Fair Information Practices Research Articles

Online privacy concerns and consumer reactions: insights for future strategies

Purpose– The present study aims to identify and study the online privacy concerns, its explanatory variables and their affect on reactions and online purchasing behavior of Indian consumers. Globalization means that companies are setting manufacturing units where their cost dynamics are most attractive and then servicing the customers in different markets. Therefore, today, most of the globalized firms are using technology to overcome physical barriers with the customer. The value chains are being reorganized to come up with innovative strategies for sales, delivery and service channels. These strategies use Internet as a competitive tool, thereby providing marketers with a completely new landscape to work with. This channel means that now even the tangibles (products) are being sold on the basis of intangibles (services). In this landscape, the success of an online business depends on its capability to think globally and act locally. Sensitivity displayed by a company to effects of cultural nuances on a consumer’s psychological constructs will determine the success of a company and its strategy. It is in this backdrop that the current study was undertaken.Design/methodology/approach– To establish a relationship of the consumer privacy concerns and consumers’ reactions and their online purchase behavior, data were collected on the basis of a self-administered structured questionnaire. Data were collected from 150 respondents. Confirmatory factor analysis in LISREL (8.70) was done to check the validity of the scale. Incremental fit indices and parsimonious fit indices were used to interpret whether the model fit the data. Further, data were analyzed using factor analysis, correlation and chi-square tests.Findings– The study found several significant correlations between consumer’s online privacy and their behavior. The study made attempt to study only linkages and not a causal relationship. This study found that there was a correlation between online privacy concerns and consumer behavior. Indian consumers opted to voice and complain about privacy concerns, and hence, companies need to invest in recovery strategies. Furthermore, Indian consumers exhibited more of a refrained behavior rather than hedonic purchase behavior. However, refrained behavior was a first step toward the latter. To promote refrained behavior, marketers need to work with a model which provides Indian consumers with an assurance of procedural fairness and fair information practices. These companies need to invest in software, rewards, detailed privacy notices and tangibles to motivate customers into transacting online. Armed with this information a marketer can also invest into the right kind of privacy and security tools.Research limitations/implications– Due to the limited sample size, the results of the study can be generalized to a limited extent.Practical implications– The results would help online marketers maneuver the target consumer’s behavior in the desired direction. The results would help companies design and invest in the right kind of privacy and security tools, for the target segments matching the sample.Originality/value– The manuscript is based on a unique data set collected for this study. The references have been cited as per American Psychological Association (APA) rules. The work is original.

Consumer Cloud Robotics and the Fair Information Practice Principles: Recognizing the Challenges and Opportunities Ahead

Rapid technological innovation has made commercially accessible consumer robotics a reality. At the same time, individuals and organizations are turning to “the cloud” for more convenient and cost effective data storage and management. It seemed only inevitable that these two technologies would merge to create cloud robotics, “a new approach to robotics that takes advantage of the Internet as a resource for massively parallel computation and sharing of vast data resources.” By making robots lighter, cheaper, and more efficient, cloud robotics could be the catalyst for a mainstream consumer robotics marketplace. However, this new industry would join a host of modern consumer technologies that seem to have rapidly outpaced the legal and regulatory regimes implemented to protect consumers. Recently, consumer advocates and the tech industry have focused their attention on information privacy and security, and how to establish sufficient safeguards for the collection, retention, and dissemination of personal information while still allowing technologies to flourish. Underlying a majority of these proposals are a set of principles that address how personal information should be collected, used, retained, managed, and deleted, known as the Fair Information Practice Principles (FIPPs). This Article examines recent frameworks that articulate how to apply the FIPPs in a consumer setting, and dissects how these frameworks may affect the emergence of cloud-enabled domestic robots. By considering practical observations of how cloud robotics may emerge in a consumer marketplace regulated by the FIPPs, this research will help both the information privacy and robotics fields in beginning to address privacy and security challenges from a law and policy perspective, while also fostering collaboration between roboticists and privacy professionals alike.

