Privacy _____________________________________________ _____________________________________________

What is “Privacy”? Too many meanings? Constitutional Government surveillance Security/encryption Privacy in ecommerce transactional data collection and processing Spam, identity theft etc. Specific technologies Cookies RFID _____________________________________________ _____________________________________________

What is “Privacy”? Function: permit individuals to control information flows about them What values are served by preventing or limiting the flow of true information? _____________________________________________ _____________________________________________

What is “Privacy”? Function: permit individuals to control information flows about them What values are served by preventing or limiting the flow of true information? Sphere of freedom from law Even legitimate law? _____________________________________________ _____________________________________________

What is “Privacy”? Function: permit individuals to control information flows about them What values are served by preventing or limiting the flow of true information? Sphere of freedom from law Sphere of freedom from social norms Regulation by gossip and censure _____________________________________________ _____________________________________________

What is “Privacy”? Function: permit individuals to control information flows about them What values are served by preventing or limiting the flow of true information? Sphere of freedom from law Sphere of freedom from social norms Sphere of freedom from regulation by market decisions of others How constrained or efficient are market behaviors constrained by competition and rationality? _____________________________________________ _____________________________________________

What is “Privacy”? Function: permit individuals to control information flows about them What values are served by preventing or limiting the flow of true information? Sphere of freedom from law Sphere of freedom from social norms Sphere of freedom from markets Power of self-definition Profiling and data-mining: being construed by another control over information received: being limited by another _____________________________________________ _____________________________________________

What is “Privacy”? The practical inefficiencies of older information processing and communications technologies created a practical sphere of freedom “Internet privacy” represents a cluster of problems that result from increased efficiency of information collection and processing that shrinks that sphere Parallels to Photography & yellow journalism Wiretaps _____________________________________________ _____________________________________________

Destabilizing Factors: Technology Ubiquitous communications capacity Walls evaporate for reading, viewing transactions can be observed anywhere Extensive processing capacity Inefficiency & cost protect privacy Aggregating and access Data-mining – analysis algorithms Communications + processing Transactional data collection Profiling Data mining _____________________________________________ _____________________________________________

Destabilizing Factors: Business Information as competitive tool Customized preference formation: advertising Customized service/goods delivered Customized price/price discrimination Customer’s life-long consumption as primary asset of firm Proprietary information fends off competitive pressures _____________________________________________ _____________________________________________

Destabilizing Factors: Politics U.S. & other governments highly sophisticated information gatherers 1990s saw the encryption wars, US Government partially lost September 11 th released the leash Government back into an explicit role of extensive information collection and processing Including by access to market-actor collected information _____________________________________________ _____________________________________________

Fair Information Practices Minimal standards imposed by law with a supporting regulatory framework As opposed to “privacy preferences” U.S.: Government & sector specific Privacy Act 1974 Video rental, HIPPA, COPPA EU Data protection OECD Guidelines _____________________________________________ _____________________________________________

Fair Information Practices Collection Limitation Data Quality Purpose Specification Use Limitation Security Safeguards Openness Individual Participation Accountability _____________________________________________ _____________________________________________

Common Concerns Openness/Notice precondition to subject’s control act of collection purposes of collection intended disclosures to third parties contacts and means of limiting use or disclosure of the information _____________________________________________ _____________________________________________

Permission opt-out or opt-in EU, opt-in for sensitive information COPPA; HIPPA Rule Reflects assumptions about knowledge, consent, responsibility, collective action cost of exercising option cost of communication loss of service for refusal to give non- necessary info Common Concerns _____________________________________________ _____________________________________________

Common Concerns Post-permission processing e.g., profiling must comply with permission must permission be given separately for each later processing? Third-party disclosure part of initial or subsequent authorization re-purposing must be authorized Security, integrity, accuracy independent duty Access for subjects to correct information in the database _____________________________________________ _____________________________________________

Regulatory approaches Mandatory law defines collection & processing practices EU Directive U.S sector-specific laws like video rental, HIPPA, COPPA _____________________________________________ _____________________________________________

Regulatory approaches Self-regulation with threat of regulation if fails U.S. approach to e-commerce e.g., TRUSTe, BBBOnline will it ever graduate to NASD? Self-regulation with teeth US/EU safe harbor? FTC enforcement of company policies adopted to come under safe harbor _____________________________________________ _____________________________________________

Regulatory approaches Technology Practice enforcing or preference negotiating? Anonymizers & encryption (client- or service-provider server-based) P3P, DRM-style models Who bears the burden, collectors or subjects? What are the defaults? Is the default minimal collection necessary, or whatever is possible? Limited use or multiple uses? _____________________________________________ _____________________________________________

RFID Story Clothing manufacturers sew RFID into cloth. Include garment characteristics, cloth batch etc for recalls & quality control Stores, malls, etc. install readers to limit pilfering & for inventory management _____________________________________________ _____________________________________________

RFID Story Clothing manufacturers sew RFID into cloth. Include garment characteristics, cloth batch etc for recalls & quality control Stores, malls, etc. install readers to limit pilfering & for inventory management Question Mall owners use the information to dynamically change the advertisements they project on billboards in the Mall _____________________________________________ _____________________________________________

RFID Story Clothing manufacturers sew RFID into cloth. Include garment characteristics, cloth batch etc for recalls & quality control Stores, malls, etc. install readers to limit pilfering & for inventory management Questions Police officers use the information to track the location of cloths that match crime scene evidence _____________________________________________ _____________________________________________

Hypothetical Amazon Story Collects information to tailor offerings Provides good recommendations for books to read Suggests music you like Offers good advice when you seem to need it, usually guesses right what you need How far would you go with this? Buying a car or furniture Financing/loan services Physician referral service _____________________________________________ _____________________________________________