Smart Cities Resources

Sensor networks and always-on data flows are supporting new service models and generating analytics that make modern cities and local communities faster and safer, as well as more sustainable, more livable, and more equitable. At the same time, connected smart city devices raise concerns about individuals’ privacy, autonomy, freedom of choice, and potential discrimination by institutions.
Given these significant and yet competing benefits and risks, the rapid adoption of smart city technologies around the globes raises the question: how can municipalities leverage the benefits of a data-rich society while minimizing threats to individual privacy and civil liberties?
This central repository for privacy-related guidance documents, best practices, reports, codes of conduct, and other resources can help local policymakers, technologists, and citizens navigate these complex issues.
If you have suggestions or additions to this list, please let Kelsey Finch know at [email protected].

• Automated License Plate Readers (ALPRs)
  • American Civil Liberties Union, You Are Being Tracked: How License Plate Readers Are Being Used to Record Americans’ Movements (July 2013). (https://www.aclu.org/files/assets/071613-aclu-alprreport-opt-v05.pdf) This report provides an overview of how license plate readers are being used by federal and state law enforcement and the significant impact of this technology upon privacy. The report also includes recommendations for authorities to harness this technology as an effective law enforcement tool without infringing on individuals’ rights to privacy and other civil liberties.
  • Information and Privacy Commissioner of Ontario, Guidance on the Use of Automated Licence Plate Recognition Systems by Police Services (September 2016). (https://www.ipc.on.ca/wp-content/uploads/2016/09/guidance-on-the-use-of-automated-licence-plate-recognition-systems-by-police-services-.pdf) This document provides detailed guidance, including best practices, on using ALPR technologies in a privacy-protective manner for public safety purposes. The guidance outlines the key obligations of police services under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and the Freedom of Information and Protection of Privacy Act (FIPPA) in their use of ALPR systems. It includes implementation guidelines addressing the authority and scope of such programs, data collection, notice, disclosure, retention, and access to information requests.
  • International Association of Chiefs of Police, Privacy Impact Assessment Report for the Utilization of License Plate Readers (September 2009). (http://www.iacp.org/Portals/0/pdfs/LPR_Privacy_Impact_Assessment.pdf) This report assesses the impact ALPR systems can have on the public’s privacy interests and makes recommendations for the development of information management policies intended to govern a law enforcement agency’s operation of an ALPR system.
  • National Conference of State Legislatures, Automated License Plate Readers | State Statues Regulating Their Use (February 2017). (http://www.ncsl.org/research/telecommunications-and-information-technology/state-statutes-regulating-the-use-of-automated-license-plade-readers-alpr-or-alpr-data.aspx) This site provides a list of state statutes relating to the use of ALPRs or the retention of data collected by ALPR, as well as year-by-year tracking of related state bills from 2013-present.
  • Office of the Information and Privacy Commissioner for British Columbia, Use of Automated Licence Plate Recognition Technology by the Victoria Police Department (November 2012). (https://www.oipc.bc.ca/investigation-reports/1480) This report describes how the Victoria, B.C., Police Department uses ALPR as a law enforcement tool. The report examines whether that use is compliant with Freedom of Information and Protection of Privacy Act (FIPPA), especially related to personal information associated with non-hits and obsolete-hits, and provides guidance for other police forces considering the use of ALPR.
  • U.S. Department of Homeland Security, Privacy Impact Assessment for the Acquisition and Use of License Plate Reader Data from a Commercial Service (March 2015). (https://www.dhs.gov/sites/default/files/publications/privacy-pia-ice-lpr-march2015.pdf) The document identifies privacy concerns and risk mitigation measures for U.S. Immigration and Customs Enforcement’s use of commercial license plate reader data for enforcement actions and investigations.
• Body-worn Cameras
  • A coalition of civil rights, privacy, and media rights organizations, Civil Rights Principles on Body Worn Cameras (May 2015). (http://www.civilrights.org/press/2015/body-camera-principles.html) This document presents guidelines from a broad of coalition of civil rights, privacy, and media rights organizations to help law enforcement agencies strengthen the protection of civil rights when deploying body-worn cameras.
  • American Civil Liberties Union of Illinois, Suggested Guidelines on Use of Body Cameras by Police (September 2014). (http://www.aclu-il.org/statement-regarding-use-of-body-cameras-by-police/) This document summarizes various recommendations to safeguard individuals’ right to privacy when taking advantage of body cameras to prevent abuse of police power and enhance police accountability.
  • Brennan Center for Justice at New York University School of Law, Police Body Camera Policies: Privacy and First Amendment Protections (August 2016). (https://www.brennancenter.org/analysis/police-body-camera-policies-privacy-and-first-amendment-protections/) This article compares the police body camera policies in different cities and organizations regarding their limits on recording witnesses and victims, private situations, First Amendment activities, and facial recognition technology.
  • International Association of Chiefs of Police, Model Policy on Body-Worn Cameras (April 2014). (http://www.aele.org/iacp-bwc-mp.pdf) This Model Policy, accompanied by the IACP Concepts and Issues Paper, provides guidance to law enforcement agencies to address various concerns raised by the use of body-worn cameras, including potential invasions of privacy.
  • Jay Stanley, Senior Policy Analyst, American Civil Liberties Union, Police Body-Mounted Cameras: With Right Policies in Place, A Win for All (March 2015). (https://www.aclu.org/other/police-body-mounted-cameras-right-policies-place-win-all) This article provides recommendations on how to deploy on-officer cameras in a manner that respects and protects individuals’ right to privacy.
  • New York City Department of Investigation Office of the Inspector General for the NYPD, Body-Worn Cameras in NYC: An Assessment of NYPD’s Pilot Program and Recommendations to Promote Accountability (July 2015). (http://www.nyc.gov/html/oignypd/assets/downloads/pdf/nypd-body-camera-report.pdf) This document presents a detailed assessment of the NYPD Volunteer BWC Pilot Program and 23 recommendations about officer discretion to record, notifications, safeguards for compliance with policy, access to video footage, and retention and purging.
  • Office of the Information and Privacy Commissioner for British Columbia, Guidance for the Use of Body-worn Cameras by Law Enforcement Authorities (February 2015). (https://www.aclu.org/other/police-body-mounted-cameras-right-policies-place-win-all) This guidance document identifies privacy considerations law enforcement authorities should take into account when deciding whether to outfit law enforcement officers with body-worn cameras. Also described is the privacy framework that should be part of any law enforcement body-worn camera program in order to ensure compliance with Canada’s personal information protection statutes.
  • Police Executive Research Forum, Implementing a Body-Worn Camera Programs: Recommendations and Lessons Learned (2014). (http://www.policeforum.org/assets/docs/Free_Online_Documents/Technology/implementing%20a%20body-worn%20camera%20program.pdf) This research project consisted of three major components: a survey of 500 law enforcement agencies nationwide; interviews with police executives; and a conference discussing the use of body-worn cameras. The paper contains analysis of the privacy implications of body-worn cameras and policy recommendations.
• Closed Circuit Television (CCTV)/Surveillance Cameras
  • American Civil Liberties Union of Northern California, Under the Watchful Eye: the Proliferation of Video Surveillance Systems in California (August 2007). (https://aclunc.org/sites/default/files/under_the_watchful_eye_the_proliferation_of_video_surveillance_systems_in_california_0.pdf) This report examines the threat posed by public video surveillance to privacy and the effectiveness of the usage by law enforcement agencies. The report also offers policy recommendations.
