Privacy

1
Privacy
__________________________________________________
________________________________________
2
What is Privacy?
__________________________________________________
________________________________________

• Too many meanings?
• Constitutional
• Government surveillance
• Security/encryption
• Privacy in ecommerce
• transactional data collection and processing
• Spam, identity theft etc.
• Specific technologies
• Cookies
• RFID

3
What is Privacy?
__________________________________________________
________________________________________

• Function permit individuals to control
  information flows about them
• What values are served by preventing or limiting
  the flow of true information?

4
What is Privacy?
__________________________________________________
________________________________________

• Function permit individuals to control
  information flows about them
• What values are served by preventing or limiting
  the flow of true information?
• Sphere of freedom from law
• Even legitimate law?

5
What is Privacy?
__________________________________________________
________________________________________

• Function permit individuals to control
  information flows about them
• What values are served by preventing or limiting
  the flow of true information?
• Sphere of freedom from law
• Sphere of freedom from social norms
• Regulation by gossip and censure

6
What is Privacy?
__________________________________________________
________________________________________

• Function permit individuals to control
  information flows about them
• What values are served by preventing or limiting
  the flow of true information?
• Sphere of freedom from law
• Sphere of freedom from social norms
• Sphere of freedom from regulation by market
  decisions of others
• How constrained or efficient are market behaviors
  constrained by competition and rationality?

7
What is Privacy?
__________________________________________________
________________________________________

• Function permit individuals to control
  information flows about them
• What values are served by preventing or limiting
  the flow of true information?
• Sphere of freedom from law
• Sphere of freedom from social norms
• Sphere of freedom from markets
• Power of self-definition
• Profiling and data-mining being construed by
  another
• control over information received being limited
  by another

8
What is Privacy?
__________________________________________________
________________________________________

• The practical inefficiencies of older information
  processing and communications technologies
  created a practical sphere of freedom
• Internet privacy represents a cluster of
  problems that result from increased efficiency of
  information collection and processing that
  shrinks that sphere
• Parallels to
• Photography yellow journalism
• Wiretaps

9
Destabilizing Factors Technology

• Ubiquitous communications capacity
• Walls evaporate for reading, viewing
• transactions can be observed anywhere
• Extensive processing capacity
• Inefficiency cost protect privacy
• Aggregating and access
• Data-mining analysis algorithms
• Communications processing
• Transactional data collection
• Profiling
• Data mining

__________________________________________________
________________________________________
10
Destabilizing Factors Business
__________________________________________________
________________________________________

• Information as competitive tool
• Customized preference formation advertising
• Customized service/goods delivered
• Customized price/price discrimination
• Customers life-long consumption as primary asset
  of firm
• Proprietary information fends off competitive
  pressures

11
Destabilizing Factors Politics
__________________________________________________
________________________________________

• U.S. other governments highly sophisticated
  information gatherers
• 1990s saw the encryption wars, US Government
  partially lost
• September 11th released the leash
• Government back into an explicit role of
  extensive information collection and processing
• Including by access to market-actor collected
  information

12
(No Transcript)
13
Fair Information Practices
__________________________________________________
________________________________________

• Minimal standards imposed by law with a
  supporting regulatory framework
• As opposed to privacy preferences
• U.S. Government sector specific
• Privacy Act 1974
• Video rental, HIPPA, COPPA
• EU Data protection
• OECD Guidelines

14
Fair Information Practices
__________________________________________________
________________________________________

• Collection Limitation
• Data Quality
• Purpose Specification
• Use Limitation
• Security Safeguards
• Openness
• Individual Participation
• Accountability

15
Common Concerns
__________________________________________________
________________________________________

• Openness/Notice
• precondition to subjects control
• act of collection
• purposes of collection
• intended disclosures to third parties
• contacts and means of limiting use or disclosure
  of the information

16
Common Concerns
__________________________________________________
________________________________________

• Permission
• opt-out or opt-in
• EU, opt-in for sensitive information
• COPPA HIPPA Rule
• Reflects assumptions about knowledge, consent,
  responsibility, collective action
• cost of exercising option
• cost of communication
• loss of service for refusal to give non-necessary
  info

17
Common Concerns
__________________________________________________
________________________________________

• Post-permission processing
• e.g., profiling
• must comply with permission
• must permission be given separately for each
  later processing?
• Third-party disclosure
• part of initial or subsequent authorization
• re-purposing must be authorized
• Security, integrity, accuracy
• independent duty
• Access for subjects to correct information in the
  database

18
Regulatory approaches
__________________________________________________
________________________________________

• Mandatory law defines collection processing
  practices
• EU Directive
• U.S sector-specific laws like video rental,
  HIPPA, COPPA

19
Regulatory approaches
__________________________________________________
________________________________________

• Self-regulation with threat of regulation if
  fails
• U.S. approach to e-commerce
• e.g., TRUSTe, BBBOnline
• will it ever graduate to NASD?
• Self-regulation with teeth
• US/EU safe harbor?
• FTC enforcement of company policies adopted to
  come under safe harbor

20
Regulatory approaches
__________________________________________________
________________________________________

• Technology
• Practice enforcing or preference negotiating?
• Anonymizers encryption (client- or
  service-provider server-based)
• P3P, DRM-style models
• Who bears the burden, collectors or subjects?
  What are the defaults?
• Is the default minimal collection necessary, or
  whatever is possible?
• Limited use or multiple uses?

21
RFID Story
__________________________________________________
________________________________________

• Clothing manufacturers sew RFID into cloth.
  Include garment characteristics, cloth batch etc
  for recalls quality control
• Stores, malls, etc. install readers to limit
  pilfering for inventory management

22
RFID Story
__________________________________________________
________________________________________

• Clothing manufacturers sew RFID into cloth.
  Include garment characteristics, cloth batch etc
  for recalls quality control
• Stores, malls, etc. install readers to limit
  pilfering for inventory management
• Question
• Mall owners use the information to dynamically
  change the advertisements they project on
  billboards in the Mall

23
RFID Story
__________________________________________________
________________________________________

• Clothing manufacturers sew RFID into cloth.
  Include garment characteristics, cloth batch etc
  for recalls quality control
• Stores, malls, etc. install readers to limit
  pilfering for inventory management
• Questions
• Police officers use the information to track the
  location of cloths that match crime scene
  evidence

24
Hypothetical Amazon Story
__________________________________________________
________________________________________

• Collects information to tailor offerings
• Provides good recommendations for books to read
• Suggests music you like
• Offers good advice when you seem to need it,
  usually guesses right what you need
• How far would you go with this?
• Buying a car or furniture
• Financing/loan services
• Physician referral service