06 Privacy

06-Privacy
http://www.howtogeek.com/125574/geek-comic-for-september-30th-loss-of-privacy-starts-early/
CptS/EE 302, Spring, 2017
1 1/26/2017
How did you do on HW #3?

Scenario Summary
You are creating the Laser Star 75, a new version of a
medical device that performs laser surgery
You are asked to replace hardware interlock device with a
software interlock system
You are given 90 days to implement and test software
interlock system, but you estimate you actually need 8-12
months
You raise concern with boss, who tells you are under
contract to remain silent; if you bring up your concerns
with anyone higher up, it will be grounds for your dismissal
You like working for the company, but you have serious
concerns. What should you do?
2 1/26/2017
Question 1: SECEPP Analysis

Relevant clauses:
Public: 1.03, 1.04
Client and Employer: 2.05, 2.06
Product: 3.01, 3.02, 3.05, 3.06, 3.09,
3.10
Management: 5.05, 5.11, 5.12
Profession: 6.12, 6.13
3 1/26/2017
Question 2: Whistleblowing Analysis

Morally permissible
Criterion 1 (serious and considerable harm to
public: Possibly
Criterion 2 (reported to immediate supervisor): Yes
Criterion 3 (exhausted all internal procedures and
possibilities): No
Morally required
Criterion 4 (accessible, documented evidence of
your view of situation): No
Criterion 5 (you have good reason to believe going
public will bring about necessary changes): No
4 1/26/2017
Todays class focuses on privacy

Key Questions Guiding Todays Class
Q1. What is privacy, and Why should CS/EE
professionals care about it?
Q2. How can I analyze the ethical acceptability
of behaviors related to privacy?
Q3.What software and hardware-related
practices raise privacy concerns?
Q4. What approaches, guidelines and laws can
help address these concerns?
5 1/26/2017
Privacy involves some sort of

breach in personal information
Several metaphors have been
used:
A repository of personal
information that can be
diminished over time
A personal space that can
be intruded upon
A fundamental right that
can be violated
Useful to distinguish between
Having privacy (descriptive)
Having a right to privacy
CptS/EE 302,
Spring, 2017
(normative)
(3)
1/26/2017
The historical evolution of

privacy
Privacy is defined in terms of
Accessibility Privacy
(19th and early 20th century) one's physically "being let
alone," or freedom from
intrusion into one's physical
space.
Decisional Privacy
(1960s-1970s)
Privacy is defined in terms of

freedom from interference in
one's choices and decisions.
Informational Privacy
(1990s-present day)
Privacy is defined as control

over the flow of one's personal
information, including the
transfer and exchange of that
information.
7 1/26/2017
As a CS/EE professional, why should

you should care about privacy?
Reason 1: CS and EE
professionals deal with personal
information in their workplace
Personal information of clients and
customers
Personal information of
employees/colleagues
Data on work activities of
employees/colleagues
If you care about privacy

You will have more satisfied clients
you will foster a more positive and
productive work environment
(5)
8 1/26/2017
As a CS/EE professional, why should

you care about privacy?
Reason 2: CS and EE professionals
design and build new software and
hardware technologies
Many of these work with personal info
Collect
Store
Analyze
Manipulate
Share
If you care about the privacy of those

who use your products
(6)
You will have a competitive advantage

You could avoid lawsuits
9 1/26/2017

10 1/26/2017
Analyzing information privacy

violations: Nissenbaums
framework
Norms of appropriateness:
Is a given type of info
appropriate to divulge
within a particular
context?
Norms of distribution: Can
info be divulged within or
across contexts?
Contextual integrity
maintained when both
norms are respected.
(4)
11 1/26/2017
Privacy Scenario
(Nissenbaum analysis of privacy)
Suppose that, in your teams common work room, you look over
Marys shoulder and notice that she is working on your teams
code base. She is implementing a particular function that, in a
recent team meeting, the project manager said was low
priority and should not be implemented for another few
months. You go immediately to the project managers office and
tell her that Mary is working on the low priority function.
Is your info gathering process appropriate to the context?
A. Yes
B. No
C. Unsure
Does your telling the project manager about Marys work
comply with norms that govern flow of personal information in
this context?
A. Yes B. No C. Unsure
12 1/26/2017
You Try It: Use Nissenbaums

