Fair Information Practice and OECD Privacy Principles

Fair Information Practice and OECD Privacy Principles: A CDPSE Guide

Overview
Fair Information Practice Principles (FIPPs) and the OECD Privacy Principles are the foundation of almost every modern privacy law, framework and privacy program. In the CDPSE exam (Domain 1: Privacy Governance), they appear as the baseline ideas behind regulations, policies and privacy-by-design decisions. You need to know what each principle means, how it shows up in real controls, and how to apply it to scenario questions.

Why It Is Important
1. A universal foundation: The GDPR, the APEC Privacy Framework, Canada's PIPEDA, Australia's Privacy Principles, many US state laws and ISO/IEC 29100 all build on FIPPs and the OECD Guidelines. If you understand the principles, you can reason about any jurisdiction.
2. A basis for governance: Privacy policies, data inventories, retention schedules, consent mechanisms and data subject request processes are all ways of putting these principles into practice.
3. A design guide for engineers: As a CDPSE you translate principles into technical controls such as data minimization, access controls, logging and data quality checks.
4. Cross-border trust: The OECD Guidelines were written to protect privacy while allowing personal data to flow freely between countries. This balance is still central to international data transfers.
5. Exam relevance: Many questions test whether you can identify which principle is being violated or which control best supports a given principle.

What It Is: Historical Background
FIPPs origin (1973): The US Department of Health, Education and Welfare (HEW) report Records, Computers and the Rights of Citizens proposed five core practices:
- No secret record-keeping systems.
- Individuals can find out what information is held about them and how it is used.
- Information collected for one purpose is not used for another without consent.
- Individuals can correct or amend records.
- Organizations must ensure data is reliable and prevent misuse.
These ideas influenced the US Privacy Act of 1974.

OECD Guidelines (1980, revised 2013): The OECD issued the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. They are non-binding but became the most widely adopted statement of FIPPs worldwide. They define eight principles.

The Eight OECD Privacy Principles
1. Collection Limitation: Limit the collection of personal data. Obtain data by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject. Control examples: data minimization, lawful basis assessment, consent capture.
2. Data Quality: Personal data should be relevant to the purpose and be accurate, complete and kept up to date. Controls: validation rules, periodic data refresh, correction workflows.
3. Purpose Specification: State the purposes no later than the time of collection. Later use must be limited to those purposes or compatible ones. Controls: privacy notices, records of processing, data inventories that tag purpose.
4. Use Limitation: Do not disclose or use data for purposes other than those specified, except with the consent of the data subject or by authority of law. Controls: purpose-based access control, data sharing agreements, secondary use reviews.
5. Security Safeguards: Protect data with reasonable safeguards against loss, unauthorized access, destruction, use, modification or disclosure. Controls: encryption, IAM, logging, DLP, incident response.
6. Openness: Be open about developments, practices and policies on personal data. Make it easy to learn whether data exists, its nature, its main purposes, and the identity and location of the data controller. Controls: published privacy policies, transparency reports.
7. Individual Participation: Individuals have the right to confirm whether data is held about them, to obtain it in a reasonable time, form and cost, to be given reasons if a request is denied, and to challenge the data and have it erased, corrected or completed. Controls: data subject access request (DSAR) processes, identity verification, correction and deletion tooling.
8. Accountability: The data controller is accountable for complying with measures that give effect to all the other principles. Controls: privacy officer or DPO, privacy program, audits, training, metrics.

Memory aid: C-D-P-U-S-O-I-A, for example 'Can Data Privacy Users Stay Open In Audits'. You can also group them:
- Collection-stage: Collection Limitation, Purpose Specification.
- Handling-stage: Data Quality, Use Limitation, Security Safeguards.
- Individual-facing: Openness, Individual Participation.
- Overarching: Accountability.

The 2013 OECD Revision
The eight principles stayed the same. The revision added:
- Privacy management programmes to show accountability in practice.
- Data security breach notification to authorities and, where appropriate, to individuals.
- A risk-based approach and stronger privacy enforcement authorities.
- Transborder flows: the controller remains accountable wherever the data is located, and flow restrictions should be proportionate to risk.
- National privacy strategies and international cooperation (interoperability).

Other FIPPs Variants You May See
US FTC FIPPs (1998):
- Notice/Awareness
- Choice/Consent
- Access/Participation
- Integrity/Security
- Enforcement/Redress
Notice is considered the most fundamental of these.

US DHS FIPPs (2008):
- Transparency
- Individual Participation
- Purpose Specification
- Data Minimization
- Use Limitation
- Data Quality and Integrity
- Security
- Accountability and Auditing

APEC Privacy Framework (2005, updated 2015): Based on the OECD principles. It has nine principles, including Preventing Harm and Choice, and is the basis for the Cross-Border Privacy Rules (CBPR) system.

