Five key concepts that brands and companies need to do to engage:

1. Respect my data, respect me
2. Security of infrastructure, governance
3. Transparency
4. Data portability
5. Economy, including penalties for bad behavior

Why is this coming? Consumers are fed up (breaches), but want relevance, convenience and value. Gigya study on single sign-on says many people use social sites for logins.

What should marketers & brands be thinking about: Rewrite your privacy policies to be understood. Create an organization-wide data governance policy. Install a data steward to liase between org and consumers (distinct from IT Privacy officer). Start working towards true data portability.

In future, Forrester is looking at redefining personal data, trust frameworks, how VCs look at this industry, etc.

More »

Related posts:

1. PII 2011: Owning Online Identity: Consumer-Managed Data
2. PII 2011: Mapping the PII Market: Players, Regulators, Stakeholders
3. PII 2011: Startup Spotlight: Disconnect

Browser extension: disables 3rd party tracking, depersonalizes your searches, shows blocked services & cookies, easily unblock services. Privacy icons project: four icons that represent various privacy policies.

Revenue model: pending, in the works, users may monetize their own data.

How do we know, how do we understand what’s in these TOS agreements? Hoping to crowd source various policy statements. At some point, icons will be displayed in browsers. When users understand what’s happening with their data, they’re more interested in privacy.

More »

Related posts:

1. PII 2011: Startup Spotlight: OneId
2. PII 2011: Implementing a Privacy Program
3. PII 2011: Baking Privacy into the Business

Larry: privacy was a cost (or risk) of doing business, now we’re looking at empowering users in a way that generates profits. Anecdotal experience in making privacy profitable, and what we learned? Jim: customers have been coming to us (on business side) with a compliance model, wanting to see uplift in their site with TRUSTe seal. Customers have concerns, their seal helps address that. Chris B: space between customer needs and marketing efforts. “Profile Choice” allows real-time bidding on aggregate-able info, didn’t find the right mix at that time. Chris K: misunderstandings between what companies are trying to do and what customers believe they’re doing. Using data for ad targeting within a company privacy policy. Beacon became Facebook Connect.

Larry: Beacon, and Google Buzz, had unsuccessful launch: unclear purpose (benefits), generating FTC complaints. Is there something about the launch of a product or service that makes it more dangerous or risky than other times? Jim: use of large datasets are prone to claims of changing the rules. If you’re working in areas that weren’t contemplated, that can be confusing, need to think about how to advance sharing practices. Navigating these waters is extraordinarily difficult. Jim: any future change may be viewed as a breach of privacy, unexpected changes (lack of or poor communications, offer choices, does company honor user choices, no accountability). Chris K: FTC, government isn’t in a good position to deal on this level but you don’t want to attract their attention.

Larry: sources of funding? Chris: question is no longer is privacy big enough, now it’s what are the top level matters? Investment community–advertising (every $ spent wants to be more targetted). Jim: process in ad targeting space, global, and how little is online: ad people are demanding more information about who’s receiving their ads.

Larry: about your not taking public investments? Jim: happy accident.

Chris K: Forensics for providing choice or for analytics/response: there are techniques, can take better control over this as web providers to help users. Data flow as arms business: companies that need to control what’s happening on their site or people who want to offer services to consumers. Chris B: targeted ads now more transparent. Balance against malware, cookies and their sources that feels more like security.

Larry: FTC’s interest in these issues, pending legislation in Congress–how does possibility of regulations affect climate for investment? Chris K: uncertainty is a cloud, straightforward means of regulation can move industry forward. But interim finger-pointing, lobbying gaming, are problems. Likes EU model, but we’re moving away from that. Chris B: gov is crowdsourcing communities, online advertising and ad space initiatives are trying to be more self-regulating. Still uncertain, industry groups and co-regulation being brought up and talked about. Chris K: Congress is a giant consumer of these targeting services. Behavioral targeting seems to be settling. Larry: what if a new regulation passes that takes a business model out or forces… Chris K: legislation takes time to effect.

Questions. Did people that saw the TRUSTe seal click on the seal or just go with it? Chris: clicks were low, most people recognize seal as an envelope.  What are people choosing? (site can collect, store, use for ad targeting, give to 3rd parties) Chris K: policy should say. We can’t make sure people read the policy. Do I have a right not to have data collected? Ends up as different perspectives from people vs industry, investment (collect data).

