Specifying Personal Privacy Policies to Avoid Unexpected Outcomes

1. Specifying Personal Privacy Policies to Avoid Unexpected Outcomes George Yee and Larry Korba {George.Yee, Larry.Korba}@nrc.ca PST 2005 October 12-14, 2005

2. Overview Introduction Privacy policies and e-services Unexpected outcomes Preventing unexpected outcomes Conclusions and future research Objectives: Show that the use of privacy policies can lead to unexpected outcomes Propose ways to eliminate or mitigate the bad outcomesObjectives: Show that the use of privacy policies can lead to unexpected outcomes Propose ways to eliminate or mitigate the bad outcomes

3. Introduction Drivers for personal privacy policies Growth of the Internet greater consumer exposure to e-services growth of consumer awareness to lack of privacy Privacy legislation greater consumer awareness of privacy rights Privacy policies on the Internet Posted privacy policies P3P privacy policies for web sites Browser plug-in allows checking of personal privacy preferences against web site�s policy �Privacy Bird�: check preferences, display policy in easy to understand language, customizable warnings

4. Privacy policies and e-services Consumer privacy policy Necessary content implied by privacy legislation (minimal policy) Simple so that it can be understood by the average e-service consumer Machine processable, e.g. using XML-based language such as APPEL Provider has its own policy