related Information." 59 FR 6842.
NTIA has received comments from 30 parties in this
proceeding. Those comments can be reviewed in NTIA's Openness
Room, U.S. Department of Commerce, Room 4092, 14th St. and
Pennsylvania Ave., N.W., Washington, D.C. 20230, between the
hours of 9:00 am - 5:00 pm. For further information about NTIA's
Openness Room, contact Norbert Schroeder at (202)482-6207.
Since the comment deadline date, NTIA has received several
requests for extension of time to file comments. In the interest
of fairness to all potentially interested parties, and to provide
an additional opportunity to develop the record in this
proceeding, NTIA will allow additional time in which to file
comments.
Additional comments should be filed on or before May 23,
1994, to receive full consideration. Please submit seven copies
to the Office of Policy Analysis and Development, NTIA, U.S.
Department of Commerce, Room 4725, 14th St. and Pennsylvania
Ave., N.W., Washington, D.C. 20230. Comments also may be
submitted electronically via Internet to cmattey@ntia.doc.gov.
For further information, please contact Carol Mattey or Lisa
Leidig, Office of Policy Analysis and Development, NTIA, at (202)
482-1880.
##
April 19, 1994
------------------- NOIPRIV.DOS follows --------------------
[Billing Code: 3510-60]
DEPARTMENT OF COMMERCE
National Telecommunications and Information Administration
[Docket No. 940104-4004]
Inquiry on Privacy Issues Relating to Private Sector Use of
Telecommunications-Related Personal Information
AGENCY: National Telecommunications and Information
Administration (NTIA), Commerce
ACTION: Notice of Inquiry; Request for Comments
SUMMARY: NTIA is conducting a comprehensive review of
privacy issues relating to private sector use of
telecommunications-related personal information associated
with the National Information Infrastructure. Public
comment is requested on issues relevant to such a review.
After analyzing the comments, NTIA intends to issue a
report, which may make recommendations to the Information
Infrastructure Task Force and Congress in the area of
telecommunications and information policy, as appropriate.
DATES: Comments should be filed on or before March 30,
1994, to receive full consideration.
ADDRESS: Comments (seven copies) should be sent to the
Office of Policy Analysis and Development, NTIA, U.S.
Department of Commerce, 14th St. and Constitution Ave.,
N.W., Room 4725, Washington, D.C. 20230.
FOR FURTHER INFORMATION CONTACT: Carol Mattey or Lisa
Leidig, Office of Policy Analysis and Development, 202-482-
1880.
AUTHORITY: National Telecommunications and Information
Administration Organization Act of 1992, Pub. L. No. 102-
538, 106 Stat. 3533 (1992) (to be codified at 47 U.S.C.
901 et seq.).
SUPPLEMENTARY INFORMATION:
I. Introduction
1. Today, there is a thriving U.S. industry dealing in
personal information. Over 10,000 lists of data about
individuals are available for rent. According to one 1990
estimate, the business of selling personal information was a
$3 billion per year industry. Personal computers can be
used to access information services that provide a wealth of
information about individuals. Often such personal data
is being manipulated for purposes other than those
originally intended when collected, and the parties engaging
in such activities have no prior direct relationship with
the individual about whom the information pertains.
Moreover, many Americans have little idea of what
information is being collected about them or the many
possible uses of such information.
2. The National Information Infrastructure (NII) -- the
evolving seamless interactive web of communications
networks, computers, data bases, and consumer electronics in
the United States -- will accelerate this trend even
further. As the NII develops, Americans will be able to
access numerous commercial, scientific, and business data
bases, obtain government information and apply for
government benefits, select and customize entertainment
programming, engage in retail, banking, and other commercial
transactions, express their views to federal, state, and
local government officials, and engage in productive
employment, all from the comfort of their homes. With this
growth in the number of electronic transactions, the
accelerated collection of personal information, and the
increase in the interconnectivity of telecommunications
networks and information service providers, however, comes
increasing public concern about communications and personal
privacy.
3. On September 15, 1993, the Clinton Administration
announced the formation of a federal interagency task force
-- the Information Infrastructure Task Force (IITF) -- that
would work with Congress and the private sector to propose
policies and initiatives needed to accelerate the deployment
of the NII. One of the IITF's goals is to ensure that the
NII's operations are compatible with the legitimate privacy
interests of its users, while recognizing the legitimate
societal need for the flow of information.
