Privacy Policy Referencing
Audun Jøsang
1
and Lothar Fritsch
2
and Tobias Mahler
3,2
1
UNIK University Graduate Center - University of Oslo
josang@unik.no
2
Norwegian Computing Center
Lothar.Fritsch@NR.no
3
Norwegian Research Center for Computers and Law - University of Oslo
tobias.mahler@jus.uio.no
Abstract. Data protection legislation was originally defined for a context where
personal information is mostly stored on centralized servers with limited con-
nectivity or openness to 3rd party access. Currently, servers are connected to the
Internet, where large amounts of personal information are continuously being ex-
changed as part of application transactions. This is very different from the origi-
nal context of data protection regulation. Even though there are rather strict data
protection laws in an increasing number of countries, it is in practice rather chal-
lenging to ensure an adequate protection for personal data that is communicated
on-line. The enforcement of privacy legislation and policies therefore might re-
quire a technological basis, which is integrated with adequate amendments to the
legal framework. This article describes a new approach called Privacy Policy Ref-
erencing, and outlines the technical and the complementary legal framework that
needs to be established to support it.
1 Introduction
Data protection law regulates the processing of information related to individual per-
sons, including their collection, storage, dissemination etc.
Privacy concerns exist wherever personally identifiable information is collected and
stored – in digital form or otherwise. Some forms of processing personal information
can be against the interests of the person the data is associated with (called the data
subject). Data privacy issues can arise with respect to information from a wide range of
sources, such as: Healthcare records, criminal justice investigations and proceedings,
financial institutions and their transactions, private sector customer data bases, social
communities, mobile phone services with context awareness, residence and geographic
records, and ethnicity information. Amongst the challenges in data privacy is to share
selected personal data and permit the processing thereof, while inhibiting unwanted or
unlawful use, including further dissemination. The IT and information security disci-
plines have made various attempts at designing and applying software, hardware, proce-
dures, policies and human resources in orderto address this issue. National and regional
privacy protection laws are to a large extent based on the OECD data privacy principles
In the proceedings of the 7th International Conference on Trust, Privacy & Security in Digital
Business (TRUSTBUS’10), Bilbao, August-September, 2010.
defined in 1980 [21], e.g. the EU Data Protection Directive [13]. The legal framework
for data protection has been adapted to take into account some of the changes in tech-
nology, but the constant technological change has been challenging to follow up. In
the 70s and 80s personal information was stored on mainframe computers, on punch
cards or on tape rolls with limited connectivity. The Internet only existed in the form of
the experimental ARPANET, and no commercial applications had been conceived. It is
natural that the principles defined by the OECD in 1980 reflected the computing infras-
tructure at that time, and the principles can be judged as relatively adequate from that
perspective. Since then, the legal framework has struggled in keeping up with changes
in the technology.
On the technological side, a long track of information security research exists. Their
focus is the development of privacy-enhancing technology (PET) in support of the -
mostly legally derived - requirements for personal information handling. A brief histor-
ical overview over privacy regulation and PET is given in [15]:
Starting in the 1970ies, regulatory regimes were put on computers and net-
works. Starting with government data processing, along the lines of computer-
ization of communication and workflows, explicit rules like the European Data
Protection Directive [7] have been put in place. With the adoption of Inter-
net and mobile telephony in society in the past decade, the privacy challenges
of information technology came to everyday life.The PET research perspective
focused to a certain degree on the legal foundations of privacyprotection, deter-
mined by constitutional and fundamental human rights that should be protected
using technology. This view is shown in an analysis of the PET vocabulary in
[18]. As rights are granted to individuals, much of the research has focused
on the user-side, e.g. visible in Pfitzmann/Hansen’s well-quoted terminology
paper [23]. The legal view is propagated into contemporary frameworks like
the Canadian [22] and Dutch [28] privacy legislation, which both define pri-
vacy audit schemes with detailed procedural definitions and responsibilities,
but neglect to provide a decision support method for managers that would en-
able them to make feasible decisions about privacy needs based on quantifiable
risks. Most of these criteria, including schemes like Datenschutz-G¨utesiegel
[16], provide checklists with questions for the auditors. They inherently call
for competent – and well-paid – external experts when they are used by a com-
pany, but are rarely based on empirical data or metrics. The PET award winning
taxonomy of privacy [26] is very visibly structured along the legal view on pri-
vacy.
