Cyber Privacy

Cyber Privacy

Note: This information about Cyber Privacy is based on an United States Sentencing Commission report to the Congress on penalties for cyber security offenses. In this case, the content of this section deals with the implementation of the Homeland Security Act Directive in relation to Cyber Privacy. The first enhancement of the new specific offense characteristic in §2B1. 1 provides a two level increase for a conviction under 18 U. S. C. § 1030 that involves an intent to obtain personal information. A definition of “personal information” is provided in the commentary. The definition makes clear that “personal information” means sensitive or private information, including information in the possession of a third party. Examples of personal information include medical records, wills, diaries, private correspondence and e-mail, financial information and photographs of a sensitive or private nature. Prior to this proposed amendment, the issue of privacy had only been addressed in §2B1. 1 by way of an upward departure provision. Application Note 17 (to be redesignated Application Note 18) to §2B1. 1 provides a non-exhaustive list of factors a court may consider in determining whether an upward departure is appropriate. One of the factors is whether the offense caused or risked a substantial non-monetary harm, such as a substantial invasion of a privacy interest. USSG §2B1. 1, comment. (n. 17(A)(ii)) (to be redesignated n. 18(A)(ii)). Although §2B1. 1 does address privacy invasions with this discretionary upward departure provision, the United States Sentencing Commission concluded that because of the increasing amount of sensitive personal information stored on computers, a specific enhancement was the most appropriate way to account for harm resulting from computer offenses that compromise personal information. Analysis of the United States Sentencing Commission's data revealed that in the 104 cases under 18 U. S. C. § 1030 that were sentenced under §2B1. 1 (or a guideline consolidated with §2B1. 1), approximately one third involved an intent to obtain personal information.