The Origin of Fair Information Practices: Archive of the Meetings of the Secretary's Advisory Committee on Automated Personal Data Systems (SACAPDS)

This paper summarizes transcripts of six of the meetings of the Department of Health, Education, and Welfare (HEW) Secretary's Advisory Committee on Automated Personal Data Systems (SACAPDS). This committee developed the landmark 1973 Records, Computers and the Rights of Citizens, Report of the Secretary's Advisory Committee on Automated Personal Data Systems, known as the HEW Report. Privacy expert Robert Gellman has noted that the HEW Report was the origin of Fair Information Practices, a set of principles that formed the basis for modern privacy legislation.The SACAPDS heard from dozens of witnesses, many of whom discussed large-scale government information collection programs that were essential for the delivery of some social good. The witnesses earnestly discussed the ways in which they tried to incorporate confidentiality and data security into these files, but often for sake of administrative efficiency and unique enumeration, these different programs used the Social Security Number (SSN) to track individuals. Some made guarantees of confidentiality without any legal basis for it. Others operated systems with no accountability controls at all. By 1972, committee members lamented that the widespread use of the SSN in the public sector was mirrored in the private marketplace, and that it was practically impossible to function in society without providing the SSN to numerous businesses.Reading the transcripts, it is striking how little conversations about privacy have changed in forty years. Tensions among interests in efficiency, law enforcement, cost, access to knowledge and freedom of information, federalism, the vagueness of the term privacy, eroding practical obscurity of public records, accountability, pragmatic system design, limitations of anonymization and the problem of re-identification, fraud and risk, the incredible complexity in the provision of benefits, the needs of a large and complex administrative state, centralization versus devolved and individual rights appear many times in the committee’s discussion. On June 7, 1972, just before the group’s third meeting, a subcommittee of the group (Dr. Grommers, Layman Allen, Arthur R. Miller, Joseph Weizenbaum, Carole Parsons, and David Martin) circulated a memo titled, Draft Thematic Outline of Report of Secretary's Advisory Committee on Automated Personal Data Systems. The five page memo contained the skeleton of what we call fair information practices today. The last page of the document details, Procedures to protect individuals in relation to the use of automated personal data systems, and concludes with an outline of penalties for infringements of these rights in addition to compensatory and punitive damages for victims.SACAPDS met nine times between 1972-3, often near the NIH campus or at the campus’ Stone House. They had to give their SSN to satisfy the NIH campus security rules. They worked very hard, on weekends and often late into the night. Transcripts, ephemera, and other information about SACAPDS are available in Dr. Willis Ware’s papers archive (1972-1977), maintained by the University of Minnesota. Please note that these transcripts are uncorrected and that when scanned, automated character recognition was used and this OCR is uncorrected.

Willis Ware's Lasting Contribution to Privacy: Fair Information Practices

It has often been said that reports by commissions and advisory committees end up gathering dust on a shelf. Advisory committee reports typically have little influence because they're too often untimely, uncreative, vision-free, or unbalanced. Presidents and agencies order reports to put off a problem too hot to handle, and by the time the committee finishes, the problem is no longer urgent. This wasn't the case for Willis Ware's advisory committee. The Department of Health, Education, and Welfare advisory committee that he chaired from 1972 to 1973 produced one of the most influential reports of its type. The committee invented the notion of Fair Information Practices (FIPs), which became the single most important concept in privacy all around the world for more than 40 years.