  • The Constitution Project, Guideline for Public Video Surveillance: A Guide to Protecting Communities and Preserving Civil Liberties (2007). (http://www.constitutionproject.org/wp-content/uploads/2012/09/54.pdf) This report describes guidelines for public video surveillance, including core principles governing the creation and design of public video surveillance systems, publicly accountable procedures for establishing the systems and principles and rules for use the systems. These guidelines will help communities meet the challenge of reconciling the need of law enforcement and constitutional rights and values.
  • Hong Kong Privacy Commissioner for Personal Data, Guidance on CCTV Surveillance and Use of Drones (March 2015). (https://www.pcpd.org.hk/english/resources_centre/publications/files/GN_CCTV_Drones_e.pdf) This guidance note offers advice to data users (both organizational and individual data users) on determining whether CCTV should be used in given circumstances and how to use CCTV responsibly. Recommendations given are based on the key requirements under the Personal Data (Privacy) Ordinance relating to the collection of personal data.
  • Office of the Information and Privacy Commissioner for British Columbia, Guide to Using Overt Video Surveillance (December 2016). (https://www.oipc.bc.ca/guidance-documents/2006) This guidance document suggests that video surveillance should only be used as last resort after exhausting other less privacy-invasive alternatives. This article also provides a clear guidance to organization on how to adopt video surveillance in a way that compliant with Freedom of Information and Protection of Privacy Act and Personal Information Protection Act.
  • Office of the Information and Privacy Commissioner for British Columbia, Public Sector Surveillance Guidelines (January 2014). (https://www.oipc.bc.ca/guidance-documents/1601) This guidance document helps public bodies operate the surveillance system in accordance with the Freedom of Information and Protection of Policy Act and in a privacy protective manner.
  • New Zealand Privacy Commissioner, Privacy and CCTV: A Guide to the Privacy Act for Businesses, Agencies and Organisations (October 2009). (http://www.privacy.org.nz/assets/Files/Brochures-and-pamphlets-and-pubs/Privacy-and-CCTV-A-guide-October-2009.pdf) These guidelines will encourage organisations of all sizes in New Zealand to operate CCTV systems in ways that protect the privacy of individuals, help them to comply with their legal obligations under the Privacy Act; and encourage them to use best privacy practice, including using privacy-enhancing technologies.
  • U.K. Information Commissioner’s Office, In the Picture: A Data Protection Code of Practice for Surveillance Cameras and Personal Information (May 2015). (https://ico.org.uk/media/for-organisations/documents/1542/cctv-code-of-practice.pdf) The Information Commissioner’s Office of the U.K. issued this code to explain to the operators of surveillance cameras how to comply with the legal requirements under the Protection of Freedom Act, the Freedom of Information Act and the Protection of Freedoms Act. The code focuses on the data protection implications of using surveillance cameras and provides good practice advice for organizations that use CCTV and other surveillance cameras to collect personal data.
  • U.K. Surveillance Camera Commissioner, Surveillance Camera Code of Practice (June 2013). (https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/204775/Surveillance_Camera_Code_of_Practice_WEB.pdf) This code provides guidance on the appropriate and the effective use of surveillance camera systems by relevant authorities in England and Wales. The code sets out 12 guiding principles that ensures proportionality and transparency in the use of surveillance by system operators and users to protect the public.
  • U.S Department of Homeland Security, CCTV: Developing Privacy Best Practices (December 2007). (https://www.dhs.gov/sites/default/files/publications/privacy_rpt_cctv_2007.pdf) The report on the DHS Privacy Office Public Workshop focuses on best practices for government use of camera technology. The Workshop examines how technology, local and international communities, law enforcement, government agencies, and privacy advocates are shaping the use of CCTV and what safeguards should be in place as the use of CCTV expands.
• Connected Transportation
  • Alliance of Automobile Manufacturers and Association of Global Automakers, Consumer Privacy Protection Principles: Privacy Principles for Vehicle Technologies and Services (November 2014).
    (https://autoalliance.org/wp-content/uploads/2017/01/Consumer_Privacy_Principlesfor_VehicleTechnologies_Services.pdf) This set of Principles provides an approach to customer privacy that members of the Alliance of Automobile Manufacturers and Association of Global Automakers can choose to adopt when offering innovative vehicle technologies and privacy. The Principles have been adopted by most leading automakers.
  • Federal Highway Administration, U.S. Department of Transportation, Shared Mobility: Current Practices and Guiding Principles (April 2016).
    (https://ops.fhwa.dot.gov/publications/fhwahop16022/fhwahop16022.pdf) This primer provides an introduction and background to shared mobility; discusses the government’s role; reviews success stories; examines challenges, lessons learned, and proposed solutions; and concludes with guiding principles for public agencies. Importance is attached to privacy protection during the process of data sharing.
  • Future of Privacy Forum, The Connected Car and Privacy: Navigating New Data Issues (November 2014).
    (https://fpf.org/wp-content/uploads/2021/05/FPF_Data-Collection-and-the-Connected-Car_November2014.pdf) This brief paper seeks to provide an overview of the technologies currently available in cars and identifies the types of data collected and the purposes for which they are used.
  • Future of Privacy Forum and the National Automobile Dealers Association, Personal Data in Your Car (January 2017).
    (https://fpf.org/wp-content/uploads/2017/01/consumerguide.pdf) In this document, FPF and NADA provide a guide to consumer privacy in the connected car. The guide helps consumers understand the kind of personal information collected by the latest generation of vehicles, which use data to further safety, infotainment, and customer experiences.
  • Information and Privacy Commissioner of Ontario, Eyes on the Road: Intelligent Transportation Systems and Your Privacy (March 1995).
    (http://www.ontla.on.ca/library/repository/mon/10000/179553.pdf) This paper briefly describes intelligent transportation systems (ITS) and discusses the key privacy issues associated with them. The paper also reviews ITS applications and their status in Canada and internationally.
  • Intelligent Transportation Society of America, ITS American’s Fair Information and Privacy Principles (2001).
    (http://connectedvehicle.itsa.wikispaces.net/file/view/ITSAFairInformatioPrivacy.pdf (Link Expiered)) This document sets forth Fair Information and Privacy Principles in recognition of the importance of upholding individual privacy in implementing ITS. These principles seek to safeguard individual privacy within the context of the deployment and operation of ITS.
  • Ministry of Infrastructure and the Environment (Netherlands), IMMA Privacy Reference Architecture (2016).
    (http://www.beterbenutten.nl/assets/upload/files/IMMA/IMMA-Privacy-reference-architecture-EN-2016.pdf) This document aims to facilitate the development of mobility and peak-traffic avoidance projects. This Privacy Reference Architecture was drawn up by the Dutch Ministry of Infrastructure and the Environment to make sure that new projects comply with applicable privacy legislation and regulations. This Privacy Reference Architecture formulates privacy principles, standards, and requirements, as well as examples and best practices.
  • National Highway Traffic Safety Administration, U.S. Department of Transportation, Federal Automated Vehicles Policy (September 2016).
    (https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/federal_automated_vehicles_policy.pdf) This policy document is intended to guide manufacturers and other entities in the safe design, development, testing, and deployment of highly automated vehicles. Measures and requirements specifically addressing the privacy issues are included.
