Draft of "A Model Regime of Privacy Protection"

Privacy law expert and law professor Dan Solove (I reviewed his latest book, The Digital Person, here) and Chris Hoofnagle (of EPIC) have published the first draft of "A Model Regime of Privacy Protection." From the abstract:

Privacy protection in the United States has often been criticized, but critics have too infrequently suggested specific proposals for reform. Recently, there has been significant legislative interest at both the federal and state levels in addressing the privacy of personal information. This was sparked when ChoicePoint, one of the largest data brokers in the United States with records on almost every adult American citizen, sold data on about 145,000 people to fraudulent businesses set up by identity thieves.

In the aftermath of the ChoicePoint debacle, both of us have been asked by Congressional legislative staffers, state legislative policymakers, journalists, academics, and others about what specifically should be done to better regulate information privacy. In response to these questions, we believe that it is imperative to have a discussion of concrete legislative solutions to privacy problems.

What appears below is our attempt at such an endeavor. Privacy experts have long suggested that information collection be consistent with Fair Information Practices. This Model Regime incorporates many of those practices and applies them specifically to the context of commercial data brokers such as Choicepoint. We hope that this will provide useful guidance to legislators and policymakers in crafting laws and regulations. We also intend this to be a work-in-progress in which we collaborate with others. We welcome input from other academics, policymakers, journalists, and experts as well as from the industries and businesses that will be subject to the regulations we propose. We invite criticisms and constructive suggestions, and we will update this Model Regime to incorporate the comments we find most helpful and illuminating. We also aim to discuss some of the comments we receive in a commentary section. To the extent to which we incorporate suggestions and commentary, and if those making suggestions want to be identified, we will graciously acknowledge those assisting in our endeavor.

I agree with PrivacySpot's assessment:

Something like this has been needed for a long time, and I am pleased to see it written by heavy hitters like Solove and Hoofnagle. This pedigree will (hopefully) ensure that the document is taken seriously by policymakers. It needs to be. Recent scares involving T-Mobile, Choice Point, LexisNexis, and Kaiser, as well as highly-publicized incidents involving Paris Hilton and, er, Fred Durst, have vividly illustrated the point that privacy protection has not caught up with recent advances in surveillance and data sharing technology.

Technorati tag: privacy