Many assumptions underlying traditional PETs (Privacy Enhancing Technologies) are
no longer valid. Users have little control overinformationthey providetoservice providers,
which e.g. exposes them to various profiling risks [14]. M. Peter Hustinx, the European
Data Protection Supervisor, said in his keynote talk at NordSec 2009
4
that the EU and
OECD have recognized the erosion of the adequacy of the classic privacy principles af-
ter the emergence of the Internet. In 2009, these organizations therefore have initiated a
4
”Privacy in the Internet Age” URL: NordSec2009.unik.no
process for defining new and more adequate privacy principles for networked environ-
ments. Similarly, in a keynote speech at the Data Protection Day on 28 January 2010 at
the European Parliament, Brussels, Viviane Reding
5
expressed the intention to present a
legislative proposal for reforming the European Privacy Directive before the end of the
year (2010), and launched the concept of ”privacy by design” [24] which specifies that
privacy requirements must always be included in the design of new Internet technolo-
gies. In her speech she said that the new legal framework should address new challenges
of the information age, such as globalisation, development of information technologies,
the Internet, online social networking, e-commerce, cloud computing, video surveil-
lance, behavioural advertising, data security breaches, etc.
Privacy policies are sometimes used by organizations that collect and process per-
sonal information. However, users often pay little or no attention to these privacy poli-
cies, and once the personal information has been collected, it is practically impossible
to verify that the specified privacy policies are being adhered to. There is also scien-
tific evidence that user-side reading of privacy policies is in conflict with basic market
economic principles [30].
It can also be mentioned that the protection of personal data is sometimes in conflict
with other interests of individuals, organizations or society at large. Several occasions,
for example the ’war on terrorism’, showed that the European Union delivers passenger
flight databases, SWIFT financial transactions, and telecommunications data to authori-
ties outside the EU legislation. In such cases, no consent is necessary, if such disclosure
is lawful under the applicable law.
From this brief survey it seems timely to rethink how information privacy should be
defined and enforced in the online environment. This paper looks at the inadequacy of
the current approach to information privacy protection, and proposes a new approach
based on attaching policy metadata to personal information. By requiring that the meta-
data follows personal information, it becomes easy to verify whether the policies are
being adhered to. In addition, one should consider standardizing privacy policies in the
form of a limited set of easily recognizable rules to improve the usability of privacy
protection.
2 The Inadequacy of the Current Approach
2.1 Business decision-making and privacy technology
For any deployment of PET into information systems, the effectiveness of the PET
measure against threats is important [15]. While PET cost of installation and opera-
tion could be assessed with experiments, the efficiency of their deployment remains
unknown. In the computer science field, several contributions provide information the-
oretic models for anonymity, identifiability or the linkability of data, e.g. in [27]or in
[10]. Both papers build mathematical models that are rather impractical for usage in
the evaluation of large-scale information systems. Another suggestion comes from an
article on intrusion detection by user context modeling [19], where the author tries to
identify attacks by classification of untypical user behavior. Such behavioral analysis
5
Member of the European Commission responsible for Information Society and Media Privacy
can be developed into a tool to measure effectiveness of PET. From some experiments
on profiling people with publicly available data from the Internet [9], one might try
to use profiling output as a measure of the quality of PET systems. But the definition
of the information that counts as a part of a profile, as well as the question of how to
distinguish leaked information from intentionally published personal information make
profiling a rather impractical metric. With these difficulties in measuring effectiveness
of PET, how will we judge efficiency? Also, for the deployment of PET on the business
side, or the acceptance of some extra effort by users adapting to PETs, there are more
questions to ask:
– Which PET will remove or reduce a particular risk? At what cost will a particular
PET remove a particular risk?
– How much effort (instruction, change of system usage habits, change of behavior,
self-control) had to be spent on the user-side for the PET to be effective?
– Is there a cheaper or more convenient alternative on how to deal with a particular
risk instead of PET deployment?
2.2 Inadequacy of Technical Privacy Strategies
Public surveys indicate that privacy is a major concern for people using the Internet [6].
Privacy related complaints that are made to the US Federal Trade Commission include
complaints about unsolicited email, identity theft, harassing phone calls, and selling of
data to third parties [20]. One attempt to address privacy concerns and thereby increase
user trust in the Web is the W3C’s Platform for Privacy Preferences (P3P) Project [8].
