===================================================================== EPIC ___________ Electronic Privacy Information Center Report 94-1 Privacy Guidelines for the National Information Infrastructure A Review of the Proposed Principles of the Privacy Working Group TABLE OF CONTENTS _______________________________________ - Summary - Issue - Background Privacy Working Group Development of Principles Code of Fair Information Principles NII and Privacy - Proposed Privacy Principles (Complete text) Preamble General Principles for the NII Principles for Information Collectors Principles for Information Users Principles for Individuals - First Impressions - Assessment Need for Codes of Fair Information Practices 1973 HEW Code 1980 OECD Guidelines Draft Privacy Principles - Proposed Change for the Privacy Principles - Further Information - Bibliography - About EPIC SUMMARY _______________________________________ * The Privacy Working Group of the Information Infrastructure Task Force has proposed a draft privacy code for the National Information Infrastructure. * "Codes of Fair Information Practice" are a foundation for future privacy policies. A 1973 code provided the basis for the Privacy Act of 1974, a landmark privacy law. A 1980 international code led to the adoption of privacy laws in 20 countries. * Strong privacy codes for network communications have recently been adopted in New York state, Canada, and Japan. * The principles proposed by the Privacy Working Group are weaker than the current codes and leave large gaps in NII privacy policy in such areas as encryption, informed consent, unique identifiers, and enforcement. * The proposed code is also inadequate for the purpose of promoting international data flows, and may limit the ability of users in the United States to exchange data with users in other countries. * Unless a stronger code is developed, there will be inadequate privacy protection for future users of the National Information Infrastructure * Comments on the proposal are due to the Privacy Working Group by June 23, 1994. The IITF Gopher/Bulletin Board can be accessed at iitf.doc.gov. Electronic comments may be sent to nii@ntia.doc.gov ISSUE _______________________________________ The Privacy Working Group of the Information Infrastructure Task Force (IITF) released draft "Principles for Providing and Using Personal Information" on May 4, 1994. This is a set of principles for the collection and use of personal information. The Code could play an important role setting out the responsibilities of organizations that collect personal information and providing privacy protection for NII users. BACKGROUND _______________________________________ = = = = = = = = = = = = = = = = = = = = To ensure individual privacy, existing laws, practices and policies must be examined and adapted to the new environment. Workplan of the Privacy Working Group = = = = = = = = = = = = = = = = = = = = Privacy Working Group The Privacy Working Group is one of the advisory groups created by the Information Infrastructure Task Force. The IITF is an inter- governmental organization charged with the coordination of government policy for the Information Infrastructure. The IITF is chaired by Vice President Al Gore and Secretary of Commerce Ron Brown. The IITF Secretariat is NTIA Administrator Larry Irving. There are three IITF Committees -- Information Policy, Applications, and Telecommunications Policy. The Privacy Working Group is one of three working groups within the Information Policy Committee. The other two are Information Access and Intellectual Property. The Privacy Working Group is made up of about twenty federal officials from such agencies as the Department of Justice, the National Security Agency, the Commerce Department, the Defense Department, the Office of Management and Budget, IRS, Census, the US Postal Service and other agencies. The Working Group was originally chaired by Patricia Faley, then acting director of the US Office of Consumer Affairs. Ms. Faley has since been succeeded by Rob Veeder of the Office of Information and Regulatory Affairs at the OMB. The Privacy Working Group reports to Sally Katzen who is the administrator for the Office of Information and Regulatory Affairs and the Chair of the IITF Committee on Information Policy. According to the Workplan of the Privacy Group, there are several priority issues including "Putting Protection Around a Moving Target," "Providing Security for Sensitive Data, and defining policies for use of personal data and personal identifiers, developing legislation, assigning responsibility for privacy protection and public education. The Privacy Working Group also identified seven possible milestones: 1) Identification of scope of privacy concerns 2) Development of a statement of Fair Information Practices 3) Determination of who should have responsibility for implementing practices 4) Identification of gaps in current U.S. law 5) Identification of control mechanisms for privacy protection 6) Preparation of paper with recommendations 7) Drafting of proposed legislation. = = = = = = = = = = = = = = = = = = = = * Financial services * Direct Marketing * Research records * Law enforcement * Information technology * Public records * Telecommunications Agenda for Working Group meeting on Privacy and the NII = = = = = = = = = = = = = = = = = = = = Development of Principles During the past year the Privacy Working Group invited interested parties to provide briefings to the group on privacy issues. Privacy experts, industry representatives and government officials all met with members of the working group and made various recommendations for privacy protection and the NII. There was a wide range of opinions on several topics. Privacy experts generally argued for stronger privacy protections, industry representatives said that self-regulation was adequate