4-1
Ethics in Information Technology, Sixth Edition
Chapter 4
Privacy
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
Lecture Notes
Overview
Chapter 4, “Privacy,” explains how the use of IT affects privacy rights and discusses several key
pieces of legislation that have addressed privacy rights over the years. The Fourth Amendment is
explained, and laws designed to protect personal financial and health data—as well as the
privacy of children—are discussed. Electronic surveillance is covered, along with many laws
associated with this activity, including Executive Order 12333, the Foreign Intelligence
4-2
Ethics in Information Technology, Sixth Edition
Objectives
As students read this chapter, they should consider the following questions:
• What is the right of privacy, and what is the basis for protecting personal privacy under
the law?
• What are some of the laws that provide protection for the privacy of personal data, and
Teaching Tips
Organizations Behaving Badly
1. Briefly discuss the features of the WhatsApp instant messaging app, and talk about the
2. Ask student to share their opinions about the WhatsApp policy change. Are they
I. Privacy Protection and the Law
1. Begin the discussion by explaining that information about people is gathered, stored,
analyzed, and reported because organizations can use it to make better decisions. Some of
2. Use Figure 4-1 to aid a discussion about the types of information that organizations
gather about people.
3. Introduce the terms Bill of Rights and the Fourth Amendment.
4. An important point to make is that today, in addition to protection from government
4-3
Ethics in Information Technology, Sixth Edition
5. Use the examples in Table 4-1 to aid a discussion about the types of systems that gather
information about individuals.
A. Information Privacy
1. Explain that a broad definition of the right to privacy is “the right to be left alone—the
most comprehensive of rights, and the right most valued by a free people.”
B. Privacy Laws, Applications, and Court Rulings
2. Explain that although a number of independent laws and acts have been implemented
over time, no single, overarching national data privacy policy has been developed in the
Financial Data
1. To access many available financial products and services, individuals must use a personal
Fair Credit Reporting Act (1970)
1. Briefly discuss the Fair Credit Reporting Act, which regulates the operations of credit-
reporting bureaus, including how they collect, store, and use credit information.
2. The act outlines who may access your credit information, how you can find out what is in
4-4
Ethics in Information Technology, Sixth Edition
Right to Financial Privacy Act (1978)
1. The Right to Financial Privacy Act protects the records of financial institution
customers from unauthorized scrutiny by the federal government. Explain that prior to
2. Point out that the Right to Financial Privacy Act only governs disclosures to the federal
Gramm-Leach-Bliley Act (1999)
1. The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services
2. Glass–Steagall prohibited any one institution from offering investment, commercial
3. Discuss the following three rules, included in GLBA, that affect personal privacy:
4. Point out that after the GLBA was passed, financial institutions resorted to mass mailings
to contact their customers with privacy-disclosure forms. As a result, many people
Fair and Accurate Credit Transactions Act (2003)
1. Note that the Fair and Accurate Credit Transactions Act was passed in 2003 as an
amendment to the Fair Credit Reporting Act, and it allows consumers to request and
obtain a free credit report once each year from each of the three primary consumer credit
reporting companies (Equifax, Experian, and TransUnion).
4-5
Ethics in Information Technology, Sixth Edition
Health Information
1. Point out that the use of electronic medical records and the subsequent interlinking and
transferring of this electronic information among different organizations has become
Health Insurance Portability and Accountability Act (1996)
1. Explain that the Health Insurance Portability and Accountability Act of 1996
(HIPAA) was designed to improve the portability and continuity of health insurance
coverage; to reduce fraud, waste, and abuse in health insurance and healthcare delivery;
and to simplify the administration of health insurance.
American Recovery and Reinvestment Act (2009)
1. The American Recovery and Reinvestment Act, passed in 2009, is a wide-ranging act
that authorized $787 billion in spending and tax cuts over a 10-year period. Explain that
Teaching
Tip
To learn more about HIPAA, visit: https://www.healthit.gov/patients-
families/protecting-your-privacy-security.
Teaching
Tip
To learn more about the HITECH Act, visit: https://www.healthit.gov/policy-
4-6
Ethics in Information Technology, Sixth Edition
Children’s Personal Data
1. Explain that to date, only a few laws have been implemented to protect children online,
Family Educational Rights and Privacy Act (1974)
1. The Family Educational Rights and Privacy Act (FERPA) is a federal law that assigns
certain rights to parents regarding their children’s educational records. Explain that these
Children’s Online Privacy Protection Act (1998)
1. Point out that the Children’s Online Privacy Protection Act (COPPA) requires
websites that cater to children to offer comprehensive privacy policies, notify parents or
Electronic Surveillance
1. Use this section to highlight some of the laws that address government surveillance,
including various forms of electronic surveillance.
