3. NIC Database Privacy

The existence of publically accessible databases brings up a number of significant questions regarding controls over the gathering and distribution of the data. It is important that these concerns are addressed prior to the wide-scale deployment of a public NIC database or a NIC risks having to retrofit an established system to formal guidelines regarding such controls when they are finally available.

For each publically accessible database that a NIC manages, the NIC needs to provide a clear statement of the purpose of the database, the types of information it contains, and the privacy policy that applies to the information stored within it. In general, this policy should inform people or organizations listed in the database of the content and purpose of their database entries. Specifically, the privacy policy should:

1. Describe why the NIC needs the information and how it will use the information.
2. List of all the information being stored in an entry.
3. Detail which information will be made available outside of the NIC, to whom it will be made available, and for what purpose.
4. Provide for notification of any person or organization added to the database at the request of a third party.
5. Explain how to have the information changed or updated.
6. Explain how to get information removed from the database, including any references to one's information in another's database entry.
7. Explain the consequences of removing information from the database and of failing to provide all or part of the information a NIC requests.

The privacy policy enables people to make informed decisions regarding which information to supply for a given NIC database. Any information supplied should treated in a manner consistent with the current privacy policy. If a NIC makes a database available in its entirety to another organization, the NIC should also provide that organization with a copy of the current privacy policy for the database.