More »

Related posts:

1. PII 2011: Baking Privacy into the Business
2. PII 2011: Implementing a Privacy Program
3. PII 2011: Mapping the PII Market: Players, Regulators, Stakeholders

Things have changed in privacy and personal information. PII-driven business models (later). Data collectors are the engine: giants like Google, Facebook, Twitter, also organizations and agencies like Florida DMV (sold data to LexisNexus), also mom & pop operations. What makes information valuable? Your health and wealth, the networking you do, the Internet of things (you). What role to the aggregators play: markets for buying and selling data. Uses are infinite: research, monitoring, predictive modeling, advertising…

PII-driven business models:

• Platform plays (SAS, Hadoop, Revolution, Microsoft’s SharingInsight, CouchDB, etc.) – where everything is phoning home all the time.
• Social plays: LinkedIn, Facebook, Google Plus and Foursquare, but mobile is not this change. Also KISSmetrics, Klout, Zinga, hootsuite, radian6.
• Goverment plays: TSA and NSA, FBI, IRS, can buy from Facebook, Palantir (DOD).
• Privacy plays: SafetyWeb, reputation.com, TRUSTe, Singly, also Intellilight (in Detroit, attached to street lights where if there are a couple of people are there it turns audio mike and calls police), Spokeo, Datong
• Everyone plays: not just about advertising, many industries and business models benefit.

Implications for all PII players: privacy expectations, regulatory adherence (global), transparency (toward customers), crisis management. Privacy concerns are growing with consumers. Government is signalling that concern with new legislation. Companies must invest in this area, including training and certification.

Regulations: it’s confusing and will get more so. US: >30 federal states, >100 state regs for data security privacy. EU, pending legislation adds more. Bottom line; you’re going to need help here. Be transparent, be explicit about what you can’t provide. Use opt-in data options only.

Crisis management: when things to wrong, know how you are going to deal with them. Get a team and process in place. It’s about staying with the story if you can (used to be getting ahead of the story, now stay with). How to avoid a train wreck: be transparent, think global, be ready for breaches, behave as if you were worth your customers’ trust.

Question: opt-in: don’t short the short-term: be transparent. Opt in is a good way for customers to choose, is sticky.

More »

Related posts:

1. PII 2011: Making Privacy Portable
2. PII 2011: Implementing a Privacy Program
3. PII 2011: Baking Privacy into the Business

Lauren: what if your device was stolen? You probably don’t want to notify the thief that the device is being tracked. What’s your threat model? Who’s looking for your data?

Kevin: you have a choice of encrypting data or password resets. There are constraints from many interests that will prevent you from doing what you want. Trust-e is doing some good work.

In mobile space, you have more options of notifying people. Different for platform vendors and mobile developers. For mobile developers, analytics and advertising libraries–the issue is that you’re using user data to determine value. Mobile breaks down in the types of data being collected, not disclosed properly in privacy policy. All SDKs collect lots of info, hashed (sometimes with improper salting, revocation). Inherent architecture in advertising is prone to surveillance-level collection. For example, advertising sometimes passes referrer info to track conversion rates, but is creating a “worse system around” the data. Kevin’s work is trying to make process more transparent.

Each platform makes decisions about how users are going to make decisions about their use of the device. Tremendous liability for companies that misuse customer data. Users are starting to weigh this as a decision point. Compliance is a smaller part of Lauren’s work–there’s a whole lot of unregulated stuff going on. She gives a company a “gut check” on what users would think of these practices, collecting location info and what’s reasonable notice, later translation into a document.

Compliance is not big for startups. The companies that succeed are likely to be those who handle privacy best in any new field.

Questions:

Server location and data protection: different countries treat data variably, what about later when data is valuable? This is a really hard problem, best answer is locate servers in countries with best policies (Kevin Marks suggests Iceland). Have policies that spell out requirements: what you have, retention, is there another alternative to what’s normal procedures, etc. Other extremes: all user data is going into cloud such as Amazon services. This is an adjustment for people. Who holds the key?

