Privacy Resource Center
On this site, we are collecting valuable resources on electronic privacy that our team has written, read and/or judged as particularly noteworthy to share.
The Privacy Legal Environment and its Evolution
|
Fair Information Practices are the governing privacy principles in the US. |
|
|
Together with the FIPs the OECD Guidelines are widely accepted as an outline to govern data protection and transborder information flows beyond Europe. |
|
|
Directive 95/46/EC of the European Parliament and of the Council of 24
October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data |
This is the core European legal framework. It is currently under revision; consequently it is important to recognize the enhancements proposed on 25h of Jan 2012 (in particular concepts like: data portability; data breach notifications; privacy by design; privacy impact assessments; a right to delete…). |
|
An agreement for data transfers between US and EU which works only marginally well due to lack of oversight and missing sanctions. |
|
|
There is a debate going on whether it wouldn’t make sense to propertize personal data; this debate is centered in the US although it may make sense in the European context as well; especially since the EU Directives already grant a lot of rights to individuals that would support to exercise property rights for personal data. |
Privacy Principles – What is Privacy?
|
These articles are giving a fantastic overview of what privacy is and how it has been conceptualized over time. |
|
|
Excellent overview article of current legal landscape and the privacy principles found therein. |
|
|
These articles derive privacy targets from privacy principles; privacy targets (German: “Schutzziele”) is what engineers can concretely try to aim for when they plan technical systems. |
Privacy Engineering and Privacy Methodologies
|
This Framework has been very influential, because the term “Privacy by Design” was coined here; privacy design goals are well outlined. |
|
|
This paper is one of the few papers that gives an overview of what privacy engineering actually means; the most important contribution is the concept of privacy by architecture and a model to analyze the identifiability of personal data. |
|
|
Privacy Impact Assessments are a key tool to create privacy by design. The BSI guideline is a very good guide on how a privacy impact assessment can be conducted step by step so that privacy by design is the outcome; the guideline focuses specifically on RFID; the more general and expanding article on how to conduct a PIA and how to conceive of PIAs as a tool is recommendable (written by the same team that developed the BSI RFID guideline); |
Privacy Enhancing Technologies
|
This paper summarizes the landscape of PETs and how these have been and can be categorized. It includes hints to much further PET literature. |
|
|
Looking back at P3P, Ari Schwartz, November 2009, |
Machine readable privacy policies that allow for privacy negotiations between data subjects and data controllers may be key in the future. A first project and technology in this direction was P3P. |
|
This is a very influential concept that was aired by Kim Cameron who was a major privacy guru at Microsoft. The idea is that we should have an identity layer between the user and the virtual world that protects peoples’ identities. |
|
|
Acquisti, A. (2009) Nudging Privacy - The Behavioral Economics of Personal Information. In: IEEE Security & Privacy, Vol. 7, pp. 82-85. IEEE Computing Society. |
This article summarizes a concept that recently emerged and that proposes that people should be supported in making rational privacy decisions through more paternalistic systems and defaults. |
|
ISO (2011) Information Technology - Security techniques - Privacy architecture framework. Vol. ISO/IEC JTC 1/SC 27 N10556, pp. DIN Deutsches Institut für Normung e.V. |
This document contains an excellent list of privacy principles although the term privacy targets could have been chosen as well; in particular it creates a link between what needs to be protected (principles) and what protection measures can actually be taken. |
Privacy Behavior
|
This article reports on how the “Privacy Paradox” was discovered. |
|
|
This article gives a very good overview how theories of behavioral economics can be transferred to the privacy domain; the main argument is that people are not rational when they make privacy decisions. |
|
|
Smith’s paper is still valid today. It summarizes all the major privacy dimensions that people seem to be concerned about and includes privacy scales. |
|
|
This article gives an excellent overview of privacy research up to 2007 and includes many of the major privacy frameworks that have been proposed by scholars and that summarize the concerns of people from multiple perspectives. |
Other recommendable sources on privacy
|
These two EU Projects have been at the core of privacy research focusing to a large extend on identity management; the researchers involved are thought leaders in the field of privacy research. |
|
|
Excellent collection by Roger Clark of links to privacy and security sources including technological solutions to ensure privacy (PETs). |
|
|
Excellent collection by Alessandro Acquisti of links to papers on the behavioral economics of privacy. |
MEMBER OF