  • Senator Edward J. Markey (D-Massachusetts), Tracking & Hacking: Security & Privacy Gaps Put American Drivers at Risk (February 2015).
    (https://www.markey.senate.gov/imo/media/doc/2015-02-06_MarkeyReport-Tracking_Hacking_CarSecurity%202.pdf) This report asserts that there is a clear lack of appropriate security measures to protect drivers against hackers who may be able to take control of a vehicle or against those who may wish to collect and use personal driver information. The report also calls for the National Highway Traffic Safety Administration, in consultation with the Federal Trade Commission on privacy issues, to promulgate new standards that will protect data, security, and privacy of driers in the modern age of increasingly connected vehicles.
  • Texas A&M Transportation Institute, Automated Vehicles: Policy Implications Scoping Study (January 2014). (https://tti.tamu.edu/policy/technology/prc-report-automated-vehicles-policy-implications-scoping-study/) This study seeks to understand how automated vehicles can alter the transportation system, identify implications for state and local transportation providers, determine future research needs, and understand emerging policy issues.
  • Center for Transportation Research, The Implications of Privacy Issues for Intelligent Transportation Systems (ITS) Data (May 2000).
    (http://static.tti.tamu.edu/swutc.tamu.edu/publications/technicalreports/472840-00075-1.pdf) This report examines current regulations, policies, and practices pertaining to sensitive ITS data in order to develop guidelines and institutional models for the management of these data. The report concludes with identification of public and private roles and responsibilities, as well as some practical recommendations.
  • Zurich American Insurance Company, Smart Cars and Connected Vehicles: Privacy, Security and Safety Considerations (May 2014).
    (https://www.zurichna.com/en/knowledge/articles/2014/05/smart-cars-and-connected-vehicles) This white paper analyzes the technologies that are contributing to a safer and more enjoyable driving experience. Automakers and other companies are recommended to develop robust systems, processes, and policies to assure information integrity and confidentiality, as well as to govern information retention and disposition.
• De-Identification of Public Data
  • DataSF (San Francisco), Open Data Release Toolkit (October 2016), (https://drive.google.com/file/d/0B0jc1tmJAlTcR0RMV01PM2NyNDA/view) This Open Data Release Toolkit guides municipal agencies and open data program staff through a step-by-step process to: identify sensitive or protected raw data, perform a risk assessment regarding the identifiability of the data, choose and implement privacy solutions (e.g. de-identification methods), and perform a risk assessment regarding the accessibility of the de-identified data.
  • Future of Privacy Forum, A Visual Guide to Practical Data De-Identification (April 2016). (https://fpf.org/2016/04/25/a-visual-guide-to-practical-data-de-identification/) This visual guide and accompanying paper propose parameters for calibrating legal rules to data depending on multiple gradations of identifiability, while also assessing other factors such as an organization’s safeguards and controls.
  • Future of Privacy Forum, Open Data Privacy Risk Assessment for the City of Seattle (January 2018). (https://fpf.org/2018/01/30/fpf-publishes-model-open-data-benefit-risk-analysis/) This Open Data Privacy Risk Assessment provides tools and guidance to the City of Seattle and other municipalities navigating the complex policy, operational, technical, organizational, and ethical standards that support privacy-protective open data programs.
  • National Institute of Standards and Technology, NISTIR 8053: De-Identification of Personal Data (October 2015). (http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf) This document summarizes roughly two decades of de-identification research, discusses current practices, and presents opportunities for future research.
  • National Institute of Standards and Technology, (2^nd draft) NIST SP 800-188: De-Identifying Government Datasets (December 2016). (http://csrc.nist.gov/publications/drafts/800-188/sp800_188_draft.pdf)  This document provides specific guidance to government agencies that wish to use de-identification.
  • Harvard Berkman Klein Center for Internet and Society, Open Data Privacy Playbook (February 2017). (https://cyber.harvard.edu/publications/2017/02/opendataprivacyplaybook) This document codifies responsible privacy-protective approaches and processes that could be adopted by cities and other government organizations that are publicly releasing data.
  • Harvard Berkman Klein Center for Internet and Society, Towards a Modern Approach to Privacy-Aware Government Data Releases (May 2016). (https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2779266) This article proposes a framework for a modern privacy analysis informed by recent advances in data privacy from disciplines such as computer science, statistics, and law. This article sketches the contours of this analytical framework, populates selected portions of its contents, and illustrates how it can inform the selection of privacy controls by discussing its application to two real-world examples of government data releases.
• Digital Signs
  • A coalition of consumer and privacy groups, Digital Signage Privacy Principles: Critical Policies and Practices for Digital Signage Networks (February 2010). (http://www.worldprivacyforum.org/wp-content/uploads/2012/01/DigitalSignage-principlesfs.pdf) This document lays baseline consumer privacy principles to be included in digital signage networks. Endorsing organizations include World Privacy Forum, Center for Digital Democracy, Consumer Action, Consumer Federation of America, Patient Privacy Rights, Privacy Activism, Privacy Lives and Privacy Rights Clearinghouse.
  • Center for Democracy and Technology, A Framework for Digital Signage Privacy (March 2010). (https://www.cdt.org/files/pdfs/A_Framework_for_Digital_Signage_Privacy-Center_for_Democracy_and_Technology-March_2010.pdf) This page contains a brief introduction of digital signage and a set of applicable privacy standards based on Fair Information Practices.
  • Digital Signage Federation, Digital Signage Privacy Standards (February 2011)(http://www.digitalsignagefederation.org/wp-content/uploads/2017/02/DSF-Digital-Signage-Privacy-Standards-02-2011-3.pdf) This document presents industry standards for electronic digital signage privacy. These standards are designed to safeguard consumer privacy and preserve the public’s trust in the electronic digital signage industry. The voluntary privacy guidelines cover transparency, individual participation, purpose specification, data minimization, use limitation, data quality and integrity, security, and accountability.
  • World Privacy Forum, The One-Way-Mirror Society: Privacy Implications of the New Digital Signage Networks (January 2010). (http://www.worldprivacyforum.org/wp-content/uploads/2013/01/onewaymirrorsocietyfs.pdf) This report discusses consumer surveillance occurring in retail and other spaces, and some preliminary recommendations. The Point of Purchase Advertising International (POPAI) Recommended Code of Conduct for Consumer Tracking Methods is appended.
• Drones/Unmanned Aircraft Systems (UAS)
  • Article 29 Data Protection Working Party, Opinion 01/2015 on Privacy and Data Protection Issues relating to the Utilisation of Drones (June 2015). (http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2015/wp231_en.pdf) This opinion addresses privacy issues related to UAS operations and discusses basic principles that must be followed when collecting personal data by means of UAS. It also provides recommendations to policymakers, legislators, and UAS manufacturers and operators.
  • Center for Democracy and Technology, Model Privacy Best Practices for Unmanned Aircraft (December 2015). (https://cdt.org/files/2015/12/Model-Privacy-Best-Practices-for-Unmanned-Aircraft-Center-for-Democracy-Technology-121515.pdf) These best practices are voluntary in nature and may be employed by UAS operators to enhance UAS privacy, transparency and accountability for the commercial and non-commercial use of UAS. These Best Practices are generally informed by the Consumer Privacy Bill of Rights, including recommendations on transparency, respect for context, focused collection, individual control, security, accountability, and access and accuracy.
