CIS-2005 : Xi’an - China 1 A New Conceptual Framework within Information Privacy: Meta Privacy Mr. Geoff Skinner Dr Song Han Prof. Elizabeth Chang Curtin University of Technology Perth, WA, Australia.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 2 Overview Introduction Information Privacy Metadata and Meta-Structure Meta Privacy Definition Meta Privacy Principles Meta Privacy Components Meta Privacy Protection Conclusion Questions

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 3 Introduction The need for excessive and increasing data collection habits is a cause for concern. Management of metadata and metastructure information involves serious privacy considerations. Entities are not given a reasonable spectrum of choices for what information you provide in order to use a service.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 4 What is Privacy? – The right to be left alone. – The maintenance of personal space. – Subjective, context and environmentally specific.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 5 What is Privacy? Privacy has a number of dimensions [Clarke]: – Privacy of the person: medical conditions, etc. – Privacy of personal behaviour: religion, sex, etc. – Privacy of personal communication. – Privacy of personal data.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 6 Privacy and Security Information Privacy: ‘is the interest an individual has in controlling, or at least significantly influencing, the handling of data about themselves’ [Clarke]. Data / Information Security IS NOT Data / Information Privacy. Rather Information Security is a tool that can be used to facilitate Information Privacy.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 7 Privacy and Security The concepts of Information Security, Privacy, and Trust are closely inter-related and often inter-dependant. PET’s : Privacy Enhancing Technologies. Include encryption, filters, anonymizers, cookie cutters, etc.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 8 Metadata and Meta-Structure Metadata provides information about, or documentation of, other data managed within an application, system, or environment. Metadata can also provide descriptive information about an organizations data, data activities, systems, and holdings.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 9 Meta-Structure The Metastructure components are composed of the data concerned with the functioning and structural details of the information systems and their many components. This may include: – information on the access controls used in the systems – the system and policy frameworks which supplies rules regarding the relationships within the systems and policies – other information about the system and component structures.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 10 Understanding Meta Privacy Current privacy protection approaches unable to provide protection across a broad spectrum of information privacy issues. Solutions applied in an ad-hoc fashion resulting in a piecemeal approach to privacy protection. Need system privacy controls designed and integrated into the system that entities are unable to circumvent.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 11 Meta Privacy - Definition Meta Privacy means ensuring the security and privacy of data about privacy and personal data. Meta privacy is concerned with the security and privacy of the information used to support other system services and processors that may impact upon an entities privacy. This encompasses the protection of metadata and metastructure information that may reveal an entities identity and other personal information.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 12 Meta Privacy - Definition Entity may be an individual, group, or organization. Individual represents a singular entity, most often a human being. A group is defined as a ‘non-committed’ informal relationship between entities. An organization is defined as a committed formal relationship between entities. The members of an groups and organization may be individuals, groups, and other organizations.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 13 Meta Privacy

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 14 Meta Privacy Practices Proper Meta Privacy practises would ensure that none of the personal information contained in the metadata and metastructure is used for any purpose other than that specially agreed upon by the personal information owner. Also metadata is not provided to any third party not authorized to access the data without the owners express permission.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 15 MPR and MPB Meta-information and processes making use of metadata and metastructure information can be classified as either: – Meta Privacy Risks (MPR) – Meta Privacy Benefits (MPB).

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 16 Meta Privacy Risks Where metadata provides information about the content, quality, condition, and other characteristics of entity data it can be classified as being in a Meta Privacy Risks (MPR) category.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 17 Meta Privacy Benefits The use of meta-information for privacy protection. Meta privacy tags and metadata can be used for entity privacy policy preferences representation and enforcement. The use of metadata and metastructure information in this way is classified as Meta Privacy Benefits (MPB).

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 18 Meta Privacy Benefits The leading example of use of metadata for representing privacy preferences is P3P. Other approaches have been proposed that use metadata and metastructure information to protect personal data and privacy in a number of alternate operational settings. E.G.: associating and storing metadata for representing individual items of personally identifiable information (PII).

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 19 Meta Privacy Components Meta Privacy therefore encompasses both Meta Privacy Risk and Meta Privacy Benefit categories. Where metadata and metastructure information contains details that reflect some level of knowledge pertaining to an individual’s identity or other forms of personal information They are a potential risk to privacy.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 20

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 21 Meta Privacy Protection Metadata and metastructure information has to be protected by the same levels of security used to protect personal information. System owners and the entities providing their personal information need to be aware of metadata generation and usage. Should be subjected to the same privacy policy guidelines selected by an entity to protect their personal data.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 22 Meta Privacy Protection Unlinkability Unobservability Use of Pseudo-Anonymous and Anonymous Data Requires same levels of protection provided to personal data and PII.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 23 Concluding Remarks Have formally defined Meta Privacy. Meta Privacy has two main elements: – Meta Privacy Benefits – Meta Privacy Risks Have shown that meta-data and meta-structural information must be afforded to the same levels of privacy and security protection given to personal data and PII. Highlighted the need to understand and give due consideration to meta privacy protection.

CIS05 Xi’an China Geoff Skinner, Song Han & Elizabeth Chang 24 Questions ? ??