Avoiding Privacy Risks: Smile! You're on the Web Camera!
March 2010
Managing privacy risks seems to be an increasingly
difficult task. To see just how much trouble businesses and government entities
are having, just read current headlines. Almost daily there are privacy and
security violations revealed.
by Gary
Clayton
Privacy Compliance
Group, Inc.
Perhaps the difficulty arises from the use of technology that we don't fully
understand. Or perhaps it comes from the failure to apply common principles
of fair use and data protection. The skeptics might say that it is these factors,
combined with an apparent lack of common sense, that create unnecessary risks
for businesses and organizations. This article shows how taking six common-sense
steps can give you the information necessary to avoid privacy risks.
Laptops, Webcams, and Common Sense
In the last few days, there has been considerable press attention given to
a case involving a Pennsylvania school district accused of secretly activating
webcams inside student's homes. The press reports state that Lower Marion school
officials handed out Apple laptops to all 2,300 students in its two high schools.
Without disclosing their plan to the families and students, the school district
allegedly activated the built-in laptop computers to locate lost computers.
Only two employees in the technology department were authorized to activate
the cameras, and then only to locate stolen computers. The school district has
admitted that they remotely activated webcams 42 times in the past 14 months.
(Numerous media reports indicate that such remote activation helped the school
district locate 28 of the 42 missing computers.) It is unknown whether or not
the school district also turned on the computers' microphones.
In mid-November 2009, the vice principal of one of the district's two high
schools allegedly informed a male student that he was "engaged in improper behavior
in his home." It is also alleged that the vice principal cited as evidence a
photograph "embedded in" the laptop the student had been issued by the school
district.
Basic Risk Avoidance Steps
This Pennsylvania case shows how even well-intentioned plans can cause problems
if we fail to understand the technology being used and its potential consequences.
In this case, school officials apparently did not stop to consider how such
use of webcams could catch children and other family members in private situations.
Considering that many teens keep computers in their bedrooms, the potential
for abuse is nearly limitless.
Effective risk management could (should) have avoided the issues raised by
the Pennsylvania case. The remainder of this article examines the fundamental
steps that management should follow when considering any use of personal information,
particularly sensitive personal data.
Six Basic Risk Avoidance Steps
Effective risk management does not have to involve complex methodologies.
Six common-sense steps can provide your organization with the information needed
to avoid privacy risks. The six steps are:
- Identify the purposes for collecting personal data and the benefits
that will result.
- Identify what personal data will be collected and eliminate the collection
of personal data that is irrelevant or excessive.
- Identify any likely adverse impact that may occur.
- Consider alternatives that may avoid or lessen the privacy and security
risks.
- Take into account the obligations that arise from collecting the personal
information.
- In light of the above, determine whether the collection of personal
data is justified.
Application of These Six Steps
Would the application of these six basic steps potentially have avoided the
situation that has arisen in Pennsylvania? While no risk avoidance process can
avoid all risks in all situations, the implementation of these six steps can
help reduce or avoid most privacy risks. How would these steps have worked in
the Pennsylvania situation?
- Identification of the purpose: The
school district's stated purpose was to prevent the theft of laptops. This
does not explain why a vice principal allegedly used the photos to reprimand
a boy's behavior.
- Personal data collected: This is the
first point at which red flags should have been raised. Think about the
types of personal data that can be collected by secretly turning on the
webcams in a teenager's laptop. First of all, teens are known to use their
laptops in their bedrooms. And, as the legal director of the American Civil
Liberties Union of Pennsylvania states: "This is the age where kids explore
their sexuality, so there is a lot of that going on in the room."
- Identify likely adverse impacts: The
potential for abuse is almost limitless in this case. Once the webcams are
turned on, there is no way to control what images will be seen or collected.
Basically, there is no way to ensure that only relevant and nonexcessive
information will be collected.
- Consider alternatives: One alternative
was to have informed the students and their families of the plan to remotely
activate the webcams. Also, remote activation of a webcam is not the only
method available to locate stolen laptops. The use of GPS chips within a
laptop is effective and would have avoided the types of risks that arise
from the use of webcams.
- Obligations that arise: Had basic
risk avoidance steps been followed, it is unlikely that this factor would
have been reached. The magnitude of the risks and the readily available
alternatives should have precluded the use of webcams. If not, however,
a discussion of the obligations that arise from collecting potentially intimate
and embarrassing situations should have raised red flags.
- Is the collection justified? Considering
the risks, the lack of notice, the potential for abuse, the adverse impact
on the school district, and the potential criminal violations that can arise,
it is difficult to see how collection of personal data through a secretly
activated web camera can be justified. Even if arguments can be made that
remote activation of a webcam was necessary, common sense should have prevailed.
Consequences
The press reports indicate that the Federal Bureau of Investigation (FBI)
is now investigating potential criminal violations from the remote activation
of webcams. In particular, the FBI is examining whether laws on wire tapping
and/or computer intrusion have been violated. The media reports that the school
district has retained special legal counsel. There are certainly scores of negative
reports that place the school district in an unfavorable light. These problems
may have been avoided by the implementation of basic privacy risk management
process. Common sense dictates that risk avoidance is preferable to costly and
resource-consuming litigation.
Opinions expressed in Expert Commentary articles are those of the author and are
not necessarily held by the author's employer or IRMI. Expert Commentary articles
and other IRMI Online content do not purport to provide legal, accounting, or other
professional advice or opinion. If such advice is needed, consult with your attorney,
accountant, or other qualified adviser.