4. One of the agencies participating in the IITF is the
National Telecommunications and Information Administration
(NTIA), which is the Executive Branch agency principally
responsible for developing and articulating domestic and
international telecommunications policies. As the principal
advisor to the President on telecommunications policies,
NTIA conducts studies and makes recommendations regarding
telecommunications policies, activities, and opportunities,
and presents Executive Branch views on telecommunications
matters to the Congress, the Federal Communications
Commission (FCC), state and local governments, and members
of the public.
5. NTIA is undertaking this proceeding to examine the
privacy implications associated with private sector use of
personal information associated with the NII. Consistent
with NTIA's communications and information policy function,
we focus our inquiry on potential uses of information
generated by interactive multimedia and by telephone usage
and transactions utilizing the telephone, known as telephone
transaction generated information (TTGI). We ask whether
any overarching principles can be developed that would apply
to all firms in the telecommunications sector. Moreover, we
consider the issues that arise when such telecommunications-
related information is used to create and disseminate
detailed dossiers about individuals. We then address the
role of industry self-regulation for providers of
telecommunications and information services. Finally, we
solicit comment on other countries' actions to ensure the
privacy of information transmitted over telecommunications
networks, and how any U.S. policies in this area will affect
the international arena. The record developed in this
proceeding will be used to develop recommendations in the
area of communications and information policy for
presentation to the IITF and Congress, as appropriate.
II. Privacy in a Changing Environment
6. A critical question is what exactly should the right to
privacy entail in today's information economy. In a
seminal law review article in 1890, Samuel Warren and Louis
Brandeis defined the right of privacy as "the right to be
left alone." In more recent years, privacy has been
defined by one academic as "the claim of individuals,
groups, or institutions to determine for themselves when,
how, and to what extent information about them is
communicated to others."
7. There is no single privacy law in the United States;
rather, U.S. privacy law is a patchwork of constitutional,
statutory, regulatory, and common law protections. While
the Supreme Court has held that the Fourth Amendment
restricts the ability of government to collect information
from places in which an individual has a reasonable
expectation of privacy, there is no constitutional right to
be free from analogous intrusions by private sector parties.
Tort law limits intrusive collection of private information,
penalizes unwarranted disclosure of such information, and
protects against disclosure of erroneous information about
individuals. A number of statutes, at both the federal and
state level, protect individuals from governmental misuse of
personal information, while other statutes adopt "fair
information principles" for private sector record keepers in
specific industries.
8. In 1974, Congress established the Privacy Protection
Study Commission to undertake a broad study of whether
privacy rights were being adequately protected in the
emerging information society. In its final report,
issued in 1977, the Commission concluded that federal
privacy laws should advance three concurrent policy goals --
To minimize intrusiveness by creating a proper
balance between what an individual is expected to
divulge to a record-keeping organization and what
he or she seeks in return;
To maximize fairness by opening up record-keeping
operations in ways that will minimize the extent
to which recorded information about an individual
is itself a source of unfairness in any decision
about him or her; and
To create legitimate, enforceable expectations of
confidentiality by creating and defining
obligations with respect to the uses and
disclosures that will be made of recorded
information about an individual.
9. Today, more than fifteen years later, there have been
further advances in telecommunications and information
technology. Given the proliferation of computerized data
collection and the prospect of converging technologies --
computers, telephones, and mass media -- it is time to
reconsider what privacy means in developing electronic
communities.
10. The Administration has a broad vision of a future NII
that will enable people in their homes, schools, places of
business, and elsewhere to benefit from improved
communications and access to information resources. In such
a world, the collection and dissemination of information can
serve many useful social and economic purposes. At the same
time, each new communications and information service
potentially affects the privacy interests of individuals and
businesses. What are the First Amendment implications of
regulating the dissemination of information by individuals
or businesses?
