data
INTRODUCTION TO PRIVACY STUDIES
Agenda
1) Privacy concept de!ned 2) How to deliver privacy protections 3) "ree privacy misunderstandings
Privacy Defined
“"e right to be let alone”. Ø From: Samuel D. Warren and Justice Louis D. Brandeis. (1890). !e right to privacy.
Harvard Law Review, p. 193.
Ø "e ability to opt-out.
Ø Is this ability still possible?
Ø Should we shift the focus to digital reputation?
Ø Privacy v. reputation
De!nition:
"e relationship between the constrained and unconstrained #ow of digital information about an individual or collective, and the de!nition of that individual or collective’s identity and/or eligibility.
(Solove, 2007)
Digital Reputation
• Ranking choices
• Choosing which ones are ‘eligible’ for decision
• Decision could be: • Hiring/Promoting/Firing • Accepting/Rejecting • Investing/Deinvesting • Targeting/Ignoring • High Cost/Low Cost
Eligibility Determinations
Data Privacy Concerns
Ø Data Collection
Ø Data Management
Ø Data Use
Ø Data Sharing/Disclosure
Ø Data Retention
Ø From: Samuel D. Warren and Justice Louis D. Brandeis. (1890). !e right to privacy. Harvard Law Review, p. 193.
Ø "e ability to opt-out.
Ø Is this ability still possible?
Ø Should we shift the focus to digital reputation?
Early Definition of the “Privacy” Concept
Ø To early colonists, Canada afforded unprecedented privacy
Ø Crowded towns and cities of Europe compared to Canada’s endless wide-open spaces
Ø More space and distance from others by comparison
Early Definition of the “Privacy” Concept
Ø At the same time, many people still lived in small towns.
Ø “No person could escape the physical surveillance of
others without special efforts.” (Flaherty, 1972)
Early Definition of the “Privacy” Concept
Ø 1769, William Blackstone comments on British privacy law which protects against eavesdropping:
Ø “listening under walls or windows, or the eaves of a house, to hearken after discourse, and thereupon to frame slanderous and mischievous tales.”
Ø Gossiping was frowned upon
The “Privacy” Concept in Early America
Ø Revolutionary War (1775-1783), central privacy issue was freedom from government intrusion.
Ø "e Founders detested the use of warrants for searches and seizures without proper evidence.
Ø Warrants “resulted in ‘ransacking’ and seizure of the personal papers of political dissenters, authors, and printers of seditious libel.”
(O’Brien, 1979)
The “Privacy” Concept in Early America
Ø Patrick Henry (U.S. Founding Father)
Ø “"ey may, unless the general government be restrained by a bill of rights … go into your cellars and rooms, and search, ransack, and measure, everything you eat, drink and wear.”
The “Privacy” Concept in Early America
Ø Desire to stop government from invading privacy led to certain statements in the Bill of Rights
Ø Including the Fourth Amendment
Ø “"e right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures …”
Canadian Charter of Rights and Freedoms
Number 8: Everyone has the right to be secure against unreasonable search or seizure.
The ‘Right’ to Privacy
• Samuel Warren and Louis Brandeis
• 1890 Harvard Law Review article
• !e Right to Privacy • Considered one of the most in$uential essays in the
history of American law.
Privacy de!ned as: “"e right to be let alone”
Governance By Platforms
Delivering Privacy Protections?
Governance By Platforms
Delivering Privacy Protections?
Data Resistance ICTs
Governance By Platforms
Delivering Privacy Protections?
Data Resistance ICTs
Notice and Choice Policy
People and Privacy
Ø “I have de!ned privacy as the claim of an individual to
determine what information about himself or herself should be known to others”.
(Alan Westin, 2003, p.3)
People and Privacy (Alan Westin’s Typology)
Privacy Fundamentalist Ø Privacy is a high priority in their life
Ø Value privacy a lot
Ø Often say no to opportunities to share or disclose personal data
Ø Believe that the government should be involved in addressing privacy threats. Example: limiting collection, sharing and retention.
People and Privacy (Alan Westin’s Typology)
Privacy Unconcerned Ø Not worried about providing personal information to
government or industry.
Ø Views privacy concern as excessive and a waste of time.
Ø Believes government intervention isn’t necessary.
People and Privacy (Alan Westin’s Typology)
Privacy Pragmatist Ø Sometimes concerned or curious about privacy.
Ø Often want to understand the tradeoffs, or what they will get in return if they do give up their personal information in a speci!c context.
Ø Privacy concerns associated with industry and government scenarios determined by entities involved and what they say about privacy protections and tradeoffs.
People and Privacy (Alan Westin’s Typology)
Ø Westin’s studies suggested privacy pragmatists generally comprised half of the U.S. population.
Ø Privacy fundamentalists comprised 20-30 percent.
Ø Westin suggests that historically, privacy policy efforts have aimed to engage pragmatists.
Governance By Platforms
Delivering Privacy Protections?
Data Resistance ICTs
Notice and Choice Policy
Some Data Resistance ICTs
Ø Do not track
Ø Identity theft protections
Ø Counter-surveillance or Sousveillance
Ø Obfuscation tools
Data obfuscation: “producing misleading, false, or ambiguous data with the intention of confusing an adversary or simply adding to the time or cost of separating bad data from good”.