Framework to Analyze this Scenario
Suppose you work for a company that specializes in
mashing up online social data to make it more
useful. Your company is designing a new app that
merges data from (a) Facebook, (a) the Department
of Motor Vehicles database of traffic violations, and
(c) the database of a large insurance company that
contains incidents of rapid braking and driving over
80 miles per hour. Your company plans to use these
data to construct a Facebook app that will allow
Facebook users to view and comment on the good
driver ratings of their friends.
You may work with a neighbor!
Put your names and WSU IDs at the top of a sheet of paper
CptS/EE
Spring,down
2017
13 1/26/2017
302,
Write
brief analyses of (a) Norms of Appropriateness,
Nissenbaums framework
(for reference)
Norms of appropriateness:
Is a given type of info
appropriate to divulge
within a particular
context?
Norms of distribution: Can
info be divulged within or
across contexts?
Contextual integrity
maintained when both
norms are respected.
(4)
14 1/26/2017

Q3.What software- and hardware-related
15 1/26/2017
Privacy threatened by three data

practices
Data gathering and

surveillance
Data exchanging
Data mining
(7)
16 1/26/2017
Turn to your neighbor (same one as before!)

(10 minutes)
Get out a sheet of paper and put both of your
names on it (can use the same one as before)
Write down Data gathering and surveillance
Write down a list of ways in which companies
can engage in data gathering and surveillance
Write down a list of key ethical questions
concerning data gathering and surveillance that
CS/EE professionals need to pay attention to
Also make lists for Data exchanging and Data
mining
Well discuss these as a class
17 1/26/2017
Class Discussion
Data gathering and surveillance
Data exchanging
Data mining
18 1/26/2017

19 1/26/2017
FTC Fair Information Practice Principles

https://en.wikipedia.org/wiki/FTC_Fair_Information_Practice
Originally developed in 1970s by a U.S.

government advisory committee
The Federal Trade Commission refined and
expanded these principles in the 1990s
The Principles
Notice/Awareness
Choice/Consent
Access/Participation
Integrity/Security
Enforcement/Redress
20 1/26/2017
Informed consent
(taken from
https://www.youtube.com/watch?v=ha63pbK6WVc&feature=youtube_gdata_player, 12:21)
The process by which a fully informed

user participates in decisions about his or
her personal data (van der Geest et al.,
2005)
Five principles
1.
2.
3.
4.
5.
Disclosure
Comprehension
Voluntariness
Competence
Agreement
21 1/26/2017
An Industry-Standard Privacy Policy:

Bank of America
Questions for discussion:
Are these privacy notices ethically
acceptable?
Would you reasonably expect customers to
read and understand these notices?
What choices do customers who are
uncomfortable with these terms and
conditions have?
Does BOA have valid and acceptable reasons
for wanting to collect and share the personal
data that it chooses to collect and share?
22 1/26/2017
Overview of privacy
23 1/26/2017
Page 1
24 1/26/2017
p. 2: How we collect and use other

information
25 1/26/2017
p. 2: Data collected for advertising,

and type of ads presented
26 1/26/2017
p. 3: Ad tailoring for third-party sites:

Contextual Integrity?
27 1/26/2017
p. 3: Opt-out choices
28 1/26/2017
Putting it together: A good privacy

disclosure
Summary Table
Reasons we may share Do we
your personal
share the
information
informatio
n?
Can you
limit the
sharing?
For everyday business

purposes
Yes
No
For joint marketing with

our partners
Yes
Yes
Go to <<url>>
or call
<<number>>
For affiliates everyday

business purposes
Yes
Yes
Go to <<url>>
or call
<<number>>
No
We dont
share
For our nonaffiliates

everyday business
purposes
How can you

limit the
sharing?
29 1/26/2017
Putting it together: A good privacy

disclosure
FAQ style disclosure
Key sections
What personal information is collected?
Can I limit the personal information collected?
What are cookies, and how are they used?
Is my personal information shared? What info?
With whom?
How is my information secured (protected)?
What choices do I (as a user and customer)
actually have in order to control my personal
information and opt out?
30 1/26/2017
Commentary: Are privacy

disclosures the most ethically
acceptable approach?
We know from research studies that users

rarely read privacy terms
How can users provide consent if they havent
read the privacy terms?
If users actually did read these terms,

would they understand them? Would they
still give their consent?
Are online companies approaching the
acquisition of consent in the most ethically
acceptable way? What could they do
better? Is true consent even possible?
31 1/26/2017
Homework #4:
Privacy in Public Space Scenario
(adapted from Scenario 5.8, p. 157)
SuperMart, a large grocery store in your town, installs several closed-circuit

