March 6, 2023

By Electronic Mail

Stephanie Weiner, Acting Chief Counsel, United States Department of Commerce

National Telecommunications and Information Administration

1401 Constitution Avenue, NW

Washington, DC 20230

Re: Comments in Docket No. 230103-0001 on Privacy, Equity, and Civil Rights

Dear Ms. Weiner:

ACM, the Association for Computing Machinery, is the world’s largest and longest established association of computing professionals, representing approximately 50,000 individuals in the United States and 100,000 worldwide. ACM is a non-profit, non-lobbying and non-political organization whose US Technology Policy Committee is charged with providing policy and law makers throughout government with timely, substantive, and apolitical input on computing technology and the legal and social issues to which it gives rise.

On behalf of the Committee, and in response to the National Telecommunications and Information Administration’s January 20, 2023 request for public comment in Docket No. 230103-0001 (RIN: 0660-XC05) (“RFI”), I am pleased to submit the attached Statement on the Importance of Protecting Personal Privacy. We specifically commend the principles it elaborates to NTIA as the agency formulates policy to address Inquiry 5 of the RFI: “What are the principles that should guide the Administration in addressing disproportionate harms experienced by underserved or marginalized groups due to commercial data collection, processing, and sharing?” (See www.acm.org/binaries/content/assets/ public-policy/2018_usacm_statement _preservingpersonalprivacy.pdf)

ACM’s US Technology Policy Committee looks forward to technically assisting NTIA and others throughout the process of developing, refining and potentially codifying enhanced public privacy protections and welcomes any and all inquiries to that end. For further information, or should you have any other questions, please contact ACM Director of Global Policy and Public Affairs Adam Eisgrau at 202-580-6555, or [email protected].

Sincerely,

Alec Yasinsac, Vice Chair

Attachment:

Statement on the Importance of Protecting Personal Privacy (March 2018)

March 1, 2018

USACM STATEMENT ON THE IMPORTANCE OF PRESERVING PERSONAL PRIVACY

USACM believes that the benefits of emerging technologies, such as Big Data and the Internet of Things, should and need not come at the expense of personal privacy. It is hoped and intended that the principles and practices set out in this Statement will provide a basis for building data privacy into modern technological systems. USACM encourages the development of innovative solutions to achieve these goals.

Foundational Privacy Principles and Practices

Fairness

• An automated system should not produce an adverse decision about an individual without the individual’s full knowledge of the factors that produced that outcome.

Transparency

• Provide individuals with clear information about how and by whom their personal data is being collected, how it will be used, how long it will be retained, to whom it may be disclosed and why, how individuals may access and modify their own data, and the process for reporting complaints or updates.
• Where feasible, provide these details prior to data collection and creation.
• Ensure that communications with individuals (i.e., data subjects) are comprehensible, readable, and straightforward.

Collection Limitation and Minimization

• Collect and retain personal data only when strictly necessary to provide the service or product to which the data relates, or to achieve a legitimate societal objective.
• Minimize the identifiability of personal data by avoiding the collection of individual-­‐level data when feasible, and taking into account the risk of correlation across data sets to re-­‐identify individuals.

Individual Control

• In all circumstances, consent to acquisition and use of an individual’s data should be meaningful and fully informed.
• Provide individuals with the ability to limit the collection, creation, retention, sharing and transfer of their personal data.
• Ensure that individuals are able to prevent personal data obtained for one purpose from being used or made available for other purposes without that person’s informed consent.
• Provide individuals with the ability to access and correct their personal data.

Data Integrity and Quality

• Ensure that personal data, including back-­‐up and copies forwarded to third parties, is sufficiently accurate, current, and complete for the purpose for which it is to be used.
• Conduct appropriate data quality assessments.

Data Security

• Protect personal data against loss, misuse, unauthorized disclosure, and improper alteration.
• Audit access, use, and maintenance of personal data.

Data Retention and Disposal

• Establish clear policies with fixed publically stated retention periods and seek individuals’ affirmative consent to retain their data for longer periods.
• Store personal data only for as long as needed to serve the stated purpose for its initial collection.
• Where feasible, de-identify personal information until properly destroyed.
• Implement mechanisms to promptly destroy unneeded or expired personal data, including back-up data and information shared with third parties.

Privacy Enhancement

• Promote and implement techniques that minimize or eliminate the collection of personal data.
• Promote and implement techniques that ensure compliance with the best privacy practices as they evolve.

Management and Accountability

• Ensure compliance with privacy practices through appropriate mechanisms, including independent audits.
• Establish and routinely test the capability to address a privacy breach or other incident.
• Implement privacy and security training and awareness programs.

Risk Management

• Routinely assess privacy risks to individuals across the data life cycle using appropriate risk models.

PDF available here.