and new laws unnecessary. There were also some areas of agreement. Many of those who spoke with the Working Group mentioned the public opposition to the Clipper encryption proposal, the need to develop a privacy agency, and the need to create new information practices for the Information Infrastructure. There were no formal announcements of these meetings or a published report. The Privacy Working Group also held several days of public hearings. In January 1994 two days of hearings were held in Washington, DC and two days in Sacramento California. Topics covered at the public hearings on "Privacy and the National Information Infrastructure" included financial services, direct marketing, research records, law enforcement, information technology, public records, and telecommunications. Participants were asked to identify the most critical privacy concerns for their organizations, to make specific recommendations to accommodate those concerns, and to provide recommendations for legislation, regulation, standards, or voluntary compliance. There was again no formal published report as a result of these hearings. The proposed privacy principles for the information infrastructure is the first recommendation from the Privacy Working Group. The privacy working group is also exploring other privacy issues including the creation of a privacy agency, identifying gaps in current U.S. law, identifying control mechanisms for privacy protection, and preparing a paper recommending proposals for actions, policies, and legislation to protect the privacy of individuals. Code of Fair Information Practices The principles developed by the Privacy Working Group follow the general format of a "Code of Fair Information Practices." Such a Code is a well known approach to develop privacy policies. The purpose is to outline general principles and to make clear the responsibility of organizations that collect personal information to protect the interests of the public. A Code developed in 1973 by a special government committee led to the development of the Privacy Act of 1974, a landmark privacy law. Another code developed in 1980 by the Organization for Economic Cooperation an Development, an international organization in Paris, later became the basis of privacy laws in almost two dozen countries. = = = = = = = = = = = = = = = = = = = = "The effective protection of personal data and privacy is developing into an essential precondition for social acceptance of the new digital networks and services." European Commission = = = = = = = = = = = = = = = = = = = = NII and Privacy During the period that the Privacy Working Group met with experts to discuss privacy issues and held public hearings, several new privacy issues regarding the information infrastructure emerged. In February, 1994 the White House announced support for the Clipper cryptography proposal. The White House also indicated support for the FBI's Digital Telephony proposal. Both proposals are controversial. A Time/CNN poll found 80% of the American public opposed to Clipper. Several legislative proposals were also under consideration in Congress. One would establish fair information practices for medical records. A second would limit the collection and use of CPNI, Customer Proprietary Network Information. Another would establish privacy safeguards for employees in the workplace. A fourth would protect the privacy of drivers' records. Perhaps the most significant legislative proposal was for the creation of a privacy agency, similar to those in other countries. Within the federal agencies there were also several proposals under consideration with significant privacy implications. The IRS was developing a system for electronic tax filing. The Postal Service was considering the establishment of a national identification card. PROPOSED PRIVACY PRINCIPLES _______________________________________ The "Principles for Providing and Using Personal Information" recommend by the Privacy Working Group begin as follows: The United States is committed to building a National Information Infrastructure (NII) to meet the information needs of its citizens. This infrastructure, essentially created by advances in technology, is expanding the level of interactively, enhancing communication, and allowing easier access to services. As a result, many more users are discovering new, previously unimagined uses for personal information. In this environment, we are challenged to develop new principles to guide participants in the NII in the fair use of personal information. Traditional fair information practices, developed in the age of paper records, must be adapted to this new environment where information and communications are sent and received over networks on which users have very different capabilities, objectives and perspectives. Specifically, new principles must acknowledge that all members of our society (government, industry, and individual citizens), share responsibility for ensuring the fair treatment of individuals in the use of personal information, whether in paper or electronic form. Moreover, the principles should recognize that the interactive nature of the NII will empower individuals to participate in protecting information about themselves. The new principles should also make it clear that this is an active responsibility requiring openness about the process, a commitment to fairness and accountability, and continued attention to security. Finally, principles must recognize the need to educate all participants about the new information infrastructure and how it will affect their lives. These "Principles for Providing and Using Personal Information" recognize the changing roles of government and industry in information collection and use. Thus they are intended to be equally applicable to public and private entities that collect and use personal information. However, these