  • Congressional Research Service, Domestic Drones and Privacy: A Primer (March 2015) (https://fas.org/sgp/crs/misc/R43965.pdf). This report provides a primer on privacy issues related to various UAS operations, both public and private, including an overview of current UAS uses, the privacy interests implicated by these operations, and various potential approaches to UAS privacy regulation.
  • Future of Privacy Forum, Intel, and Precision Hawk, Drones and Privacy by Design: Embedding Privacy Enhancing Technology in Unmanned Aircraft (August 2016). (https://fpf.org/wp-content/uploads/2016/08/Drones_and_Privacy_by_Design_FPF_Intel_PrecisionHawk.pdf) The document provides examples of how UAS designers, manufacturers, and operators can strengthen privacy protections and build consumer trust with the help of Privacy-by-Design Principles.
  • National Telecommunications and Information Administration, Voluntary Best Practices for UAS Privacy, Transparency, and Accountability: Consensus, Stakeholder-Drafted Best Practices Created in the NTIA-Convened Multistakeholder Process (May 2016). (https://fpf.org/wp-content/uploads/2016/06/UAS_Privacy_Best_Practices_6-21-16.pdf) These Voluntary Best Practices are the result of multi-stakeholder engagement process led by the NTIA. UAS operators may utilize these best practices to advance UAS privacy, transparency, and accountability for commercial and non-commercial uses of UAS. These best practices urge UAS operators to take reasonable, practical steps to safeguard personal data.
  • The White House, Presidential Memorandum: Promoting Economic Competitiveness While Safeguarding Privacy, Civil Rights, and Civil Liberties in Domestic Use of Unmanned Aircraft Systems (February 2015). (https://obamawhitehouse.archives.gov/the-press-office/2015/02/15/presidential-memorandum-promoting-economic-competitiveness-while-safegua) This Presidential Memorandum directs federal agencies to develop policies to mitigate privacy concerns in UAS operations and requires the development of best practices through a multistakeholder engagement process.
  • U.S. Department of Homeland Security, Best Practices for Protecting Privacy, Civil Rights & Civil Liberties in Unmanned Aircraft Systems Programs (December 2015). (https://www.dhs.gov/sites/default/files/publications/UAS%20Best%20Practices.pdf) These best practices reflects DHS’s approach to safeguarding privacy, civil rights, and civil liberties during the use of UAS. This guidance is intended for first responders and does not seek to provide guidance in regard to investigative use of unmanned aircraft systems.
  • U.S. Department of Justice, Policy Guidance: Domestic Use of Unmanned Aircraft Systems (May 2015). (https://www.justice.gov/file/441266/download) The document provides internal guidance intended to help the Department of Justice operate UAS in a privacy-protective manner.
  • U.S. Department of Transportation, Departmental Unmanned Aircraft Systems Privacy Policy (September 2014). (https://www.transportation.gov/sites/dot.gov/files/docs/UAS%20Privacy%20Policy.pdf) This privacy policy offers guidance to ensure that any UAS operations conducted by the Department of Transportation comply with relevant law and regulations and do not infringe upon citizens’ privacy rights.
• Environmental Sensors
  • Lukasz Olejnik, Report on Sensor APIs: privacy and transparency perspective (April 2016).(http://lukaszolejnik.com/SensorsPrivacyReport.pdf) This document analyzes possible privacy issues in relation to existing and proposed browser sensor/device APIs, and provides recommendations in line with the principles of minimization, user awareness, and consent.
  • Sabrina De Capitani di Vimercati, Angelo Genovese, Giovanni Livraga, Vincenzo Piuri and Fabio Scotti, Privacy and Security in Environmental Monitoring Systems: Issues and Solutions, Satellite Telecommunications (ESTEL) (2013). (https://www.academia.edu/14333356/Privacy_and_Security_in_Environmental_Monitoring_Systems) This article discusses how privacy risks arise when sensitive information may be inferred from the collection of environmental data, both directly and indirectly. This article includes an overview of the systems and architectures used for environmental monitoring and possible countermeasures for mitigating security and privacy risks from a relatively technical perspective.
• Facial Recognition
  • Article 29 Data Protection Working Party, Opinion 02/2012 on Facial Recognition in Online and Mobile Services (March 2012). (http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2012/wp192_en.pdf) This opinion includes recommendations applicable to facial recognition technology when used in the context of online and mobile services.
  • Federal Trade Commission, Facing Facts: Best Practices for Common Uses of Facial Recognition Technologies (October 2012). (https://www.ftc.gov/sites/default/files/documents/reports/facing-facts-best-practices-common-uses-facial-recognition-technologies/121022facialtechrpt.pdf) This report provides guidance for commercial uses of facial recognition technologies. The reports recommends that companies implement privacy by design principles, provide consumers with simplified choices, increase transparency, and obtain consumers’ prior affirmative express consent in certain situations.
  • National Telecommunications and Information Administration, Privacy Best Practice Recommendations for Commercial Facial Recognition Use (June 2016). (https://www.ntia.doc.gov/files/ntia/publications/privacy_best_practices_recommendations_for_commercial_use_of_facial_recogntion.pdf) These best practices are the work product of a multistakeholder process convened by the NTIA. They are intended to serve as general guidelines for commercial use of facial recognition technologies.
  • Nlets – the International Justice and Public Safety Network, Privacy Impact Assessment Report for the Utilization of Facial Recognition Technologies to Identify Subjects in the Field (June 2011). (https://www.eff.org/files/2013/11/07/09_-_facial_recognition_pia_report_final_v2_2.pdf) This report addresses how law enforcement agencies’ utilization of facial recognition technologies in the field can impact the public’s reasonable expectation of privacy and makes recommendations for the development of policies and procedures intended to guide departments of motor vehicles’ and law enforcement agencies’ appropriate use of facial recognition technologies in the field.
  • Office of the Privacy Commissioner of Canada, Data at Your Fingertips: Biometrics and the Challenges to Privacy (February 2011). (https://www.priv.gc.ca/en/privacy-topics/health-genetic-and-other-body-information/gd_bio_201102/) This document describes some privacy implications raised by biometric technologies, including facial recognition technology, as well as measures to mitigate the risks.
  • U.S. Government Accountability Office, Facial Recognition Technology: Commercial Uses, Privacy Issues, and Applicable Federal Law (July 2015). (http://www.gao.gov/assets/680/671764.pdf) This report examines privacy issue that have been raised by the use of facial recognition technology in commercial settings, as well as proposed best practices and industry privacy policies. GAO makes no recommendations in this report. However, GAO suggested in Consumer Privacy Framework Needs to Reflect Changes in Technology and the Marketplace (GAO-13-663) that Congress consider strengthening the consumer privacy framework to reflect changes in technology and the marketplace.
• Gunshot Detectors
  • Jay Stanley, Gunshot Detectors: the ACLU’s View (May 2012). (https://www.aclu.org/blog/gunshot-detectors-aclus-view) This article discusses the privacy issues involved with the deployment of gunshot detectors.
  • Jay Stanley, Shotspotter CEO Answers Questions on Gunshot Detectors in Cities (May 2015). (https://www.aclu.org/blog/free-future/shotspotter-ceo-answers-questions-gunshot-detectors-cities) In this article, a ACLU Senior Policy Analyst talks with the CEO of Shotspotter, and discusses how the gunshot detector works, what privacy protections are in place, and what residual privacy risks still raise concern.
