Scott Cadzow attended and presented to the 1st Annual Privacy Forum covering the role of standards in privacy protection and definition. The following report is a summary of the event at an impressionist level. The audience and the presenters were drawn from the major social network providers (Facebook, Google, Microsoft), from the EU data commissioner community, from academia, from European business and telecommunications, from FP7 projects (including i-Tour and i-SCOPE) and from the standards community. The last 3 were all represented by Scott Cadzow.
A good event with major impact to the debate that needs to be very seriously followed up as there was genuine momentum and interest gathered over the event towards searching for wider solutions. The overriding message from the first few sessions is that privacy is complex and easily manipulated in favour of the privacy attacker – a message that was never really challenged throughout the event. In particular Allesandro Acquisti showed some experimental results that illustrate a key problem: Understanding of privacy is transient and can be manipulated by subtle modification of the content of the questions asked to initiate private data transfer, and further manipulated by asking for data outside the scope of the agreed consent after the consent has been given. The example linking facial recognition to detail social network profiles and governmental level data (e.g. social security numbers) illustrating the power of data linking and data farming to reveal detailed private data (even if all of that data is on “open” resources) would raise concerns if the capability was wider known. The theme that seemed to be set by this opening exchange was that privacy violation is simple without recourse to any sophisticated tools or knowledge and that any protection model that looks at single instances of private data will be inadequate.
A number of technical approaches to the solution of the privacy problem were proposed at different parts of the privacy domain, ranging from using UML’s extended requirements engineering module to analyse the roles of stakeholders and counter-stakeholders but it falls down a little (not to denigrate the importance on the work) on the ability of the modeller to synthesise a complete model. Further presentations showed how unlinked most policies and implementations are in practice but worryingly don’t seem to engage with those having the broken implementations on resolving the issues. In fact the research goals would appear to be to highlight the problem and not to fix it. Justifying that a problem exists in privacy is simply more fuel on an already raging fire whereas my interest in the event was how we can dowse the fire by removing the problems.
There was a lot of discussion of legality – however it was made clear that many of those who have given cause for concern are either non-EU organisations or have funds to pay lawyers to ensure that interpretations of conformance work in their favour (often in fact they were both). There was some but quite low key mention of the acceptance by users of poor privacy protection. In other words there is no option but to accept a policy if the service is required even if the impacted user is uncertain of the impact on privacy of signing a consent box – this seems wrong but didn’t get explored in sufficient detail to identify if data regulation is assisting or not. Another area where too little emphasis was given was on rebalancing the current trend to reduce privacy protection to data protection (often the terms are used as synonyms) rather than re-focussing on wider privacy protection by opening the field to locational and behavioural privacy and, perhaps the biggest challenge, to the problem of addressing long term privacy protection.
From my personal perspective now of addressing privacy protection in the worlds of open data for smart city environments the continuous retreat into data protection as a synonym for privacy protection is both disappointing and worrying. The work in smart city, smart society, smart citizen environments is to reinforce the social contracts we have to support each other whereas it seemed that many of the presentations and a lot of the debate was surrounding how to turn privacy protection as a service to an economic advantage. The regulation panels also reinforced some of the concerns that data protection is a synonym for privacy protection although not through lack of desire but a more worrying lack of support to address the wider domain of privacy protection.
