Thank you, Mr. Chairman and members of the committee.  I applaud the Subcommittee's leadership in addressing privacy issues, and appreciate the opportunity to talk today about the role technology solutions play in maintaining information privacy in our global information society.  

My name is Austin Hill, and I am the co-founder, executive vice-president, and chief strategy officer for Zero-Knowledge Systems.  Zero-Knowledge is a provider of privacy-enabling technologies and services.  We employ 175 people and are headquartered in Montreal, Canada with offices in Redwood City, California.  Zero-Knowledge is the oldest and largest privacy technology and services company.  We employ many of the world's leading privacy policy and cryptography experts, and have been working since 1997 on technological ways to prevent the erosion of privacy in the information society.^[1]  

As both a privacy advocate and entrepreneur, I will outline the factors creating our society's major privacy challenges, and detail where we have the technological tools to manage and secure information privacy.  

Information Privacy: An Entrepreneur's Perspective

Four years ago, after successfully creating Canada's third largest ISP, my partners and I started thinking about Internet privacy.  We saw studies showing that privacy was a growing concern for consumers and immediately recognized its importance to an emerging e-business sector.   

Much of our inspiration was based upon the idea that technology will be everywhere: multiple networked devices, wireless location services, intelligent homes, and ubiquitous networks.  We believed that if we, as a society, did not come to terms with how to safeguard people's personal information, the technologies that would soon become so pervasive would erode individual privacy.  We also recognized that if information privacy was not addressed in a way that offered customer preference and choice while enabling businesses to build trusted relationships with consumers, all of the coming advancements in technology would not reach their full potential.  

As a person who places a high value on individual privacy, I was deeply concerned.  Yet, I also saw an incredible opportunity for privacy-enabling products and services.  So, in 1997 my partners and I created Zero-Knowledge Systems to be the company that provides the solutions to ensure information privacy in our society.  

At Zero-Knowledge we have long held the view that good privacy is good for business, and the more we talk with our customers at some of the world's leading companies, the more we see that industry leaders share this view.  

The Gartner Group articulated it well in a recent report, saying: "The widespread adoption of the Internet and the web has shifted cultural attitudes toward privacy.   Heightened privacy sensitivity will require online and offline businesses to re-examine existing information practices.  Through 2006 information privacy will be the greatest inhibitor for consumer-based e-business."^[2]  

We are at the beginning of the information technology revolution and it is clear that privacy has emerged as both a major challenge and opportunity.  Now is the time to build privacy into business, and the new products and services being deployed every day.  On the positive side, businesses and policy-makers such as yourselves have recognized the problem and are actively looking for solutions.  I firmly believe that Zero-Knowledge and other companies are well positioned to provide these solutions.  

When examining what we need to address to provide the tools to assure information privacy, one must look at the information itself.  How well an enterprise manages its personal information assets will determine the success or failure of critical e-business initiatives.  A core business asset, personal information carries with it many challenges and opportunities.  

One must recognize the information explosion our society is in the midst of.  UC Berkeley's School of Information Management and Systems stated that "(m)ore information will be created in the next 3 years than in the last 40,000 years."  Between 1980 and 2000 we created 10 million terabytes of data.  This includes music, books, credit, medical and personal records and other common data types.  From 2000 to 2003 we will create 40 million terabytes of data.^[3]  

This is a truly astounding statistic.  It becomes even more important to today's discussion when two more factors are taken into account.  

The first is to again realize that the trend for technology is toward pervasive devices and ubiquitous networks.  Everything from your car to your home and phone will talk to each other and share data.   The combination of the two technological trends of information explosion and pervasive computing suggests that personal information will now need to stored and transferred in a variety of new manners.  Information will not simply reside on a home PC, or a PDA, but will be stored on a variety of networks, and with a variety of different organizations.  This data will then be shared via the fixed Internet, the mobile Internet, and emerging personal area networks such as Bluetooth and wireless 802.11 connections.  

The second factor, and most relevant to your topic today, is that of all of this data the overwhelming majority of it will be personal information.  Some estimates hold that over 80% of it will be personal information, including medical records, insurance records, educational records, personal communications, credit history, photos and home video, and government records.^[4]  

Zero-Knowledge believes that there are two classes of privacy-enabling products necessary to fully address information privacy in a climate such as this: (1) consumer-side privacy protection tools; and (2) corporate-side Privacy Rights Management technologies.  

Examples of privacy protection tools include products such as anti-virus programs, firewalls, and encryption tools.  The goal of privacy protection technologies is to stop people from invading your privacy.  These types of tools place the burden of use on the consumer, but also empower them to take control over and protect their privacy.  We will always have private data that only we as individuals can protect and so it is essential for there to be privacy protection tools available to consumers.   