• Location Services
  • Beacons
  • Future of Privacy Forum, Understanding Beacons: A Guide to Beacon Technologies (December 2014). (https://fpf.org/wp-content/uploads/2021/05/Guide_To_Beacons_Final.pdf) This short document answers basic questions about how Bluetooth Low Energy beacons work, as well as their capabilities and limitations.
  • Groupe Speciale Mobile Association, A Guide to Bluetooth Beacons (September 2014). (http://www.gsma.com/digitalcommerce/wp-content/uploads/2013/10/A-guide-to-BLE-beacons-FINAL-18-Sept-14.pdf) This paper is a guide to Bluetooth low energy beacons and their potential role in the retail, hospitality, transport, healthcare, entertainment, and banking sectors.
  • Mobile Location Analytics
  • Future of Privacy Forum, Mobile Location Analytics Code of Conduct (2013). (https://fpf.org/wp-content/uploads/10.22.13-FINAL-MLA-Code.pdf) This MLA Code of Conduct is an enforceable, self-regulatory framework for the services provided to venues by MLA Companies. It puts data protection standards in place to ensure that MLA technology is used responsibly.
  • Information and Privacy Commissioner of Ontario and Aislelabs, Building Privacy into Mobile Location Analytics (MLA) Through Privacy by Design, (March 2014). (https://www.ftc.gov/system/files/documents/public_comments/2014/03/00002-88948.pdf) This paper identifies privacy risks associated with MLA technologies and introduces Privacy by Design principles that allow consumer privacy and retail analytics to co-exist.
  • Marius Gassen and Hervais Simo Fhom, Towards Privacy-preserving Mobile Location Analytics, Published in the Workshop Proceedings of the EDBT/ICDT 2016 Joint Conference (2016). (http://ceur-ws.org/Vol-1558/paper31.pdf) This paper discusses embedding privacy and data protection into MLA technology. It argues for a holistic and user-centered approach enabling individuals whose data are collected and processed by MLA services to be aware of and understand the associated data flows, the resulting privacy risks and appropriate options to restrict the access to and usage of their data.
  • General
  • American Civil Liberties Union of Northern California, Location-Based Services: Time for a Privacy Check-in (November 2010). (https://www.aclunc.org/sites/default/files/asset_upload_file183_9627.pdf) This paper examines the state of legal and technical privacy protections for users of location-based services and explores opportunities for consumers, businesses, and policymakers to work together to update and enhance these protections.
  • Information and Privacy Commissioner of Ontario and BeringMedia, Redesigning IP Geolocation: Privacy by Design and Online Targeted Advertising (October 2010). (https://www.ipc.on.ca/wp-content/uploads/Resources/pbd-ip-geo.pdf) This paper advocates Privacy by Design principles to both serve of relevant ads and maintain Web users’ privacy.
  • CTIA – The Wireless Association, Best Practices and Guidelines for Location-Based Services (April 2008). (http://files.ctia.org/pdf/CTIA_LBS_BestPracticesandGuidelines_04_08.pdf) These Best Practices and Guidelines are applicable to all Location-Based Services providers to help promote and protect user privacy. To achieve this goal, the Guidelines rely on two fundamental principles: user notice and consent.
  • Committee on Energy and Commerce, The Collection and Use of Location Information for Commercial Purposes (February 2010). (https://www.gpo.gov/fdsys/pkg/CHRG-111hhrg76010/pdf/CHRG-111hhrg76010.pdf)  This hearing by the House of Representatives Subcommittee on Commerce, Trade, and Consumer Protection and the Subcommittee on Communications, Technology, and the Internet held examined privacy and other issues related to the commercial collection, use, and sharing of location-based information.
  • Department of Spatial Information Science and Engineering and National Center for Geographic Information and Analysis, Protecting Personal Privacy in Using Geographic Information Systems, Photogrammetric Engineering and Remote Sensing LX(9), 1083-1095 (1994). (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.9.7523&rep=rep1&type=pdf) This article discusses practices and trends in the collection, maintenance, and dissemination of personal information by government and industry through Geographic Information Systems and related technologies. The article recommends privacy protection guidelines and principles to be implemented by the GIS community.
  • Digital Advertising Alliance, Application of Self-Regulatory Principles to the Mobile Environment (July 2013). (http://www.mmaglobal.com/files/whitepapers/DAA_Mobile_Guidance.pdf) This guidance explains for covered companies how the existing Digital Advertising Alliance Self-Regulatory Principles for Online Behavioral Advertising and MultiSite Data apply to certain types of data in the mobile Web site and application environment. Section IV of this guidance explains the application of the Principles to Precise Location Data – data obtained from a device about the physical location of the device that is sufficiently precise to locate a specific individual or device.
  • European Commission, Guidelines for Public Administrations on Location Privacy (2016). (https://joinup.ec.europa.eu/sites/default/files/jrc103110_1-dc246-d3.2_eulf_guideline_on_location_privacy_v1.00_final_-_pubsy.pdf) This guide outlines the key obligations that public administrations should comply with when handling personal location data and raises awareness about the importance of location data privacy. It does so by guiding the reader through concrete scenarios that public administrations might face when processing personal location data and provides a set of practical recommendations that can help ensure the adequate protection of personal location data.
  • Heather Burns, Legal Guidelines for the Use of Location Data on the Web (March 2016). (https://www.smashingmagazine.com/2016/03/location-data-web-development-and-the-law/) This article provides guidance on how to build a healthy workflow for developing with location data by using best practice frameworks, providing users with privacy-friendly options, coding to development guidelines and working with an insightful regard for the law.
  • Internet Engineering Task Force, Geopriv Requirements (February 2004). (https://datatracker.ietf.org/doc/rfc3693/?include_text=1) This document is a work product of IETF Geographic Location/Privacy (Geopriv) Working Group. This document focuses on the authorization, security, and privacy requirements for location-dependent services.
  • Location Forum, Location Data Privacy: Guidelines, Assessment & Recommendations (May 2013). (https://iapp.org/media/pdf/resource_center/LocationDataPrivacyGuidelines_v2.pdf) These Guidelines developed to bring attention to critical issues, and provide a framework for developers, managers, marketers, and executives to follow.
  • Matt Duckham and Lars Kulik (University of Melbourne, Australia), Location Privacy and Location-Aware Computing (2006). (http://www.geosensor.net/papers/duckham06.IGIS.pdf) This article explores the different concepts of privacy and their relevant to location-aware computing and mobile GIS, and examines four classes of privacy protection strategy: regulatory, privacy policies, anonymity, and obfuscation strategies.
  • Network Advertising Initiative, NAI Code of Conduct (2015). https://www.networkadvertising.org/sites/default/files/NAI_Code15encr.pdf This self-regulatory code of conduct describes the substantive obligations of NAI members with regard to privacy and online advertising, including precise location data.
  • K. Information Commissioner’s Office, Wi-Fi Location Analytics (February 2016). (https://ico.org.uk/media/1560691/wi-fi-location-analytics-guidance.pdf) This guidance explains how organizations can use location analytics information collected via Wi-Fi in a manner that that complies with the Data Protection Act 1998.  The guidance applies to all operators of Wi-Fi networks.
• Mobile Apps
  • Electronic Frontier Foundation, Mobile User Privacy Bill of Rights (March 2012). (https://www.eff.org/deeplinks/2012/03/best-practices-respect-mobile-user-bill-rights) This guide of best practices pulls from documents like EFF’s Bill of Privacy Rights for Social Network Users and the White House white paper Consumer Data Privacy in a Networked World to set a baseline for what mobile industry players must do to respect user privacy.