Mapping to GDPR Article 5:
- Lawfulness, fairness and transparency correspond to Collection Limitation and Openness.
- Purpose limitation corresponds to Purpose Specification and Use Limitation.
- Data minimization corresponds to Collection Limitation.
- Accuracy corresponds to Data Quality.
- Storage limitation is an extension of data quality and minimization.
- Integrity and confidentiality correspond to Security Safeguards.
- Accountability maps directly.
- Individual Participation corresponds to the data subject rights in GDPR Articles 15 to 22.

How It Works in Practice
FIPPs and the OECD principles are outcome statements, not technical specifications. A privacy program puts them into effect through a chain of layers:
1. Governance: Adopt the principles in a privacy policy approved by senior management. Assign accountability to a privacy officer or DPO.
2. Inventory and mapping: Identify what personal data is collected, why, where it flows and who has access. This supports purpose specification and openness.
3. Assessment: Use Privacy Impact Assessments (PIAs/DPIAs) to test new projects against each principle.
4. Design: Apply privacy by design. Collect only necessary fields, set default retention, pseudonymize, and enforce purpose-bound access.
5. Operations: Run DSAR handling, consent management, data quality checks, vendor management and breach response.
6. Monitoring and assurance: Use audits, metrics, logs and training to demonstrate accountability.

Example: A retailer wants to use loyalty-program purchase data for targeted credit offers.
- Purpose Specification and Use Limitation: Was this purpose disclosed at collection? If not, it needs new consent or a compatibility assessment.
- Openness: The privacy notice must be updated.
- Individual Participation: Customers must be able to access and correct their data.
- Accountability: The privacy office must approve the change through a PIA.

Exam Tips: Answering Questions on Fair Information Practice and OECD Privacy Principles
1. Memorize the eight OECD principles exactly. Questions often describe a scenario and ask which principle is violated. Learn the precise wording, for example Purpose Specification versus Use Limitation.
2. Separate Purpose Specification from Use Limitation. Purpose Specification means stating the purpose at or before collection. Use Limitation means not using or disclosing data beyond that purpose. A company that never told users why it collects data violates Purpose Specification. A company that told users but later sells the data violates Use Limitation.
3. Separate Collection Limitation from Data Quality. Collecting too much, or collecting unfairly, is Collection Limitation. Holding inaccurate, irrelevant or outdated data is Data Quality.
4. Separate Openness from Individual Participation. Openness is general transparency about policies and practices. Individual Participation is a specific person's right to access, challenge and correct their own data.
5. Accountability is the umbrella. If a question asks which principle ensures all the others are followed, or who is ultimately responsible, the answer is Accountability, and it rests with the data controller even when a processor or a third country is involved.
6. Know the source and date. FIPPs originated in the 1973 HEW report. The OECD Guidelines date from 1980 and were revised in 2013. The guidelines are voluntary and non-binding, but they are the basis for binding laws.
7. Remember what the 2013 revision added. It added privacy management programmes, breach notification and a risk-based approach to transborder flows. It did not add new core principles.
8. Look for the BEST answer. CDPSE questions often list several valid controls. Choose the one that most directly addresses the stated principle. For a Data Quality problem, a data validation and correction process beats encryption. For Security Safeguards, choose access control or encryption.
9. Think like an engineer applying governance. When asked how to implement a principle, prefer preventive, built-in technical controls (privacy by design) over after-the-fact detective ones, unless the question asks about assurance.
10. Watch for distractors from other frameworks. Terms like Preventing Harm (APEC), Notice/Choice (FTC) or Storage Limitation (GDPR) may appear. Make sure you answer within the framework the question names.
11. Map to GDPR when helpful. If you know the GDPR principles, translate them back to OECD terms to eliminate wrong options.
12. Keywords to watch:
- 'Lawful and fair means' or 'minimum necessary' point to Collection Limitation.
- 'Accurate, complete, up to date' points to Data Quality.
- 'At the time of collection' points to Purpose Specification.
- 'Secondary use' or 'disclosure to third parties' points to Use Limitation.
- 'Reasonable safeguards' points to Security Safeguards.
- 'Policies publicly available' or 'identity of the controller' points to Openness.
- 'Access, challenge, correct' points to Individual Participation.
- 'Responsible for compliance' points to Accountability.

Quick Summary
FIPPs are the globally recognized core ideas of privacy. The OECD's eight principles are the most influential version: Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation and Accountability. Know each definition, the controls that implement it, the differences between similar principles, and how they map to the GDPR, the FTC and APEC frameworks. That combination will let you answer most CDPSE governance questions on this topic with confidence.