1 Last update 21 December 2010 1 Advanced

1 Last update: 21 December 2010 1 Advanced databases – Data, the Web, mining, and privacy Part I: Conceptual issues Bettina Berendt Katholieke Universiteit Leuven, Department of Computer Science http: //www. cs. kuleuven. ac. be/~berendt/teaching/ Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 1

2 Where are we / Recall: Gegevensbanken Bachelor structure 2 Les Nr. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 wie ED ED KV KV KV BB BB ED wat intro, ER EER relational model mapping EER 2 relational algebra, relational calculus SQL vervolg SQL demo Access, QBE, JDBC functional dependencies and normalisation file structures and hashing indexing II and higher-dimensional structures query processing transaction query security Data warehousing and mining XML, oodb, multimedia db Conceptueel model Relationeel model Fysisch model / vragen Nieuwe thema‘s / vooruitblik Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 2

Structure, which is taken up here again 3 3 1. From knowledge (in the head) to data: n 2. Getting knowledge out of the data n 3. 4. Conceptual modelling at different levels of expressivity SQL, deductive and inductive inferences Making this fast(er) 1. Optimising file and index structures, queries, … 2. Parallelising things 3. Doing only what‘s needed New topics (here: databases and privacy) Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 3

Recall the discussion questions from last week 4 4 1. What does privacy mean for you concretely? Can you remember situations where it was important for you to show yourself in a different way than you are? Do you expect such situations in the future? 2. Privacy also involves the possibility of lying. Is this possibility a right? Give concrete examples and discuss them. 3. Think of a case where someone would want to not disclose some information and where you would think "this is not right". Does this person claim their privacy? Would your desired outcome be a privacy violation? 4. Who do you think should be watched most closely when it comes to handling personal information: the government? companies? anyone else? why? 5. So what does privacy mean for databases and data mining? What problems would you like to see addressed? Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 4

5 Agenda 5 Three types of privacy … and how the law respects them Societal conventions that allow for secrecy Surveillance, democracy, and … Whose privacy? and: when privacy is traded off against other goods “When you delete your FB account, what happens? ” (Web) databases, Web mining and privacy Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 5

What is privacy? 6 6 (just one example: http: //www. thinkmoney. com/Privacy. Policy. asp ) Protecting your privacy is important to us. This privacy statement explains how we collect, store and use the information you provide. Please read this privacy statement carefully, as once you use the Think Money web site you will be deemed to have read and accepted this statement. What personal information is collected via the web site? We will only collect personal information about you, given by you, when you complete a contact form requesting us to contact you or an application form. What happens to the information provided/collected? We may use the information you provide to contact you, for product administration and for customer research. The information you provide through this website may be used by Think Money and its sister Think Money Group companies (Think Money Limited, Think Loans Limited, Think Insure Limited, Think Banking Limited, Gregory Pennington Limited, Freeman Jones Limited, Wilson Andrews Limited) to provide you with information, including by email and mobile telephone, about their and other companies' products and services that may be of interest to you. … Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 6

1. Privacy as hiding: Confidentiality 7 7 „People should not know my personal information“ [italics: your quotes from last week’s discussion] „the right to be let alone“ Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 7

2. Privacy as control: Informational self-determination 8 8 “The things you expect to be from you (msg, emails) / that you expect to be private, should be private” “Personal stuff should not be distributed to other sites/sources/companies” the ability to control what happens with one‘s personal information Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 8

3. Privacy as practice: Identity construction 9 9 “What’s not on FB, nobody should know about” “What are the types of “sensitive data”? Is this fixed? Does this change with what’s on FB etc. ? ” “Information that others can abuse to disadvantage me” „Culture-specific” the freedom from unreasonable constraints on the construction of one’s own identity, be it by strategically being able to reveal or conceal data. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 9

What’s seen as private (or public) changes over time 10 10 Privacy is about self-determined, individual and societal re-negotiation of information disclosure and hiding (private/public) “privacy negotiations“ (incl. work by/with Teltzrow, Preibusch, Spiekermann) Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 10

11 Privacy is culture-specific (1): How to „measure“ culture? 11 Individualism and Collectivism are cultural dimensions developed by Hofstede (1991). Individualism implies loose ties between the members of a society; collectivism implies that people are integrated into strong, cohesive groups (Marcus & West Gould, 2000). Power distance is another of Hofstede’s cultural dimensions that describes the extent to which less powerful members of institutions and organisations accept that power is distributed unequally (Hofstede, 1991). Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 11

