Residential Data Collection Privacy Issues Susan A Ebersole

Residential Data Collection Privacy Issues Susan A. Ebersole Latham & Watkins LLP November 30, 2016 Latham & Watkins operates worldwide as a limited liability partnership organized under the laws of the State of Delaware (USA) with affiliated limited liability partnerships conducting the practice in the United Kingdom, France, Italy and Singapore and as affiliated partnerships conducting the practice in Hong Kong and Japan. The Law Office of Salman M. Al-Sudairi is Latham & Watkins’ associated office in the Kingdom of Saudi Arabia. © Copyright 2015 Latham & Watkins. All Rights Reserved.

Types of Sensitive Residential Data Collected in the Affordable Housing Context • Financial Information • • • Financial account information (bank account, or lack thereof) Rent payment history Income and employment information *Often required to be collected by Federal housing subsidy regulations, but also used for resident services Health Information • • • Information about mental or physical health status or treatment (ER visits, primary care provider, depression screening) Substance abuse history or treatment information Insurance information

Types of Sensitive Residential Data Collected in the Affordable Housing Context • Education Information • • • Information About Children • • Can also be health or education information Housing Stability Information • • Education level of adults Enrollment in Head. Start or grade advancement for children Turnover rate Households that move and why (eviction, home purchase) Households with lease violations Community Engagement • • Feelings about safety Voter registration

What Laws Might Apply? In most cases, the privacy and security of data is not federally regulated in the context in which it is collected and used in resident services. Rather, a general set of best practices known as Fair Information Practice Principles (FIPPs) apply.

What Laws Might Apply? • Financial Information • • • Potentially regulated by the Fair Credit Reporting Act (FCRA) FCRA promotes accuracy, fairness, and the privacy of personal information assembled by Credit Reporting Agencies (CRAs) Health Information • • Only if individually identifiable (de-identified data does not count, but must be truly de-identified) Federally regulated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), but only if collected by a health care provider or health insurance plan or by a service provider working on behalf of a provider or plan If collected directly from tenants, likely not regulated State medical information privacy laws could apply

What Laws Might Apply? • Education Information • • Information About Children • • The Family Education Rights & Privacy Act (FERPA) protects the privacy of educational records maintained by schools that receive federal funds The Children’s Online Privacy Protection Act (COPPA) protects the privacy of information about children on the internet Housing Stability & Community Engagement Information • This type of information, while personal, is generally not covered by federal regulations

Financial Information Are you using or generating reports of consumer information (such as credit reports)? N o What is financial information? Federal law defines financial information to include information about an individual’s credit worthiness; credit standing; credit capacity; character; general reputation; personal characteristics; or mode of living that serves as a factor in determining eligibility for personal or household credit or insurance, or employment purposes. 15 U. S. C. § 1681 et seq. Yes No federal rules apply The Fair Credit Reporting Act promotes accuracy, fairness, and the privacy of personal information assembled by Credit Reporting Agencies (CRAs). You may only use credit reports for limited permissible purposes, including review of rental applications. If you take an adverse action against a potential tenant or renewing tenant, you must provide the individual with notice that the action was taken pursuant to a credit report. Once you are finished with the credit report, you must securely dispose of the report and any information you gathered from it. Disposal can be by burning, pulverizing, or shredding paper documents and disposing of electronic information so that it can't be read or reconstructed. Consult an attorney. Did you get the information from a Credit Reporting Agency (CRA)? Yes No Do you provide information to any Credit Reporting Agency? Yes The Fair Credit Reporting Act requires information furnishers to provide information that is accurate and complete, and to investigate and resolve disputes about the accuracy of such information. Consult an attorney. No No federal rules apply This quick reference guide is not legal advice. Please consult your lawyer when making decisions about what personal information to collect and how to use, share, and protect that information. Protecting privacy is your responsibility.

