Paradigms of Privacy Research & Privacy Engineering Seda - - PowerPoint PPT Presentation

▶
paradigms of privacy research privacy engineering
SMART_READER_LITE
LIVE PREVIEW

Paradigms of Privacy Research & Privacy Engineering Seda - - PowerPoint PPT Presentation

Jan 14, 2023 365 likes •956 views

Paradigms of Privacy Research & Privacy Engineering Seda Grses f.s.gurses@tudelft.nl TU Delft/ KU Leuven 18. June 2019 GDPR requires data protection by design and by default (Article 25) A complex law with many requirements. More

slide-1
SLIDE 1

Paradigms of Privacy Research & Privacy Engineering

Seda Gürses f.s.gurses@tudelft.nl TU Delft/ KU Leuven

  • 18. June 2019
slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4

GDPR requires data protection by design and by default (Article 25)

A complex law with many requirements. More about creating a vision than a checklist

slide-5
SLIDE 5

How to of Article 25!?

recommendations are abundant

slide-6
SLIDE 6

European Data Protection Board https://edpb.europa.eu/edpb_en

slide-7
SLIDE 7

European Data Protection Supervisor https://edps.europa.eu

slide-8
SLIDE 8

ENISA https://www.enisa.europa.eu/publications

slide-9
SLIDE 9

Norwegian Data Protection Authority https://www.datatilsynet.no

slide-10
SLIDE 10

Unabhängiges Landeszentrum für Datenschutz https://www.datenschutzzentrum.de/sdm/

slide-11
SLIDE 11

Federal Trade Commission https://www.ftc.gov/tips-advice/business-center/privacy-and-security/tech

slide-12
SLIDE 12

National Institute of Standards and Technology (NIST) https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering

slide-13
SLIDE 13

Data Protection as a Service

http://cdn.ttgtmedia.com/informationsecurity/images/vol4iss7/ism_v4i7_f4_DataLifecycle.pdf

slide-14
SLIDE 14

getting privacy engineering right?

slide-15
SLIDE 15

privacy research getting privacy engineering right?

software engineering practice

slide-16
SLIDE 16

privacy research

software engineering practice

slide-17
SLIDE 17

privacy research

software engineering practice

slide-18
SLIDE 18
slide-19
SLIDE 19

can it be that the practices around the production of software are an important element of privacy research?

privacy research

software engineering practice

slide-20
SLIDE 20

matters?

slide-21
SLIDE 21

800

slide-22
SLIDE 22
slide-23
SLIDE 23

Tinder decides based on your profile who you see first! LinkedIn uses similar inferences to decide which job ads to show you!

Insurance companies, banks, universities, and many others are ready to follow suit!

Profiling and ranking is becoming a common practice

slide-24
SLIDE 24

imagine you want to share a picture on a social network.

picture of a meeting with your colleagues discussing the introduction of code commits as a performance metric

scenario

you want to share the excitement of the moment with your friends (not your manager)

you would like to tag your colleagues in the picture in an appropriate manner

you do not want your managers and 3rd parties (like Tinder) to see the picture you do not want the social network to run facial recognition on the pictures How would you use OR design a system to do the following?

slide-25
SLIDE 25

study: lit review 42 interviews events/papers

slide-26
SLIDE 26

privacy as control privacy as confidentiality privacy as practice

PRIVACY RESEARCH PARADIGMS

slide-27
SLIDE 27

privacy as confidentiality

PRIVACY RESEARCH PARADIGMS

“the right to be let alone” Warren and Brandeis data minimization avoid single point of failure

  • pen source - it takes a village to keep it secure

properties with mathematical guarantees

slide-28
SLIDE 28

privacy as confidentiality

PRIVACY RESEARCH PARADIGMS

you are worried that the social network may run facial recognition encrypt the picture before uploading