  • Federal Trade Commission, Mobile Apps for Kids: Current Privacy Disclosure are Disappointing (February 2012). (https://www.ftc.gov/sites/default/files/documents/reports/mobile-apps-kids-current-privacy-disclosures-are-disappointing/120216mobile_apps_kids.pdf) This report offers recommendations to app stores, developers, and third parties providing services for apps offered to children.
  • Future of Privacy Forum and Center for Democracy and Technology, Best Practices for Mobile Application Developers (July 2012). (https://fpf.org/wp-content/uploads/2021/05/Best-Practices-for-Mobile-App-Developers_Final.pdf) These guidelines serve as a road map for mobile app developers to build privacy into apps, better inform and empower end-users, and foster trust and confidence in the mobile app ecosystem. Many guidelines are based on the Fair Information Practice Principles.
  • Future of Privacy Forum, Best Practices for Consumer Wearables and Wellness Apps and Devices (August 2016). https://fpf.org/wp-content/uploads/2016/08/FPF-Best-Practices-for-Wearables-and-Wellness-Apps-and-Devices-Final.pdf This document sets forth a detailed set of guidelines that responsible companies can follow to ensure they provide practical privacy protections for consumer-generated health and wellness data.
  • Groupe Speciale Mobile Association, Mobile Privacy Principles: Promoting Consumer Privacy in the Mobile Ecosystem (January 2011). (http://www.gsma.com/publicpolicy/wp-content/uploads/2016/02/GSMA2016_Guidelines_Mobile_Privacy_Principles.pdf) These principles were developed in 2011 and describe the way in which mobile consumers’ privacy should be respected and protected when consumers use mobile applications and services that access, use or collect their personal information.
  • Groupe Speciale Mobile Association, Privacy Design Guidelines for Mobile Application Development (February 2012). (http://www.gsma.com/publicpolicy/wp-content/uploads/2012/03/gsmaprivacydesignguidelinesformobileapplicationdevelopmentv1.pdf) These guidelines adopt a Privacy by Design approach. They are intended to help ensure that mobile applications are developed in ways that respect and protect the privacy of users and their personal information. Examples are provided with each guideline.
  • Lookout, Mobile App Advertising Guidelines: A Framework for Encouraging Innovation While Protecting User Privacy (June 2012). (https://www.mylookout.com/img/images/lookout-mobile-app-advertising-guidelines.pdf) These Mobile Ad Guidelines cover requirements and best practices around the transparency and clarity of data collection, individual control over information collected, ad delivery and display behavior, collection and retention of personal or device-specific data, and secure transport of sensitive data.
  • Mobile Marketing Association, Mobile Application Privacy Policy Framework (January 2012). (http://www.mmaglobal.com/whitepaper-request?filename=MMA_Mobile_Application_Privacy_Policy_15Dec2011PC_Update_FINAL.pdf) These privacy guidelines for app developers outline best practices and provide sample language for privacy policies.
  • National Telecommunications and Information Administration, Short Form Notice Code of Conduct to Promote Transparency in Mobile App Practices (July 2013). (https://www.ntia.doc.gov/files/ntia/publications/july_25_code_draft.pdf) This voluntary Code of Conduct for mobile application short notices was developed through the Multi-Stakeholder Process on Application Transparency convened by the United States Department of Commerce. The purpose of the short form notices is to provide consumers enhanced transparency about the data collection and sharing practices of apps that consumers use.
  • Network Advertising Initiative, 2015 Update to the NAI Mobile Applications Code (2015). (https://www.networkadvertising.org/mobile/NAI_Mobile_Application_Code.pdf) This update NAI Mobile Applications Code reflects changed in NAI’s Code of Conduct and applicable to mobile app ecosystem. The Mobile Applications Code’s requirements inform both consumers and businesses that NAI members implement, honor, and maintain high standards for cross-app data collection.
  • Office of the Australian Information Commissioner, Mobile: A Better Practice Guide for Mobile App Developers (September 2014). (https://www.oaic.gov.au/resources/agencies-and-organisations/guides/guide-for-mobile-app-developers.pdf)  This guide helps mobile device application developers embed better privacy practices in their products and services, and helps developers that are operating in the Australian market to comply with Australian privacy law and best practice.
  • Office of the Information and Privacy Commissioner of Ontario, The Roadmap for Privacy by Design in Mobile Communications: A Practical Tool for Developers, Service Providers, and Users (December 2010). (https://www.ipc.on.ca/wp-content/uploads/Resources/pbd-asu-mobile.pdf) This document provides guidance for building privacy into your app as you develop it.
  • Office of the Privacy Commissioner for Personal Data (Hong Kong), Best Practice Guide for Mobile App Development (2015). (https://www.pcpd.org.hk//english/resources_centre/publications/files/Best_Practice_Guide_for_Mobile_App_Development_20151103.pdf) This bilingual guide aims to provide comprehensive, step-by-step practical guidance to those who are in the mobile applications development business.
  • Office of the Privacy Commissioner of Canada and Offices of the Information and Privacy Commissioner of Alberta and British Columbia, Seizing Opportunity: Good Privacy Practices for Developing Mobile Apps (October 2012). (https://www.oipc.bc.ca/guidance-documents/1426) These best practices provide guidance when designing and developing mobile apps. The regulators recommend short privacy notice layer using graphics and images.
  • W3C, Web Application Privacy Best Practices (July 2012). (https://www.w3.org/TR/2012/NOTE-app-privacy-bp-20120703/#usercentric) This document describes privacy best practices for web applications, including those that might use device APIs.
  • K. Information Commissioner’s Office, Privacy in Mobile Apps: Guidance for App Developers (December 2013). (https://ico.org.uk/media/for-organisations/documents/1596/privacy-in-mobile-apps-dp-guidance.pdf) This guidance helps mobile application developers comply with the Data Protection Act 1998 and ensure users’ privacy.
• Public Broadband
  • New York Civil Liberties Union, City’s Public Wi-Fi Raises Privacy Concerns (March 2016). (https://www.nyclu.org/en/press-releases/nyclu-citys-public-wi-fi-raises-privacy-concerns) This article expresses the NYCLU’s privacy concerns regarding a New York City program that aimed to bring free, fast wireless service to citizens through 7,500 to 10,000 public kiosks.
  • Ningning Cheng, Xinlei (Oscar) Wang, Wei Cheng, Prasant Mohapatra, Aruna Seneviratne, Characterizing Privacy Leakage of Public WiFi Networks for Users on Travel (2013). (http://qurinet.ucdavis.edu/pubs/conf/Ningning_INFOCOM13.pdf) This technology paper examines the privacy leakage in public hotspots. The authors collect and analyze real data from 20 airport datasets in four countries and propose several simple strategies for reducing privacy leakage.
  • Privacy Special Interest Group, Privacy in WiFi Analytics (December 2015). (http://www.privacysig.org/uploads/3/0/1/4/30147215/privacyinwifianalytics.pdf) This white paper discusses the privacy impact on consumers in WiFi tracking: analyzing visitor crowds by collecting WiFi signals of smartphones. The white paper includes some solutions to mitigate privacy risks.