Health Information What is health information? Federal law defines health information to include information about past, present or future physical or mental health or condition; the provision of health care; or past, present or future payment for the provision of health care. 42 U. S. C. § 1320 d Are you collecting health information from your tenants? N o Has the information been de-identified? Information that is de-identified does not identify an individual and there is no reasonable basis to believe that the information can be used to identify an individual Yes Did you get the information directly from the individual (or their legal guardian) with their consent? No federal rules apply You are likely covered by federal rules requiring you to sign a business associate agreement with the provider of the information (which is a “covered entity” under the Health Insurance Portability and Accountability Act (“HIPAA”)). Before receiving information you should retain a lawyer to assist with protecting this information. No Yes Retain a lawyer to uncover the source of the information and any legal requirements No Did you get the information from a health plan, health care clearing house, or health care provider, such as a doctor, hospital or clinic? Yes No This quick reference guide is not legal advice. Please consult your lawyer when making decisions about what personal information to collect and how to use, share, and protect that information. Protecting privacy is your responsibility.

Education Information What is education information? Federal law defines education information to include grades and transcripts; class lists and student course schedules; health records at the K-12 level; student financial information at the postsecondary level; and student discipline files. 20 U. S. C. § 1232 g Are you collecting education information from your tenants? N o Yes Did you get the information directly from the individual (or their legal guardian) with their consent? Yes No Did you get the information from a school or school-related program? No federal rules apply Yes Federal law applies to education records maintained by public schools, school districts, local educational agencies, and postsecondary institutions such as colleges and universities that receive funds from programs administered by the U. S. Department of Education. If they share educational information with your organization, they must do so in compliance with the Family Educational Rights and Privacy Act (“FERPA”). You will likely be bound by contract to comply to FERPA’s requirements. You should retain a lawyer before agreeing to receive any educational information from a school or school-related program. No Retain a lawyer to uncover the source of the information and any legal requirements This quick reference guide is not legal advice. Please consult your lawyer when making decisions about what personal information to collect and how to use, share, and protect that information. Protecting privacy is your responsibility.

Information About Children Is your organization a non-profit entity without any for-profit members? Ye s What information about children is protected? Federal law treats children’s information differently when that information is collected online. What information is protected changes over time, but includes the categories listed below. 5 U. S. C. § 6501 Are you operating a website, mobile app, or other online services? No No federal rules apply You may be covered by the Children’s Online Privacy Protection Act (“COPPA”). Central to these requirements is obtaining valid parental consent in advance of any data collection. While there are exceptions and your website, mobile app, or other online service can be designed to comply with these rules, in general, you cannot collect a child’s: full name; home or other physical address, including street name and city; online contact information like an email address that permits someone to contact a person directly; user name where it functions as online contact information; telephone number; Social Security number; a persistent identifier that can be used to recognize a user over time and across different sites, like an IP address; a photo, video, or audio file containing a child’s image or voice; geolocation information sufficient to identify a street name and city; or other information about the child or parent that is collected from the child and is combined with one of these identifiers. No Yes Is there any commercial purpose for the website, mobile app, or other online services? No Yes Does the website, mobile app, or online service collect any information from individuals? No Yes Do you intentionally or knowingly collect information from any individuals under the age of 13? No Yes This quick reference guide is not legal advice. Please consult your lawyer when making decisions about what personal information to collect and how to use, share, and protect that information. Protecting privacy is your responsibility.

Fair Information Practice Principles (FIPPs) Latham & Watkins operates worldwide as a limited liability partnership organized under the laws of the State of Delaware (USA) with affiliated limited liability partnerships conducting the practice in the United Kingdom, France, Italy and Singapore and as affiliated partnerships conducting the practice in Hong Kong and Japan. The Law Office of Salman M. Al-Sudairi is Latham & Watkins’ associated office in the Kingdom of Saudi Arabia. © Copyright 2015 Latham & Watkins. All Rights Reserved.