11. What technology is available now, or in the foreseeable
future, that could have an impact on the privacy
expectations of telecommunications users? Should the
ability of technology to enhance, or threaten, privacy have
a bearing on what expectations of privacy are deemed
"reasonable"? Can privacy laws or policies be developed
that are technology-neutral? How can we ensure that
whatever privacy protections that are in place apply equally
to all Americans that use the NII, both younger and older,
the wealthy, the middle class and the disadvantaged, and the
technologically literate and the uneducated?
12. As the components of the NII develop, it may become
increasingly difficult to define the rights and
responsibilities of stakeholders. Today, one set of privacy
requirements applies to traditional cable operators; other
rules apply to telecommunications common carriers (with even
more specialized rules that apply to the Regional Bell
Operating Companies and AT&T); and other firms that provide
telecommunications and information services are subject to
no restrictions on how they use personal information. Are
there any overarching principles that can be extended across
specific services in the telecommunications sector? Given
the convergence of different industries within this sector,
is there a need for a more comprehensive approach to privacy
regulation? Can "fair information principles" be extended
to interactions between individuals in an electronically
wired nation?
III. Multimedia Transactions
13. The NII could ultimately provide access to interactive
multimedia, integrated digital streams of video, audio,
text, and graphics that will allow an instantaneous dialogue
between the user and the system for the transmittal of
information. Interactive multimedia encompasses such
services as video on demand, participatory television,
electronic publishing, interactive video games,
teleshopping, telebanking, videoconferencing, remote medical
testing and evaluation, and distance learning. For
example, using devices with the attributes of a telephone, a
television, a camcorder, and a personal computer, students
ultimately may be able to browse through the collections of
any library in the country and collaborate on research
projects with others hundreds of miles away, individuals may
be able to experience special family events like a
christening or wedding even though they cannot attend in
person, and citizens may be able to participate in
electronic town meetings. In addition, small businesses as
well as large may take advantage of the latest in computer
technology to design products and provide useful services,
and consumers may be able to shop for the best prices in
town on groceries, furniture, clothing, or other consumer
items.
14. Of necessity, usage of such multimedia services may
create the electronic equivalent of a paper trail capturing
many details of a person's life. Moreover, as more and more
everyday interactions take place on-line, it will become
even easier to compile, package, and sell information about
individuals than presently is the case. The existence of
more extensive transactional data may enable both large and
small firms to conduct more effective targeted advertising
and market research, which could facilitate the ability of
individuals to access the products and services they desire.
At the same time, people may be uncomfortable with the
notion that "someone" may be keeping track of every
interaction they engage in with the outside world.
A. Existing Legal Framework
15. Several laws are relevant to the use of transactional
records associated with communications media. Three of
these laws -- the 1984 Cable Act, the Cable Television
Consumer Protection Act of 1992 (1992 Cable Act), and the
Video Act -- in essence adopt "fair information principles"
for the use of cable subscriber data and video cassette
rental and sale data. In contrast, the Electronic
Communications Privacy Act of 1986 (ECPA) imposes no
restrictions on private sector use of transactional data.
16. The 1984 Cable Act precludes cable operators or third
parties from monitoring the viewing habits of cable
subscribers. Under the subscriber privacy provisions of
that Act, cable operators are required to inform their
subscribers at the time of entering into a contractual
arrangement, and annually thereafter, of the nature of the
"personally identifiable information" they collect about
subscribers, their data disclosure practices, and subscriber
rights to inspect and correct errors in such data. Cable
operators are prohibited from using the cable system to
collect personally identifiable information about their
subscribers, except that which is necessary to render cable
service, without subscriber consent, and are generally
barred from disclosing such data to third parties without
written or electronic consent. Cable operators may sell
their mailing lists to third parties only if they have given
their subscribers an opportunity to limit such disclosure,
and the disclosure does not reveal the viewing habits or
other transactions of the subscriber.
17. The 1992 Cable Act extended the protections of the 1984
Cable Act to new wire and radio services that may be
provided over cable facilities, such as personal
communications services (PCS). It also requires cable
operators to take actions necessary to prevent unauthorized
access to personal information by persons other than the
subscriber or cable operator.
