Not since the early 1970s, when computing pioneer Willis Ware chaired the committee that produced the initial Fair Information Practice Principles,10 has privacy been so much in the U.S. public eye. Edward Snowden’s revelations, as well as a growing awareness that merely living our lives seems to generate an expanding "digital exhaust," have triggered many workshops and meetings.1,5,11,12 An alphabet soup of advisory groups—PRG,a PCLOB,b PCASTc—have produced privacy-related reports.2,6,7,89 The wheels are turning at NITRDd to produce a national strategy for privacy research, perhaps paralleling the federal strategy for cybersecurity research and development.3 I have participated in a number of these and have developed my own view of privacy and privacy research. My U.S. perspective may differ from those from different backgrounds; privacy views vary with culture.
Some characterize privacy in terms of harms: to have suffered a loss of privacy that is actionable, there must be some way to characterize the harm an individual suffers as a result of the privacy breach. This practical view motivates many privacy concerns: the data revealed may cause the loss of a benefit or service. However, this view runs into trouble where the damage seems primarily psychological—I really do not want my neighbor to know if I have unconventional sexual practices or have had cosmetic surgery, and I may suffer psychologically or emotionally from such revelations, but it may be difficult to characterize the loss in a way that can be compensated. Further, it may be difficult to know that a harm has occurred—I may be deprived of an opportunity to be employed by the disclosure of private information through a breach I am unaware of.
Domain-specific privacy definitions and rules may be needed. I once preferred the uniform structure of privacy regulations of the European Union’s Data Protection Directive to the U.S. patchwork of laws and regulations that separately cover health records, educational records, legal proceedings, business transactions, and so on. Now I am less sure. One of the definitions of privacy that continues to seem useful to me is that privacy is preserved when information remains within a specified context—financial information stays with my financial advisor or broker, religious information with my religious counselor, health information with my medical practice, educational information with my school, and so on.4 Perhaps it is better to continue to use policies that take these contexts and the semantics of the information into account and to strive for, but not insist on, unification. In this case, it is also necessary to specify when information can be allowed to move between normally isolated contexts, for example to deal with an emergency.
A legal regime in which data "belongs" to an owner who then has complete dominion over it is too simple to accommodate future needs both for preservation of useful notions of privacy and for productive use of data. The fact that a private party engages in a transaction with a business or public service, be it a grocery purchase, telephone call, email message, or database query, should not necessarily entitle the business or service to unlimited use or publication of the data from that transaction. In fact, there are already many cases where there are competing interests in particular data and the custodian of data does not exercise complete control over it. In the future, it may make sense for data custodians to be bound by "responsible use" policies that depend on how the data was collected, the domain of data collected, and other factors. Constraints need to accompany data in a form that enables the recipient to continue to enforce them easily.
To gain the benefits of having large datasets to analyze (perhaps most apparent in healthcare, but in many other domains as well), anonymization and differential privacy will be of some, but limited, use. It will be essential for the subjects whose data is collected to trust that the custodians of their data will handle it properly, in accordance with whatever responsible use policies are established for it. Otherwise the subjects may withhold their data and the societal benefits will be lost. Because humans and systems are fallible, there will undoubtedly be some instances where sensitive data is lost or mishandled. To maintain public trust in the face of such incidents it will be important to assure data subjects that the custodians can be held to account: mechanisms must be provided that enable injured parties to detect misuse and obtain redress.
Potential Areas of Research
With those thoughts in mind, I offer some potential privacy-related research areas, in no particular order, and with some overlap.
Effective privacy definitions, and in particular, domain-specific definitions of privacy. HIPAA (internationally considered a strongly protective model) and other regulations already provide what might be considered domain-specific rules for data privacy in healthcare. These have received some research attention. Other domains, including law enforcement, finance, and intelligence, might benefit from efforts to characterize the data involved, how it should be handled within the domain of use, and under what conditions and controls it might be allowed to flow to different domains.
Effects of surveillance on social groups of different sizes. For example, has the chilling effect of surveillance on free expression been studied systematically? I am not a social scientist, so I may be unaware of research in this area, but research results, if they exist, must be aired, and if they do not exist, they deserve study.
Development of better languages for specifying privacy policies. Not a new area of research, perhaps, but effective solutions do not seem to be available. Languages are needed that enable specification of policies that can be enforced algorithmically and also that can be understood by the public.
Accountability mechanisms for privacy violations. Both detection of a privacy violation and the ability to trace the violation back to responsible individuals are important. Detecting violations will of course imply there is an expressed policy that is to be enforced. Tracing violations has implications for authentication and auditing. Some financial systems incorporate accountability mechanisms for purposes of fraud deterrence and detection, and some health records systems incorporate mechanisms to account for privacy violations, but these mechanisms will need to find homes in a much broader range of systems with various privacy policy enforcement needs. The ability to support provenance for both data and programs at scale is needed.
Privacy may be difficult to define and culturally dependent, but it nevertheless seems to be universally valued.
Techniques and mechanisms for tracking information flow. To me, the fundamental nature of a privacy violation is an improper information flow. Privacy policy needs to distinguish proper and improper flows and to enable authorization of exceptions. Capabilities for tracking the flow of information within programs have matured substantially in the past decade. Those capabilities need to be extended to systems of programs.
Techniques for binding policies to data and enabling distributed enforcement. If the data itself can carry the policy to be enforced along with it, each domain in which it appears can apply appropriate enforcement. One might imagine the data also collecting an audit trail as it moves from place to place. Cryptographic approaches may help.
Techniques for identifying and quantifying benefits of large-scale data analysis and costs of privacy harms. It is a tall order to model in advance the benefit one may gain from analyzing some large dataset, since one does not know what might be learned. On the other hand, the analysis is usually undertaken with some objective in mind, and it might be possible to quantify what is to be gained if that objective is realized. Similarly, some resources need to be devoted to anticipating privacy harms and what damages may occur if large datasets are abused. These kinds of trade-offs must be understood as well as possible at the time people are deciding whether or not to initiate new projects if there is to be any rigorous risk/benefit analysis in this sphere.
Conclusion
Privacy may be difficult to define and culturally dependent, but it nevertheless seems to be universally valued. Future computing systems must incorporate mechanisms for preserving whatever privacy policies people and societies decide to embrace, and research is needed to identify those mechanisms and how they may best be applied.
Join the Discussion (0)
Become a Member or Sign In to Post a Comment