Archive for January 28th, 2008

live blog/twitter

Today: Data Privacy in Transatlantic Prespective for Data Privacy Day 08

at Duke Law for data privacy confab. Bout half Europeans. US privacy is about limiting gubernint

duke net lets you see all the mac addresses for all duke guests in the room. So much for privacy at the privacy confab

Howard Beales formerly FTC Bureau of Consumer Protection talks about unencrypted wireless while I am handed MAC addresses by Dukenet

in Europe this is Data Protection Day; in US this is Data Privacy Day – why? Stefano Rodotà explains

citing European Dream http://tinyurl.com/2zf2zs ” How Europe’s Vision of the Future Is Quietly Eclipsing the American Dream”

Europeans are not drunk on the free market; American privacy law is mostly against the gubermint but changing.

European approach seen, by them, as human rights agenda

COuncil of Europe’s Internet Bill of Rights

next up Peter Hustinx, European Data Protection Supervisor of the European Union

1/28/81??? was european data protect acts. US didn’t sign

Again the Human Rights perspective in Europe is emphasised.

3 deficitcies in original. def of privacy is unclear. again only against gubermint/public interference. negative approach rather than struct

Euro Charter of Fundamental Rights – Privacy and Data Protection are separate but closely related

about independent agencies — outside of gubermint but in Italy directly elected. how to avoid over politicalization of such agencies?

Kathryn Ratte, Attorney, US Federal Trade Commission on Notice and Consent policy. means you get to read the unreadable

on unfair practices. the key is injury. injury that cannot be easily avoided

behaviorable advertising == tracking you online so’s you can get targeted adverts. FTC wants industry self-regulation by disclosure

Annie Anton of NCSU’s Privacy Place. Can software extract policies and put them to effect

2002 survey instrument to find what people say they want in privacy and that was actually in policies

guess what they didn’t align

annie’s hang out and publications to which she is refering http://theprivacyplace.org/

Anton does have great war stories about trying to get access to policies on privacy issues. Europeans are harder to read tho

Fred Cate, Director of the Center for Applied Cybersecurity Research next

Cate notices that how people *say* they care about privacy has almost no effect on their behavior!

people all ignore consent and notice. hippa for example. want surgery? you sign

notice and choice is intellectually dishonest says Cate

what is your choice once you have notice?

Peter Swire: opt-out vs opt-in for third party uses doesn’t work. there are instead 5 categories. Fulfillment. Internal operations. Anti-fraud. Public priority. Marketing (most controversial). looking for substantive rules rather than millions of contracts.

??s P3P policy enacted anywhere asks Andrew Chin of UNC Law. Anton answers: no one have accepted and implemented really. insight: companies have no reason to implement P3P unless they are required to do so.

Cate picks up on browser protection. and ignoring the customized security settings. bad security interfaces means bad compliances. everyone keeps the default. under Vista,IE comes with a higher security setting.

Anton: says that P3P policy interpretation is non-consistent. (as well as inconsistent)

from the audience. p3p was good only for cookies and stopped there. flash cookies are immune for example.

Mike Hubble of Womble Carlyle. What are actual data protections in practice? (part of the issue here is that policy and compliance are nowhere well reviewed).

Swire sees this as can you buy insurance for your data protection.

Giovanni Buttarelli says europeans work on that and let businesses be responsible for implementing

Cate says that audits and standards in advance and liability afters. Focus on end results. Not PR and policy.

Kathryn Ratte says FTC looks at security that way

audience: like swire’s 5 approaches. but how to implement that? and who? FTC? public sector? tell us more about how it might work? (Swedish guy asking)

Swire: commercial data is overseen by FTC, a independent agency in all respects, so they should and do have authority except banks. they do have medical. now about public sector: swire says see his writing. senate has something in place but the executive branch has provided no budget or appointments.

anti-fraud is protected. as is all except marketing which does have some regulations.

Swire: practices in US and in Europe are similar regardless of policy and law.

more from audience on marketing. who wants it? recommender systems like netflix, amazon etc.

Buttarelli on new telephone books. 27 million Italians were asked it they wanted their mail, sms, email and phone should be listed. 5 million answered the inquiry. most agreed to have it all listed.

Cate differentiates between disclosure vs poorly targeted adverts (like spam). He loves his personal preferences at eBay, amazon etc

Swire doesn’t want heavily personalized info just out there because the info can be had by say local law enforcement.

Anton on Catalog choice by mail. She unsubscribed to many but not Anne Taylor (thanks for sharing ;->).

audience: she reads all notices. like opting IN rather than OUT. likes the 5 categories. but says that notice and consent has not gotten a fair shake. success of do not call as an example.

anton: clicking as opt in sux

cate: no one reads notices. response rate for opting in and opting out is tiny and identical. basically always fails. default will always be the rule.

audience (anton student): Cate said transparency is better than notice. but transparent to who? how to make that via software? Cate says it’s law not software that will work here. when you roll out the system, you need to be clear on collection, storage, third party etc. one problem in the notice world is that having the FTC use your notice against you creates overprotection and opacity. more on transparency.

Comments 4 Comments »