What You Must Know About DRM

9 A detailed description and definition of each of these principles is included in Appendix A of this paper. Step #2: Develop privacy policies and principles Companies that use DRM can create easily accessible privacy policies either by using an online privacy policy generator 31 or by contracting the services of a reputable third party. Privacy policies should be based on the privacy legislation that applies to personal information collected in a particular jurisdiction, or on fair information practices if no legislation exists. Such policies should be displayed in a prominent place on a company's Web site and should be written in plain language. A privacy policy should explain to consumers: · what personal information is being collected; · why it is being collected; · how it will be used; · who will have access to it; · how long you will retain it; · how you will dispose of it; · who in the organization to contact for more information about the policy. The IPC has published a set of privacy policy best practices, which are available at www.ipc.on.ca/ english/pubpres/if-you/web-priv.htm. Step #3: Undertake an assessment of human and information resources with a focus on personally identifiable data (collection, processing, managing data flows) Companies that sell DRM-protected products should assess how their human resources (i.e., managers, employees) handle the personal information of consumers. In addition, they should conduct an assessment of how their informational resources (i.e., computer hardware and software) are used to collect, store and transmit personal information. The IPC has developed, with the assistance of PricewaterhouseCoopers and Guardent, the freely available Privacy Diagnostic Tool (PDT), 32 which can be used by organizations to gauge their data handling processes against fair information practices. Once the tool's privacy questionnaire has been completed, the PDT generates a report summarizing the strengths and weaknesses of the organiza- tion's data-handling processes and provides suggested remedial next steps. We would recommend that companies develop a specific action plan dealing with issues of employee accountability, privacy awareness and levels of training around DRM.