Kristina Lovejoy at Newsfactor is calling for omnibus privacy legislation for the US. What's interesting is that what she proposes looks a lot like the CSA Model Code that's built into PIPEDA:

NewsFactor Network - Enterprise - Beyond the Patchwork of Privacy Regulations:

...Because terms like privacy, confidentiality, and security often create confusion, the label 'information protection' was coined to encompass the range of mechanisms that guide collection, use, and disclosure of information. An information-protection regulation is one that enforces the right of privacy by dictating, among other things, requirements for maintaining the confidentiality, integrity, and availability of protected data.

In general, a strong information-protection plan would require the following:

1. Establishing ownership and accountability within the organization for confidentiality, integrity, and availability.

2. Identifying the reasons for obtaining private information from an end user and making those reasons available.

3. Establishing mechanisms for gaining consent of the end user before collecting private information.

4. Limiting collection of private information only to that information you need for business purposes.

5. Limiting use and disclosure only for the purposes for which you have gained consent, and limiting retention of information to a period specified by law or by user consent.

6. Ensuring that information collected is accurate.

7. Implementing administrative, technical, and physical controls around information to ensure its confidentiality, integrity, and availability.

8. Creating a culture of openness so that if the confidentiality, integrity, or availability of the information is breached in a significant way, the user is notified.

9. Providing the end user with documented escalation policy and process.

In the U.S., information-protection mandates have generally had impact only in certain market segments, such as the Health Insurance Portability and Accountability Act (HIPAA) in healthcare industry and the Gramm-Leach-Bliley Act (GLBA) in the banking sector.

Will there be increased pressure to regulate other industries? Yes. Will there be impetus for creating an Omnibus Information Protection regulation? Definitely.

Labels: health information, information breaches, privacy, retention