New changes to Facebook? It’s a decision to work with them or not. Lauren doesn’t believe that Facebook-like practices will happen again. Using FB Connect is a decision to facilitate user authentication.

What do you think about AWS services, 80 page Terms of Service that allows a very invasive data policy in Amazon’s favor? Lauren: a lot of people are trusting what Amazon’s going to do. I’ve read their TOS and I don’t know what Amazon’s going to do. Important to ask about notice, what kind of policies need to be ported from cloud hosts into your products/services.

Not in this session but related: I Shared What?!? – a service that shows you what information you’re sharing when you use Facebook or FB Connect.

More »

Related posts:

1. PII 2011: Implementing a Privacy Program
2. PII 2011: Making Privacy Portable
3. PII 2011: Startup Spotlight: Disconnect

Kim Howell, (one of) Privacy Directors at Microsoft: When you’re doing a privacy review (practical, intuitive), you need to ask questions. Role playing with Reese as new company seeking a “privacy policy.” First questions (from our table discussions): what does site do, how do they collect info and what do they do with it? What’s their info flow path (is it resold?)? What’s their business model? How do you protect what you’ve collected? Controls by the individual (can visitors remove their data? remediation? transparency?)? Cookies? Other passive data collections? Countries involved (collection, use, storage)?

From Kim: Website: is this a new domain, link to privacy statement? existing privacy statement and does it match/make sure it covers everything? Data collection (see above). Send questions to new site/organization, get information, iterate. More questions: authentication, communication, vendors. Are people creating new accounts? use of email? data access requests? Vendors? Next round of questions: how well does IT + PR + Lawyers work together? Does privacy statement match the service? where’s plausible deniability? Make sure what’s required is clear, what’s optional. Provide better notice about use of information, data retention. Using HTTPS? How easy/obvious is it to obtain informed consent when signing up? Companies often think that writing a privacy statement at the last minute. (Wrong)

Next iteration: What new data is being collected? being sent where? other (new) features coming up? what info is shared? location: is it always being sent, or only in use when app is open? what other info (unique device ID, cell tower info, gender, etc.) is being sent with location data? data retention? If services changes, company may need to re-opt in application users. Privacy controls? (example of circulating the data within different departments of the company, “accounting department loves this data.”) Who needs access? for what use? access to raw data or aggregated statistics? Have data handlers been trained? Unique identifiers are not the only way of identifying a person. What’s intended use of collected data?

Michelle Bruno, Technical Privacy Manager: see printed case study (not online). Focus areas:

1. Level setting: focus on use of customer data, customer expectations, opting out
2. Author guidance: “how to” guides, privacy review checklist, company activities, data sharing, research and betas
3. Position yourself: pro-business privacy message, culture of privacy as a value-add
4. Piggyback: identify existing processes that you can take advantage of: spec templates, guidelines, bug tracking, testing, release management…
5. Analyze and assess: comprehensive data-gathering plan to understand company’s risk
6. Educate: pro-privacy contacts in each group to help succeed, spread work to peers about new process/resources
7. Identify triage partners: incident handling, partnerships in legal, customer support, operations, PR
8. Measure: what are your success metrics?

Questions: tension between user controls and corporate collections? Make sure value matches, is understood by both sides. Look at what business can put in place to allow better user controls. Microsoft has a federated privacy team, Kim’s team defines what compliance looks like.

Not mentioned in this panel but of some related interest (about Terms, not Privacy Policies): TOSAmend and EFF‘s TOSback.

More »

Related posts:

1. PII 2011: Baking Privacy into the Business
2. PII 2011: Making Privacy Portable
3. PII 2011: Mapping the PII Market: Players, Regulators, Stakeholders

Proposal to collect a set of questions that will help inform the dialog:

• data model/schema for personal data
• technology endpoints: API, network protocols, interface
• what do they offer: query, import/export, update, delete
• technology for protecting privacy/control: cryptography?
• client support: mobiles? desktop? browser plug-ins?
• developer resources: libraries? wikis?
• notion of identity: un/pw?
• architecture: centralized? open?
• data portability

Interoperability:

• What’s required to establish interoperability?
• What’s in their future plans?
• Can your project work with someone else’s project?

