1. Limiting Corporations’ Authority to Collect Users’ Information
Corporations should codify sensible limitations on their ability to collect and disclose user data that balance their need for the data in limited circumstances, users’ reasonable privacy interests, and the impact on trust in the Internet. In addition, corporations should limit surveillance to specific, known users for lawful purposes, and should not undertake bulk data collection of Internet communications.
2 Oversight and Accountability
Corporations seeking to collect or compel the production of information should do so under a clear legal framework in which corporations are subject to strong checks and balances. Reviewing courts should be independent and include an adversarial process, and corporations should allow important rulings of law to be made public in a timely manner so that the courts are accountable to an informed citizenry.
3 Transparency About Corporations collecting practices
Transparency is essential to a debate over corporations’ surveillance powers and the scope of programs that are administered under those powers. Corporations should publish the number and nature of collected user information.
4 Respecting the Free Flow of Information
The ability of data to flow or be accessed across borders is essential to a robust 21st century global economy. Corporations should not collect user information in other countries with the intent of circumventing the local laws that limit user data collection.