Privacy Research Directions

The promise of the digital society is predicated on individuals using applications and services where they reveal personal details and create information. The term privacy has come to encompass not just personally identifiable information (PII) in the technical sense, but the commercial, legal and regulatory polices about how users interact with a range of technologies and the notion that users should be aware of the information they create and how it is used. The issue of privacy extends beyond the cookies that collect information about web browsing to massive databases of collected information to surveillance cameras and connected devices.

A holistic view of privacy needs to move beyond platitudes such as ‘There’s no privacy. Get over it’ and ‘No tracking should be allowed at all’. As such, privacy needs to be a symbiosis that takes into account a variety of perspectives including business, regulatory, technical, and not least, the preferences of users, which may vary considerably. There is no doubt that many users will stop using applications if they feel abused. But without any information on their users, most internet companies would collapse. Indeed, information can improve a system to the user’s benefit. Moreover if users are educated and informed about how information is used, they may increase their information sharing.

To be sure, research on privacy is essential for policymaking. Fortunately there is a large degree of consensus on design guidelines for privacy, such as Kim Cameron’s ‘Laws of identity’ (2005), ‘Fair information practice principles’ (OECD, 1970s), ‘Privacy by design’ (Ann Cavoukian et al. 2010-present), as well as the EU’s Data Protection Directive, national legislation and self-regulatory principles – see also the US Direct Market Association’s Guidelines for Ethical Business Practice. Comparative research on regulatory regimes – such as introduced in the article in this issue of Intermedia about the US and Europe – should also be fruitful.

Additionally a number of technologies can implement guidelines, eg. OAuth 2.0, OpenID Connect, User-Managed Access (UMA) and so on. These are becoming standards and are expected to have a major impact on future systems for identity and access management, including enterprise solutions. There is also growing investment in what is termed the ‘privacy economy’, where companies are taking advantage of a demand for services and technology to manage protection of the massive explosion in online information. A good example is Reputation.com.

Together, this paves the way for fine-grained control and disclosure of user attributes, user consent and authorisation, minimising disclosure of personal information, and potentially a better balance between protected resources hosted by service providers, enterprises and users.

research at aalborg

Privacy is an area of focus at the Center for Communication, Media and Information Studies at Aalborg University. Its research and specialised classes on the topic explore trust between users, service providers and enterprises. Perspectives are explored with tools such as user surveys, awareness frameworks, and visualisations of contacts between users and service providers, and other interactions.

Recent papers include ‘Privacy for sale? Analysis of online user privacy’ which gives insight to users in Denmark, which is one of the world’s leading digital societies. The authors discuss how users see privacy, either as an instrumental good (value to obtain something else) or as an intrinsic good (having a value in itself). A related paper, ‘Where does my private data go? Visualisation of users’ privacy’, compares how transparency tools match users’ ability to manage privacy.

Another paper looks at India, where there is not only no concept of digital privacy, but only a small percentage of people online. This research could inform what will be an important discussion in developing countries.

Other CMI research offers a vision of privacy for the 5G mobile standard, which will enable many user requirements and preferences. The goal of this research is to identify elements of user controlled privacy needed for future technologies. The paper, ‘5G visions of user privacy’ concludes that an ecosystem consisting of a trusted third party between the end user and service providers as a distributed system could be integrated to secure the perspective of user controlled privacy for future services.

Another paper, ‘Accessing and disclosing protected resources: a user-centric view’ investigates the service provider interaction and how recent technological progress, in particular the framework of UMA, can enable users to understand the value of their protected resources and possibly give them control of how their data will be used by service providers. Forthcoming research will investigate privacy in regard to trust models, economical valuation, and 5G user requirements, and CMI will host a conference on privacy on 26-27 November in Copenhagen. Email aby@cmi.aau.dk for information.