Fair Information Practice Principles (FIPPs) • • FIPPs are a set of internationally recognized practices for addressing the privacy of information about individuals Began in the 1970 s with a report from the U. S. Department of Health, Education & Welfare, and have since evolved and been adopted by different countries in different forms They provide the underlying policy for many national laws addressing privacy and data protection matters Can be used as a set of “best practices” where sensitive personal data is collected but no legal regime applies

Fair Information Practice Principles (FIPPs) • Transparency: Organizations should be transparent and notify individuals regarding collection, use, dissemination, and maintenance of Personal Data. • Individual Participation: Organizations should involve the individual in the process of using Personal Data and, to the extent practicable, seek individual consent for the collection, use, dissemination, and maintenance of Personal Data. Organizations should also provide mechanisms for appropriate access, correction, and redress regarding use of Personal Data.

FIPPs, continued • • • Purpose Specification: Organizations should specifically articulate the authority that permits the collection of Personal Data and specifically articulate the purpose or purposes for which the Personal Data is intended to be used. Data Minimization: Organizations should only collect Personal Data that is directly relevant and necessary to accomplish the specified purpose(s) and only retain Personal Data for as long as is necessary to fulfill the specified purpose(s). Use Limitation: Organizations should use Personal Data solely for the purpose(s) specified in the notice. Sharing Personal Data should be for a purpose compatible with the purpose for which the Personal Data was collected.

FIPPs, continued • • • Data Quality and Integrity: Organizations should, to the extent practicable, ensure that Personal Data is accurate, relevant, timely, and complete. Security: Organizations should protect Personal Data (in all media) through appropriate security safeguards against risks such as loss, unauthorized access or use, destruction, modification, or unintended or inappropriate disclosure. Accountability and Auditing: Organizations should be accountable for complying with these principles, providing training to all employees and contractors who use Personal Data, and auditing the actual use of Personal Data to demonstrate compliance with these principles and all applicable privacy protection requirements.

What is Personal Data? Typical Federal Trade Commission Definition from consent decree: (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name; (d) a telephone number; (e) a Social Security number; (f) a driver’s license or other state-issued identification number; (g) a financial institution account number; (h) credit or debit card information, including card number, expiration date, and security code; (i) a persistent identifier, such as a customer number held in a “cookie” or processor serial number, that is combined with other available data that identifies an individual consumer; or (j) any information that is combined with any of (a) through (i) above.

Privacy By Design • • • Proactive/preventative Organizational priority Part of design process Embedded into everything End to end life cycle Privacy as default (regulator preference) • • • Safeguarding Collection limited to legitimate business use Accuracy Visibility/transparency Retention periods customized by data set

Privacy Impact Assessments • • Used by government (Privacy Act requirement) but also many private actors to assess and govern systems that handle Personal Data Identifies the type of Personal Data in the system (including any ability to combine multiple identifying elements on an individual); Identifies who has access to that information (whether full access or limited access rights); and Describes the administrative controls that ensure that only information that is necessary and relevant to defined purpose/mission is included.

Privacy Impact Assessment Approach • • List fields of data (Name, etc. ) How will it be collected (directly from individual or indirectly about an individual? ) Purpose of collection (use specification) Disclosures to others (employees or affiliates, government, service providers? ) • • • Resident choices? (opt in or out) Security/confidentiality safeguards (administrative, technical) Who can access, who administers those controls so that security and use limitations are achieved? Oversight, monitoring, training, accountability Breach readiness

6 Main Elements of a PIA • Identify the need for a PIA • • Scope the inquiry with threshold factual questions Identify and evaluate solutions (remediation) • Describe the information flows • • • What/Who/Where/Why • Identify privacy and related risks • Data minimization is a key to reducing risk Sign-off and record PIA outcomes • • Driven by overall business tolerance for risk Document Integrate PIA outcomes back into business plan • Learn for next project

SAHF Outcomes Initiative PIA • Purpose of data collection • • • What Personal Data is being collected? • • Articulate clearly and in detail Align with values and goals of project and organization Specify at “data field” level Data sources Keep in mind FIPPs principles of data minimization, transparency, and individual participation What is the intended use of the Personal Data? • • • Keep closely tailored to purpose specification Consider whether Data Subjects adequately and clearly notified of intended use Who within organization will use? Data minimization at use level.