  • bfuscate the image
slide-29
SLIDE 29

privacy as confidentiality

PRIVACY RESEARCH PARADIGMS

secure messaging Signal - WhisperSystems WhatsApp - Facebook iMessage - Apple Off The Record - Cypherpunks

slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33

data minimization

slide-34
SLIDE 34

data minimization

slide-35
SLIDE 35

Seda Gurses, Carmela Troncoso, Claudia Diaz. Engineering Privacy by Design Reloaded. Amsterdam Privacy Conference. 2015

Minimize Collection Minimize Disclosure Minimize Centralization Minimize Linkability Minimize Replication Minimize Retention strategies

minimizing privacy risks and trust assumptions placed on other entities

Overarching goal

Unpacking Data Minimization: Privacy By Design Strategies

slide-36
SLIDE 36

privacy as control

PRIVACY RESEARCH PARADIGMS

“right of the individual to decide what information about himself should be communicated to others and under what circumstances” Westin transparency and accountability control sharing of picture with managers and 3rd parties FB and CambridgeAnalytica FIPPS/GDPR compliance individual participation and control

slide-37
SLIDE 37

privacy as control

PRIVACY RESEARCH PARADIGMS

privacy policy languages purpose based access control Attribute Based Credentials

slide-38
SLIDE 38
slide-39
SLIDE 39
slide-40
SLIDE 40

Android Permissions Remystified: A field study of Contextual Integrity (Wijesekera et al. 2015)

slide-41
SLIDE 41

Android Permissions Remystified: A field study of Contextual Integrity (Wijesekera et al.)

slide-42
SLIDE 42

Android Permissions Remystified: A field study of Contextual Integrity (Wijesekera et al.)

slide-43
SLIDE 43

Android Permissions Remystified: A field study of Contextual Integrity (Wijesekera et al.)

slide-44
SLIDE 44

FB and CambridgeAnalytica

slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49

Dark Patterns invoked in a case by the Norwegian Consumer Council

slide-50
SLIDE 50

CNIL (French Data Protection Authority) already fined Google $50million Euros

slide-51
SLIDE 51

privacy as practice

PRIVACY RESEARCH PARADIGMS

“the freedom from unreasonable constraints

  • n the construction of one’s identity” Agre

improve user agency in negotiating privacy privacy integral to collective info practices aid in privacy decision making transparency of social impact

slide-52
SLIDE 52

privacy as practice

PRIVACY RESEARCH PARADIGMS

“the freedom from unreasonable constraints on the construction of one’s identity” Agre enhance design of collective info practices

appropriate way to tag your colleagues? try different designs for tagging/ permissions/confirmations/removal

slide-53
SLIDE 53

privacy as practice

PRIVACY RESEARCH PARADIGMS

feedback & awareness design privacy nudges

slide-54
SLIDE 54
slide-55
SLIDE 55

Liu et al., Follow My Recommendations: A Personalized Privacy Assistant for Mobile App Permission, USENIX, 2016. Shvartzshnaider et al., Crowdsourced, Actionable and Verifiable Contextual Informational Norms, Arxiv 2016.

Contextual Integrity: actors type of information transmission principles

slide-56
SLIDE 56

privacy as control privacy as confidentiality privacy as practice

PRIVACY RESEARCH PARADIGMS

slide-57
SLIDE 57

the paradigms are the basis of engineering privacy

privacy as confidentiality: especially valuable in current data practices

privacy as control: personal data-centric, likely to have great traction with GDPR

privacy as practice: fundamental to smart environment and understanding user needs

privacy engineering requires rethinking software engineering

ideally, all three approaches ought to be considered together good systems engineering includes privacy engineering privacy engineering will be important for GDPR compliance, too

slide-58
SLIDE 58
  • Please contact me for further references
  • f.s.gurses@tudelft.nl
  • Interdisciplinary Summer School on Privacy
  • Theme: Dark Patterns
  • September 2.-6., 2019 Nijmegen, The

Netherlands

thank you!