Online Privacy Policy of the Thirty Dow Jones Corporations: Compliance with FTC Fair Information Practice Principles and Readability Assessment

INTRODUCTION Privacy policy in corporation's business refers to a statement or a legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's personal data such as name, age, address, gender, email, etc. (Privacy Policy, 2012). While online privacy policy (or online privacy) emphasizes on the right or mandates of personal privacy concerning the storing, repurposing, providing to third-parties, and displaying of information pertaining to oneself via the Internet (Internet Privacy, 2012). In the age of the internet, sharing information, communication, and working through the internet, especially the flow of information between companies and customers has caused a growing concerns regarding online privacy policy. For example, Google, as one of the most popular search engine in the world, has a well-known reputation and vast of cooperation with third parties. However, an announcement from Maryland Attorney General Douglas Gansler and attorneys general from thirty-five other states indicated that Google had tracked people using computers and mobile devices based on its new privacy components (published on March first, 2012) such as searching history without opt-out choice for customers (Acohido, 2012). From customer's view a disclosed online privacy would satisfy customer's concerns letting her/him know what information the company collected, what information the company may share with third parties, and how the company may secure her/his information. As mentioned above, the new online privacy of Google revealed the information that Google has been tracking customer's information. Few customers would like to be monitored all the time by Google; however, customers would be like walking on the thin ice without notice if there was no online privacy. In 1998, the United States Federal Trade Commission (FTC) reported a study of online privacy concerns to Congress. In this report, FTC described a widely-accepted Fair Information Practice Principles (FIPs) of Notice, Choice, Access, and Security1 (Landesberg et al., 1998). And FTC also defined the Enforcement principle to provide sanctions for noncompliance as a critical component of any governmental or self-regulatory program to protect online privacy. STATEMENT OF THE PROBLEM In July 1997, FTC conducted a survey about consumer privacy on the World Wide Web. The survey includes six sample groups: 1) comprehensive, 2) health, 3) retail, 4) financial, 5) children, and 6) most popular. Only fourteen percent of all sites in the Comprehensive Sample (sample size = 674) posted any disclosure about privacy. Only seventy-one percent of all sites in Most Popular Sample (sample size = 111) have some type of information disclosure about privacy (Landesberg et al., 1998). Furthermore, a study by George Milne, Mary Culnan, and Henry Greene showed that online privacy has grown in length as well as declined in readability (Milne et al., 2006). Even though a company discloses its online privacy and complies with FIPs, the unreadable privacy is still impractical for customers. Few people would like to spend half an hour or even a couple of hours to read the online privacy notice, especially when she/he is shopping online. Therefore, FIPs compliance and improving readability seems to be more and more intensive in terms of current online privacy policy. Significance of the Project On March 30th 2012, Nicole Perlroth from the New York Times reported that approximately one million to three million Visa and MasterCard accounts were exposed at Global Payments. Credit card numbers as well as cardholders' personal information had been hacked when payments were processed. Nicole also mentioned this was the second breach already at Global Payments in the last twelve months. Additionally, Heartland Payment Systems disclosed a breach which caused 130 million credit card to be hacked during two years from 2007 to 2009 (Greenberg & Schwartz, 2012). …

Big Data analytics: risks and responsibilities

Big data analytics sifts through mountains of data to identify or predict facts about individuals and to use those facts in decisions ranging from which products to sell them to whether to provide them medical treatment. Given the present state of technology, there are risks associated with big data analytics: source data may be misunderstood or contain errors and analytics processes may introduce new errors or be less exact than intended. Data protection and the application of principles of fair information practices promote the responsible management and use of information about individuals and guard against risks that data and its use may raise. Given the potential harm to individuals—from the denial of credit or care to the elimination of educational opportunities—we addresses the corporate, social, and ethical responsibility to engage the appropriate professionals in making decisions to use the resulting predictions as well as the responsibility to implement a robust risk management process.

Fair Information Practices: A Basic History

This report offers a history of Fair Information Practices (FIPs) with a focus – but not an exclusive one – on activities in the United States. The text usually quotes key portions of source documents in order to allow for comparison of different versions of FIPs. For the most part, the analysis is neutral, with only limited interpretation, comment, and criticism. FIPs are a set of internationally recognized practices for addressing the privacy of information about individuals. Information privacy is a subset of privacy. FIPs are important because they provide the underlying policy for many national laws addressing privacy and data protection matters. The international policy convergence around FIPs as core elements for information privacy has remained in place since the late 1970s. Privacy laws in the United States, which are much less comprehensive in scope than laws in some other countries, often reflect some elements of FIPs but not as consistently as the laws of most other nations.