Zero-Knowledge has created the Freedom Internet Privacy Suite to empower Internet users to secure and protect their privacy when online.  Its standard features include a firewall, ad manager, form filler, word scanner, and cookie manager.  These features combine to enable an Internet user to control how and when their personal information is released, and to protect their PC from malicious hackers.  We also offer Freedom's Premium Services, which add the industry's most robust private encrypted email and private browsing to the suite.  These two services utilize the global Zero-Knowledge Network of servers that re-route and privatize the traffic of Freedom users.  

Other privacy protection solutions are available to consumers and two of them are here to testify today, WebWasher and Microsoft with its P3P-enabled browser.  Technologies such as these are essential to ensure that consumers have the tools necessary to protect their privacy.  

The second class of privacy solutions I referred to, Privacy Rights Management (PRM) technologies, represent an essential framework for building information privacy into the enterprise.  

In the information society, I must trust various organizations, businesses or individuals such as my doctor with my personal information.  Hence, there is a requirement for those parties to be responsible and accountable for how they manage my data.  Today, no tools exist for a business or organization to demonstrably protect and manage the personal information it has collected about its valued customers and employees.  

Businesses must adhere to a complex and constantly emerging global framework of privacy regulations and have begun hiring Chief Privacy Officers (CPO) and other data protection officers to help with the task.  I have spoken with many of these new CPOs at Fortune 500 companies and they all articulate the same concern: they don't have the tools to do their job.  Imagine a Chief Financial Officer attempting to do her job without tools such as Enterprise Resource Planning software or even spreadsheets.  It would be close to impossible.  Unfortunately, that's exactly the position that every CPO is in today.  There is, quite simply, a lack of tools for the job.  This is where PRM technologies will be applied. The core idea behind PRM is that the enterprise needs a policy-based framework for data management and protection if it is to comply with regulations, mitigate risk, support customer preferences and build consumer trust.  

There are several companies developing solutions that fit in the Privacy Rights Management framework.  These include IBM, Novell, and Tivoli.  PRM is an emerging category of enterprise software that will help close the current gap between stated policies, customer preferences and operational realities.  

Privacy Rights Management: Software Solutions for the Global Enterprise

The proliferation of data systems in both the public and private sectors that handle sensitive personal information such as health/medical records, financial/credit records, and location-based profiles demand that proper controls be put in place to ensure this data does not fall into the wrong hands and is not subject to misuse. It is of great value for a business to have these controls in place in order to mitigate risk, reduce the cost of compliance and build consumer trust.  

A comment I often hear from CPOs at major corporations is that they have no idea what personal information assets are present at their company, who has access to them and how the data is being used. As a case study, imagine a global corporation with operations in disparate countries and several divisions. As an incoming CPO you will need to first discover all of the personal information present throughout the organization. You will need to know who controls each repository of personal information, which people are allowed to access what information and in what cases this information is combined with other data resources.  

Once that information is gathered you will have to assess which regulations apply to what kinds of data. For example, a Customer Relationship Management database located in Canada will be subject to the recently enacted Personal Information Privacy and Electronic Documents Act. Data held in a European country will be subject to the EU Directive. American companies also face privacy legislation at the local, state and federal level including the Gramm-Leach-Bliley (GLB) Act and Health Insurance Portability and Accountability Act (HIPAA). Combined with this global patchwork of regulations are the data and privacy policies present in your company.  

As Chief Privacy Officer your next challenge is to apply and enforce data regulations and policies on the data and continually monitor and assess the data flows within the organization. A CPO also needs to grapple with issues such as providing consumers with access to certain types of data in order to foster trust, and restricting third party sharing of data in an environment where thousands of employees might have access to information assets that are spread across multiple applications. Some regulations such as HIPAA also call for businesses to obtain consent from consumers before sharing their data. Setting up a call center or mailing out hundreds of thousands of notices can be a costly exercise compared to having tools that can automate this procedure.  

Zero-Knowledge Systems' Privacy Rights Management Suite is an enterprise software solution designed to enable the entire range of processes detailed above.  

Our PRM Suite applies a policy-based framework to enterprise IT infrastructures for the responsible management of personal information, enabling business to mitigate risk, attain compliance and build consumer trust.  The various components of the Suite are designed as tools to allow businesses to rollout their information privacy program in an efficient and reliable manner, and include:

• Discovery and inventory of personal information resources
• Definition and articulation of privacy policies in an application-readable form
• Policy implementation at the application and data store level
• System monitoring of personal information handling practices
• Enforcement of information privacy requirements
• Audit and assurance of information privacy practices  

The Zero-Knowledge PRM Console, the first component of our PRM Suite to be released in Q4 of this year, enables the end-to-end management of information privacy within an enterprise.   Information security and privacy officers can discover, inventory, and classify personal information (PI) assets while applying relevant global data regulations and corporate privacy policy. The Console works with existing IT resources such as customer and employee databases, Web servers, enterprise applications and access control solutions.  

