Options for Promoting Privacy on the National Information Infrastructure. IV. Privacy Protection in Four Economic Sectors

04/01/1997

Privacy is a complex concept. An acceptable use of information in one setting may be an unacceptable invasion of privacy in another. Within a particular setting, individuals make very different judgments about what constitutes an acceptable use of their personal information. This diversity makes it difficult to apply a uniform privacy protection scheme across all sectors of human interaction.

In the United States, business and government have adopted sector-specific privacy rules, combining legislation, regulation, and voluntary codes to achieve the desired level of privacy protection in each sector. Each of these tools offers a different level of protection, and provides a different remedy. If a widely respected social custom is violated, the penalty may be embarrassment or ostracism. Market forces may cause a company that inappropriately sells personal customer information to lose business to a competitor. Failure to follow accepted computer security standards may result in civil liability. Failure to follow legal requirements may result in civil or even criminal penalties.

In the sector discussions that follow, we start with legal restrictions that bind information users and follow with an analysis of private policies and principles that supplement existing law and regulation. Finally, we consider how successful this combination of law and policy has been and how it is likely to hold up in the online environment.