Fair Information Practices
In 1973 Willis Ware of the RAND Corporation chaired a committee to advise the Secretary of the U.S. Department of Health, Education and Welfare (now called Health and Human Services) on privacy issues. The report (summarized in [WAR73a]) proposes a set of principles based on fair information practice:
• Collection limitation. Data should be obtained lawfully and fairly.
• Data quality. Data should be relevant to their purposes, accurate, complete, and up to date.
• Purpose specification. The purposes for which data will be used should be identified and the data destroyed if no longer necessary to serve that purpose.
• Use limitation. Use for purposes other than those specified is authorized only with consent of the data subject or by authority of law.
• Security safeguards. Procedures to guard against loss, corruption, destruction, or misuse of data should be established.
• Openness. It should be possible to acquire information about the collection, storage, and use of personal data systems.
• Individual participation. The data subjects normally have a right to access and to challenge data relating to them.
• Accountability. A data controller should be designated and accountable for complying with the measures to effect the principles.
These principles describe the rights of individuals, not requirements on collectors; that is, the principles do not require protection of the data collected.