Principles are not intended to address all information uses and protection concerns for each segment of the economy or function of government. Rather, they should provide the framework from which specialized principles can be developed. = = = = = = = = = = = = = = = = = = = = Factors contributing to the growth of public concern about communications privacy: (1) growth of electronic transactions (2) accelerated collection of personal information (3) increase in number of communication service provider (4) growing use of unsecured communication channels such as mobile phones. New York Public Service Commission = = = = = = = = = = = = = = = = = = = = These are the draft principles developed by the Privacy Working Group. I. General Principles for the National Information Infrastructure A. Information Privacy Principle 1. Individuals are entitled to a reasonable expectation of information privacy. B. Information Integrity Principles Participants in the NII rely upon the integrity of the information it contains. It is therefore the responsibility of all participants to ensure that integrity. In particular, participants in the NII should, to the extent reasonable: 1. Ensure that information is secure, using whatever means are appropriate; II. Principle for Information Collectors (i.e. entities that collect personal information directly from the individual) A. Collection Principle Before individuals make a decision to provide personal information, they need to know how it is intended to be used, how it will be protected, and what will happen if they provide or withhold the information. Therefore, collectors of this information should: 1. Tell the individual why they are collecting the information, what they expect it will be used for, what steps they will take to protect its confidentiality and integrity, the consequences of providing or withholding information, and any rights of redress. III. Principles for Information Users (i.e. Information Collectors and entities that obtain, process, send or store personal information) A. Acquisition and Use Principles Users of personal information must recognize and respect the stake individuals have in the use of personal information. Therefore, users of personal information should: 1. Assess the impact on personal privacy of current or planned activities before obtaining or using personal information; 2. Obtain and keep only information that could reasonably be expected to support current or planned activities and use the information only for those or compatible purposes; 3. Assure that personal information is as accurate, timely, complete and relevant as necessary for the intended use; B. Protection Principle Users of personal information must take reasonable steps to prevent the information they have from being disclosed or altered improperly. Such users should: 1. Use appropriate managerial and technical controls to protect the confidentiality and integrity of personal information. C. Education Principle The full effect of the NII on both data use and personal privacy is not readily apparent, and individuals may not recognize how their lives can be affected by networked information. Therefore, information users should: 1. Educate themselves, their employees, and the public about how personal information is obtained, sent, stored and protected, and how these activities affect others. 2. Ensure that information is accurate, timely, complete, and relevant for the purpose for which it is given. D. Fairness Principles Because information is used to make decisions that affect individuals, those decisions should be fair. Information users should, as appropriate: 1. Provide individuals a reasonable means to obtain, review, and correct their own information; 2. Inform individuals about any final actions taken against them and provide individuals with means to redress harm resulting from improper use of personal information; 3. Allow individuals to limit the use of their personal information if the intended use is incompatible with the original purpose for which it was collected, unless that use is authorized by law. IV. Principles for Individuals who Provide Personal Information A. Awareness Principles While information collectors have a responsibility to tell individuals why they want information about them, individuals also have a responsibility to understand the consequences of providing personal information to others. Therefore, individuals should obtain adequate, relevant information about: 1. Planned primary and secondary uses of the information; 2. Any efforts that will be made to protect the confidentiality and integrity of the information; 3. Consequences for the individual of providing or withholding information; 4. Any rights of redress the individual has if harmed by improper use of the information. B. Redress Principles Individuals should be protected from harm resulting from inaccurate or improperly used personal information. Therefore, individuals should, as appropriate: 1. Be given means to obtain their information and be provided opportunity to correct inaccurate information that could harm them; 2. Be informed of any final actions taken against them and what information was used as a basis for the decision; 3. Have a means of redress if harmed by an improper use of their personal information. A commentary with 40 numbered paragraphs follow. FIRST IMPRESSIONS _______________________________________ = = = = = = = = = = = = = = = = = = = = Surveillance, carried out for whatever presumed benevolent purpose, has the potential to hinder our liberty and erode democracy. Hon. David Flaherty = = = = = = = = = = = = = = = = = = = = The Working Group chose an appropriate privacy topic to address first. Updating the Code of Fair Information Practices is an important project. The original 1973 Code could be adapted for network communications. This