Data governance requirements for distributed clinical research networks: triangulating perspectives of diverse stakeholders

There is currently limited information on best practices for the development of governance requirements for distributed research networks (DRNs), an emerging model that promotes clinical data reuse and improves timeliness of comparative effectiveness research. Much of the existing information is based on a single type of stakeholder such as researchers or administrators. This paper reports on a triangulated approach to developing DRN data governance requirements based on a combination of policy analysis with experts, interviews with institutional leaders, and patient focus groups. This approach is illustrated with an example from the Scalable National Network for Effectiveness Research, which resulted in 91 requirements. These requirements were analyzed against the Fair Information Practice Principles (FIPPs) and Health Insurance Portability and Accountability Act (HIPAA) protected versus non-protected health information. The requirements addressed all FIPPs, showing how a DRN's technical infrastructure is able to fulfill HIPAA regulations, protect privacy, and provide a trustworthy platform for research.

Point/Counterpoint

The first article, "The Consequences of the Lack of Privacy in Today's Electronic Health Systems," by Deborah C. Peel, argues that because the public doesn't trust technology systems that prevent them from deciding who can see, use, or sell their health data, millions avoid treatment or hide information and suffer bad health outcomes. The second article, "Privacy and Security as Enabler, Not Barrier, to Responsible Health Data Uses," by Deven McGraw, states that trust in health technology will be enabled not by focusing disproportionately on patient consent but through robust policies that address all of the fair information practice principles.

If Personal Information is Privacy's Gatekeeper, then Risk of Harm is the Key: A Proposed Method for Determining What Counts as Personal Information

In the late sixties, with the development of automated data banks and the growing use of computers the private and public sector, privacy was conceptualized as having individuals in control over their personal (Westin, 1967). The principles of Fair Information Practices were elaborated during this period and have been incorporated data protection laws (DPLs) adopted various jurisdictions around the world ever since. These DPLs protect personal information, which is defined similarly various DPLs (such as Europe and Canada) as relating to an identifiable individual. In the U.S., information is accorded special recognition through a series of sectoral privacy statutes focused on protecting personally identifiable (or PII), a notion close to personal information. Going back to the early seventies, we can note that identical or very similar definitions of personal information were already used DPLs, illustrating that this definition of personal information dates back to this period.In recent days, with the Internet and the circulation of new types of information, the efficiency of this definition may be challenged. Recent technological developments are triggering the emergence of new identification tools allowing for easier identification of individuals. Data-mining techniques and capabilities are reaching new levels of sophistication. In the era of Big Data, because it is now possible to interpret almost any data as personal information (any data can one way or another be related to some individual) the question arises as to how much and which data should be considered as personal information.In section 1, I elaborate on how a literal interpretation of the definition of personal information is no longer workable. In light of this, I present the proposed approach to interpreting the definition of personal information, under which the ultimate purpose behind DPLs should be taken into account. I then demonstrate that the ultimate purpose of DPLs was to protect individuals against a risk of harm triggered by organizations collecting, using and disclosing their information. In section 2, I demonstrate how this risk of harm can be subjective or objective, depending on the data handling activity at stake and I offer a way forward, proposing a decision-tree test useful when deciding whether certain information should qualify as personal information. The objective of my work is to come to a common understanding of the notion of personal information, the situations which DPLs should be applied, and the way they should be applied. The approach is meant to provide for a useful framework under which DPLs remain efficient light of modern Internet technologies.