Title III of the Omnibus Crime Control and Safe Streets Act, also known as the Wiretap Act
1. Title III of the Omnibus Crime Control and Safe Streets Act, also known as the
Wiretap Act, regulates the interception of wire (telephone) and oral communications.
To learn more about the Katz v. United States case and its implications, read the
following article published by the National Constitution Center, “Katz v. United
4-7
Ethics in Information Technology, Sixth Edition
Foreign Intelligence Surveillance Act (1978)
1. Explain that the Foreign Intelligence Surveillance Act (FISA) describes procedures for
the electronic surveillance and collection of foreign intelligence information in
communications between foreign powers and the agents of foreign powers.
Executive Order 12333 (1981)
1. Explain that an executive order is an official document used by the president of the
2. Note that many executive orders pertain to routine administrative matters and the internal
3. Executive Order 12333, which was issued by President Reagan in 1981 and has been
amended several times, identifies the various U.S. governmental intelligence-gathering
Electronic Communications Privacy Act (1986)
1. Explain that the Electronic Communications Privacy Act (ECPA) protects
2. Under Title II of ECPA (also called the Stored Communications Act), the FBI director or
someone acting on his behalf may issue a National Security Letter (NSL) to an Internet
4-8
Ethics in Information Technology, Sixth Edition
Communications Assistance for Law Enforcement Act (1994)
1. Explain that Communications Assistance for Law Enforcement Act (CALEA)
amended both the Wiretap Act and ECPA; it required the telecommunications industry to
USA PATRIOT Act (2001)
1. Explain that the USA PATRIOT Act gave sweeping new powers both to domestic law
2. Note that although the act was more than 340 pages long and quite complex (it changed
3. Point out that the USA PATRIOT Act also eased restrictions on foreign intelligence
gathering in the United States.
4. Note that the NSL gag provision prohibits NSL recipients from informing anyone, even
Foreign Intelligence Surveillance Act Amendments Act (2004)
1. Explain that the Foreign Intelligence Surveillance Act (FISA) Amendments Act passed in
2004 amended the FISA to authorize intelligence gathering on individuals not affiliated
Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008
1. Briefly discuss some of the issues that led to the passage of this act. A few months after
the September 11, 2001, terrorist attacks, President George W. Bush signed an executive
4-9
Ethics in Information Technology, Sixth Edition
without court-approved warrants, international communications as they flow through U.S.
PATRIOT Sunsets Extension Act of 2011
1. The PATRIOT Sunsets Extension Act of 2011 granted a four-year extension of two key
provisions in the USA PATRIOT Act that allowed roving wiretaps and searches of
USA Freedom Act (2015)
1. The USA Freedom Act was passed following revelations by Edward Snowden (a former
Fair Information Practices
1. Explain that fair information practices is a term for a set of guidelines that govern the
collection and use of personal data. Note that the overall goal of such guidelines is to stop
Organisation for Economic Co-operation and Development for the Protection of Privacy
and Transborder Flows of Personal Information (1980)
3. Discuss the Organisation for Economic Co-operation and Development (OECD) and its
European Union Data Protection Directive (1995)
1. Explain that the European Union Data Protection Directive requires any company
doing business within the borders of the countries comprising the European Union to
4-10
Ethics in Information Technology, Sixth Edition
• Choice
European–United States Privacy Shield Data Transfer Program Guidelines
3. Explain that EU countries were concerned that the largely voluntary system of data
privacy in the United States did not meet the EU directive’s stringent standards.
European–United States Privacy Shield Data Transfer Program Guidelines
1. Briefly discuss this new arrangement between the EU and the United States, which places
stronger obligations on companies in the United States to protect the personal data of
General Data Protection Regulation (GDPR)
1. The General Data Protection Regulation (GDPR) is designed to strengthen data
protection for individuals within the EU by addressing the export of personal data outside
Access to Government Records
Freedom of Information Act (1966; amended 1974)
1. The Freedom of Information Act (FOIA), passed in 1966 and amended in 1974, grants
citizens the right to access certain information and records of federal, state, and local
governments upon request.