SAHF Outcomes Initiative PIA, cont’d • Data Governance Controls • • System Ownership, Data Maintenance & Retention, Data Security • • How is data stored within the organization? Who has access and is responsible for data quality and integrity? Data from which data subjects is stored? Data quality and integrity Security Accountability and Auditing Data Sharing Outside of Organization • Consider controls on service providers

SAHF Outcomes Initiative PIA, cont’d • Security Incident Reporting and Management • • What is the organization’s plan? Security Incident Related Liability • • What are the risks to the organization of collecting, storing, and using the data for this project? How can those risks be minimized?

Example Scenarios Latham & Watkins operates worldwide as a limited liability partnership organized under the laws of the State of Delaware (USA) with affiliated limited liability partnerships conducting the practice in the United Kingdom, France, Italy and Singapore and as affiliated partnerships conducting the practice in Hong Kong and Japan. The Law Office of Salman M. Al-Sudairi is Latham & Watkins’ associated office in the Kingdom of Saudi Arabia. © Copyright 2015 Latham & Watkins. All Rights Reserved.

Scenario 1: Financial & Housing Stability Information A SAHF member is the property manager and co-owner of Property A which is undergoing redevelopment. Resident services are subcontracted to a third party service provider. The SAHF member is conducting an eviction prevention strategy, whereby the property management staff identify residents in Property A who have had difficulty paying their rent on time or in full in the most recent month. Property management may also identify residents in Property A who have received lease violations that may jeopardize the resident’s tenancy. These lease violations may be physical (e. g. damage to the unit), behavioral (e. g. noise violation) or other. The property management staff share this information about residents in Property A with the resident services staff. The resident services staff conduct outreach to these residents to address their housing issues and stabilize or protect their tenancy. Some residents may express frustration, as they feel that their personal information has been shared without their consent. What is required? What are best practices?

Approach 1. 2. 3. What type of information is involved? Do any federal or state privacy or security laws apply? Apply FIPPs: 1. 2. 3. 4. 5. 6. 7. 8. Transparency (Notification) Individual Participation (Consent, Access) Purpose Specification Data Minimization Use Limitation Data Quality and Integrity Security Accountability & Auditing (Including Training)

Scenario 2: Financial Information A SAHF member is the property manager, property owner and resident services provider in Property C. The SAHF member also works with third party organizations, such as local banks or non-profit financial counseling organizations, to offer on and off-site services to residents. The staff of Property C have found that many residents pay their rent using money orders, rather than personal or bank checks. Since money orders are a wealth-stripping tool, the staff of Property C have set a goal of helping 60% of the residents in Property C set up and use a bank account to pay their rent. The staff of Property C have identified a local credit union to help counsel residents on the benefits of owning a bank account, and have offered to come to Property C to conduct workshops. Property C is a large community, home to over 700 units. In order to target the residents most in need of banking services, the resident services staff would like to conduct targeted outreach to those residents who do not currently have a bank account. The property management staff at Property C collect this information from residents each year, when residents complete their annual lease recertification – a requirement to remain eligible for HUD-assisted housing in Property C. The property management staff pull a report from their records that lists all residents, and whether or not they have a bank account. The property management staff share this list with the resident services staff who, together with the banking partner, conduct targeted outreach to residents in Property C. While some residents are eager to participate in the banking services, other residents are confused and upset that the resident services staff and a banking partner that they are unfamiliar with, appear to have access to their personal information. Was this permitted? What are best practices?