cameras in each of its aisles. These closed-circuit cameras not only allow the
store to obtain aggregate statistics on how much time shoppers are spending
in each aisle (for sales/marketing purposes); they also allow the store to learn
about the movements and preferences of individual shoppers. As a shopper
walks down an aisle, a facial recognition algorithm attempts to recognize the
shoppers face by matching video stills with a database of (identified) face
shots that SuperMart collects when customers register for its Club Card.
If SuperMart can recognize an individual shopper, that shoppers particular
preferences and interests are inferred based on how long the shopper lingers in
a particular place, and what products the shopper picks up and either puts in
his/her cart or back on the shelf. In addition, SuperMart uses point-of-sale
receipts to collect further information on customers preferences. SuperMart
then uses all of this information to build a profile of its individual customers.
The profile, in turn, is used to furnish customers with in-store targeted coupons
and online targeted ads. Note that SuperMart also shares its customer
information with third parties, who then use the information to furnish targeted
online ads on the their sites.
32 1/26/2017
Homework #4 (cont.):
Privacy Analysis and Policy
1. In a paragraph or two, apply Nissenbaums privacy framework
to determine whether SuperMarts practices, as described in
the scenario, are a violation of customer privacy.
2. Suppose that you are charged with writing SuperMarts
privacy policy. It will be published in a brochure available to
customers before they enter the store. Fill in the SuperMart
Privacy Policy Template to flesh out an ethically acceptable
privacy policy for SuperMarts collection of personal
information. Be sure to address each prompt within the
template.
Create a PDF document with your responses, and submit to
OSBLE by the start of class next January, 31. You can work with
up to one other person on this assignment. If you do, only one of
you needs to submit the solution, but be sure that both your
names are on the submission!
33 1/26/2017
For next time

Work on HW#4
Take the case study selection survey:
https://wsu.co1.qualtrics.com/SE/?SID=SV_74JXPY
WOEnFA9MN
(Its worth participation credit!)

Next class: Guest speaker talks about
intellectual property
34 1/26/2017
Image credits
1.
2.
3.
4.
5.
6.
7.
8.
9.
http://www.divorcelawyerschicago.org/chicago-divorce-attorneys-explain-the-changing-eavesdroppin
g-laws-in-illinois/
http://managedhealthcareexecutive.modernmedicine.com/managed-healthcare-executive/news/clin
ical/practice-management/private-information?page=full
http://diginomica.com/2014/08/15/microsofts-pursuit-big-data-privacy-law-rethink-deserves-indust
ry-support/
http://www.strategies.com/blog/is-your-information-flowing/
http://news-quality.com/2012/12/employee-monitoring-survey-123012/
http://usatoday30.usatoday.com/tech/news/2011-08-03-internet-tracking-mobile-privacy_n.htm
https://loveinthetimeofinternets.wordpress.com/2015/01/04/1984wasnotsupposedtobeaninstructi
onmanual/
https://www.barcodesinc.com/info/buying-guides/rfid.htm
http://www.wirelessvisionme.com/products-solutions/technologies/passive-active-rfid/
35 1/26/2017

06 Privacy

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

06 Privacy

Uploaded by

Copyright:

Available Formats

06-Privacy

How did you do on HW #3?

Question 1: SECEPP Analysis

CptS/EE 302, Spring, 2017

Question 2: Whistleblowing Analysis

CptS/EE 302, Spring, 2017

Todays class focuses on privacy

Privacy involves some sort of

The historical evolution of

Privacy is defined in terms of

Privacy is defined as control

CptS/EE 302, Spring, 2017

As a CS/EE professional, why should

If you care about privacy

As a CS/EE professional, why should

If you care about the privacy of those

You will have a competitive advantage

Todays class focuses on privacy

Analyzing information privacy

You Try It: Use Nissenbaums

Todays class focuses on privacy

Privacy threatened by three data

Data gathering and

CptS/EE 302, Spring, 2017

Turn to your neighbor (same one as before!)

CptS/EE 302, Spring, 2017

Todays class focuses on privacy

FTC Fair Information Practice Principles

Originally developed in 1970s by a U.S.

The process by which a fully informed

CptS/EE 302, Spring, 2017

An Industry-Standard Privacy Policy:

CptS/EE 302, Spring, 2017

CptS/EE 302, Spring, 2017

p. 2: How we collect and use other

CptS/EE 302, Spring, 2017

p. 2: Data collected for advertising,

CptS/EE 302, Spring, 2017

p. 3: Ad tailoring for third-party sites:

CptS/EE 302, Spring, 2017

CptS/EE 302, Spring, 2017

Putting it together: A good privacy

For everyday business

For joint marketing with

For affiliates everyday

For our nonaffiliates

How can you

Putting it together: A good privacy

Commentary: Are privacy

We know from research studies that users

If users actually did read these terms,

SuperMart, a large grocery store in your town, installs several closed-circuit

CptS/EE 302, Spring, 2017

CptS/EE 302, Spring, 2017

For next time

(Its worth participation credit!)

CptS/EE 302, Spring, 2017

CptS/EE 302, Spring, 2017

You might also like