Giving patients granular control of personal health information: Using an ethics ‘Points to Consider’ to inform informatics system designers

ObjectiveThere are benefits and risks of giving patients more granular control of their personal health information in electronic health record (EHR) systems. When designing EHR systems and policies, informaticists and system developers must balance these benefits and risks. Ethical considerations should be an explicit part of this balancing. Our objective was to develop a structured ethics framework to accomplish this. MethodsWe reviewed existing literature on the ethical and policy issues, developed an ethics framework called a “Points to Consider” (P2C) document, and convened a national expert panel to review and critique the P2C. ResultsWe developed the P2C to aid informaticists designing an advanced query tool for an electronic health record (EHR) system in Indianapolis. The P2C consists of six questions (“Points”) that frame important ethical issues, apply accepted principles of bioethics and Fair Information Practices, comment on how questions might be answered, and address implications for patient care. DiscussionThe P2C is intended to clarify what is at stake when designers try to accommodate potentially competing ethical commitments and logistical realities. The P2C was developed to guide informaticists who were designing a query tool in an existing EHR that would permit patient granular control. While consideration of ethical issues is coming to the forefront of medical informatics design and development practices, more reflection is needed to facilitate optimal collaboration between designers and ethicists. This report contributes to that discussion.

Reconciling Personal Information in the United States and European Union

Copyright © 2014 California Law Review, Inc.U.S. and EU privacy law diverge greatly. At the foundational level, they differ in their underlying philosophy: In the United States, privacy law focuses on redressing consumer harm and balancing privacy with efficient commercial transactions. In the European Union, privacy is hailed as a fundamental right that can trump other interests. Even at the threshold level-determining what information is covered by the regulation-the United States and European Union differ significantly. The existence of personal information- commonly referred to as personally identifiable information (PII)-triggers the application of privacy law. The U.S. and the European Union define this essential term of privacy law quite differently. The U.S. approach involves multiple and inconsistent definitions of PII that are often particularly narrow. The EU approach defines PII to encompass all information identifiable to a person, a definition that can be quite broad and vague. This divergence is so basic that it threatens the stability of existing policy mechanisms for permitting international data flows.In this Essay, we propose a way to bridge these differences regarding PII. We contend that a tiered approach to the concept of PII (which we call PII 2.0 ) represents a superior way of defining PII compared to the current approaches in the United States and European Union. We also argue that PII 2.0 is consistent with the different underlying philosophies of the U.S. and EU privacy law regimes. Under PII 2.0, all of the Fair Information Practices (FIPs) should apply when data refers to an identified person or when there is a significant risk of the data being identified. Only some of the FIPs should apply when data is merely identifiable, and no FIPs should apply when there is a minimal risk that the data is identifiable. We demonstrate how PII 2.0 furthers the goals of both U.S. and EU privacy law and how PII 2.0 is consistent with their different underlying philosophies. PII 2.0 thus advances the process of bridging the current gap between U.S. and EU privacy law.

A Model Regime of Privacy Protection (Version 1.1)

Privacy protection in the United States has often been criticized, but critics have too infrequently suggested specific proposals for reform. Recently, there has been significant legislative interest at both the federal and state levels in addressing the privacy of personal information. This was sparked when ChoicePoint, one of the largest data brokers in the United States with records on almost every adult American citizen, sold data on about 145,000 people to fraudulent businesses set up by identity thieves. In the aftermath of the ChoicePoint debacle, both of us have been asked by Congressional legislative staffers, state legislative policymakers, journalists, academics, and others about what specifically should be done to better regulate information privacy. In response to these questions, we believe that it is imperative to have a discussion of concrete legislative solutions to privacy problems. What appears below is our attempt at such an endeavor. Privacy experts have long suggested that information collection be consistent with Fair Information Practices. This Model Regime incorporates many of those practices and applies them specifically to the context of commercial data brokers such as Choicepoint. We hope that this will provide useful guidance to legislators and policymakers in crafting laws and regulations. We also intend this to be a work-in-progress in which we collaborate with others. We welcome input from other academics, policymakers, journalists, and experts as well as from the industries and businesses that will be subject to the regulations we propose. We invite criticisms and constructive suggestions, and we will update this Model Regime to incorporate the comments we find most helpful and illuminating. We also aim to discuss some of the comments we receive in a commentary section. To the extent to which we incorporate suggestions and commentary, and if those making suggestions want to be identified, we will graciously acknowledge those assisting in our endeavor. Notice, Consent, Control, and Access 1. Universal Notice 2. Meaningful Informed Consent 3. One-Step Exercise of Rights 4. Individual Credit Management 5. Access to and Accuracy of Personal Information Security of Personal Information 6. Secure Identification 7. Disclosure of Security Breaches Business Access to and Use of Personal Information 8. Social Security Number Use Limitation 9. Access and Use Restrictions for Public Records 10. Curbing Excessive Uses of Background Checks 11. Private Investigators Government Access to and Use of Personal Data 12. Limiting Government Access to Business and Financial Records 13. Government Data Mining 14. Control of Government Maintenance of Personal Information Privacy Innovation and Enforcement 15. Preserving the Innovative Role of the States 16. Effective Enforcement of Privacy Rights

