Towards End-to-End Privacy Control in the Outsourcing of Marketing Activities: A Web Service Integration Patrick C. K. HungDickson K.W. Chiu W.W. FungWilliam K. Cheung Raymond WongSamuel P.M. Choi Eleanna KafezaJames Kwok Jousha C.C. PunVivying S.Y. Cheng 1 BSIM0012

RECORDS MANAGEMENT 1. Introduction 2. Background Information 3. Towards End-to-End Privacy Control 4. Conclusions and Future Works Agenda

RECORDS MANAGEMENT Introduction  Marketing is a strategy for selling products more efficiently. ◦ sales promotion strategies for making consumers recognize a product’s existence ◦ persuading them to take purchase actions ◦ circulation strategies for efficiently delivering the desired product ◦ continuation strategies such as after-sales service and claim processing.  Outsourcing of marketing activities widely adopted ◦ raises the concern of privacy issues.

RECORDS MANAGEMENT Privacy  Privacy is a state or condition of limited access to a person. ◦ Ref: SCHOEMAN, E. D Philosophical Dimensions of Privacy: An Anthology. New York, NY, Cambridge Univ. Press.  Information privacy relates to an individual’s right to determine how, when, and to what extent information about the self will be released to another person or to an organization.

RECORDS MANAGEMENT Example Scenario  A bank performs a marketing campaign by calling its credit card holders.  Outsource the calling activity to a third-party service provider ◦ resource problems / other economic reasons  Personal information required ◦ name, credit card number, gender, age group, salary range, and even addresses activity  Under current practices, all the necessary credit card holders’ data are transferred in bulk from the bank to the marketing company. ◦ large amount of personal information.

RECORDS MANAGEMENT Example Process with Web Service Solution

RECORDS MANAGEMENT What is Web Service W3C definition of a Web Service ◦ has a unique Uniform Resource Identifier (URI)  URI are commonly in the form of URL ◦ can be defined, described, and discovered using XML ◦ supports exchange of XML messages via Internet- based protocols ◦ Supported by all major computing companies, e.g., IBM, Microsoft, Sun, and etc.

RECORDS MANAGEMENT Access Control Concepts

RECORDS MANAGEMENT Access Control Languages  Enterprise Privacy Authorization Language (EPAL) ◦ By IBM - privacy/ privacy/ ◦ encode an enterprise’s privacy-related data- handling policies and practices. ◦ An EPAL policy defines lists of hierarchies of data- categories, data-users, and purposes, and sets of actions, obligations, and conditions.  Platform for Privacy Preferences (P3P) ◦ Current W3C standard ◦

RECORDS MANAGEMENT A Layered Framework for Tackling Privacy Protection

RECORDS MANAGEMENT Conceptual Model of Web-Service Based Privacy Access Control

RECORDS MANAGEMENT Implementation Architecture

RECORDS MANAGEMENT Conclusion  A layered architecture and methodology for the facilitation of privacy control based-on Web services.  A conceptual model of Web-service-based privacy access control to facilitate the design of an implementation architecture.  Outsourced marketing companies can be integrated with adequate control and auditing.  Practicability showing how the call center software for a typical marketing activity can be integrated effectively with the banks’ Web service  Only the required part of a customer record is retrieved through the appropriate data views and sent one at a time to achieve strict end-to-end privacy.

RECORDS MANAGEMENT Future Work  Use P3P instead of EPAL  Ontology: Adopt OWL vocabularies for classifications  Critical success factors  Cost and technical requirements  Implementation issues  Extending the framework to other applicable scenarios such as credit reference agencies.