Today: Data Privacy in Transatlantic Prespective for Data Privacy Day 08
at Duke Law for data privacy confab. Bout half Europeans. US privacy is about limiting gubernint
duke net lets you see all the mac addresses for all duke guests in the room. So much for privacy at the privacy confab
Howard Beales formerly FTC Bureau of Consumer Protection talks about unencrypted wireless while I am handed MAC addresses by Dukenet
in Europe this is Data Protection Day; in US this is Data Privacy Day – why? Stefano Rodotà explains
citing European Dream http://tinyurl.com/2zf2zs ” How Europe’s Vision of the Future Is Quietly Eclipsing the American Dream”
Europeans are not drunk on the free market; American privacy law is mostly against the gubermint but changing.
European approach seen, by them, as human rights agenda
COuncil of Europe’s Internet Bill of Rights
next up Peter Hustinx, European Data Protection Supervisor of the European Union
1/28/81??? was european data protect acts. US didn’t sign
Again the Human Rights perspective in Europe is emphasised.
3 deficitcies in original. def of privacy is unclear. again only against gubermint/public interference. negative approach rather than struct
Euro Charter of Fundamental Rights – Privacy and Data Protection are separate but closely related
about independent agencies — outside of gubermint but in Italy directly elected. how to avoid over politicalization of such agencies?
Kathryn Ratte, Attorney, US Federal Trade Commission on Notice and Consent policy. means you get to read the unreadable
on unfair practices. the key is injury. injury that cannot be easily avoided
behaviorable advertising == tracking you online so’s you can get targeted adverts. FTC wants industry self-regulation by disclosure
Annie Anton of NCSU’s Privacy Place. Can software extract policies and put them to effect
2002 survey instrument to find what people say they want in privacy and that was actually in policies
guess what they didn’t align
annie’s hang out and publications to which she is refering http://theprivacyplace.org/
Anton does have great war stories about trying to get access to policies on privacy issues. Europeans are harder to read tho
Fred Cate, Director of the Center for Applied Cybersecurity Research next
Cate notices that how people *say* they care about privacy has almost no effect on their behavior!
people all ignore consent and notice. hippa for example. want surgery? you sign
notice and choice is intellectually dishonest says Cate
what is your choice once you have notice?
Peter Swire: opt-out vs opt-in for third party uses doesn’t work. there are instead 5 categories. Fulfillment. Internal operations. Anti-fraud. Public priority. Marketing (most controversial). looking for substantive rules rather than millions of contracts.
??s P3P policy enacted anywhere asks Andrew Chin of UNC Law. Anton answers: no one have accepted and implemented really. insight: companies have no reason to implement P3P unless they are required to do so.
Cate picks up on browser protection. and ignoring the customized security settings. bad security interfaces means bad compliances. everyone keeps the default. under Vista,IE comes with a higher security setting.
Anton: says that P3P policy interpretation is non-consistent. (as well as inconsistent)
from the audience. p3p was good only for cookies and stopped there. flash cookies are immune for example.
Mike Hubble of Womble Carlyle. What are actual data protections in practice? (part of the issue here is that policy and compliance are nowhere well reviewed).
Swire sees this as can you buy insurance for your data protection.
Giovanni Buttarelli says europeans work on that and let businesses be responsible for implementing
Cate says that audits and standards in advance and liability afters. Focus on end results. Not PR and policy.
Kathryn Ratte says FTC looks at security that way
audience: like swire’s 5 approaches. but how to implement that? and who? FTC? public sector? tell us more about how it might work? (Swedish guy asking)
Swire: commercial data is overseen by FTC, a independent agency in all respects, so they should and do have authority except banks. they do have medical. now about public sector: swire says see his writing. senate has something in place but the executive branch has provided no budget or appointments.
anti-fraud is protected. as is all except marketing which does have some regulations.
Swire: practices in US and in Europe are similar regardless of policy and law.
more from audience on marketing. who wants it? recommender systems like netflix, amazon etc.
Buttarelli on new telephone books. 27 million Italians were asked it they wanted their mail, sms, email and phone should be listed. 5 million answered the inquiry. most agreed to have it all listed.
Cate differentiates between disclosure vs poorly targeted adverts (like spam). He loves his personal preferences at eBay, amazon etc
Swire doesn’t want heavily personalized info just out there because the info can be had by say local law enforcement.
Anton on Catalog choice by mail. She unsubscribed to many but not Anne Taylor (thanks for sharing ;->).
audience: she reads all notices. like opting IN rather than OUT. likes the 5 categories. but says that notice and consent has not gotten a fair shake. success of do not call as an example.
anton: clicking as opt in sux
cate: no one reads notices. response rate for opting in and opting out is tiny and identical. basically always fails. default will always be the rule.
audience (anton student): Cate said transparency is better than notice. but transparent to who? how to make that via software? Cate says it’s law not software that will work here. when you roll out the system, you need to be clear on collection, storage, third party etc. one problem in the notice world is that having the FTC use your notice against you creates overprotection and opacity. more on transparency.