Privacy Issues and Data Protection in Technology Enhanced Learning - PowerPoint PPT Presentation

Privacy Issues and Data Protection in Technology Enhanced Learning Seda Gürses COSIC, K.U. Leuven dataTEL 2011 Alpines Rendez-vous Thursday, March 31, 2011 1

- mendeley: - group: privacy and dataTEL - slides: - after talk: - http://www.esat.kuleuven.be/~sguerses/ talks.html 2 Thursday, March 31, 2011 2

outline - introduction to privacy notions - building systems that address privacy concerns - privacy solutions - privacy and ethics - conclusion 3 Thursday, March 31, 2011 3

privacy? - what is privacy? - what are privacy requirements? - in security engineering: confidentiality 4 Thursday, March 31, 2011 4

online social networks (SNS) 5 Thursday, March 31, 2011 5

online social networks 6 Thursday, March 31, 2011 6

data protection privacy non-absolute contextual procedural safeguards relational accountability transparency opacity of the individual personal data 7 Thursday, March 31, 2011 7

cumulative disadvantage surveillance dataveillance covaillance sousveillance Thursday, March 31, 2011 8

data protection notice and consent purpose and proportionality subject acces rights data disclosure 9 Thursday, March 31, 2011 9

- how do we deal with these issues when developing systems? - specifically: during requirements engineering 10 Thursday, March 31, 2011 10

multilateral privacy requirements engineering - reconcile: - privacy notions (legal & surveillance studies) - privacy solutions (computer science) - in a social context (dataTEL contexts) - multilaterally - during requirements engineering 11 Thursday, March 31, 2011 11

privacy requirements definition subjectivity lack of contrivability lack of satisfiability universality legal compliance agonism negotiability counter - factuality environmental factors temporality 12 Thursday, March 31, 2011 12

multilateral privacy requirements engineering - reconcile: - privacy notions (legal & surveillance studies) - privacy solutions (computer science) - in a social context (dataTEL contexts) - multilaterally - during requirements engineering 13 Thursday, March 31, 2011 13

solutions from privacy research data confidentiality anonymous Privacy Policy communications Languages IDMS PPDM/PPDP Differential Feedback and Privacy Awareness Systems 14 Thursday, March 31, 2011 14

privacy research paradigms hiding information and identity the right to be let alone. Warren & Brandeis (1890) privacy as confidentiality 15 Thursday, March 31, 2011 15

privacy research paradigms hiding information and identity right of the individual to decide what information about himself should be communicated to the right to be let alone. others and under what Warren & Brandeis (1890) circumstances. (Westin 1970) privacy as separation of privacy confidentiality identities, data as control protection principles 16 Thursday, March 31, 2011 16

privacy research paradigms hiding information and identity right of the individual to decide what information about himself should be communicated to the right to be let alone. others and under what Warren & Brandeis (1890) circumstances. (Westin 1970) privacy as separation of privacy confidentiality identities, data as control protection principles privacy as practice the freedom from unreasonable constraints on the construction of one’s own identity (Agre, 1999) transparency and feedback 17 Thursday, March 31, 2011 17

privacy research paradigms hiding information and identity privacy as separation of privacy confidentiality identities, data as control protection principles privacy as practice transparency and feedback 18 Thursday, March 31, 2011 18

privacy as confidentiality 19 Thursday, March 31, 2011 19

main concerns - centralized databases - do not provide identifiable information - provide as little information as possible - minimize collection of any data - minimize data used for processing - control - hard security - only communication partner receives information - if at all: trust and risks are minimized 20 Thursday, March 31, 2011 20

Anonymizers (main concept) 21 Thursday, March 31, 2011 21

Anonymizers (the model) - observer (adversary) - does not know who is communicating with whom - probabilistic models - varying degrees of anonymity: - entropy base metrics - users traces delinked from identity 22 Thursday, March 31, 2011 22

DB ANONYMIZATION - PPDP - PPDM - basic idea: - in the database individuals no longer uniquely identifiable - keep the utility of the data - economic / dp approach - k-anonymity 23 Thursday, March 31, 2011 23

24 Thursday, March 31, 2011 24

privacy as confidentiality 25 Thursday, March 31, 2011 25

anonymization fail! - Narayanan and Shmatikov (2010) show that: - you can always link disparate information sources and identify individuals - so, what’s with personal data? - and with data protection? - differential privacy... - very theoretical interactive privacy preserving querying system 26 Thursday, March 31, 2011 26

dataTEL and confidentiality - if you want anonymous access to your systems - anonymous communications - future research: usability issues - if you want anonymization - check out anonymization methods - interesting for dp compliance (only) 27 Thursday, March 31, 2011 27

dataTEL and confidentiality - if you want controlled access to your dataset - future research: differential privacy model - e.g., Dwork 2009 - secure multi party computation - e.g., Erkin et al. (2011) - encrypt user ratings - process them under encryption 28 Thursday, March 31, 2011 28

privacy as practice? 29 Thursday, March 31, 2011 29

- make data practices transparent - allow users to individually and collectively affect the flows of information - privacy is a social decision - trade off model misleading - including your user models? - research methods? 30 Thursday, March 31, 2011 30

- feedback and awareness - social translucence - Erickson and Kellogg 2003 - identity mirror, privacy mirror - individual transparency not enough - what can we say about the observed population/groups? 31 Thursday, March 31, 2011 31

- attacks on machine learning algorithms - Barreno et al. 2008 - Dutrisac and Skillicorn 2008 32 Thursday, March 31, 2011 32

privacy as practice? 33 Thursday, March 31, 2011 33

- users may want to be open to negotiating data collection, processing, distribution - but how about dataTEL researchers? - who defines the process of negotiation? - what are good practices? 34 Thursday, March 31, 2011 34

privacy or ethics - Carusi, 2008 - anonymization is not a panacea information representation 35 Thursday, March 31, 2011 35

privacy or ethics naturalism interactionism isomorphism constructionism 36 Thursday, March 31, 2011 36

privacy or ethics naturalism interactionism data subjects concerns isomorphism researcher constructionism concerns 37 Thursday, March 31, 2011 37

privacy or politics - reflect on cumulative disadvantage - prediction becomes self-fulfilling prophecy - who are you observing? - disadvantaged groups - groups unlikely to articulate their rights - who wants your data? - university, law enforcement, employers 38 Thursday, March 31, 2011 38

lessons for dataTEL - privacy is not just confidentiality or compliance - compliance is “easy” and boring - future research - develop privacy practices - you can define the field - effects for used methodologies - the dataTEL privacy challenge may change the way you do research 39 Thursday, March 31, 2011 39