FTC QUESTION 1: RISKS
Original Question
What risks, concerns, and benefits arise from the collection, sharing, and use of consumer information? For example, consider the risks and/or benefits of information practices in the following contexts: retail or other commercial environments involving a direct consumer-business relationship; data broker and other business-to-business environments involving no direct consumer relationship; platform environments involving information sharing with third party application developers; the mobile environment; social networking sites; behavioral advertising; cloud computing services; services that collect sensitive data, such as information about adolescents or children, financial or health information, or location data; and any other contexts you wish to address.
Response: The FTC should develop a methodology/metrics for measuring the risk of improper use of Personally Identifiable Information (PII).
In order to properly regulate the handling of PII, it is necessary to understand the impacts of mishandling this information.
The impacts of improperly handled PII potentially include the following:
1. Physical harm (e.g., from government or rebel groups)
2. Financial harm (e.g., from governments, criminals)
3. Reputational harm
4. National security
These impacts need to be measured at a data item level, not merely PII as a class. And the likelihood of worst-case scenarios needs to be considered to develop a proper assessment of the risk associated with each data item. For example, information that suggests an individual