Privacy is culture-specific (2) 12 12 Privacy issues have also been shown to be affected by a culture’s degree of individualism. Members of individualistic cultures tend to be less willing to provide sensitive information than members of collectivistic cultures. This can be explained by the observation that individualistic cultures value private space more than collectivistic cultures (e. g. Milberg, Smith, & Burke, 2000). Individualistic and collectivistic cultures also differ in the type of information they provide when negotiating identity (Burk, 2004; Reeder et al. , 2004). “It is likely that in some cultural settings, information considered highly personal by Western standards, such as wealth or spending habits, may be deemed open and public, whereas information considered relatively innocuous in Western settings, such as a nickname, might be considered extremely private” (Burk, 2004). Debnath and Bhal (2004) point out that ethical issues related to privacy differ among Indian citizens depending on their acquired norms of ethical and moral conduct. Burk (2004) emphasizes that “privacy as a matter of individual autonomy may be relatively unimportant in cultural settings where communal information is unlikely to be accommodated within the data protection models now sweeping across the globe”. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 12

Privacy is culture-specific (3) 13 13 In addition, power distance has a similar impact on users’ willingness to disclose data, with members of high power distant countries being more willing to provide data than members of low power distant countries (Kralisch, 2006). However, within high power distant societies, knowledge sharing from high hierarchy levels to low hierarchy levels is difficult since it would transfer decision making authorities to subordinates. Heier and Borgman (2002) describe how this effect challenged the international HRbase, an Intranet-based knowledge management system, of Deutsche Bank: usage rates were about 20% in Germany and the UK but only about 4% in Asian countries. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 13

14 Agenda 14 Three types of privacy … and how the law respects them Societal conventions that allow for secrecy Surveillance, democracy, and … Whose privacy? and: when privacy is traded off against other goods “When you delete your FB account, what happens? ” (Web) databases, Web mining and privacy Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 14

Privacy as confidentiality 15 15 Freedom from intrusion : This is most popularly known as the “right to be let alone” [25]. This kind of privacy presumes an intrinsic self and protects a sphere of autonomy in which the individual is free to express and inhabit that self and enjoy intimate relationships. The home as an intimate and untouchable space is an example of this kind of privacy. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 15

Privacy as control (1) 16 16 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (aka Fair Information Practices) - Similarly encoded in the EU Guidelines relating to privacy Collection limitation : Data collectors should only collect information that is necessary, and should do so by lawful and fair means, i. e. , with the knowledge or consent of the data subject. Data quality : The collected data should be kept up-to-date and stored only as long as it is relevant. Purpose specification : The purpose for which data is collected should be specified (and announced) ahead of the data collection. Use limitation : Personal data should only be used for the stated purpose, except with the data subject’s consent or as required by law. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 16

Privacy as control (2) 17 17 Security safeguards : Reasonable security safeguards should protect collected data from unauthorised access, use, modification, or disclosure. Openness : It should be possible for data subjects to learn about the data controller’s identity, and how to get in touch with him. Individual participation : A data subject should be able to obtain from a data controller confirmation of whether or not the controller has data relating to him, to obtain such data, to challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed or amended. Accountability : Data controllers should be accountable for complying with these principles. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 17

Privacy as practice 18 18 Construction of the public/private divide : This distinction concerns the social negotiation of what remains private (i. e. silent and out of the public discourse) and what becomes public. For example, in the case of voting, individuals may want to keep their choice private, and in the case of domestic violence, interest groups may have an interest in defining the “domestic” as a public issue. Separation of identities : This allows individuals to selectively employ revelation and concealment to facilitate their social performances and relationships. It gives individuals the right to control, edit, manage and delete information about themselves. An example is the possibility to maintain multiple identities in Internet chat rooms, games, etc. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 18

19 Agenda 19 Three types of privacy … and how the law respects them Societal conventions that allow for secrecy Surveillance, democracy, and … Whose privacy? and: when privacy is traded off against other goods “When you delete your FB account, what happens? ” (Web) databases, Web mining and privacy Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 19

