Presentation by Christina Gagnier of Gagnier Margossian at Privacy Identity Innovation's pii Labs workshop in Seattle, WA on May 14, 2012

1. PRIMER
PRIVACY LAW

3. Experience won’t just be about the tool you
build, but it will include how you manage
sensitive data and how you respect users.

4. This talk is not about Facebook.
This talk is about you.

5. uncharted legal territory
What do we mean by “privacy?”

7. Distinguishing Fourth Amendment from privacy
in the civil sense.

8. Electronic Communications Privacy Act

9. Personally Identifiable Information (Pii)

10. “Personally identifiable information” is information that
identifies a particular person. “Pii” includes:
• Full name;
• National identification number;
• IP address;
• Vehicle registration plate number;
• Driver’s license number;
• Face;
• Fingerprints;
• Handwriting;
• Credit card numbers;
• Digital identity;
• Date of birth;
• Birthplace; and
• Genetic information.

11. federal movement on privacy
I just want to build cool stuff.
Why should I care?

13. Problem #1: The laws around data reside in
industry silos.

15. Few pieces of key legislation:
Do Not Track Act
Commercial Privacy Bill of Rights Act of 2011
Personal Data Privacy and Security Act
Secure and Fortify Electronics Data Act (SAFE)
Data Security and Breach Notification Act

16. Problem #2: They aren’t getting it in DC.

17. Silicon Valley, Alley, Beach > DC

18. Problem #3: This isn’t going away.

19. FTC Action
Opting Out = ScanScout
Children’s Privacy = SkidKids

20. oh crap.
What Developers Can Do

21. What people care about:

22. Data control

23. Data minimization

24. Data portability

25. Data withdrawal

26. Here are a few places to start:

27. Conducting an assessment on privacy and
data security.

28. type
amount
Audit:
use
intake

29. Architectural solutions to privacy. Build with
privacy in mind.

30. We can work to create a marketplace that
rewards “privacy by design” while promoting
innovation.

31. Policy solutions to privacy.

32. Privacy policies and practices in their current
incarnation are not working.

35. kidz.
yes, different rules apply.

37. Minors
Children’s Online Privacy Protection Act

38. Children’s Online Privacy Protection Act
Regulates all types of identifying information
Exemptions: electronic postcards, contests, online
newsletters, homework help
Example: Disney’s Club Penguin
If you know you have minors on your site, close
the accounts

39. Children’s Online Privacy Protection Act
Requires websites to get parental consent before
collecting or sharing info for children under 13
Enforced by the Federal Trade Commission
Applies to commercial websites and other online
services
If you know you have minors on your site, close
the accounts

40. Children’s Online Privacy Protection Act
To comply:
Post a privacy policy/advise whenever personal
information collected
Parental notice, consent, access to information
Can’t condition participation on providing
more info
Confidentiality & security of information
collected from children

41. We just scratched the surface.

42. Lawyer
Christina Gagnier
@gagnier
gagnier@gamallp.com
gamallp.com

43. ?

44. PRIMER
PRIVACY LAW