Privacy paper offers options, no prescription
Don't hold your breath waiting for a federal privacy office. At the end of April, the Office of Information and Regulatory Affairs at the Office of Management and Budget released a long-awaited options paper for promoting privacy on the National Information Infrastructure. The author is listed as the Information Policy Committee of the NII Task Force, but OMB did the drafting.
Don't hold your breath waiting for a federal privacy office. At the end of April, the
Office of Information and Regulatory Affairs at the Office of Management and Budget
released a long-awaited options paper for promoting privacy on the National Information
Infrastructure. The author is listed as the Information Policy Committee of the NII Task
Force, but OMB did the drafting.
The point of the exercise was to lay out alternatives for creating a privacy office.
The document has a long history. Few people remember that in 1993, Vice President Gore's
National Performance Review proposed establishing a privacy protection board. That was
also when the Clinton administration established a privacy working group as part of the
task force. In 1995, the group produced principles for providing and using personal
information.
The privacy working group's next assignment was to suggest alternatives for creating a
privacy office. The working group was disbanded before a suitable paper was produced. The
responsibility for the promised options paper fell on OIRA, and OIRA did a nice job with
it. Honest.
The paper is long at 72 pages and contains a useful review of the state of privacy
regulation today. It evaluates the Privacy Act of 1974, telecommunications privacy laws,
medical privacy and privacy in the marketplace. In my opinion, the analysis is even-handed
and objective. Look for yourself at http://www.iitf.nist.gov/ipc/ipc-pub.html.
Anyone who reads the paper must understand that the administration has not committed to
creating a privacy office. The paper is just what it says it is: a discussion of options.
Three basic alternatives are set out. The first is a federal privacy agency with
regulatory authority. That should be seen as the anchor position on the left wing. It is
not really a serious alternative. There is no chance that Congress or the administration
would take the regulatory approach.
The second option is at the other extreme: the creation of a nongovernmental or
advisory entity.
It is hard to make the case that another powerless advisory committee, whether
permanent or temporary, would make much of a difference. Still, the paper does its best to
state the argument.
The middle alternative is the creation of a federal entity without regulatory
authority.
Many different flavors of a nonregulatory office are possible. The menu of credible
functions includes coordination, representation, advocacy, ombudsman, advice and
education. An almost unlimited number of combinations of functions, structure and
placement are possible for this alternative and for the others as well.
The paper makes it clear that there are not just three options but a continuum of
choices across the spectrum.
The idea of a privacy agency dates back to the early 1970s. This is one of those ideas
that never gets enough support but never goes away. I have long advocated establishing a
privacy agency.
The two most important characteristics for a privacy agency are independence and single
function. A privacy office cannot be effective unless it can criticize the administration
without fear. Privacy offices in other countries usually are politically independent. If
an agency has another function besides privacy, it will eventually neglect the privacy
side.
The Federal Trade Commission, OMB and others have dabbled in privacy from time to time,
but they always drop it when it falls off the front page.
Yet in the current environment, it is hard to expect the creation of an independent,
focused privacy office. Without legislation, it is not possible to create a true privacy
advocate. The best alternative may be the creation of an office of the privacy
representative in the Executive Office of the President. Its chief function would be to
make sure that privacy issues are raised appropriately within the administration. The
privacy representative could also work on international issues and advise the private
sector.
The real question is what happens next. I must admit that I don't have a clue. But here
is my personal early morning line on the possibilities. Nothing at all will happen:
2-to-1. OIRA will issue a request for more comments: 5-to-1. An advisory committee will be
formed: 5-to-1. A nonregulatory executive branch office will be formed: 6-to-1. Privacy
will be assigned to OMB or another agency: 4-to-1. A regulatory agency will be formed:
1,000-to-1.
Robert Gellman, former chief counsel to the House Government Operations Subcommittee on
Information, Justice, Transportation and Agriculture, is a Washington privacy and
information policy consultant. His e-mail address is rgellman@cais.com.
NEXT STORY: Interior Dept. upgrades its procurement system