P3P enables Web sites to express their privacy practices in a standardized, XML-based,
format that can be automatically interpreted by user agents such as a Web browser. The
aim is that discrepancies between a site’s practices and the user’s preferences can be
automatically flagged. Nine aspects of online privacy are covered by P3P,including five
that cover data being tracked by the site: who is collecting the data; what information
is being collected; for what purposes is it being collected; which information is being
shared with others; and who are the data recipients. Four topics explain the site’s inter-
nal privacy policies: can users make changes in how their data is used; how are disputes
resolved; what is the policy for retaining data; and where can the detailed policies be
found in a‘human readable’ form. It would be fair to say that P3P has been a failure
because users and industry have not adopted it.One of the reasons might be that P3P
is unable to guarantee or enforce the privacy claims made by Websites. Despite its po-
tential, detractors say that P3P does not go far enough to protect privacy. They believe
that the aim of privacy technology should be to enable people to transact anonymously
[11]. Private privacy service providers or anonymisers have been proposed [29]. One
example is iPrivacy, a New York based company that around 2002 professed on its Web
site, “not even iPrivacy will know the true identity of the people who use its service”.
To utilize the technology, users first had to download software from the Web site of a
company they trusted, for example a bank or credit card company. When they wished to
purchase a product online, they used the software to generate a one-offfictitious identity
(name, address and email address). Users were given the choice of collecting the goods
from their local post office (their post or zip code is the only part of the address which is
correct) or having the goods delivered by a delivery company or postal service that has
been sent a decoded address label. Originally the iPrivacy software generated a one-off
credit card number for each transaction. The credit card issuer matched the credit card
number it received from the merchant with the user’s real credit card number and then
authorized payment. However,this proved to be a major job for banks to integrate and
is no longer offered by iPrivacy. There are still other companies such as Orbiscom.com
and Cyota.com (acquired by RSA) that do offer one-off credit card numbers,but these
have captured limited use to date. Another type of privacy provider or infomediary is
emerging which sells aggregated buyer data to marketers, but keeps individual identify-
ing information private [29]. One example of this is Lumeria, a Berkley based company
that provides royalties to people who participate. In the Lumeria system, users down-
load free software that encrypts their profile and stores it on Lumeria’s servers. The
user accesses the Web via a Lumeria proxy server, which shields their identity from
merchants and marketing companies whilst enabling marketing material that matches
their profile to be sent to them. However, none of these initiatives have been a success,
and many privacy providers have gone out of business. This is quite understandable, as
the anonymity solutions result in significant additional complexity and cost.
2.3 Inadequacy of Specifying Privacy Policies
Many data controllers specify privacy policies that can be accessed from the interface
where personal information is being collected or where consent to do so is given. Such
policies are sometimes of 10 pages or longer, and can be written in a jargon that makes
them inaccessible for most people. Users are normally required to accept the policies by
ticking a box, which all but very few do in a semi-automatic fashion.Users quickly learn
that reading such policies is very frustrating. In addition, users who might be opposed to
some clauses in the policy faces the organization alone, although many others might be
of the same opinion. It is difficult for users to organize themselves and exercise pressure
on organizations to change their privacy policies, but both data protection authorities
and consumer ombudsmen have succeeded in pressuring some organizations to change
their policies. Once personal information has been collected, users have no practical
way of verifying whether the policies are being adhered to. In practice, it would also
be difficult to trace personal information back to the point where it was collected. Once
inside the network or system of an organization, it often becomes very difficult to trace
personal information back to the point of origin and the applicable privacy policy. This
is precisely where our proposal offers a solution, whereby the applicable privacy policy
always is referenced by the metadata associated with any personal information. This
will be explained in further detail below.
The privacy policy interpretation and specification troubles are illustrated in a sur-
vey article that provides a taxonomy of ’privacy-supporting’ and ’privacy-consuming’
privacy clauses from real policies [1]. The survey clearly shows that most privacy poli-
cies on web pages are carefully drafted to lure the consumers into accepting privacy-
consuming clauses.
A privacy policy may fulfill several different functions [4] (p.239). First, it can be
used to provide information about how personal data is processed by the data controller,
and such information may be mandatory according to the law. Second and somewhat