At the AAPC, we respect the right to privacy and believe individuals should have control over how their personal information is used. We believe it is our responsibility to set best practices for our members related to data privacy, security, and ethics. It is essential to understand the data we collect, where it is stored, how it is used, and how it is protected. The AAPC is committed to providing the resources and education necessary to help our members establish transparent data privacy policies and data protection procedures. We encourage our members to determine which regulations apply to their businesses and to be in compliance with all state and federal regulations. We support well-defined privacy regulations and the ability to penalize companies acting in bad faith who repeatedly violate state and federal laws.

Data Privacy and Compliance Guiding Principles

At the AAPC, we encourage our members who are originators of data to:

• Establish Transparent Data Privacy Policies and Data Protection Procedures
• Respect the right of individuals to remove their names from private companies’ communications and marketing campaigns.
• De-identify personal information whenever possible.
• Store any PII in a hardened, privacy protected environment.
• Only share files with other parties through a secure file transfer, such as an Amazon s3 bucket or a SFTP.
• Follow data security best practices including two-factor authentication when accessing files that may have personal information.
• Notify processors of data with whom you work of any required name removals.
• Have an incident response plan for breaches to personal data.
• Keep Proper Compliance Documentation and maintain Proof of Compliance.

At the AAPC, we encourage our members who are processors of data to:

• Establish Transparent Data Privacy Policies and Data Protection Procedures.
• Respect the right of individuals to remove their names from private companies’ communications and marketing campaigns.
• Comply with requests by originators to remove personal information in a timely manner.
• Delete all files as soon as their use has expired, or a newer version of the data is sent.
• Only accept files via a secure file transfer.