Embedding Privacy Controls in OnLine Identity Mechanism: How and Why?

Issue/Topic: Embedding Privacy Controls in OnLine Identity Mechanisms: How and Why?

Convener: Kasey Chapell

Session: 5B

Conference: IIW-Europe October 11, London Complete Notes Page

Notes-taker(s): Dave Birch

Tags for the session - technology discussed/ideas considered:

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

The Privacy Policy Crisis: The privacy policies are not appropriate to the technology.

A "legalistic" policy makes no sense because customers can't make an informed choice based on informed consent (see VOME).

Companies are not meeting the "spirit" of the law.

We overly rely on consent.

Is there a way around this?

VOME are working on visualisation.

There are three basic categories of consumers: paranoid, don't care, pragmatists (trust based on other things: brand, and so on).

These groups require different kinds of input and education.

We need a new vocabulary for privacy.

Are we communicating with consumers or with consumer groups?

Watchdogs or crypto?

Lawyers have no incentives to come up with standard policies.

We could ask the technology community to propose alternatives as part of the Commission's Data Protection review but they wouldn't understand them so what's the point.

European Consumer Protection organisation

Touch2ID is an example where the technology obviates the need for privacy profiles.

For targeted marketing, companies don't need to know who you are.

The regulatory environment treats "profiles" as personal information.

Companies are beginning to provide more granularity over the control of data.

The consumer "wins" need to be tangible.

Some data is much more sensitive than others, such as location

Here's an example policy:

Because we understand that you would be concerned if people could locate you without your knowledge, Vodafone takes robust measures to ensure that all location based service providers that use Vodafone network location data as part of their services comply with the Industry Code of Practice For the Use of Mobile Phone Technology to Provide Passive Services in the UK [From UK - About Vodafone UK - Legal Information - Privacy Policies - Location based services]

Google can use location data more freely than telecoms companies, another quirk of the law. This sort of thing happens because privacy regulations are often formed in response to specific outlying events rather than according to general principals.

What can technology offer? Some combination of personal data stores (PDS), VRM and the like.

Is there an analogy between privacy and organ donation? Once you make it opt-in, then participation rates fall.

New legislation will bring breach notification to Europe.

Perhaps multiple identities might provide a way forward: give up on privacy, and when an identity is violated, it gets deleted.

There are no criminal penalties for privacy breach.

How can we balance or cap the liabilities associated with identities? Suppose a mobile phone company was an IDP -- if the liabilities are too draconian then how could it be a business.

One remedy under consideration for review in the data protection directive is a "private cause of action" which means that consumer groups could sue for violations.