would require giving individuals enforceable rights, controlling the sale of personal data, strengthening consent mechanisms, and incorporating new principles that recognize recent developments in technology such as the use of cryptography in commercial networks. Instead, the Privacy Working Group developed a code that is actually weaker than the 1973 guidelines and far weaker than recent proposals developed in New York state, Canada and Japan. The basic premise of Fair Information Practices is that organizations have responsibilities to protect data and that individuals have rights when data is improperly used. The Privacy Working Group shifts the responsibility for privacy protection from organizations to individuals. This is a surprising recommendation that ignores the fact that it is organizations that are currently developing the policies and practices for data collection in the information infrastructure. The working group also assumed mistakenly that the 1973 Code did not cover the private sector, which it does. Indeed the 1980 OECD Guidelines, a similar code of Fair Information Practices based on the 1973 Code, has already been endorsed by 140 US companies. Finally, the important new privacy issues brought about the NII -- the use of cryptography, the collection of transactional data, the use of unique identifiers, the sale of personal records, the creation of on- line mailing lists -- are not addressed in the proposed code. For example, the principle in the 1970s that individuals have a right to inspect personal information and determine accuracy could have been updated, given recent growth of network technologies, to require organizations such as credit agencies and insurance companies to make available to individuals each year a complete record of personal information held. The Privacy Working Group also did not address many of the most pressing privacy concerns, particularly the Clipper proposal or the sale of consumer data. This is significant because while the Working Group was developing the privacy principles, the White House decided to move forward with the Clipper proposal. ASSESSMENT _______________________________________ Need for Codes of Fair Information Practices A Code of fair Information Practices is a good starting point for privacy policy. Such codes help clarify the responsibilities of organizations that collect personal information and provide basic safeguards for individuals. The codes are typically non-technical, and non-legalistic and allow the development of national laws and voluntary policies. In the last few years several states in the US and many foreign governments have developed such codes to address the privacy issues created by new communications technologies. Perhaps the most important state code was developed by Professor Eli Noam when he served as chair of the New York Public Service Commission. Notable codes were also developed in Japan for the Ministry of Post and Telecommunication by Professor Masao Horibe and in Canada by Professor David Flaherty. The most important Code of Fair Information Practices in the United States was developed in 1973 by a special committee at the Department of Health, Education, and Welfare charged with developing privacy safeguards for automated information systems. The group was chaired by Willis Ware and published a widely cited report Records, Computer, and the Rights of Citizens. The report is often credited with providing the foundation for the Privacy Act of 1974. The 1973 Code of Fair Information Practices is often mentioned in privacy literature. Various capsulations of the Code are frequently cited. It is important to look at the original HEW report to understand the full force of the recommendations. The 1973 Advisory Committees recommended the "enactment of legislation establishing a Code of Fair Information practices for all automated personal data systems. It said also : * The code should define "fair information practice" as adherence to specified safeguard requirements. * The Code should prohibit violation of any safeguard requirement as an unfair information practice. * The Code should provide that an unfair information practice be subject to both civil and criminal penalties. * The Code should provide for injunction to prevent violation of any safeguard requirement. * The Code should also give individuals the right to bring suits for information practices to recover actual, liquidated, and punitive damages in individual or class action. The 1973 Code set out a proposed code subdivided into three categories -- General Requirements, Public Notice Requirements, and Rights of Individual Data Subjects. General Requirements focused on the responsibilities of organizations maintaining individually identifiable personally data to safeguard the information and to restrict transfer without prior informed consent. The Public Notice section described the obligation of an organization to make known to the public existence of such record-keeping systems. The section on Rights of Individual Data Subjects described a range of rights of individual subjects including the right to be informed of data collection, to correct errors, and to limit dissemination of personal information. The 1973 Code set out clear responsibilities for data collectors and clear rights for data subjects. It argued that enforcement of the principles was necessary and that rights should be backed up by criminal penalties. Codes of Fair Information Practices can also be found in international agreements. The best known is the "Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data" developed by the Organization for Economic Cooperation and Development in 1980. The Basic Guidelines are these: Collection Limitation Principle There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject: Data Quality Principle. Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date. Purpose Specification Principle. The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose. Use Limitation Principle. Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with Paragraph 9 except: (a) with the consent of the data subject; or (b) by the authority of law. Security Safeguards Principle. Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data. Openness Principle. There should be a general policy of openness about developments, practices and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller. Individual Participation Principle. An individual should have the right: (a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; (b) to have communicated to him, data relating to him (i) within a reasonable time; (ii) at a charge, if any, that is not excessive; (iii) in a reasonable manner; and (iv) in a form that is readily intelligible to him; (c) to be given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such denial; and (d) to challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed or amended. Accountability Principle. A data controller should be accountable for complying with measures which give effect to the principles stated above. Again, it is clear that such Codes place responsibilities on those organizations that collect personal information and establishes rights for individuals. This is the basic premise of fair information practices. There is also before the Congress this year legislation based on a code of fair information practices, The Fair Medical Information Practices Act of 1994, that sets out privacy protection for medical records. It is a complex and sophisticated privacy law, but the underlying structure is similar to most Codes of Fair Information Practices. All Codes of fair information practices are based on the basic principle that organizations that collect and use personal information have a responsibility to the person about whom the information refers to, also called the data subject. The responsibility is sometimes described as a fiduciary obligation, but it may also be viewed as an expectation to design "safe" information systems. Like companies that manufacture consumer products, companies in the information business have a responsibility to ensure that their products are safe and well designed. When the product is personal information, safety is measured in terms of privacy protection. Over the years, the Codes of Fair Information Practices have done a fairly good job of clarifying rights and responsibilities, but there are some shortcomings. Principles lacking enforcement means create no actual rights when improper uses of personal data occur. Certain problems, such as the use of a unique identifier like the Social Security Number are simply not covered by most codes. And codes do not generally include the goal of encouraging the use of privacy enhancing technologies such as electronic cash cards and encryption. These are the possible improvements to current codes that should have be considered in the development of a code of fair information practices for the NII. = = = = = = = = = = = = = = = = = = = = "The collection of personal data in connection with the provision of telecommunication services should be limited to the extent necessary to provide the intended service." Ministry of Post and Telecommunications,Japan = = = = = = = = = = = = = = = = = = = = The Draft Privacy Principles Viewed against the history of Codes of Information Practices, the proposed code for the NII is a surprisingly weak set of standards that does little to protect privacy or even to recognize some of the emerging privacy issues brought about by network communications. In shifting responsibility from data collectors to subjects for basic fair information practices, the principles weaken current safeguards and make it more likely that the improper use of personal information will occur. Companies engaged in the illegal sale of personal information and agencies involved in the development of surveillance technologies could claim that the responsibility lies with the individuals not with the organization to correct these practices. This is contrary not only to Fair Information Practices but also to the general structure of privacy law in the United States which places responsibilities squarely on organization to protect personal information. For example, the Video Privacy Protection Act properly places responsibilities on video service providers, not video store customers, for privacy protection. The proposed Principles also weaken the notice provision established in Codes of Fair Information Practices and make it more difficult for NII users to know fully the privacy implications of new network services. Most current regulatory approaches encourage organizations to fully inform customers about product information so that consumers may make informed decisions. The principles are silent on such pressing issues as what constitutes "consent" -- the word is not mentioned in the draft. The proposed Code also eliminate many of the currently existing safeguards for data subjects. The proposed Principles of the Privacy working group require only that Information collectors inform individuals why information is collected, how it will be sued, protected, and the consequences for withholding. Missing is the responsibility to collect only that information necessary for a transaction. Individuals who are harmed by the misuse of personal information may turn to the Redress Principle, but what they will find is simply the old right to correct inaccurate information There is no recognition of a legal right to be compensated for harm. Viewed against the pre-existing OECD guidelines for the protection of personal data, the proposed privacy principles will be considered inadequate by most European countries because the principles provide insufficient protection