Minimization. Governments and commercial entities should collect the minimum amount of information necessary in order to perform a given function or transaction.
Use limitations and purpose specifications. Data should only be used consistently with the purpose stated at the time of collection and not in other ways without the affirmative consent of the data subject.
Access and data quality. Data collectors must give individuals access to their personal information, allow individuals to correct inaccurate information, and maintain data accurately and only to the extent necessary for the purposes for which the data is to be used.
Accountability. Individuals recognize that rights should have remedies. There should be redress against privacy violators. Effective accountability would require a private right of action, liquidated damages and a grant of subject matter jurisdiction to small claims or higher courts.
Security. Personal information should be protected by reasonable security measures. This includes a requirement to purge customer information that is no longer needed.
Consent. Before data is collected, opt-in consent should be obtained from the individual.
Notice. Individuals have the right to be informed of how their personal information will be collected, used, and stored.