Antitrust Law Daily Wrap Up, PRIVACY NEWS: National Telecommunications and Information Administration seeks comments on big data and privacy reports, (Jun 6, 2014)

By Greg Hammond, J.D.

The National Telecommunications and Information Administration (NTIA) is seeking comment on “big data” developments and how they may impact the Consumer Privacy Bill of Rights (CPBR). According to its notice in the Federal Register, the NTIA is particularly interested in receiving feedback on a number of questions raised by two reports: Big Data: Seizing Opportunities, Preserving Values (the Big Data Report) and the President’s Council of Advisors on Science and Technology’s Big Data and Privacy: A Technological Perspective report (the PCAST Report).

Broad questions. The notice sets forth a number of broad questions that were raised by the Big Data Report and the PCAST Report: (1) how can the CPBR support the innovations of big data and simultaneously respond to its risks? (2) Should any specific elements of the CPBR be clarified or modified to accommodate the benefits of or address the risks posed by big data? (3) Should a responsible use framework be used to address challenges posed by big data, how would that framework be embraced within the CPBR, and in what contexts would the framework be most effective? (4) What devices should be used to address the practical limits to the “notice and consent” model noted in the Big Data Report? (5) Is there existing research that quantifies or substantiates privacy risks associated with big data, and how might future research best quantify or substantiate these privacy risks? (6) How can potential legislation regarding consumer privacy support the innovations of big data while responding to the risks?

Specific questions. In addition, the NTIA raised a number of specific questions for comment, in relation to the two reports: (1) The PCAST Report stated that in some cases it would be nearly impossible to delete all of the data about an individual. Does this pose privacy risks and how might they be addressed? (2) The Big Data Report noted that some uses of data by data brokers could have significant ramifications for targeted individuals. How significant are these privacy risks and how might they be addressed? (3) How significant are the privacy risks in relation to unindexed data backups and other latent information about individuals, and what methods exist to determine whether data is sufficiently irretrievable? (4) The PCAST Report noted that data fusion often results in the identification of individuals. How significant are these privacy risks, how should big data analysis companies respond to requests to delete personal data, and do systems already exist allowing entities to act on deletion requests? (5) How significant are the privacy risks associated with the re-identification of de-identified data, and what steps can the government take to expand the capabilities and practical application of these techniques? (6) Should the CPBR address the risk of discriminatory effects resulting from automated decision processes using personal data, and if so, how?

Possible approaches to big data. Both the Big Data Report and the PCAST Report set forth various approaches to big data that the NTIA would like comment on. Specifically, the agency requests responses to the following questions: (1) Can accountability mechanisms play a useful role in promoting socially beneficial uses of big data while safeguarding privacy? (2) Would a “privacy preference profile” system, as suggested by the PCAST Report, mitigate privacy risks regarding big data analysis? (3) Would a privacy risk management framework be effective in addressing the challenges of big data? (4) Can emerging privacy enhancing technologies lesson privacy risks to individuals while maintaining the benefits of robust aggregate data sets? (5) How can these possible approaches be accommodated within the CPBR? (6) What other approaches to big data could be considered to promote privacy, and what other questions should the NTIA be asking?

News: Privacy