Reconciling Personal Information in the United States and European Union

U.S. and EU privacy law diverge greatly. At the foundational level, they differ in their underlying philosophy: In the United States, privacy law focuses on redressing consumer harm and balancing privacy with efficient commercial transactions. In the European Union, privacy is hailed as a fundamental right that can trump other interests. Even at the threshold level -- determining what information is covered by the regulation -- the United States and European Union differ significantly. The existence of personal information -- commonly referred to as “personally identifiable information” (PII) -- triggers the application of privacy law. The U.S. and the European Union define this essential term of privacy law quite differently. The U.S. approach involves multiple and inconsistent definitions of PII that are often particularly narrow. The EU approach defines PII to encompass all information identifiable to a person, a definition that can be quite broad and vague. This divergence is so basic that it threatens the stability of existing policy mechanisms for permitting international data flows.In this Essay, we propose a way to bridge these differences regarding PII. We contend that a tiered approach to the concept of PII (which we call “PII 2.0”) represents a superior way of defining PII compared to the current approaches in the United States and European Union. We also argue that PII 2.0 is consistent with the different underlying philosophies of the U.S. and EU privacy law regimes. Under PII 2.0, all of the Fair Information Practices (FIPs) should apply when data refers to an identified person or when there is a significant risk of the data being identified. Only some of the FIPs should apply when data is merely identifiable, and no FIPs should apply when there is a minimal risk that the data is identifiable. We demonstrate how PII 2.0 furthers the goals of both U.S. and EU privacy law and how PII 2.0 is consistent with their different underlying philosophies. PII 2.0 thus advances the process of bridging the current gap between U.S. and EU privacy law.

Restoring Americans' Privacy in Electronic Commerce Symposium - The Legal and Policy Framework for Global Electronic Commerce: A Progress Report

Restoring Americans' Privacy in Electronic Commerce Symposium - The Legal and Policy Framework for Global Electronic Commerce: A Progress Report

The Networking Dead: An Attempt to Define Statutory Third-Party Publicity Rights in Digital Estates

With the advent of social networking, one’s online identity and their personal information become embedded within the online personas of others. One problem of digital estates is this: Consider the personal information of third-parties such as: i) families of the deceased concerned with privacy, or ii) those consociates who have “friended” the deceased online or who, perhaps, are the subject-matter of the deceased’s copyrighted content, e.g., such as photographs. How is that shared information of those parties protected, even after the deceased has passed? In Europe, there are “fair information practice” standards codified by law. Regardless of whether the information is held by the government or private entities, European citizens have legal rights to prevent their personal information from being misused. The United States has no such comprehensive protection for its citizens.Nor will contract law provide U.S. citizens comparable substantive rights under a third-party beneficiary theory. The law of torts will instead be explored to clarify the public policy rationales that have been successful in underpinning privacy and limitations over publication of personal information. But, also and especially, the law of property will be investigated. This is in line with leading scholars who have posited that property interests could be a viable way to internalize the costs of information to those who would primarily benefit from that information. In Part I, we define the “third-parties” whose interests are at issue by tying the concept to those whose personally identifiable information has been captured. In Part II, we analyze the existing obstacles and loopholes that serve to vitiate end-users rights to their own data. We also propose that at least one way to avoid those pitfalls is to formalize a property right in a person’s data from the onset. In Part III, we analyze certain exemplars which can be used to fashion a better regulatory scheme, based on such a property right. Part IV concludes, while an appendix contains a sample code wherein a jurisdiction might attempt to implement our suggested solution.

