WPF Key Reports

WPF has written numerous ground breaking reports. The reports listed here are good key reference points for our work, as each report has been impactful and has changed the public dialogue. In some cases, laws were changed based on our findings or recommendations, particularly when there were pronounced and unambiguous harms associated with the issues raised.

To see all reports, see the Reports category on this site. Also visit the home pages for individual reports by clicking on the links for the report.

Data Brokers and the Federal Government: A New Front in the Battle for Privacy Opens,  Part III in a series, Bob Gellman and Pam Dixon, authors.

This report focuses on government use of commercial data brokers, the implications for that usage, and what needs to be done to address privacy problems. The government must bring itself fully to heel in the area of privacy. If it is going to outsource its data needs to commercial data brokers, it needs to attach the privacy standards it would have been held to if it had collected the data itself. Outsourcing is not an excuse for evading privacy obligations.

To highlight privacy problems and opportunities for reform in the uses of data brokers by government, the report discusses the new Office of Management and Budget (OMB) guidance for an initiative (Do Not Pay Initiative) that on one hand provides for expanded use of commercial data brokers by federal agencies and on the other it establishes new privacy standards for the databases used in the Initiative. Although incomplete, its extension of privacy standards to commercial databases purchased by the federal government is groundbreaking. As such, this report recommends that OMB should expand its new guidance to cover all government data purchases, bartering, and exchanges from commercial data brokers and databases containing personal information. The problems created by unregulated government use of commercial data sources need to be seen clearly and addressed directly.

If all federal government uses of commercial data brokers are not required to satisfy the new OMB guidelines at a minimum, then the very databases that are supposed to be used for society’s benefit will be less accurate, timely, relevant, and complete, and can therefore cause unnecessary and avoidable harms such as garbled identities, blocking individuals from government benefits, and potential misclassification or even law enforcement actions against people due to errors in data. On a broader level, a lack of trust in the government’s ability to properly protect fair information rights in a new digital era can be the expensive societal result.

Medical Identity Theft: The Information Crime that Can Kill You, Pam Dixon, author. Bob Gellman, editor.

This report discusses the issue of medical identity theft and outlines how it can cause great harm to its victims. The report finds that one of the significant harms a victim may experience is a false entry made to his or her medical history due to the activities of an imposter. Erroneous information in health files can lead and has led to a number of negative consequences for victims. Victims do not have the same recourse and help for recovery from medical identity theft as do victims of financial identity theft. This report analyzes statistics in health care and identity theft, and estimates that approximately a quarter million to a half million individuals have been victims of this crime. The report presents the specific harms of medical identity theft based on analysis of cases, and explains why the falsification of information in victims’ medical files is one of the crime’s core harms. The report reviews the planned National Health Information Network and why the network may facilitate this crime. The report explains the reasons why medical identity theft is challenging to detect, and discusses the specific ways consumers have discovered they were victims of this crime.

Privacy in the Clouds: The Risks to Privacy and Confidentiality from Cloud Computing, Bob Gellman, author. Pam Dixon, editor.

This report discusses the issue of cloud computing and outlines its implications for the privacy of personal information as well as its implications for the confidentiality of business and governmental information. The report finds that for some information and for some business users, sharing may be illegal, may be limited in some ways, or may affect the status or protections of the information shared. The report discusses how even when no laws or obligations block the ability of a user to disclose information to a cloud provider, disclosure may still not be free of consequences. The report finds that information stored by a business or an individual with a third party may have fewer or weaker privacy or other protections than information in the possession of the creator of the information. The report, in its analysis and discussion of relevant laws, finds that both government agencies and private litigants may be able to obtain information from a third party more easily than from the creator of the information. A cloud provider’s terms of service, privacy policy, and location may significantly affect a user’s privacy and confidentiality interests.

One-Way Mirror Society: Privacy Implications of the New Digital Signage Networks, Pam Dixon, author. Bob Gellman, editor.

New forms of sophisticated digital signage networks are being deployed widely by retailers and others in both public and private spaces. From simple people-counting sensors mounted on doorways to sophisticated facial recognition cameras mounted in flat video screens and end-cap displays, digital signage technologies are gathering increasing amounts of detailed information about consumers, their behaviors, and their characteristics.

These technologies are quickly becoming ubiquitous in the offline world, and there is little if any disclosure to consumers that information about behavioral and personal characteristics is being collected and analyzed to create highly targeted advertisements, among other things. In the most sophisticated digital sign networks, for example, individuals watching a video screen will be shown different information based on their age bracket, gender, or ethnicity.

While most consumers understand a need for security cameras, few expect that the video screen they are watching, the kiosk they are typing on, or the game billboard they are interacting with is watching them while gathering copious images and behavioral and demographic information. This is creating a one-way-mirror society with no notice or opportunity for consumers to consent to being monitored in retail, public, and other spaces or to consent to having their behavior analyzed for marketing and profit.

The privacy problems inherent in these networks are profound, and to date these issues have not been adequately addressed by anyone. Digital signage networks, if left unaddressed, will very likely comprise a new form of sophisticated marketing surveillance leading to abuses of the collected information.

A Patient’s Guide to HIPAA: How to Use the Law to Guard your Health Privacy, Bob Gellman lead author with John Fanning, Pam Dixon.