Approach 1. 2. 3. What type of information is involved? Do any federal or state privacy or security laws apply? Apply FIPPs: 1. 2. 3. 4. 5. 6. 7. 8. Transparency (Notification) Individual Participation (Consent, Access) Purpose Specification Data Minimization Use Limitation Data Quality and Integrity Security Accountability & Auditing (Including Training)

Scenario 3: Education and Children’s Information A SAHF member is the property manager, property owner and resident services provider in Property B. The SAHF member also works with third party organizations, such as a local health centers or youth development organizations, to provide on and off-site services to residents. The SAHF member has developed a partnership with a local youth afterschool program to offer afterschool activities and homework help to residents in Property B. The SAHF member and afterschool program provider would like to track the progress and success of program participants by conducting a preand post-assessment. Part of this assessment includes collecting and tracking student grades throughout the program. The resident services staff has recently collected student grades as part of a baseline assessment of the residents in Property B. Collecting student grades was a difficult process for resident services staff, as some families did not have report cards readily available. In order to eliminate the burden placed on residents to supply this information again, the resident services staff has decided to provide a report of the student grades directly to the afterschool program provider. The provider uses this information to develop a tailored curriculum and to identify students who need additional support. This data will also be used to determine whether student grades improved over the course of the semester. Can they do this without informing students or parents of the sharing? What are best practices?

Approach 1. 2. 3. What type of information is involved? Do any federal or state privacy or security laws apply? Apply FIPPs: 1. 2. 3. 4. 5. 6. 7. 8. Transparency (Notification) Individual Participation (Consent, Access) Purpose Specification Data Minimization Use Limitation Data Quality and Integrity Security Accountability & Auditing (Including Training)

Scenario 4: Health Information A SAHF member is the property owner, property manager and resident services provider at Property D, a senior community. The SAHF member’s goal is to provide high quality housing and services that help seniors age in place, such as access to primary care, fall-prevention, mental health or social isolation screening, etc. As part of this strategy, the SAHF member conducts a comprehensive health assessment of every resident each year. The questions on the health assessment are designed to identify how vulnerable or frail the seniors may be or whether they are experiencing trouble completing activities of daily living. The resident services staff explain to residents that the purpose of the survey is to help develop programs and services that will help resident maintain their independence and dignity in their home. At each assessment, the resident services staff takes notes on the information supplied by the resident, and logs these notes into a database. In a recent appointment, a resident asked to see the notes that the resident services staff has been collecting at each assessment. The resident feels that this is her personal information and that it should be shared with her. The resident services staff is unsure how to respond, as they have been instructed to keep all resident case notes private and confidential, including from the resident. What is required? What are best practices?

Approach 1. 2. 3. What type of information is involved? Do any federal or state privacy or security laws apply? Apply FIPPs: 1. 2. 3. 4. 5. 6. 7. 8. Transparency (Notification) Individual Participation (Consent, Access) Purpose Specification Data Minimization Use Limitation Data Quality and Integrity Security Accountability & Auditing (Including Training)

Scenario 5: Health Information A SAHF member is the property owner, property manager and resident services provider at Property E, a senior community. The SAHF member has developed a partnership with a local health center to offer a chronic disease self-management curriculum. In order to conduct outreach to residents, the health center would like to send letters directly to residents at Property E who may be in particular need of these services. The resident services staff at Property E recently conducted a health assessment of all residents, and are able to compile a list of residents that have indicated that they are managing a chronic condition. The names and specific conditions of the resident have been removed, such that only the list only contains the addresses of these residents. After the letters have been sent, one resident visits the resident services office to inquire about why they received the letter, expressing some concern about whether their personal information may have been shared outside of the resident services staff. Was this permitted? What are best practices?

Approach 1. 2. 3. What type of information is involved? Do any federal or state privacy or security laws apply? Apply FIPPs: 1. 2. 3. 4. 5. 6. 7. 8. Transparency (Notification) Individual Participation (Consent, Access) Purpose Specification Data Minimization Use Limitation Data Quality and Integrity Security Accountability & Auditing (Including Training)