• Radio Frequency Identification (RFID)
  • American Library Association, RFID in Libraries: Privacy and Confidentiality Guidelines (June 2006). (http://www.ala.org/advocacy/intfreedom/statementspols/otherpolicies/rfidguidelines)  This report presents policy guidelines and best practices for RFID in libraries, including considering selecting an “opt-in” system that allows library users who do not wish to use or carry an RFID-enabled borrower card to choose an alternative method to borrow materials. This document also provides some suggestions to librarians when dealing with vendors.
  • Article 29 Data Protection Working Party, Working Document on Data Protection Issues Related to RFID Technology (January 2005). (http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp105_en.pdf)  This paper examines the application of RFID technology and presents guidance to multiple stakeholders for adhere to privacy-protective principles under the Data Protection Directive.
  • Australia Law Reform Commission, Impact of Developing Technology on Privacy: Radio Frequency Identification (August 2008). (http://www.alrc.gov.au/publications/9.%20Overview%3A%20Impact%20of%20Developing%20Technology%20on%20Privacy/radio-frequency-identification) This report gives a brief introduction of RFID technology and lists some proposed privacy protections.
  • Center for Democracy and Technology, Privacy Best Practices for Deployment of RFID Technology (November 2008). (https://cdt.org/insight/privacy-best-practices-for-deployment-of-rfid-technology/) This article outlines three general principles (technology neutrality, privacy and security as primary design requirements, and consumer transparency) and guidelines targeted at commercial and private sector to address privacy concerns arising from RFID.
  • Commission of the European Communities, Commission Recommendation on the Implementation of Privacy and Data Protection Principles in Application Supported by Radio-Frequency Identification (May 2009). (http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ%3AL%3A2009%3A122%3A0047%3A0051%3AEN%3APDF) This Commission Recommendation applies the principles of Data Privacy Directive and of the e-Privacy Directive to RFID technology.
  • Consumers Against Supermarket Privacy Invasion and Numbering, Electronic Privacy Information Center, and Privacy Rights Clearinghouse, Position Paper on the Use of RFID in Schools (August 2012). (http://www.spychips.com/school/RFIDSchoolPositionPaper.pdf) This Position Paper identifies threats of using RFID technology to privacy and civil liberties in schools and proposes a three-part framework for mitigating privacy concerns.
  • Department of Homeland Security, RFID Security and Privacy White Paper (An Attachment to US-VISIT Increment 2C RFID Feasibility Study Final Report) (January 2005). (https://www.dhs.gov/xlibrary/assets/foia/US-VISIT_RFIDattachE.pdf) This white paper proposed several privacy protection strategies, including the implementation of Fair Information Practices, care in assignment of a-ID numbers, and providing visitors with information about physical shielding of RFID-enabled documents.
  • Federal Trade Commission, Radio Frequency Identification: Applications and Implications for Consumers (March 2005). (https://www.ftc.gov/sites/default/files/documents/reports/rfid-radio-frequency-identification-applications-and-implications-consumers-workshop-report-staff/050308rfidrpt.pdf) This report gives an overview of the applications of RFID technology and discusses their consumer privacy implications. The report concludes with best practices and principles to address privacy concerns.
  • Information and Privacy Commissioner of Ontario, Privacy Guidelines for RFID Information Systems (June 2006). (https://www.ipc.on.ca/wp-content/uploads/Resources/rfid-guides&tips.pdf) This document provides guidance to organizations that deploy RFID technology with consumer-facing implications and contains practical tips for implementing such guidance.
  • International Chamber of Commerce, ICC Principles for Responsible Deployment and Operation of Electronic Product Codes (March 2005). (http://www.codescentre.com/media/1342/6rev8_final_epc_principles.pdf) This document highlights that the Electronic Product Code (EPC), enabled by RFID, has great impact on consumer privacy and serves as a guidance to promote responsible deployment and operation of EPC that are compliant with legal requirements and business ethics.
  • National Conference of State Legislation, Radio Frequency Identification (RFID) Privacy Laws (December 2016). (http://www.ncsl.org/research/telecommunications-and-information-technology/radio-frequency-identification-rfid-privacy-laws.aspx) This site lists state privacy statutes regulating RFID for comparative purposes.
  • National Institute of Standards and Technology, Guidelines for Securing Radio Frequency Identification (RFID) Systems (April 2007). (http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-98.pdf) These guidelines address concerns that the implementation of RFID technology may impose various risks upon data security and personal privacy and provide recommended practices to mitigate these risks.
  • Organisation for Economic Co-operation and Development, OECD Policy Guidance on Radio Frequency Identification (June 2008). (http://www.oecd.org/sti/ieconomy/40892347.pdf) This document provides governments, manufactures, standardization bodies, and other stakeholders with policy and practical guidance to enhance privacy protection with the growing usage of RFID technology.
• Smart Cards/Payment
  • Australia Department of Finance and Deregulation, National Smartcard Framework: Smartcard Project Design Guide (December 2008). (http://www.finance.gov.au/sites/default/files/smartcard-project-design-guide.pdf) This National Smartcard Framework aims to facilitate the adoption of a consistent approach to the implementation of smartcard technology by agencies in all levels of government in Australia. This document is intended to serve as guidance at the project management level in important areas such as privacy, security, and technology selection.
  • Australia Law Reform Commission, Impact of Developing Technology on Privacy: Smart Cards (August 2008). (http://www.alrc.gov.au/publications/9.%20Overview%3A%20Impact%20of%20Developing%20Technology%20on%20Privacy/smart-cards) This report introduces smart card technology and explores relevant privacy risks, as well as the Australian legal framework.
  • Council of Europe, Guiding Principles for the Protection of Personal Data with Regard to Smart Cards (May 2004). (https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016806840bb) These guiding principles address data protection issues arising with respect to the use of smart cards. The guiding principles are primarily aimed at the issuer of the card, who holds primary responsibility for the protection of personal data contained on the card. They are also directed at all other participants involved in information systems.
  • General Accounting Office, Electronic Government: Progress in Promoting Adoption of Smart Card Technology (January 2003). (http://www.gao.gov/new.items/d03144.pdf) Smart cards offer a range of potential uses for the federal government, particularly in increasing security for its many physical and information assets. GAO was asked to review the use of smart cards across the federal government and identify potential challenges. One of the substantial challenges is to maintain the security of smart card system and privacy of personal information.
  • Interoperable Fare Management Project, European Handbook on Rules and Regulations for Privacy Protection in Fare Devices and Back-Offices (March 2010). (http://www.smart-ticketing.org/downloads/ifm-project/D2.3_201003.pdf) This project proposes a privacy model to address traveler’s personal data protection issues in e-ticketing system.
  • Smart Card Alliance (Now: Secure Technology Alliance), Best Practices for the Use of RF-Enabled Technology in Identity Management (January 2007). (https://www.library.ca.gov/crb/rfidap/docs/SCA-RF_Technology_Best_Practices.pdf)  These best practice guidelines for use of radio frequency (RF)-enabled technology for identity management. Regarding personal privacy protection, the best practices cover notice, disclosure and ability for redress.
  • Smart Card Alliance (Now: Secure Technology Alliance), HIPAA Compliance and Smart Cards: Solutions to Privacy and Security Requirements (September 2003). (http://cab.org.in/ICTPortal/Lists/Knowledge%20Bank/Attachments/39/HIPAA_Compliance_and_Smart_Cards_FINAL_23_12_2007.pdf) This white paper describes how smart cards can be used to meet the security and privacy requirements of the Health Insurance Portability and Accountability Act of 1996. The white paper also includes profiles of some smart health card implementations and outlines key success factors.