Even though this Guide is heavily researched, this is not a traditional research report. Rather, this is a consumer’s guide to HIPAA written expressly for consumers, and is to date the only one we know of. It is written based on extensive research, however the writing style is simplified and the topics are broken into FAQs to facilitate ease of access to the information. The Guide has been published twice, with the first publication in 2009 and an extensive rewrite and update for 2013 to reflect the regulatory changes in HIPAA that took effect September 23, 2013.

The National Advertising Initiative: Failing at Consumer Protection and at Self-Regulation Pam Dixon, author. Bob Gellman, editor.

As a result of this report, the NAI rules were re-drafted, and the organization underwent substantive change. The NAI went from having two members to now over 90, at last count. It is a greatly improved self-regulatory situation.

This report examines behavioral advertising in the online and digital arena and specifically analyzes the effectiveness of the July 2000 industry and FTC agreement on self-regulation for behavioral ad targeting and delivery. The report finds that the agreement and the related self-regulatory body – called the Network Advertising Initiative or NAI – have failed to protect consumers and have failed to self-regulate the behavioral targeting industry.

The report reviews four areas of failure:

1) the NAI opt-out cookie does not work consistently and does not fulfill its purpose as a consumer protection mechanism;
2) the NAI static approach to self-regulation ignores new business models and emerging consumer tracking and profiling technologies and practices;
3) the NAI self-regulation does not include a majority of industry groups in the behavioral advertising sector; and
4) NAI’s self-regulatory third party enforcement program lacks transparency and independence. The only success of the NAI has been lulling regulators into thinking that self-regulation fairly and effectively addresses the interests of consumers who are the targets of behavioral advertising.

Many Failures: A brief history of privacy self-regulation  Bob Gellman, Pam Dixon, authors.

Major efforts to create self-regulatory, or voluntary, guidelines in the area of privacy began in 1997. Industry promoted privacy self-regulation at the time as a solution to consumer privacy challenges. This report reviews the leading efforts of the first self-regulatory wave from 1997 to 2007, and includes a review of the life span, policies, and activities of the Individual Reference Services Group, Privacy Leadership Initiative, Online Privacy Alliance, Network Advertising Initiative, BBBOnline Privacy Program, US-EU Safe Harbor Framework, Children’s Online Privacy Protection Act, and the Platform for Privacy Preferences. A key finding of this report is that the majority of the industry self-regulatory programs that were initiated failed in one or more substantive ways, and, many disappeared entirely. The report concludes with a discussion of possible reforms for the process, including a defined and permanent role for consumers, independence, setting benchmarks, and other safeguards.

Call, Don’t Click: A Series of Two Reports on AnnualCreditReport.com, Pam Dixon, author.

These encompass two separate reports about the congressionally mandated annualcreditreport.com. We wrote the reports after being contacted by consumers who were being misdirected to imposter web sites with domains very similar to annualcreditreport.com. As a result of these two reports, the FTC took numerous enforcement actions, and for many years the scams were reduced.

Report I: Call Don’t Click : Why it’s smarter to order federally mandates free credit reports via telephone, not the internet Pam Dixon, author.

The World Privacy Forum urges consumers who qualify [1] to order a federally mandated free annual credit report [2] to call the toll free number (877-322-8228) instead of ordering their free credit report online. Calling the toll free number exposes consumers to fewer potential hazards than ordering online. [3] Consumers who try to use the official online site www.annualcreditreport.com may encounter numerous challenges, some of them potentially serious.

Report II: Call Don’t Click Update: Still be smart about ordering federally mandated free credit reports, Pam Dixon, author.

Summary of new findings:

• At least 233 total domains with close or nearly identical spellings of annualcreditreport.com have been purchased. This is an increase from the findings in the first report.
• At least 112 known and confirmed imposter domains were “live,” that is, online and are actively routing consumers away from the official site as of June, 2005. This is an increase of 62 domains from the findings in the first report.
• 7 of the 112 imposter sites posted a privacy policy.
• 21 of the imposter sites posted some form of minimal contact information, such as the ability to fill out a Web form or send an email.
• Many of the imposter domains actively sent consumers to credit bureaus instead of to the official annualcreditreport.com site. This is happening because the pay per click and affiliate marketing issues articulated in the first report are still a substantial problem. When the “live” and “parked” imposter domains send consumers to commercial credit services and some credit bureaus, many of the imposter domains get paid for doing this via “pay per click” online advertising and/or affiliate marketing schemes.
• Four imposter domains forwarded consumers directly to a commercial data broker, Intelius.

 A Year in the Life of an Online Job Scam: A Longitudinal Study, Pam Dixon, author.

This report is almost a decade old, yet job scams continue to be a problem. This was the first report to explore privacy, online job searching, and the impact of scams when the effort went awry.

Job scams are as old as jobs themselves. In past years, con artists would put a bad job ad up, fool a job seeker into giving up their money, and then physically move on to a new city. Now bad job ads have moved onto the Internet, with devastating consequences. The very things that make the Internet so effective for job seekers — speed, convenience, and a nationwide job search from a computer screen — are the same things that make it effective for fraudulent activity. Job seekers and job sites have unfortunately been targeted with sophisticated triangulation scams that move rapidly and seamlessly through a selection of job sites from coast to coast in a matter of days.

In this report, The World Privacy Forum is publishing the first documentation of the detailed path of an online job scam as it worked its way across multiple job sites over the course of a year. The documentation of this scam, its evolution, and its devastating effects on the victims it has left behind provides the first clear longitudinal view of the scope, patterns, and severity of the online job fraud problem.