Big Data: The End of Privacy or a New Beginning?

‘Big Data’ refers to novel ways in which organizations, including government and businesses, combine diverse digital datasets and then use statistics and other data mining techniques to extract from them both hidden information and surprising correlations. While Big Data promises significant economic and social benefits, it also raises serious privacy concerns. In particular, Big Data challenges the Fair Information Practices (FIPs), which form the basis of all modern privacy law. Probably the most influential privacy law in the world today is the European Union Data Protection Directive 95/46 EC (DPD). 1 In January 2012, the European Commission (EC) released a proposal to reform and replace the DPD by adopting a new Regulation. 2 In what follows, I argue that this Regulation, in seeking to remedy some longstanding deficiencies with the DPD as well as more recent issues associated with targeting, profiling, and consumer mistrust, relies too heavily on the discredited informed choice model, and therefore fails to fully engage with the impending Big Data tsunami. My contention is that when this advancing wave arrives, it will so overwhelm the core privacy principles of informed choice and data minimization on which the DPD rests that reform efforts will not be enough. Rather, an adequate response must combine legal reform with the encouragement of new business models premised on consumer empowerment and supported by a personal data ecosystem. This new business model is important for two reasons: First, existing business models have proven time and again that privacy regulation is no match for them. Businesses inevitably collect and use more and more personal data, and while consumers realize many benefits in exchange, there is little doubt that businesses, not consumers, control the market in personal data with their own interests in mind. Second, a new business model, which I describe below, promises to stand processing of personal data on its head by shifting control over both the collection and use of data from firms to individuals. This new business model arguably stands a chance of making the FIPs efficacious by giving individuals the capacity to benefit from Big Data and hence the motivation to learn about and control how their data are collected and used. It could also enable businesses to profit from a new breed of services

Privacy by Design: A Counterfactual Analysis of Google and Facebook Privacy Incidents

Regulators here and abroad have embraced “privacy by design” as a critical element of their ongoing revision of current privacy laws. The underlying idea is to “build in” privacy— in the form of Fair Information Practices or (“FIPs”)—when creating software products and services. But FIPs are not self-executing. Rather, privacy by design requires the translation of FIPs into engineering and usability principles and practices. The best way to ensure that software includes the broad goals of privacy as described in the FIPs and any related corporate privacy guidelines is by including them in the definition of software “requirements.” And a main component of making a specification or requirement for software design is to make it concrete, specific, and preferably associated with a metric. Equally important is developing software interfaces and other visual elements that are focused around end-user goals, needs, wants, and constraints. This Article offers the first comprehensive analysis of engineering and usability principles specifically relevant to privacy. Based on a review of the technical literature, it derives a small number of relevant principles and illustrates them by reference to ten recent privacy incidents involving Google and Facebook. Part I of this Article analyzes the prerequisites for undertaking a counterfactual analysis of these ten incidents. Part II presents a general review of the design principles relevant to privacy. Part III turns to ten case studies of Google and Facebook privacy incidents, relying on the principles identified in Part II to discover what went wrong and what the two companies might have done differently to avoid privacy violations and consumer harms. Part IV of the Article concludes by arguing that all ten privacy incidents might have been avoided by the application of the privacy engineering and usability principles identified herein. Further, we suggest that the main challenge to effective privacy by design is not the lack of design guidelines. Rather, it is that business concerns often compete with and overshadow privacy concerns. Hence the solution lies in providing firms with much clearer guidance about applicable design principles and how best to incorporate them into their software development processes. Regulators should provide greater guidance on how to balance privacy with business interests, along with appropriate oversight mechanisms. © 2013 Ira S. Rubinstein & Nathaniel Good. † Adjunct Professor of Law and Senior Fellow, Information Law Institute, New York University School of Law. †† Principal, Good Research LLC. This Article was presented at the NYU Privacy Research Group and at the 2012 Privacy Law Scholars Conference, and we are grateful for the comments of workshop participants. Ron Lee, Paul Schwartz, and Tal Zarsky provided valuable suggestions on an earlier draft. Thanks are also due to Jeramie Scott and Mangesh Kulkarni for excellent research assistance and to Tim Huang for his help with citations. A grant from The Privacy Projects supported this work. 1334 BERKELEY TECHNOLOGY LAW JOURNAL [Vol. 28:1333