4-11
Ethics in Information Technology, Sixth Edition
4. Note that exemptions to the FOIA bar disclosure of information that could compromise
national security or interfere with an active law enforcement investigation. Another
exemption prevents disclosure of records if it would invade someone’s privacy.
Privacy Act (1974)
1. The Privacy Act of 1974 establishes a code of fair information practices that sets rules
2. Explain that under the Privacy Act, any agency that maintains such a system must
Critical Thinking Exercise: HIPAA Regulations Raise Concern
1. Suggest to students that they do some research online to find information regarding
which HIPAA provisions are of most concern to healthcare organizations. HIPAA has
required many healthcare organizations to make significant changes to the way they
provide healthcare-related services. In addition to making operational changes, those
Quick Quiz 1
1. _____ is the combination of communications privacy (the ability to communicate with
others without those communications being monitored by other persons or organizations)
Ask students to read the following article and then discuss whether they are
concerned by the increase in the number of instances in which the federal
4-12
Ethics in Information Technology, Sixth Edition
2. The _____ protects the records of financial institution customers from unauthorized
scrutiny by the federal government.
3. The _____ requires any website that caters to children to offer comprehensive privacy
policies, notify parents or guardians about its data collection practices, and receive
parental consent before collecting any personal information from children under 13 years
of age.
4. A(n) _____ is a device that records electronic impulses to identify the numbers dialed for
outgoing calls.
5. A(n) _____ is a device that records the originating number of incoming calls for a
particular phone number.
6. _____ is a term for a set of guidelines that govern the collection and use of personal data.
II. Key Privacy and Anonymity Issues
A. Consumer Profiling
1. Introduce the term cookies.
2. Emphasize that the marketing firms aggregate the information they gather about
3. Point out that the cost to an organization that suffers a data breach (an unintended
4. Use Table 4-4 to aid a discussion of some of the largest data breaches in recent years.
4-13
Ethics in Information Technology, Sixth Edition
B. Electronic Discovery
1. Explain that discovery is part of the pretrial phase of a lawsuit in which each party can
2. Introduce the terms electronic discovery (e-discovery) and electronically stored
information (ESI).
6. E-discovery raises many ethical issues: Should an organization ever attempt to destroy or
conceal incriminating evidence that could otherwise be revealed during discovery? To
what degree must an organization be proactive and thorough in providing evidence
sought through the discovery process? Should an organization attempt to bury
incriminating evidence in a mountain of trivial, routine ESI?
C. Workplace Monitoring
1. Introduce the term cyberloafing.
2. Remind students that many organizations have developed policies on the use of IT in the
3. Note that almost 80% of major companies choose to record and review employee
4. As the laws governing employee privacy and monitoring continue to evolve, business
D. Advanced Surveillance Technology
1. Draw attention to the fact that advances in information technology—surveillance cameras
and satellite-based systems that can pinpoint a person’s physical location—have provided
Teaching
Ask students to research the Equifax data breach announced in September 2017
to find the latest developments related to that incident—such as additional
4-14
Ethics in Information Technology, Sixth Edition
2. Explain that advocates of advanced surveillance technology argue that people have no
legitimate expectation of privacy in public places and thus Fourth Amendment privacy
Camera Surveillance
1. Note that surveillance cameras are used in major cities around the world in an effort to
deter crime and terrorist activities. Critics believe that such scrutiny is a violation of civil
2. Briefly discuss the use of camera surveillance in London, and a number of U.S. cities.
Vehicle Event Data Recorders
1. Note that a vehicle event data recorder (EDR) is a device that records vehicle and
2. Point out that the EDR cannot capture any data that could identify the driver of the
Stalking Apps
1. Explain that a stalking app can be loaded onto someone’s cell phone or smartphone
2. Note that there is no law that prohibits a business from making an app whose primary
Critical Thinking Exercise: Monitoring Worker Productivity
1. Students will likely be able to suggest a variety of potential problems that could arise
from using the new inventory control system to monitor worker productivity—including
a negative impact on morale if employees feel like their every move is being tracked. The
4-15
Ethics in Information Technology, Sixth Edition
Quick Quiz 2
1. A(n) _____ is a text file that can be downloaded to the hard drives of users who visit a
website, so that the website is able to identify visitors on subsequent visits.
2. A(n) _____ is an unintended release of sensitive data or the access of sensitive data (e.g.,
credit card numbers, health insurance member ids, and Social Security numbers) by
unauthorized individuals
3. A(n) _____ is a set of instructions sent by organizations to inform its employees (or to the
opposing party) to save relevant data and to suspend data that might be due to be
destroyed based on normal data-retention rules.
