Fair Information Practice Principles (FIPPs)
Department of Homeland Security (DHS) issued a Memorandum to memorialize the Fair Information Practice Principles (FIPPs) as the foundational privacy principles for DHS. The FIPPs are a set of eight principles that are built on the core tenets outlined in the Privacy Act of 1974. They are adopted as privacy standards by many U.S. states, U.S. federal departments and other nations. For a brief history of information policies and practices, see Robert Gellman’s Fair Information Practices: A Basic History (2008). The Safe Harbors framework is also interesting from a human service perspective. It is a set of principles developed to prevent unintentional disclosures or loss of client information and is for organizations in the EU or US: U.S.-EU Safe Harbor.
Fair Information Practice Principles (FIPPs):
- Transparency: DHS should be transparent and provide notice to the individual regarding its collection, use, dissemination, and maintenance of personally identifiable information (PII).
- Individual Participation: DHS should involve the individual in the process of using PII and, to the extent practicable, seek individual consent for the collection, use, dissemination, and maintenance of PII. DHS should also provide mechanisms for appropriate access, correction, and redress regarding DHS’s use of PII.
- Purpose Specification: DHS should specifically articulate the authority that permits the collection of PII and specifically articulate the purpose or purposes for which the PII is intended to be used.
- Data Minimization: DHS should only collect PII that is directly relevant and necessary to accomplish the specified purpose(s) and only retain PII for as long as is necessary to fulfill the specified purpose(s).
- Use Limitation: DHS should use PII solely for the purpose(s) specified in the notice. Sharing PII outside the Department should be for a purpose compatible with the purpose for which the PII was collected.
- Data Quality and Integrity: DHS should, to the extent practicable, ensure that PII is accurate, relevant, timely, and complete.
- Security: DHS should protect PII (in all media) through appropriate security safeguards against risks such as loss, unauthorized access or use, destruction, modification, or unintended or inappropriate disclosure.
- Accountability and Auditing: DHS should be accountable for complying with these principles, providing training to all employees and contractors who use PII, and auditing the actual use of PII to demonstrate compliance with these principles and all applicable privacy protection requirements.
Homeland Security Act of 2002, as amended, 6 U.S.C. § 142.
Privacy Policy: Fair Information Practice Principles
December 29, 2008