Big Data: The End of Privacy or a New Beginning?

“Big data” refers to novel ways in which organizations, including government and businesses, combine diverse digital data sets and then use statistics and other data mining techniques to extract from them both hidden information and surprising correlations. While big data promises significant economic and social benefits, it also raises serious privacy concerns. In particular, big data challenges the Fair Information Practices (FIPs) as embodied in various privacy laws including the EU Data Protection Directive. This past January, the European Commission released a proposal to reform and replace the Directive by adopting a new Regulation. In this paper, I argue that this Regulation relies too heavily on the discredited informed choice model, and therefore fails to fully engage with the coming big data tsunami. My contention is that when this advancing wave arrives, it will so overwhelm the core privacy principles of informed choice and data minimization on which the Directive rests that reform efforts alone will prove inadequate. Rather, an adequate response must combine legal reform with encouragement of new business models premised on consumer empowerment and supported by a personal data ecosystem. This new business model is important for two reasons: first, existing business models have proven time and again that privacy regulation is no match for them. Businesses inevitably collect and use more and more personal data, and while consumers realize many benefits in exchange, there is little doubt that businesses, not consumers, control the market in personal data with their own interests in mind. Second, a new business model, which I describe in this paper, promises to stand processing of personal data on its head by shifting control over both the collection and use of data from firms to individuals. This “control shift” — and this alone — stands a chance of making the FIPs efficacious by giving individuals the capacity to benefit from big data and hence the motivation to learn about and control how their data is collected and used, while also enabling businesses to profit from a new breed of services that are both data-intensive and imbued with privacy values.

Privacy by Design: A Counterfactual Analysis of Google and Facebook Privacy Incidents

Regulators here and abroad have embraced “privacy by design” as a critical element of their ongoing revision of current privacy laws. The underlying idea is to “build in” privacy (in the form of Fair Information Practices or FIPs) when creating software products and services. But FIPs are not self-executing. Rather, privacy by design requires the translation of FIPs into engineering and usability principles and practices. The best way to ensure that software includes the broad goals of privacy as described in the FIPs and any related corporate privacy guidelines is by including it in the definition of software “requirements.” And a main component of making a specification or requirement for software design is to make it concrete, specific and preferably associated with a metric. Equally important is developing software interfaces and other visual elements that are focused around end-user goals, needs, wants and constraints. The Article offers the first comprehensive analysis of engineering and usability principles specifically relevant to privacy. Based on the relevant technical literature, it derives a small number of relevant principles and illustrates them by reference to ten recent privacy incidents involving Google and Facebook. The Article concludes that all ten privacy incidents might have been avoided by the application of these privacy engineering and usability principles. Further, we suggest that the main challenge to effective privacy by design is not the lack of design guidelines. Rather, it is that business concerns often compete with and overshadow privacy concerns. Hence the solution lies in providing firms with much clearer guidance about applicable design principles and how best to incorporate them into their software development processes. Greater guidance is also needed for how to balance privacy with business interests, and there must be oversight mechanisms as well.