DirectNic Demands SlicksNetwork.com Hand Over Model IDs

[LadyMischief]

How about we remove all doubt and I just post from the Act itself:

Personal information

Personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as:

* age, name, ID numbers, income, ethnic origin, or blood type;
* opinions, evaluations, comments, social status, or disciplinary actions; and
* employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs)

Personal information does not include the name, title or business address or telephone number of an employee of an organization.

How about the definition of consent with regards to that personal information:
Consent

Voluntary agreement with what is being done or proposed. Consent can be either express or implied. Express consent is given explicitly, either orally or in writing. Express consent is unequivocal and does not require any inference on the part of the organization seeking consent. Implied consent arises where consent may reasonably be inferred from the action or inaction of the individual.

Disclosure

Making personal information available to others outside the organization
Use

Refers to the treatment and handling of personal information within an organization.

That should clear up the "definitions" for you a little.

[LadyMischief]

Here are some of the obligations under PIPA for businesses and organization who collect personal information:

Your responsibilities

* Comply with all 10 of the principles of Schedule 1.
* Appoint an individual (or individuals) to be responsible for your organization's compliance.
* Protect all personal information held by your organization or transferred to a third party for processing.
* Develop and implement personal information policies and practices.

How to fulfil these responsibilities

* Give your designated privacy official senior management support and the authority to intervene on privacy issues relating to any of your organization's operations.
* Communicate the name or title of this individual internally and externally (e.g. on Web sites and in publications).
* Analyze all personal information handling practices including ongoing activities and new initiatives, using the following checklist to ensure that they meet fair information practices:
o What personal information do we collect?
o Why do we collect it?
o How do we collect it?
o What do we use it for?
o Where do we keep it?
o How is it secured?
o Who has access to or uses it?
o To whom is it disclosed?
o When is it disposed of?
* Develop and implement policies and procedures to protect personal information:
o define the purposes of its collection
o obtain consent
o limit its collection, use and disclosure
o ensure information is correct, complete and current
o ensure adequate security measures
o develop or update a retention and destruction timetable
o process access requests
o respond to inquiries and complaints
* Include a privacy protection clause in contracts to guarantee that the third party provides the same level of protection as your organization does.
* Inform and train staff on privacy policies and procedures.
* Make information available explaining these policies and procedures to customers (e.g. in brochures and on Web sites).

When transferring personal information to third parties, ensure that they:

* Name a person to handle all privacy aspects of the contract.
* Limit use of the personal information to the purposes specified to fulfil the contract.
* Limit disclosure of the information to what is authorized by your organization or required by law.
* Refer any people looking for access to their personal information to your organization.
* Return or dispose of the transferred information upon completion of the contract.
* Use appropriate security measures to protect the personal information.
* Allow your organization to audit the third party's compliance with the contract as necessary.

[LadyMischief]

Oh and yet MORE responsibility and liability with regards to personal information:
Your responsibilities

* Before or when any personal information is collected, identify why it is needed and how it will be used.
* Document why the information is collected.
* Inform the individual from whom the information is collected why it is needed.
* Identify any new purpose for the information and obtain the individual's consent before using it.

How to fulfil these responsibilities

* Review your personal information holdings to ensure they are all required for a specific purpose.
* Notify the individual, either orally or in writing, of these purposes.
* Record all identified purposes and obtained consents for easy reference in case an individual requests an account of such information.
* Ensure that these purposes are limited to what a reasonable person would expect under the circumstances.