Seven Principles of Privacy

This summary of the basic principles of privacy protection is derived from a U.S. Department of Commerce document aimed at acquainting U.S. organizations with privacy issues and with regulations governing privacy in the European Union. All corporations that operate there, including Microsoft, must follow these regulations. Note that these rules apply to personal data collected by any means, and are not limited to electronic data.

Notice. An organization must inform individuals about the types of personal information it collects, how it collects that information, the purposes for which it collects such information, the types of organizations to which it discloses the information, and how individuals can limit its use and disclosure. This notice must be provided in clear, conspicuous language that is readily understandable, and it must be made available when individuals are first asked to provide personal information to the organization.

Choice. Individuals must be able to opt out of any use of their information that is unrelated to the purpose for which they originally disclosed it. They must explicitly grant permission (opt in) for disclosure of particularly sensitive information, such as their medical history.