(Brunton and Nissenbaum, 2011, abstract)
Governance By Platforms
Delivering Privacy Protections?
Data Resistance ICTs
Notice and Choice Policy
Ø Policy framework designed to put individuals in charge of the collection and use of their personal data.
NOTICE: Providing people information about data collection
and use (i.e. privacy policies). CHOICE: Access to and control of personal data at all phases
of collection and use.
Ø Notice is “the most fundamental principle” of PII protection.
(FTC, 1998)
Notice and Choice Privacy Framework
Canada
Ø Privacy Act (1983) Ø Limitations on government collection and control of personal
information Ø Established Federal Privacy Commissioner
Ø Personal Information Protection and Electronic
Documents Act (PIPEDA) (2000) Ø Privacy protections in the private sector
Notice and Choice Privacy Framework
PIPEDA – Principle 8 (Openness)! 4.8 Principle 8 — Openness
An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
PIPEDA – Principle 8 (Openness)! 4.8 Principle 8 — Openness
An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
TRANSPARENCY PARADOX
Transparency Paradox
• Helen Nissenbaum
• Too much information = overwhelming to users • Too little information = informed decisions difficult
THREE PRIVACY
MISUNDERSTANDINGS
“BIGGEST LIE ON THE INTERNET”
Identifying Problematic User Behaviour
RQ: To what extent do individuals ignore
social media privacy and TOS and policies?
¨ Average adult reading speed 250-280wpm
PRIVACY POLICY ¨ 7,977 words ¨ 30 minutes required TERMS OF SERVICE POLICY ¨ 4,316 words ¨ 16 minutes required
Time to Read Privacy and TOS Policies
Who Read the Privacy Policy? (n=543)
74%
26%
0%
20%
40%
60%
80%
100%
No Yes
Read Privacy Policy To read: 30 minutes
RESULTS • Average reading Fme: 74 seconds
• Median reading Fme: 14 seconds • 97% agreed
40
Who Read Terms of Service?
• 16 minutes required
51 seconds average reading 2me
• 14 seconds
Median similar to privacy policy
• Individuals missed “gotcha clauses”
98%
41
0.0%
10.0%
20.0%
30.0%
40.0%
50.0%
60.0%
70.0%
80.0%
90.0%
100.0%
1 minute or less 2 minutes 3 minutes 4 minutes 5 minutes or more
Time spent reading NameDrop Terms of Service and Privacy Policy
Privacy Policy Terms of Service
Ø “Simple”
Ø “Easy”
Ø “Convenient”
Ø “It expedites the process”
Clickwrap Preferred
“It’s a hassle to deal with a massive amount of boring pages about privacy […] when the site you are joining is there to
do something much more interesting.”
Notice = Nuisance
“My friends use this social media, in order to catch up with their life I signup for this as quick as possible.”
“I'm in a hurry to use the service.”
Notice = Nuisance
“It feels like a cultural norm not to read them and I'm too lazy to read them in detail.”
Notice = Nuisance
INFORMATION OVERLOAD = Signi!cant negative predictor of reading …
Ø TOS during signup β = -.17, p < .01
Ø TOS when change β = -.24, p < .001
Ø PP when change β = -.22, p < .001
Regression Analysis
1) People want to enjoy the ends of digital production without being inhibited by the means.
2) People aren’t looking for a privacy education or
discussion when they access social media.
3) Notice = Nuisance
"is Suggests…
IMPLICATIONS
• Any and all data generated and/or collected by NameDrop, by any means, may be shared with third parties.
• For example, NameDrop may be required to share data
with government agencies, including the U.S. NSA […]
Data Sharing “Gotcha Clause”
• NameDrop may also choose to share data with third parties involved in the development of data products designed to assess eligibility.
• "is could impact eligibility in the following areas: employment, !nancial service (bank loans, insurance, etc.), university entrance, international travel, the criminal justice system, etc.
Data Sharing “Gotcha Clause”
¨ By agreeing to these Terms of Service, and in exchange for service, all users of this site agree to immediately assign their !rst-born child to NameDrop, Inc.
¨ If the user does not yet have children, this agreement will be enforceable until the year 2050. No exceptions.
Child Assignment Clause
“I’VE GOT NOTHING TO HIDE”
Problems with ‘I’ve got nothing to hide”
• Privacy is more than just concealing wrongs.
• Requires understanding of collection, retention and use.
• Complete understanding is very difficult because of the extent and complexity of surveillance efforts.
• What can possibly be revealed through various unknown analyses/aggregations/patterns.
Problems with ‘I’ve got nothing to hide”
• Chilling effect on behaviour
• Argument is sel!sh, what about others? • Lack of democratic/individual control over surveillance
apparatus
• As things change, system of ignorance will leave users vulnerable and unaware of new threats.
The Tradeoff Fallacy (Turow et al)
Ø “Marketers are misrepresenting a large majority of Americans by claiming that Americans give out information about themselves as a tradeoff for bene!ts they receive.”
Ø “"e survey reveals most Americans do not believe that ‘data for discounts’ is a square deal.”
Ø “Our !ndings, instead, support a new explanation: a majority of Americans are resigned to giving up their data—and that is why many appear to be engaging in tradeoffs.”
(p. 3)
1) "e right “to be let alone”? 2) "e biggest lie on the internet 3) Nothing to hide? 4) Tradeoff fallacy
Take-Home Points