20 20 “Why can’t everybody just act more professionally? (“I do not want to talk about it” – “ok” – doesn’t require lying)” “Lying is very relative – stressing some part of the information. . . “ Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 20

Moore & Tumin (1949). Some social functions of ignorance (1) 21 21 1. 2. As preservative of privileged position l The specialist and the consumer l The specialist and the potential competitor l Role differentiation and the maintenance of power l Avoidance of jealousy over unequal rewards l Secrecy and security As reinforcement of traditional values l Isolation and traditionalism l Ignorance of normative violations „Another way in which ignorance serves to protect the traditional normative structure is through reinforcing the assumption that deviation from the rules is statistically insignificant. “ l Reinforcement of group mandates Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 21

Moore & Tumin (1949). Some social functions of ignorance (2) 22 22 3. As preservative of fair competition 4. As preservative of stereotypes 5. 1. Bureaucratic organization 2. Ethnic and class stereotypes As incentive appropriate to the system 1. Anxiety and work „… ignorance of present rating or future chances is used as a device to create anxieties and spur activity in a competitive system. … in a bureaucratic organization rules are ordinarily thought of as giving predictability. However, they may be so constructed and applied as they relate to persons in the lower strata that prediction is difficult and the worker is expected to be motivated by this insecurity. 2. The aleatory principle The attractiveness of new experiences depends in part on the uncertainty of the outcome. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 22

23 Agenda 23 Three types of privacy … and how the law respects them Societal conventions that allow for secrecy Surveillance, democracy, and … Whose privacy? and: when privacy is traded off against other goods “When you delete your FB account, what happens? ” (Web) databases, Web mining and privacy Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 23

24 24 “People add their own assumptions to what you tell them – I won’t say anything that is not necessary to say – makes you more conservative” Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 24

25 Volkszählungsurteil [Census ruling], German Constitutional Court, 1983: ~ When people feel observed all the time, they will not fully exercise their democratic rights any more 25 „Mit dem Recht auf informationelle Selbstbestimmung wären eine Gesellschaftsordnung und eine diese ermöglichende Rechtsordnung nicht vereinbar, in der Bürger nicht mehr wissen können, wer was wann und bei welcher Gelegenheit über sie weiß. Wer unsicher ist, ob abweichende Verhaltensweisen jederzeit notiert und als Information dauerhaft gespeichert, verwendet oder weitergegeben werden, wird versuchen, nicht durch solche Verhaltensweisen aufzufallen. […] Dies würde nicht nur die individuellen Entfaltungschancen des Einzelnen beeinträchtigen, sondern auch das Gemeinwohl, weil Selbstbestimmung eine elementare Funktionsbedingung eines auf Handlungsfähigkeit und Mitwirkungsfähigkeit seiner Bürger begründeten freiheitlichen demokratischen Gemeinwesens ist. Hieraus folgt: Freie Entfaltung der Persönlichkeit setzt unter den modernen Bedingungen der Datenverarbeitung den Schutz des Einzelnen gegen unbegrenzte Erhebung, Speicherung, Verwendung und Weitergabe seiner persönlichen Daten voraus. “ Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 25

26 26 ~ „I am the first Belgian victim of Wikileaks. I will not talk freely to my diplomatic colleagues any more. “ (a Belgian minister or member of the diplomatic corps last week, seen in De Standaard) – unfortunately, I cannot find the exact source any more) Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 26

27 Agenda 27 Three types of privacy … and how the law respects them Societal conventions that allow for secrecy Surveillance, democracy, and … Whose privacy? and: when privacy is traded off against other goods “When you delete your FB account, what happens? ” (Web) databases, Web mining and privacy Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 27

28 28 “The government should be able to get some private information because of the safety of other people (terrorists’ privacy? ). ” – privacy-security tradeoff. “Companies should know about employees’ wrong behaviour (dazzling of funds) – cameras? But only work-related / difficult to draw the line” “Contracts (hiring contracts) say what employers may watch (notice to the employee, but no right to refuse)” “Everybody should be watched – they can all abuse the info – should everyone be monitored this way? ” Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 28

