Privacy Protection Strategies

1
Privacy Protection Strategies

• Andrew Schulman
• Workplace Surveillance Project
• Privacy Foundation, US
• http//www.privacyfoundation.org/workplace

2
Privacy protection strategies

• Legislation
• Litigation
• Self-regulation
• Market forces
• DIY (do it yourself)
• Unions
• Education

3
Legislation

• Notice has been focus (CYA)
• Who knows what statutes mean?(e.g., ECPA)
• Sectoral approach(e.g. HIPPA public vs. private
  employer COPPA)
• FIPPs (one size fits all)
• Balancing? (The privacy paradox)

4
Litigation

• Case law (legislation by the courts)
• In US, privacy history is largely case law (even
  Warren Brandeis Prince Albert v. Strange)
• Get to find out what statutes mean
• Ultra-sectoral approach(e.g. Watkins v. Berry
  1983 phonevs. Smyth v. Pillsbury 1996 email)
• Part of the privacy problem?(Email as evidence,
  discovery)

5
Self-regulation

• Network Advertising Initiative (NAI)
• Opt out (implied consent)
• Requires threat of legislation or litigation
• Platform for Privacy Preferences (P3P)
  defaults private law?
• CYA
• Employer self-interest (litigation)

6
Market forces

• Market has issued verdictAdForce, 24/7 Media,
  Avenue A
• Compete over privacy? (AllAdvantage)
• But opposite market forceavailability of cheap
  surveillance

7
DIY (do it yourself)

• Technology as solution?
• Libertarian, anti-government?
• Privacy as business? (market forces)
• Pretty Good Privacy (PGP) in use?
• SafeWeb it works, but does it work?
• JunkBusters Proxy, Bugnosis

8
Unions

• No consumer equivalent
• In workplace, coupled with legislation
• Requires bargaining power (not US)

9
Education

• Help policy makers understand technology,
  surveillance business
• Help engineers see wider implications
• Informed consent Notice vs. access
• But education reduces reasonable expectation!
  (Big Tobacco)
• Take technology out of drivers seat
• Make it explicit!