The NIST Privacy Framework Inadequately Addresses Risks Associated with Data Collection

Yesterday, New America’s Open Technology Institute (OTI) filed comments in response to the National Institute of Standards and Technology’s (NIST) proposed privacy framework. The voluntary, risk-based framework provides guidance to companies to take stock of their privacy practices, identify ways to improve, and then make those improvements. OTI’s comments focus primarily on how the framework inadequately addresses the risks associated with data collection.

The framework places responsibility on companies to assess what level of privacy risk is acceptable to users resulting from their data practices. Placing that responsibility on companies will likely increase privacy risks to individuals and likely cause individual harm as companies downplay certain risks and ignore others in pursuit of enhancing revenue. If NIST retains this approach, it should be much clearer and more comprehensive in its explanation of the types of risks that companies should assess.

Moreover, the framework does not discuss the importance of data minimization, which is possibly the most effective way to reduce privacy risks overall. Nor does it create any mechanism to encourage organizations to limit the amount of data they collect. If companies limit their data collection to only the data they need for their operations, the risks associated with data retention and use are greatly reduced. The framework also fails to properly address the risks associated with the use of de-identified data, which can in many cases be re-identified.

The following quote can be attributed to Eric Null, senior policy counsel at New America’s Open Technology Institute:

“We appreciate NIST’s extensive work and thoughtfulness in creating the privacy framework, but changes are needed if the framework is to lead to significant improvements in online privacy practices. Under the current draft, the likelihood that online privacy practices will get better is low. Without clearer guidance from NIST, companies adopting the framework will lure themselves and their users into a false sense of security because the companies will not understand the breadth or gravity of the privacy risks involved in their data processing practices.”