29 IRS employee uses Outlook rules to intercept boss's e-mails, convicted of wiretapping (Tim Stevens, Dec 15 th 2010) 29 Here's an interesting question for you: if you set up a rule in Microsoft Outlook to forward messages from one account to another, and you do it without the knowledge of the owner of the account you're forwarding from, are you intercepting or merely copying mail? It may seem like a moot point, but for David Szymuszkiewicz, a former IRS worker, it's an important distinction. David was afraid of being fired after his license was suspended for drunk driving (he needed to drive to the homes of delinquent taxpayers), so he secretly set up this rule on his boss's machine to see what the world was saying about him. The rule was discovered and, wouldn't you know it, he was in trouble. The only question now: whether to charge him under the Wiretap Act for intercepting messages or the Stored Communications Act for merely copying of them. So, what was your answer to the question above? You might be tempted to say he was simply making a copy, and indeed that was Szymuszkiewicz's argument, but any Exchange admin will tell you that Outlook rules are executed on the server, not at the client, meaning those e-mails were indeed being intercepted. Szymuszkiewicz was convicted of wiretapping but seems to have avoided a harsh sentence, with 18 months probation being handed down. A light punishment for wiretapping, but a heavy one for diddling menus in Outlook. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 29

Leaks … 30 30 LAWYERS for Julian Assange have expressed anger about an alleged smear campaign against the Australian Wiki. Leaks founder. Incriminating police files were published in the British newspaper that has used him as its source for hundreds of leaked US embassy cables. In a move that surprised many of Mr Assange's closest supporters on Saturday, The Guardian newspaper published previously unseen police documents that accused Mr Assange in graphic detail of sexually assaulting two Swedish women. […] Bjorn Hurtig, Mr Assange's Swedish lawyer, said he would lodge a formal complaint to the authorities and ask them to investigate how such sensitive police material leaked into the public domain. "It is with great concern that I hear about this because it puts Julian and his defence in a bad position, " he told a colleague. "I do not like the idea that Julian may be forced into a trial in the media. And I feel especially concerned that he will be presented with the evidence in his own language for the first time when reading the newspaper. I do not know who has given these documents to the media, but the purpose can only be one thing - trying to make Julian look bad. „ … Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 30

31 Agenda 31 Three types of privacy … and how the law respects them Societal conventions that allow for secrecy Surveillance, democracy, and … Whose privacy? and: when privacy is traded off against other goods “When you delete your FB account, what happens? ” (Web) databases, Web mining and privacy Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 31

http: //www. facebook. com/editaccount. php? language#!/policy. php , 32 32 21 Dec 2010 (1) 7. How You Can Change or Remove Information Editing your profile. You may change or remove your profile information at any time by going to your profile page and clicking “Edit My Profile. ” Information will be updated immediately. Delete uploaded contacts. If you use our contact importer to upload addresses, you can later delete the list on this help page. You can delete the email addresses of friends you have invited to join Facebook on your invite history page. Deactivating or deleting your account. If you want to stop using your account you may deactivate it or delete it. When you deactivate an account, no user will be able to see it, but it will not be deleted. We save your profile information (connections, photos, etc. ) in case you later decide to reactivate your account. Many users deactivate their accounts for temporary reasons and in doing so are asking us to maintain their information until they return to Facebook. You will still have the ability to reactivate your account and restore your profile in its entirety. When you delete an account, it is permanently deleted from Facebook. You should only delete your account if you are certain you never want to reactivate it. You may deactivate your account on your account settingspage or delete your account on this help page. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 32

http: //www. facebook. com/editaccount. php? language#!/policy. php , 33 33 21 Dec 2010 (2) Limitations on removal. Even after you remove information from your profile or delete your account, copies of that information may remain viewable elsewhere to the extent it has been shared with others, it was otherwise distributed pursuant to your privacy settings, or it was copied or stored by other users. However, your name will no longer be associated with that information on Facebook. (For example, if you post something to another user’s profile and then you delete your account, that post may remain, but be attributed to an “Anonymous Facebook User. ”) Additionally, we may retain certain information to prevent identity theft and other misconduct even if deletion has been requested. If you have given third party applications or websites access to your information, they may retain your information to the extent permitted under their terms of service or privacy policies. But they will no longer be able to access the information through our Platform after you disconnect from them. Backup copies. Removed and deleted information may persist in backup copies for up to 90 days, but will not be available to others. Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 33

The Evolution of Privacy on Facebook 34 (Matt Mc. Keon, http: //mattmckeon. com/facebook-privacy/ , 21 Dec 2010) 34 Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 34

