C MU U sable P rivacy and S ecurity Laboratory 1 Privacy Policy, Law and Technology Fair Information Practices September 9, 2008

C MU U sable P rivacy and S ecurity Laboratory 2 Assignments for HW2 #4  TRUSTe  Network Advertising Initiative  Safe Harbor  The Privacy Act of 1974  The Federal Wiretap Act  The Fair Credit Reporting Act  HIPPA  The Gramm-Leach Bliley Act  The Video Privacy Protection Act  Children's Online Privacy Protection Act  Family Educational Rights and Privacy Act (FERPA)  CPNI rules  Cable TV Privacy Act  EU Directive  PIPEDA (Canadian privacy law)  Japanese Personal Information Protection Act (PIPA)  California SB-1386  Australian Federal Privacy Law  Other US laws?  Other international laws?

C MU U sable P rivacy and S ecurity Laboratory 3 Using Library Resources

C MU U sable P rivacy and S ecurity Laboratory 4 CMU Libraries   Engineering and Science (a.k.a. E&S) –Location: Wean Hall, 4th floor –Subjects: Computer Science, Engineering, Mathematics, Physics, Science, Technology  Hunt (CMU’s main library) –Location: Its own building (possibly 2nd ugliest on campus behind Wean), between Tepper and Baker –Subjects: Arts, Business, Humanities, Social Sciences  Software Engineering Institute (a.k.a. SEI) –Location: SEI Building (4500 Fifth Avenue), 3rd floor –Subjects: Security, Software, Technology

C MU U sable P rivacy and S ecurity Laboratory 5 START HERE: Cameo  Cameo is CMU’s online library catalog –  Catalogs everything CMU has: books, journals, periodicals, multimedia, etc.  Search by key words, author, title, periodical title, etc.

C MU U sable P rivacy and S ecurity Laboratory 6 CAMEO: Search Result for “Cranor” Number of copies and status Library

C MU U sable P rivacy and S ecurity Laboratory 7 CAMEO: Search Result for “Solove” Due date

C MU U sable P rivacy and S ecurity Laboratory 8 If it’s not in Cameo, but you need it today: Local Libraries  Carnegie Library of Pittsburgh –Two closest locations Oakland: Practically on campus (4400 Forbes Ave.) Squirrel Hill: Forbes & Murray (5801 Forbes Ave.) –  University of Pittsburgh Libraries –16 libraries! Information science, Engineering, Law, Business, etc. –

C MU U sable P rivacy and S ecurity Laboratory 9 If it’s not in Cameo, and you can wait: ILLiad and E-ZBorrow  ILLiad and E-ZBorrow are catalogs of resources available for Interlibrary Loan from other libraries nationwide (ILLiad) and in Pennsylvania (E-ZBorrow)  Order items online (almost always free)  Wait for delivery – average 10 business days  Find links to ILLiad and E-ZBorrow online catalogs at

C MU U sable P rivacy and S ecurity Laboratory 10 Other Useful Databases  Links to many more databases, journal collections –Must be accessed on campus or through VPN –  Lexis-Nexis –Massive catalog of legal sources – law journals, case law, news stories, etc.  IEEE and ACM journal databases –IEEE Xplore and ACM Digital Library  INSPEC database –Huge database of scientific and technical papers  JSTOR –Arts & Sciences, Business, Mathematics, Statistics

C MU U sable P rivacy and S ecurity Laboratory 11 And of course…  Reference librarians are available at all CMU libraries, and love to help people find what they need – just ask!

C MU U sable P rivacy and S ecurity Laboratory 12 Writing a Literature Review

C MU U sable P rivacy and S ecurity Laboratory 13 Writing a literature review  What is a literature review? –A critical summary of what has been published on a topic What is already known about the topic Strengths and weaknesses of previous studies –Often part of the introduction or a section of a research paper, proposal, or thesis  A literature review should –be organized around and related directly to the thesis or research question you are developing –synthesize results into a summary of what is and is not known –identify areas of controversy in the literature –formulate questions that need further research Dena Taylor and Margaret Procter The literature review: A few tips on conducting it.

C MU U sable P rivacy and S ecurity Laboratory 14 Literature review do’s and don’ts  Don’t create a list of article summaries or quotes  Do point out what is most relevant about each article to your paper  Do compare and contrast the articles you review  Do highlight controversies raised or questions left unanswered by the articles you review  Do take a look at some examples of literature reviews or related work sections before you try to create one yourself –For an example, of a literature review in a CS conference paper see section 2 of

C MU U sable P rivacy and S ecurity Laboratory 15 Privacy terminology  Data subject  Data controller  Secondary use of data

C MU U sable P rivacy and S ecurity Laboratory 16 OECD fair information principles  _34255_ _1_1_1_1,00.html _34255_ _1_1_1_1,00.html  Collection limitation  Data quality  Purpose specification  Use limitation  Security safeguards  Openness  Individual participation  Accountability

C MU U sable P rivacy and S ecurity Laboratory 17 US FTC simplified principles  Notice and disclosure  Choice and consent  Data security  Data quality and access  Recourse and remedies US Federal Trade Commission, Privacy Online: A Report to Congress (June 1998),

C MU U sable P rivacy and S ecurity Laboratory 18 USACM Policy Recommendations on Privacy (June 2006)  y.htm y.htm

C MU U sable P rivacy and S ecurity Laboratory 19 Discussion

C MU U sable P rivacy and S ecurity Laboratory 20 The Prada NYC dressing room  e.com/ e.com/  What aspects seem privacy invasive?  How could the design be changed to reduce privacy concerns?

C MU U sable P rivacy and S ecurity Laboratory 21 Discussion questions  Which technologies are privacy invasive?  Which technologies are privacy protective?  Can we turn one into the other?  How can we use the FIPs in our analysis?

C MU U sable P rivacy and S ecurity Laboratory 22 Applying the FIPs  Google Street View  Gmail advertising  Hillman Library Web Cam  Amazon.com book recommendations  Giant Eagle Advantage Card  Transportation Security Administration watch lists