18. The Video Act protects the privacy of video cassette
rentals and sales. Among other things, the law prohibits
disclosure of the fact that individuals have rented specific
videos. Congress enacted this law in part in reaction to
the well-publicized disclosure of Robert Bork's video rental
history when he was under consideration for the Supreme
Court. The law prohibits video tape service providers from
disclosing to anyone the titles of video cassettes rented or
purchased by a particular individual without the customer's
consent, although they may release customer mailing lists
and the subject matter (but not specific titles) of customer
selections if the customer has been given the opportunity to
object to such disclosure.
19. ECPA was enacted in 1986 to address new technologies
not anticipated by the 1968 federal wiretap law. While
that law generally prohibits eavesdropping and the
interception of the content of electronic mail, radio
communications, data transmissions, and telephone calls
without consent, it imposes no restrictions on the internal
use by providers of an "electronic communication service"
of transactional records pertaining to such
communications. As a consequence, such service providers
are free to make any use of the identity of the parties to
the communication or the fact of the communication.
Moreover, while the ECPA specifies standards and procedures
for court authorized electronic surveillance by government
entities, and government access to stored electronic
communications, it does not restrict the dissemination of
transactional data that is maintained in electronic storage
to non-governmental entities. Indeed, a service provider is
expressly permitted to disclose transaction information
concerning a subscriber to any person, for any purpose,
without notice or subscriber consent.
B. Areas of Inquiry
20. NTIA solicits comment on the extent to which the
foregoing laws would apply to multimedia services that will
be delivered over the NII, and if not, how they provide a
useful model for new legislation. Commenters are
specifically asked to provide a legal analysis of whether
the cable subscriber privacy protections of the 1984 Cable
Act, as amended by the 1992 Cable Act, would apply to
telephone companies delivering multimedia services over
switched broadband networks. Commenters also are asked to
provide a legal analysis of whether firms that provide video
on demand would be considered "video tape service providers"
as defined in the Video Act, 47 U.S.C. 2710(a)(4).
21. As a policy matter, what principles should apply to the
handling of transactional records associated with multimedia
services delivered over the NII? Should multimedia service
providers be required to obtain affirmative consent from NII
users for the collection and dissemination of personal
information, and how should this type of presumptively
restricted information be defined? What should the user be
deemed to consent to by subscribing to or ordering NII
multimedia?
22. Without consent, should any secondary uses of personal
information derived through the use of NII multimedia be
permissible? As a technical matter, is there any way a user
could monitor subsequent usage of personal information to
ensure that such usage is consistent with his or her
expectations? Should there be a requirement that
transactional records be destroyed after some designated
period of time? How will these requirements be enforced,
and what right of redress will individuals have?
23. Should the ECPA be amended to impose restrictions on
the use of transactional records associated with electronic
communications services? What costs would such restrictions
place on businesses, and what impact would restrictions on
information collection and dissemination have on
individuals?
IV. Telephone Transaction Generated Information
24. Existing telecommunications networks generate a vast
amount of personal information about telephone usage and
transactions related to telephone service, which is likely
to increase as more advanced services are offered. There
are many forms of TTGI: white pages information, yellow
pages information, new telephone service orders, aggregate
telephone traffic information, calling number
identification, other network information, call detail
records, and billing and credit information. Today, some
telephone companies are subject to restrictions on the use
and disclosure of telephone transactional data, while other
firms that have access to such information are subject to no
restrictions at all. Given that the networks of
telecommunications carriers are part of the backbone of the
NII, NTIA is interested in determining what policies, if
any, should govern the secondary use of telephone
transaction generated information. In the discussion below,
we focus on two forms of TTGI: Customer Proprietary Network
Information (CPNI) and Automatic Number Identification
(ANI).
A. Existing Legal Framework
1. Customer Proprietary Network Information
25. When initially establishing telephone service for a
customer, telephone companies obtain information such as the
subscriber's name, billing address, and desired network
services. Over time, telephone companies maintain service
records and billing records, which include the monthly
charges for network services, call detail for toll calls,
and, if applicable, call detail for local calls. Such
information, known as CPNI, is one form of telephone
transaction generated information.
26. Currently, there are no federal statutes governing the
secondary use of such information, but there are FCC rules
governing use of CPNI by AT&T and the Bell Operating
Companies (BOCs). Those rules prohibit the BOCs and AT&T
from transferring the CPNI of customers with more than
twenty lines to affiliated personnel engaged in the