The Evolution of Privacy on Facebook 35 (Matt Mc. Keon, http: //mattmckeon. com/facebook-privacy/ , 21 Dec 2010) 35 Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 35

The Evolution of Privacy on Facebook 36 (Matt Mc. Keon, http: //mattmckeon. com/facebook-privacy/ , 21 Dec 2010) 36 Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 36

The Evolution of Privacy on Facebook 37 (Matt Mc. Keon, http: //mattmckeon. com/facebook-privacy/ , 21 Dec 2010) 37 Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 37

The Evolution of Privacy on Facebook 38 (Matt Mc. Keon, http: //mattmckeon. com/facebook-privacy/ , 21 Dec 2010) 38 Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 38

The Evolution of Privacy on Facebook 39 (Matt Mc. Keon, http: //mattmckeon. com/facebook-privacy/ , 21 Dec 2010) 39 Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 39

40 Agenda 40 Three types of privacy … and how the law respects them Societal conventions that allow for secrecy Surveillance, democracy, and … Whose privacy? and: when privacy is traded off against other goods “When you delete your FB account, what happens? ” (Web) databases, Web mining and privacy Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 40

41 41 Part 2 at http: //people. cs. kuleuven. be/~bettina. berendt/teaching/Privacy 10/berendt_2010_06_23. ppt Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 41

Literature 42 42 p. 4: Questions from/inspired by Martens, B. , Dierick, G. , & Noot, W. (2008). Ethiek en weerbarheid in de informatiesamenleving, Uitgeverij Lannoo. Campus, Leuven & Academic Service, Den Haag, p. 75 pp. 7 ff: The three types of privacy have first been described here: Gürses, S. F. & Berendt, B. (2010). The Social Web and Privacy: Practices, Reciprocity and Conflict Detection in Social Networks. In E. Ferrari & F. Bonchi (Eds. ), Privacy-Aware Knowledge Discovery: Novel Applications and New Techniques. Boca Raton, FL: Chapman & Hall/CRC Press, Data Mining and Knowledge Discovery Series. http: //www. cosic. esat. kuleuven. be/publications/article-1304. pdf pp. 11 -13: Berendt, B. & Kralisch, A. (2007). From World-Wide-Web Mining to Worldwide Webmining: Understanding Peoples Diversity for Effective Knowledge Discovery. In Berendt, Hotho, Mladeničc, & Semeraro (Eds. ), From Web to Social Web: Discovering and deploying user and content profiles. (pp. 102– 121). LNAI 4737. Berlin etc. : Springer. http: //warhol. wiwi. hu-berlin. de/~berendt/Papers/berendt_kralisch_2007. pdf pp. 15 -18: Gürses, S. F. , Berendt, B. , & Santen, Th. (2006). Multilateral security requirements analysis for preserving privacy in ubiquitous environments. In Berendt & Menasalvas (Eds. ) (2006) Proceedings of the Workshop on Ubiquitous Knowledge Discovery for Users at ECML/PKDD’ 06. Berlin, Germany, 22 September 2006. (pp. 51– 64). https: //lirias. kuleuven. be/bitstream/123456789/164018/1/Seda. Bettina. Thomas. Ukdu 2006. pdf pp. 21 f: Wilbert E. Moore and Melvin M. Tumin. Some Social Functions of Ignorance. American Sociological Review Vol. 14, No. 6 (Dec. , 1949), pp. 787 -795. http: //www. jstor. org/stable/2086681 p. 25: cited after Wikipedia-Autoren. Volkszählungsurteil. Wikipedia, Die freie Enzyklopädie. 12. Dezember 2010, http: //de. wikipedia. org/w/index. php? title=Volksz%C 3%A 4 hlungsurteil&oldid=82556948 p. 29: http: //www. engadget. com/2010/12/15/irs-employee-uses-outlook-rules-to-intercept-bosss-e-mailscon/ p. 30: Lawyers cry foul over leak of Julian Assange sex-case papers. The Australian, 20 Dec 2010, http: //www. theaustralian. com. au/news/world/lawyers-cry-foul-over-leak-of-julian-assange-sex-casepapers/story-e 6 frg 6 so-1225973548657 Berendt: Advanced databases, 2010, http: //www. cs. kuleuven. be/~berendt/teaching 42