...
Response: The FTC should develop a methodology/metrics for measuring the risk of improper use of Personally Identifiable Information (PII).
There are two areas of risk in considering the exposure of Personally Identifiable Information (PII): planned risks and unplanned risks. Planned risks are the risks associated with the intentional and agreed-to (implicitly or explicitly) sharing, collection, storage, archiving, and destruction of PII by the parties. The parties to such planned risks are the Subject of the PII, Relying Parties, and Identity Providers. Unplanned risks stem from the misuse/abuse of PII in ways not sanctioned by the agreeing parties (particularly the Subject) at the time they enter into an agreement.
Planned risks fall into the domain of contract law, and, as noted in our response to Questions 2 and 3, there is much room for improvement in the current legal regimes that cover this domain.
Unplanned risks more typically emanate from illegal activity. These are the subject of this response.
In order to properly regulate the handling of PII, it is necessary to understand the impacts of mishandling this information.
The impacts of improperly handled PII potentially include the following:
1.* Physical harm (e.g., from government or rebel groups)
2 .* Financial harm (e.g., from governments, criminals)
3 .* Reputational harm
4. National securityThese impacts need to be measured at a data item level, .* Duress and mental anguish (e.g., from abusive ex-partners or bullies)
.* National security.
The measurement of these impacts must consider individual data items and not merely PII as a class. And the likelihood of worst-case scenarios needs to be considered to To develop a proper assessment of the risk associated with each data item, an analysis of both the impact and the likelihood of worst-case scenarios must be considered. For example, information certain data items that suggests an individual