  • Smart Card Alliance (Now: Secure Technology Alliance), Privacy and Secure Identification Systems: The Role of Smart Cards as a Privacy-Enabling Technology (February 2003). (https://www.securetechalliance.org/resources/lib/Privacy_White_Paper.pdf) This white paper introduces how smart cards can provide a privacy-enabling technology for different ID systems, how they interact with other system components, and how smart cards can address the growing problem of identity theft. The paper recommends key guidelines for business practices and system designs that can help protect privacy.
  • Paul Stephen Dempsey, Privacy Issues with the Use of Smart Cards (April 2008). (http://www.tcrponline.org/PDFDocuments/TCRP_LRD_25.pdf) This digest examines basic privacy issues associated with acquisition and storage of financial and trip data and offers recommendations.
• Smart Grid
  • Information and Privacy Commissioner of Ontario and Future of Privacy Forum, Privacy by Design and Third Party Access to Customer Energy Usage Data (January 2013). (https://www.ipc.on.ca/wp-content/uploads/Resources/pbd-thirdparty-CEUD.pdf) This paper explores at a high level the issue of third party access to customer energy usage data, as well as the potential privacy risks. Privacy by Design is described and examples of proactive approaches to privacy already underway, in the context of third party access to customer energy usage data, are detailed.
  • Department of Energy, Data Access and Privacy Issues Related to Smart Grid Technologies (September 2010). (https://www.smartgrid.gov/document/data_access_and_privacy_issues_related_smart_grid_technologies.html) This report summarizes DOE’ findings regarding data-privacy and data-security issues raised by Smart Grid technologies like advanced metering..
  • Department of Energy, Data Privacy and the Smart Grid: A Voluntary Code of Conduct (January 2015). (https://www.dataguardprivacyprogram.org/downloads/DataGuard_VCC_Concepts_and_Principles_2015_01_08_FINAL.pdf)  This voluntary code of conduct is intended to address privacy issues related to data enabled by smart grid technologies. It is facilitated by the United States Department of Energy’s Office of Electricity Delivery and Energy Reliability and the Federal Smart Grid Task Force and intended to be applicable to, and voluntarily adopted by, both utilities and third parties.
  • Future of Privacy Forum and Information and Privacy Commissioner of Ontario, SmartPrivacy for the Smart Grid: Embedding Privacy into the Design of Electricity Conservation (November 2009). (https://www.smartgrid.gov/files/SmartPrivacy_for_Smart_Grid_Embedding_Privacy_into_Design_El_200909.pdf) This paper explores how the nature of utilities as power providers will shift due to the large amounts of personal information they will be collecting from consumers because of advancements in the Smart Grid, such as the installation of smart meters and the use of smart appliances by households. The paper focuses on ensuring consumers’ confidence and trust by Privacy by Design principle.
  • Future of Privacy Forum and TRUSTe, TRUSTed Smart Grid Certification Standards (July 2016). (https://www.truste.com/privacy-certification-standards/trusted-smart-grid/) This Smart Grid Privacy Program helps companies certify their data collection and usage practices using a standard based on Smart Grid Guidelines developed by the Future of Privacy Forum and TRUSTe’s core values of transparency, choice, and accountability.
  • GridWise Alliance, Policy Position on Data Access & Privacy Issues (August 2011). (https://www.smartgrid.gov/document/gridwise_alliance_policy_position_data_access_privacy_issues.html) This fact sheet describes how the Gridwise Alliance recommends that privacy concerns for energy use data be addressed by the application of Fair Information Practice Principles and by encouraging utilities, service providers, and other interested stakeholders to develop voluntary, enforceable codes to which all will subscribe and abide, based on FIP principles like transparency and choice.
  • Information and Privacy Commissioner of Ontario, Hydro One Networks Inc., and Toronto Hydro Electric System, Privacy by Design: Achieving the Gold Standard in Data Protection for the Smart Grid (June 2010). (https://www.smartgrid.gov/files/Privacy_by_Design_Achieving_Gold_Standard_in_Data_Protection_201006.pdf) This paper puts forward Privacy by Design as the standard to be adopted for Smart Grid implementation, in order to protect data privacy. It will also showcase how Smart Grid programs in Ontario are being built with Privacy by Design as a central guiding design feature.
  • National Conference of State Legislation, States Get Smart: Encouraging and Regulating Smart Grid Technologies (July 2013). (http://www.ncsl.org/research/energy/regulating-and-encouraging-smart-grid-technologies.aspx) This site provides an overview of state action around smart grids. The table for enacted legislation and the table for pending legislation provide a more detailed description of smart grid-related legislation up to 2013.
  • National Institute of Standards and Technology, Guidelines for Smart Grid Cybersecurity: Vol. 2, Privacy and the Smart Grid (March 2013). (https://collaborate.nist.gov/twiki-sggrid/pub/SmartGrid/DraftNISTIR7628Rev1/nistir-7628_vol2_03-14-2013_draft.pdf) This document was developed as a consensus document by a diverse subgroup consisting of representatives from the privacy, electric energy, telecommunications and cyber industry, academia, and government organizations. In addition to a detailed review of the privacy risks and legal framework, this document also provides recommendations for all entities that participate within the smart grid.
  • Vermont Law School, A Model Privacy Policy for Smart Grid Data (August 2014). (http://www-assets.vermontlaw.edu/Assets/iee/Model%20Smart%20Grid%20Privacy%20Policy%208_14_14.pdf) This Model Privacy Policy is intended to serve as a foundation and guidance for utilities develop their own policy to enhance consumers’ confidence in the protection of their personal information.
• Social Network Monitoring
  • Alexandra Mateescu, Douglas Brunton, Alex Rosenblat, Desmond Patton, Zachary Gold and Danah Boyd, Social Media Surveillance and Law Enforcement (October 2015). (http://www.datacivilrights.org/pubs/2015-1027/Social_Media_Surveillance_and_Law_Enforcement.pdf) This article examines the legal questions of social media surveillance, including privacy concerns.
  • Chief Information Officers Council, Privacy Best Practices for Social Media (July 2013). (https://cio.gov/wp-content/uploads/downloads/2013/07/Privacy-Best-Practices-for-Social-Media.pdf) This paper addresses various forms of government use of social media, including monitoring social media sites to enhance situational awareness, and introduces some privacy best practices.
  • Council of American Survey Research Organizations, Social Media Research Guidelines (October 2011). (https://c.ymcdn.com/sites/www.casro.org/resource/resmgr/docs/social_media_research_guidel.pdf) These guidelines describe the social media space and provide contemporary guidance for research organizations, especially with respect to privacy laws and regulations.
  • Office of the Information and Privacy Commissioner for British Columbia, Guidelines for Social Media Background Checks (October 2011). (https://www.oipc.bc.ca/guidance-documents/1454) These guidelines were developed to help organizations and public bodies to comply with privacy laws when conducting social media background checks on future and prospective employees, volunteers and candidates.
  • Victor Bekkers, Arthur Edwards and Dennis de Kool, Social Media Monitoring: Responsive Governance in the Shadow of Surveillance (2013) (https://repub.eur.nl/pub/50340/metis_194130_AAM.pdf) This paper investigates four cases of social media monitoring by Dutch public organizations. The paper argues for more transparency on social media monitoring