for personal data. For this reason, the ability of users of the NII to exchange information with users in other countries may ultimately be jeopardized. PROPOSED CHANGES FOR THE PRIVACY PRINCIPLES _______________________________________ The Privacy Working Group would do well to return to the 1973 Code of Fair Information Practices, the 1980 OECD Guidelines, and then to look at the privacy principles developed in New York State, Canada, Japan, and the European Community to address communications technologies. Certain points will become clear. * The Principles should focus on the responsibility of organizations that collect personal information * The privacy implications of new network services should be made fully known to the public. * The Principle should set out clear rights for individuals whose personal information is collected. * The sale of personal data should require informed consent, possibly even financial compensation. * Enforcement of the principles will require legal rights One model privacy code for the NII is as follows: 1. The confidentiality of electronic communications should be protected 2. Privacy considerations must be recognized explicitly in the provision, use and regulation of telecommunications services 3. The collection of personal data for telecommunications services should be limited to the extent necessary to provide the service 4. Service providers should not disclose information without the explicit consent of service users. Service providers should be required to make known their data collection practices to service users. 5. Users should not be required to pay for routine privacy protection. Additional costs for privacy should be imposed only for extraordinary protection 6. Service providers should be encouraged to explore technical means to protect privacy. 7. Appropriate security policies should be developed to protect network communications 8. A mechanism should be established to ensure the observance of these principles = = = = = = = = = = = = = = = = = = = = Proposed Changes to the Draft Principles * Focus on privacy protection * Emphasize the responsibility of data collectors * Add new responsibilities for companies that sell personal data * Add a new principle to protect the right of anonymity * Add a new principle to protect the right to use encryption * Require affirmative consent for the sale of personal data * Support the code with legal remedies * Prohibit the use of universal identifiers = = = = = = = = = = = = = = = = = = = = FURTHER INFORMATION _______________________________________ The Privacy Working Group is requesting comments on the draft principles. Comments should be sent to the Working Group on Privacy c/o the NII Secretariat, National Telecommunications and Information Administration, US Department of Commerce, Room 4892, Washington, DC 20230. The Principles and Commentary can be downloaded from the IITF Gopher/Bulletin Board System: 202-501-1920. The IITF Gopher/Bulletin Board can be accessed through the Internet by pointing your Gopher Client to iitf.doc.gov or by telnet to iitf.doc.gov and login as gopher. Electronic comments may be sent to nii@ntia.doc.gov. Commentators may wish to address the following issues: * The need to strengthen the proposed principles * The need to establish an enforcement mechanism for the principles * The need to address other pressing privacy issues such as Clipper and the FBI Digital Telephony proposal BIBLIOGRAPHY _______________________________________ Bennet, Colin J. Regulating Privacy: Data Protection and Public Policy in Eastern Europe and the United States. Ithica and London: Cornell University Press, 1992. Flaherty, David H. Protecting Privacy in Surveillance Societies: The Federal Republic of Germany, Sweden, France, Canada and the United States. Chapel Hill: University of North Carolina Press, 1989. Noam, Eli. �Telecomm Privacy Policy Elements.� Transnational Data and Communications Report .March (1990): 9. Rotenberg, Marc. �Privacy and the National Information Infrastructure.� Educom Review 29.2 (1994): 50-51. Rotenberg, Marc. �Communications Privacy: Implications for Network Design.� Communications of the ACM 36.8 (1993): 61-68. U.S. Department of Health, Education, and Welfare (HEW),. Records, Computers, and the Rights of Citizens. Washington, DC: HEW, 1973. ABOUT EPIC _______________________________________ The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues relating to the National Information Infrastructure, such as the Clipper Chip, the Digital Telephony proposal, medical record privacy, and the sale of consumer data. EPIC is sponsored by the Fund for Constitutional Government and Computer Professionals for Social Responsibility. EPIC publishes the EPIC Alert and EPIC Reports, pursues Freedom of Information Act litigation, and conducts policy research on emerging privacy issues. EPIC Alert is a biweekly publication that provides information on recent privacy developments, including legislation, reports, and upcoming conferences. To subscribe to the EPIC Alert, send the message: "subscribe cpsr-announce " (without quotes or brackets) to listserv@cpsr.org. You may also receive the Alert by reading the USENET newsgroup comp.org.cpsr.announce EPIC Reports provide detailed analysis of emerging privacy issues, and are distributed free of charge to Internet users. Future reports will focus on national identification cards, electronic surveillance, medical record privacy, Clipper chip and a US privacy commission. Comments and suggestions are welcome. Send messages to reports@epic.org. ===================================================================== Electronic Privacy Information Center (EPIC) 666 Pennsylvania Ave., SE Suite 301 Washington, DC 20003 +1 202 544 9240 (tel) +1 202 547 5482 (fax) info@epic.org =====================================================================