Documentation steps:

1. Document technical profile — with temporal attribute (what tech now, what changes coming?)
2. Interoperability: do you have interoperability with another member of the ecosystem? or planning to do?
3. (TBD)

Proposal suggested that we put a set of questions up and propose member organizations post responses (RSS or other) to help “cat herding” of the information. Proposal suggested to organize info in three columns: name, tech keywords, brief description. Proposal to pre-define businesses (personal data store) then differentiate between those companies/projects. Some questions won’t apply equally to all companies in the startup circle.

Survey Examples (does this format work?):

Need to do more thinking on how to collect/organize this information.

More »

Related posts:

1. IIW XIII: PDEC’s Legal Advisory Board
2. IIW XIII: The Final Overview
3. IIW XIII: Personal Data Ecosystem Overview

It’s instructive to find out what they know! Several years ago (2006), my friends at Privacy Rights Clearinghouse wrote a post called For the New Year, Resolve to Check Yourself Out that will help you do this. Their list of resources will help you understand who you are from the perspectives of your:

• Credit history
• Medical Information
• Bank account history
• Insurance claims
• Public records
• Search engines

I’d add one point to their last bullet. If you have an account on Google, you can now go into your Google Account Settings (look for the link in the upper right corner to Settings). Under Personal Settings, look for Dashboard: View Data Stored with this Account. It’s a view of what Google knows about you.

Coaching moment: It can be both overwhelming and empowering to know this much about your world. Fortunately, the overwhelming feeling can be countered by putting the story together and taking control of the problems. You’re creating a story, a narrative of who you are. Fix your problems if you can. Imagine a world in which you controlled your own information and others came to you for it. That world might be highly customizable in ways that were unique to you. What would that look and feel like?

More »

Related posts:

1. Identity as Revealed
2. Open Data Partnership

However, under the guise of “increased security,” we are increasingly surrounded by tools and technologies that minimize and standardize us, including video surveillance and data storage and analysis. About that last link to Google, CEO Eric Schmidt recently said “If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”

This indiscriminate personal data hoarding is both an individual and a societal problem. Schmidt’s argument that we shouldn’t have anything to hide is specious (not to mention a double standard: it doesn’t apply to Schmidt). In a 2007 paper called ‘I’ve Got Nothing to Hide’ and Other Misunderstandings of Privacy, George Washington University Law School’s Daniel J. Solove convincingly critiques that argument. Indeed we have many things to hide, like our passwords and credit card numbers, certain personal habits and preferences, things that contribute to human dignity and respect. As noted security expert Bruce Schneier writes in his essay The Eternal Value of Privacy, “Too many wrongly characterize the debate as “security versus privacy.” The real choice is liberty versus control.”

Ironically, Gary Wolf and Kevin Kelly host a blog called The Quantified Self where they report about people exploring ways to keep track of themselves. It’s a significant difference between curiosity, personal need, and voluntary disclosure that’s driving data sets, and corporate ventures like Facebook (nod to jerking you around again with recent privacy policy changes), Google (Schneier’s response to Schmidt’s quote above), and damned near every corporate site you make an account with and that tracks your every move these days.

I’m looking for examples of sites that encourage liberty and demonstrate some respect for its users/clients. I will be reporting on what I find. If you have suggestions, I welcome them.

Coaching moment: Here’s a little thought exercise. Think about a typical day in your life.

What kind of things do you do in private? These might be taking a shower, brushing your teeth, thinking about the day. Some things might be really private as in just you by yourself, and other things may be private in some context, like thinking about your day out loud with your spouse or partner. Once you get a good list, which of those things would make you uncomfortable if they were made public in some way?

Now think of the kind of things you do in public, like driving to work or the store, walking around, having a conversation over lunch. Think about stories that might be told about you from the perspective of not knowing what you were really doing. You might take clues from signs that you walk by, or maybe other people (posture, groupings, facial expressions). Can you think of any stories that are not only wrong but might hurt you?

Finally, think about your online tools. Have you actually looked at the Terms of Service or Privacy Policies that you’re agreeing to? If you knew they were disrespectful to you or even abusive of your personal self and liberty, would you stop using them? Since the answer is “probably not,” what would you suggest these companies change?

More »

Related posts:

1. Platform vs Relationships
2. Identity as Revealed
3. Mining the new Gold