Atos, Atos and fish symbol, Atos Origin and fish symbol, Atos Consulting and the fish symbol itself are registered trademarks of Atos Origin. (c) 2006 Atos Origin. Confidential information owned by Atos Origin, to be used by the recipient only. This document or any part of it, may not be reproduced, copied, circulated and/or distributed nor quoted without prior written approval from Atos Origin Turn Risk Into Advantage: Reconsideration of Privacy Compliance Incentives Aljosa Pasic Budapest, May18, 2010

Privacy…in products, solutions, services, operations… Regulations are pretty general (for instance, the “Proportionality Principle”) National Guidelines are sometimes incompatible with each other Evaluation of privacy compliance is a lengthy and costly process Sticks or Carrots for Service Providers??? Privacy dilemmas

Which way to go?  Not all privacy-related risk can be, or should be, treated as negative  Investments in privacy policy management should be based on risk optimization  Privacy value contain factors and variables that reflect the trade-offs an individual has to make between the benefits (e.g. gain of comfort, increased functionality, discounts) and risks (e.g. mistrust, disadvantages, risk of misuse or manipulation) …or this… This…

Evolution of Solution  Effective and efficient cost-benefit privacy impact analysis must integrate features that are unique to the each context and each domain, so the pre-existence of some sort of contextual integrity framework is a must  We need an integrated framework that provides a basis for the monetary valuation of potential gains and losses, but also structures and adequately weighs the uncertainty associated with diverse privacy elements  Cost-benefit analysis together with risk analysis and assessment of social factors should be used as mutually reinforcing analytical tools in the appraisal of proposed measures in situations involving large degrees of uncertainty.  Typical limitations in process-based risk assessments are related to the lack of detailed operational context, limited analysis and accounts of uncertainty, limited accounts of social costs and values, limited analysis of combined effects of different risk conditions, and the tendency for local optimization.  We want a structured approach to analyze complex systems, use of simulations to evaluate alternative privacy designs, influence diagrams, expected utility models of risk taking, and use of qualitative analysis in situation there is the lack of historic data (e.g. Atos recommendation tool called Metamender).  We will extend the original notion of contextual integrity in order to cover people, process, legislation, terminology and technology dynamics. Furthermore, we need to tune it for the particular objective or trade- off such as for example efficiency and effectiveness versus coverage.

Conclusions “He who would put security before liberty deserves neither” B. Franklin

Thank you FACING TECHNOLOGICAL CHALLENGES TOGETHER Aljosa Pasic (Atos Origin)