PRM Console features include:  

. Discovery and Inventory module: Enables and centralizes the identification, classification and management of personal information throughout the enterprise

. Modeling module: Supports compliance efforts by enabling the application of rules based on regulation or corporate policy, and customer preferences to personal information

. Reporting module: Ensures privacy or security officers have the reports needed to facilitate management, auditing and verification  

Underlying PRM is Privacy Rights Markup Language (PRML), a language specification designed to capture the complex relationship between business operations and personal information.  PRML formalizes privacy policies and operational procedures across enterprise applications and data stores, producing detailed reports and requirements as output.  PRML's underlying principles are based on the OECD Fair Information Practices and support a wide range of possible privacy policies and several forms of output, including XML and plain English.  Future releases of PRML will provide automated enforcement within the enterprise IT infrastructure.   

The goal of the PRM Suite is to define a standard of functionality that will secure personal information by providing data protection and security officers and CPOs with a toolkit to facilitate and reduce the cost of regulatory compliance, while supporting business objectives, and customer preference and choice.  The PRM Suite takes advantage of a wide range of new and evolving technologies to support legacy enterprise applications while simplifying integration through a component-based application model.  It supports applications ranging from traditional client-server applications delivered over corporate intranets to outward facing web services on the Internet.

If the developments of recent data and communication technologies are going to fulfill their promise, customers need to trust businesses with the collection, disclosure and use of their personal information. 

The Zero-Knowledge PRM Suite provides a cost effective means to implement privacy solutions that enable global and industry-wide compliance, which in turn fosters consumer trust, and enhances both the value of information assets.     

The Promise of PRM and Privacy Enabling Technologies

PRM technologies such as Zero-Knowledge's PRM Suite can be a major force in enabling businesses to build privacy into their operations and thus raise the bar for privacy in our society.  

The Zero-Knowledge PRM suite empowers data protection and security officers with the tools to effectively address the intensifying demand for consumer privacy, to navigate complex global regulations, and most of all, to institutionalize the enterprise's commitment to protecting consumer privacy in a demonstrable manner. Specifically, the Suite allows for

• assessment and mitigation of risk across the entire organization

• simplifies compliance in a cost-effective manner

• assembles a dynamic inventory of company-wide information assets and practices

• enforces policy on personal information assets

• generates reports to facilitate auditing and assurance  

The key to successful adoption of data protection and information privacy technologies within the enterprise is to assure that they support corporate objectives, do not hinder commercial activity or burden the enterprise with demands that cannot realistically be met.  Privacy Rights Management technologies are being developed to privacy-enable everyday business operations in a way that is manageable and cost-effective to the organization, yet still meets the high privacy standards of consumers.   

Business objectives like personalization, marketing, and online transaction and payments do not have to compromise consumer privacy.  Analytical research, direct marketing, and trends in ubiquitous communications also need not be impeded by privacy objectives such as compliance, consent, notice, opt-in, access, or use limitation. Building trust with consumers, managing data security risks, and implementing sufficient safeguards can be achieved by aligning business and privacy into a single, coherent, strategy that combines effective policies and Privacy Rights Management technologies.  

Standing At The Crossroads

As both an entrepreneur and privacy advocate I believe we are at a critical junction for privacy. We are currently experiencing the largest explosion of information in history.  The new networks and devices being deployed will make personal information available anywhere, anytime.  The overwhelming majority of this information being created and spread over a plethora of devices and networks will be personal information - and it will primarily reside with businesses and organizations, rather than with individuals themselves.  

The information and networking explosion affects every individual, organization and business.  Whether the net effect will be positive for information privacy or negative will depend on the policies we adopt, and the availability of technologies to enforce those policies.  

I believe the combination of consumer privacy protection tools and Privacy Rights Management technologies within the enterprise provide an immediate and fundamental framework for addressing privacy in the information society. The combination of these privacy-enabling technologies with strong privacy and data handling policies is a powerful and effective approach.  

In conclusion I want to articulate that over the past four years I have been encouraged by the positive steps industry leaders and policy-makers such as yourselves have taken. As a society, we have a critical challenge and opportunity in front of us, and I hope we can continue to work together to ensure information privacy and business can flourish together.  

Again, I thank the Subcommittee for the opportunity to participate in today's hearing.  This hearing provides a valuable opportunity to discuss the important role that technology solutions play in addressing both business and consumer needs with regard to privacy.  Zero-Knowledge Systems looks forward to continuing to work with the Subcommittee in its review of privacy issues.