Privacy Policy Law and Technology Fair Information Practices

Privacy Policy, Law and Technology Fair Information Practices September 9, 2008 CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 1

Assignments for HW 2 #4 § § § § § TRUSTe § Network Advertising Initiative § Safe Harbor § The Privacy Act of 1974 § The Federal Wiretap Act The Fair Credit Reporting Act § HIPPA The Gramm-Leach Bliley Act § The Video Privacy Protection § Act § Children's Online Privacy § Protection Act § § Family Educational Rights and Privacy Act (FERPA) CPNI rules Cable TV Privacy Act EU Directive PIPEDA (Canadian privacy law) Japanese Personal Information Protection Act (PIPA) California SB-1386 Australian Federal Privacy Law Other US laws? Other international laws? CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 2

Using Library Resources CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 3

CMU Libraries § http: //www. library. cmu. edu § Engineering and Science (a. k. a. E&S) – Location: Wean Hall, 4 th floor – Subjects: Computer Science, Engineering, Mathematics, Physics, Science, Technology § Hunt (CMU’s main library) – Location: Its own building (possibly 2 nd ugliest on campus behind Wean), between Tepper and Baker – Subjects: Arts, Business, Humanities, Social Sciences § Software Engineering Institute (a. k. a. SEI) – Location: SEI Building (4500 Fifth Avenue), 3 rd floor – Subjects: Security, Software, Technology CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 4

START HERE: Cameo § Cameo is CMU’s online library catalog – http: //cameo. library. cmu. edu/ § Catalogs everything CMU has: books, journals, periodicals, multimedia, etc. § Search by key words, author, title, periodical title, etc. CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 5

CAMEO: Search Result for “Cranor” Number of copies and status Library CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 6

CAMEO: Search Result for “Solove” Due date CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 7

If it’s not in Cameo, but you need it today: Local Libraries § Carnegie Library of Pittsburgh – Two closest locations • Oakland: Practically on campus (4400 Forbes Ave. ) • Squirrel Hill: Forbes & Murray (5801 Forbes Ave. ) – http: //www. carnegielibrary. org/index. html § University of Pittsburgh Libraries – 16 libraries! Information science, Engineering, Law, Business, etc. – http: //pittcat. pitt. edu/ CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 8

If it’s not in Cameo, and you can wait: ILLiad and E-ZBorrow § ILLiad and E-ZBorrow are catalogs of resources available for Interlibrary Loan from other libraries nationwide (ILLiad) and in Pennsylvania (E-ZBorrow) § Order items online (almost always free) § Wait for delivery – average 10 business days § Find links to ILLiad and E-ZBorrow online catalogs at http: //www. library. cmu. edu/Services/ILL/ CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 9

Other Useful Databases § Links to many more databases, journal collections – Must be accessed on campus or through VPN – http: //www. library. cmu. edu/Search/AZ. html § Lexis-Nexis – Massive catalog of legal sources – law journals, case law, news stories, etc. § IEEE and ACM journal databases – IEEE Xplore and ACM Digital Library § INSPEC database – Huge database of scientific and technical papers § JSTOR – Arts & Sciences, Business, Mathematics, Statistics CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 10

And of course… § Reference librarians are available at all CMU libraries, and love to help people find what they need – just ask! CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 11

Writing a Literature Review CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 12

Writing a literature review § What is a literature review? – A critical summary of what has been published on a topic • What is already known about the topic • Strengths and weaknesses of previous studies – Often part of the introduction or a section of a research paper, proposal, or thesis § A literature review should – be organized around and related directly to thesis or research question you are developing – synthesize results into a summary of what is and is not known – identify areas of controversy in the literature – formulate questions that need further research Dena Taylor and Margaret Procter. 2004. The literature review: A few tips on conducting it. http: //www. utoronto. ca/writing/litrev. html CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 13

Literature review do’s and don’ts § Don’t create a list of article summaries or quotes § Do point out what is most relevant about each article to your paper § Do compare and contrast the articles you review § Do highlight controversies raised or questions left unanswered by the articles you review § Do take a look at some examples of literature reviews or related work sections before you try to create one yourself – For an example, of a literature review in a CS conference paper see section 2 of http: //cs 1. cs. nyu. edu/~waldman/publius/paper. html CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 14

Privacy terminology § Data subject § Data controller § Secondary use of data CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 15

OECD fair information principles § http: //www. oecd. org/document/18/0, 3343, en_2649 _34255_1815186_1_1, 00. html § Collection limitation § Data quality § Purpose specification § Use limitation § Security safeguards § Openness § Individual participation § Accountability CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 16

US FTC simplified principles § § § Notice and disclosure Choice and consent Data security Data quality and access Recourse and remedies US Federal Trade Commission, Privacy Online: A Report to Congress (June 1998), http: //www. ftc. gov/reports/privacy 3/ CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 17

USACM Policy Recommendations on Privacy (June 2006) § http: //usacm. org/usacm/Issues/Privac y. htm CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 18

Discussion CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 19

The Prada NYC dressing room § http: //www. sggprivalit e. com/ § What aspects seem privacy invasive? § How could the design be changed to reduce privacy concerns? CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 20

Discussion questions § § Which technologies are privacy invasive? Which technologies are privacy protective? Can we turn one into the other? How can we use the FIPs in our analysis? CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 21

Applying the FIPs § § § Google Street View Gmail advertising Hillman Library Web Cam Amazon. com book recommendations Giant Eagle Advantage Card Transportation Security Administration watch lists CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 22