4. (True or False) The U.S. government required vehicle event data recorders (EDRs) in
passenger vehicles.
Discussion Questions
1. Are you concerned about the amount of personal information that organizations might
have gathered about you? Do you take any steps to safeguard your personal information?
Do you think more constraints should be put on the use of your personal data by
marketers?
2. Since there are few legal limitations to the surveillance of private citizens by industry,
4-16
Ethics in Information Technology, Sixth Edition
Additional Projects
1. Research the use of data from vehicle event data recorders (EDRs) in criminal cases
related to automobile accidents. Has this data been used to convict drivers of
negligence—or even vehicular manslaughter or homicide? Is the data from EDRs
Additional Resources
1. Federal Trade Commission, “The Equifax Data Breach: What to Do”
2. Electronic Privacy Information Center, “Privacy and Consumer Profiling”
3. New York Times, “European Court Limits Employers’ Right to Monitor Workers’ Email”
4. U.S. Department of Health and Human Services, “$5.5 Million HIPAA Settlement Shines
Light On the Importance of Audit Controls”
Key Terms
American Recovery and Reinvestment Act: A wide-ranging act that authorized $787 billion in
spending and tax cuts over a 10-year period and included strong privacy provisions for electronic
4-17
Ethics in Information Technology, Sixth Edition
Children’s Online Privacy Protection Act (COPPA): An act implemented in 1998 in an
attempt to give parents control over the collection, use, and disclosure of their children’s personal
information.
cookie: Text files that can be downloaded to the hard drives of users who visit a website, so that
the website is able to identify visitors on subsequent visits.
Communications Assistance for Law Enforcement Act (CALEA): An act passed in 1994 that
cyberloafing: Using the Internet for purposes unrelated to work such as posting to Facebook,
sending personal emails or Instant messages, or shopping online.
Electronic Communications Privacy Act (ECPA): An act that deals with the protection of
three main issues: (1) the protection of communications while in transfer from sender to receiver;
(2) the protection of communications held in electronic storage; and (3) the prohibition of
devices from recording dialing, routing, addressing, and signaling information without a search
warrant.
Fair and Accurate Credit Transactions Act: An amendment to the Fair Credit Reporting Act
passed in 2003 that allows consumers to request and obtain a free credit report once each year
from each of the three primary consumer credit reporting companies (Equifax, Experian, and
TransUnion).
Fair Credit Reporting Act: An act that regulates the operations of credit-reporting bureaus,
including how they collect, store, and use credit information.
4-18
Ethics in Information Technology, Sixth Edition
Foreign Intelligence Surveillance Act (FISA) Court: Created by the Foreign Intelligence
Surveillance Act (FISA), this court meets in secret to hear applications for orders approving
electronic surveillance anywhere within the United States.
Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008: An act that granted
NSA expanded authority to collect, without court-approved warrants, international
communications as they flow through U.S. telecommunications network equipment and
facilities.
Fourth Amendment: An amendment to the Constitution that protects citizens from
unreasonable government searches and is often invoked to protect the privacy of government
employees.
Health Insurance Portability and Accountability Act (HIPAA): An act designed to improve
the portability and continuity of health insurance coverage; to reduce fraud, waste, and abuse in
health insurance and healthcare delivery; and to simplify the administration of health insurance.
information privacy: The combination of communications privacy and data privacy.
4-19
Ethics in Information Technology, Sixth Edition
opt in: To give an organization the right to share personal data, such as annual earnings, net
worth, employers, personal investment information, loan amounts, and Social Security numbers,
to other financial institutions.
predictive coding: A process that couples human guidance with computer-driven concept
searching in order to “train” document review software to recognize relevant documents within a
document universe.
Privacy Act: Establishes a code of fair information practices that sets rules for the collection,
maintenance, use, and dissemination of personal data that is kept in systems of records by federal
agencies.
Title III of the Omnibus Crime Control and Safe Streets Act: A law that regulates the
interception of wire (telephone) and oral communications; also known as the Wiretap Act.
transborder data flow: The flow of personal data across national boundaries
trap and trace: A device that records the originating number of incoming calls for a particular
phone number.
4-20
Ethics in Information Technology, Sixth Edition
USA Freedom Act: An act passed following startling revelations by Edward Snowden of secret
NSA surveillance programs, which terminated the bulk collection of telephone metadata by the
NSA.