Privacy CSC385 Kutztown University Fall 2009 Oskars J. Rieksts

2009Kutztown University2 Notes on Privacy Based on Lawrence Snyder Based on Lawrence Snyder Fluency in Information Technology Fluency in Information Technology Augmented with my notes Augmented with my notes See also: topics/privacy/notes.html See also: topics/privacy/notes.html topics/privacy/notes.html topics/privacy/notes.html

2009Kutztown University3 Outline Privacy basics Privacy basics Threats to privacy Threats to privacy Personal information control Personal information control FIP principles FIP principles Privacy practices Privacy practices Cookies Cookies Cryptography Cryptography Data mining Data mining

2009Kutztown University4 Privacy Basics Definition – “The right of people to choose freely under what circumstances and to what extent they will reveal themselves to others.” – p. 481 Definition – “The right of people to choose freely under what circumstances and to what extent they will reveal themselves to others.” – p. 481 Rieksts: Privacy is the cornerstone of selfhood Rieksts: Privacy is the cornerstone of selfhood Modern devices & privacy Modern devices & privacy Chief Justice, Louis Brandeis Chief Justice, Louis Brandeis

2009Kutztown University5 Basis of Privacy Conflict Modern life requires Modern life requires Revelation of information Revelation of information  Financial transactions  Applications  Medical services  Etc.

2009Kutztown University6 Basic Privacy Issue Ownership of information Ownership of information Related IT ownership issue Related IT ownership issue  Your machine  Contents of your machine  Files  Software

2009Kutztown University7 Threats to Privacy Criminal element Criminal element  Identity theft  Cyber-stalking  Organized crime Business & industry Business & industry  Marketing  Employment

2009Kutztown University8 Threats to Privacy Enemies of public safety Enemies of public safety Governments Governments  Totalitarian regimes  Overzealous public servants Social engineers Social engineers

2009Kutztown University9 Spectrum of Personal Information Control The lens The lens  Transaction produces information Basic categories Basic categories  No uses  Opt-In or Approval  Opt-Out or Objection  Internal use only  No limits

2009Kutztown University10 Storage & Use beyond transactional necessity No uses No uses  Delete information  Upon completion of transaction Opt-In Opt-In  Permission must be requested  Explicit approval required

2009Kutztown University11 Storage & Use beyond transactional necessity Opt-Out Opt-Out  S&U is OK  Unless specifically objected to Internal use only Internal use only  S&U OK  Only for business itself No limits No limits

2009Kutztown University12 FIP Principles FIP = fair information practices FIP = fair information practices Standard 8 point list Standard 8 point list Developed in 1980 by OECD Developed in 1980 by OECD OECD = Organization of Economic Cooperation and Development OECD = Organization of Economic Cooperation and Development

2009Kutztown University13 Eight FIP Principles Limited Collection Limited Collection Quality Quality Purpose Purpose Use Limitation Use Limitation Security Security Openness Openness Participation Participation Accountability Accountability

2009Kutztown University14 Limited Collection Principle Limits to data collected Limits to data collected Collection by Collection by  Fair means  Lawful means Knowledge & consent required Knowledge & consent required  If possible  When appropriate

2009Kutztown University15 Quality Principle Relevance Relevance  Data must be relevant  to collection purpose Data must be Data must be  Accurate  Complete  Up to date

2009Kutztown University16 Purpose Principle Purpose of collection stated Purpose of collection stated Use limitation Use limitation  Use limited to..  stated purpose

2009Kutztown University17 Use Limitation Principle Data not to be disclosed Data not to be disclosed No use for other purposes No use for other purposes Unless.. Unless..  Consent given by individual  Authority granted by law

2009Kutztown University18 Security Principle Data controller must.. Data controller must.. Exercise reasonable security measures Exercise reasonable security measures

2009Kutztown University19 Openness Principle Data collection policies & practices.. Data collection policies & practices.. Open to the public Open to the public Public knowledge of.. Public knowledge of..  Existence of data  Kind of data  Purpose/use of data  Identity & contact information of  Data controller

2009Kutztown University20 Participation Principle Individual able to determine.. Individual able to determine..  Whether data controller has information  What the information is Denial of access can be challenged Denial of access can be challenged Information can be challenged Information can be challenged

2009Kutztown University21 Accountability Principle Data controller accountable.. Data controller accountable.. for FIP Principles compliance for FIP Principles compliance

2009Kutztown University22 Privacy Practices – EU European Union European Union A ccepts OECD FIP principles A ccepts OECD FIP principles Has European Data Protection Directive Has European Data Protection Directive EU citizen protection standard EU citizen protection standard  Extends beyond EU borders

2009Kutztown University23 Privacy Practices – U.S.A. Sectoral approach Sectoral approach Freedom of Information Act – 1966 Freedom of Information Act – 1966 Privacy Act of 1974 (wrt government) Privacy Act of 1974 (wrt government) Electronics Communication Privacy Act – 1986 Electronics Communication Privacy Act – 1986 Video Privacy Protection Act – 1988 Video Privacy Protection Act – 1988 Telephone Consumer Protection Act – 1991 Telephone Consumer Protection Act – 1991 Drivers Privacy Protection Act – 1994 Drivers Privacy Protection Act – 1994

2009Kutztown University24 Freedom of Information Act – Links One OneOne Two TwoTwo Three ThreeThree Four Four Four Four

2009Kutztown University25 Privacy Act of 1974 – Links One OneOne Two TwoTwo Three ThreeThree

2009Kutztown University26 Electronic Communications Privacy Act One One One Two Two Two Three ThreeThree Efforts to update Efforts to update

2009Kutztown University27 Video Privacy Protection Act One OneOne Two TwoTwo Three ThreeThree

2009Kutztown University28 Telephone Consumer Protection Act One One One Two Two Two Three Three Three

2009Kutztown University29 Driver Privacy Protection Act One OneOne Two TwoTwo Three ThreeThree Four FourFour

2009Kutztown University30 Privacy Advocacy EPIC EPIC  Electronic Privacy Information Center  About About  Home Page Home PageHome Page Privacy Rights Clearinghouse Privacy Rights ClearinghousePrivacy Rights ClearinghousePrivacy Rights Clearinghouse Electronic Frontier Foundation Electronic Frontier Foundation  About About  Wikipedia Wikipedia

2009Kutztown University31Cookies 7-field record 7-field record Uniquely identifies.. Uniquely identifies.. customer session on website customer session on website

2009Kutztown University32 Cookies – 3 rd Party Problem Advertiser on contacted website Advertiser on contacted website  Client/server relationship with customer Allows 3 rd party cookies Allows 3 rd party cookies  Placed  Accessed  from various sites Discussion Discussion Discussion