Subject: [ietf-privacy] Privacy: Exploring a Definitional Formula

From: Mark Lizar <[email-masked]>
Date: Thu, 14 Jul 2011 13:10:16 +0100

Very Inspiring Thread,

After digging deep into this topic for some time to find various ways  
to discuss privacy in identity management it seems very clear that  
privacy is context specific and often unique for each person in need  
of it.  Context being an operational constant of privacy.

In addition, the relationship between control over information and the  
need for privacy also seems to be constant. For instance if I don't  
share my information or if my information is not gathered I do not  
need privacy.  In this way the benefit of anonymity can be described  
as privacy protecting.   It is when information is out of the  
individuals control that privacy seems to become an important  
consideration.  The less control the individual has the more  
considerations it seems is needed.

When information is gathered for a specific purpose or for a specfic  
context this information not only needs protection but the context to  
which it is used needs to be protected.   Lately I have been wondering  
what  levels of control, protection and assurance provide a measure  
that reflects the degree of privacy in context for the individual when  
her information is shared.  In this regard I follow Nissenbaum and  
Walzer excellent work in this area in which they have explained that  
contextual integrity is a key component of privacy.

Rather than providing a definition for the term privacy perhaps an  
approach can be taken by looking at privacy as a set of mechanics (or  
states of information) which require privacy.  I think this  
conversation would get much closer to defining the measureable  
elements of privacy if a more operational baseline is first  
established.  What if a privacy definition formula is constructed?   
E.g. context + circumstances + level of control + level of protection  
= degree of privacy.

I believe an approach of this nature is supported by the discussions I  
have observed in this thread.

For instance:

On 12 Jul 2011, at 12:24, Rhys Smith wrote:

> I think the main issue would actually not be that its contentious -  
> rather that it would almost certainly be incomplete. There are so  
> many definitions of privacy - across multiple contexts, multiple  
> cultures - that we'd be certain to not capture them all (and  
> probably not even most).

On 12 Jul 2011, at 04:30, [email-masked] wrote:

> However, as to definitions of "privacy", our friend, Trent, spotted  
> this definition in the OECD "Glossary of Statistical Terms" (see http://stats.oecd.org/glossary/detail.asp?ID=6959) 
> :
>
> "Privacy is a concept that applies to data subjects while  
> confidentiality applies to data.
>
> The concept is defined as follows: "It is the status accorded to  
> data which has been agreed upon between the person or organisation  
> furnishing the data and the organisation receiving it and which  
> describes the degree of protection which will be provided."."

On 12 Jul 2011, at 01:25, Bjoern Hoehrmann wrote:

> Including the term "privacy" is important for reasons of  
> discoverability
> and establishing context; beyond that I do not think it's a very  
> useful
> term.

On 12 Jul 2011, at 00:59, Thomson, Martin wrote:

> RFC 3552 doesn't attempt to define "security".  But it does have  
> something to say on the generic nature of the term:
>
>   Most people speak of security as if it were a single monolithic
>   property of a protocol or system, however, upon reflection, one
>   realizes that it is clearly not true.  Rather, security is a series
>   of related but somewhat independent properties.  Not all of these
>   properties are required for every application.
>
> Defining each of the properties we're interested in paints a more  
> accurate picture of the concept than a single trite statement.

On 11 Jul 2011, at 19:37, Rhys Smith wrote:

> Hannes' doc then needs to introduce terms that can help people  
> express how privacy is affected in their specific context and domain  
> using a common language: things such as linkability and whatnot.  
> This would be extremely helpful to people and very useful for readers.

On 11 Jul 2011, at 17:36, SM wrote:

> In a security context, you might see the following description for  
> privacy:
>
>  "Privacy refers to the right of an entity, normally a person,  
> acting in
>   its own behalf, to determine the degree to which it will interact  
> with
>   its environment, including the degree to which the entity is  
> willing to
>   share information about itself with others."

Maybe describing privacy as context specific and exploring the  
development of a common formula for assessing privacy in context may  
be a more fruitful approach for how to understand and define what  
privacy 'actually' is.

 From this vantage a few operational privacy components become more  
meaningful.

1. The context and purpose to which information is gathered is  
important and should be locked to data and use.
2. The unique circumstances of the context for which the individual  
requires privacy is also important and makes privacy unique for each  
circumstance.  A privacy fingerprint if you will.

To help visualise this approach I have put together a visualisation of  
what a Privacy ICON could look like that provides a more contextual  
understanding of privacy.(attached)    This is an over simplified view  
of three categorical context of information control in which privacy  
dramatically differs. This visualisation is presented in the likeness  
of a stoplight ICON.

In no way do I suggest that this is a definition but I do present this  
as perhaps a more productive methodology to explore defining privacy.

Kind Regards,

Mark Lizar

Mark Lizar
http://www.identity-trust.com

---

From: Nat Sakimura <[email-masked]>
Date: Fri, 15 Jul 2011 03:00:10 +0900

I have not looked through the thread yet, but my shot towards the definition
of privacy:

http://nat.sakimura.org/2011/06/28/entity-identity-privacy-1/

It has got graphical representation.

It may be interesting for you guys to look at ISO29100 and 29101 drafts as
well.
Unfortunately, they do not define "privacy" per se, but has many related
concepts.

=nat

On Thu, Jul 14, 2011 at 9:10 PM, Mark Lizar <[email-masked]> wrote:

>
> Very Inspiring Thread,
>
> After digging deep into this topic for some time to find various ways to
> discuss privacy in identity management it seems very clear that privacy is
> context specific and often unique for each person in need of it.  Context
> being an operational constant of privacy.
>
> In addition, the relationship between control over information and the need
> for privacy also seems to be constant. For instance if I don't share my
> information or if my information is not gathered I do not need privacy.  In
> this way the benefit of anonymity can be described as privacy protecting.
> It is when information is out of the individuals control that privacy seems
> to become an important consideration.  The less control the individual has
> the more considerations it seems is needed.
>
> context this information not only needs protection but the context to which
> it is used needs to be protected.   Lately I have been wondering what
>  levels of control, protection and assurance provide a measure that reflects
> the *degree of privacy* in context for the individual when her information
> is shared.  In this regard I follow Nissenbaum and Walzer excellent work in
> this area in which they have explained that contextual integrity is a key
> component of privacy.
>
> Rather than providing a definition for the term privacy perhaps an approach
> can be taken by looking at privacy as a set of mechanics (or states of
> information) which require privacy.  I think this conversation would get
> much closer to defining the measureable elements of privacy if a more
> operational baseline is first established.  What if a privacy definition
> formula is constructed?  E.g. context + circumstances + level of control +
> level of protection = degree of privacy.
>
> I believe an approach of this nature is supported by the discussions I have
> observed in this thread.
>
> For instance:
>
> I think the main issue would actually not be that its contentious - rather
> that it would almost certainly be incomplete. There are so many definitions
> of privacy - across multiple contexts, multiple cultures - that we'd be
> certain to not capture them all (and probably not even most).
>
>
>
> However, as to definitions of "privacy", our friend, Trent, spotted this
> definition in the OECD "Glossary of Statistical Terms" (see
> http://stats.oecd.org/glossary/detail.asp?ID=6959):
>
> "Privacy is a concept that applies to data subjects while confidentiality
> applies to data.
>
> The concept is defined as follows: "It is the status accorded to data which
> has been agreed upon between the person or organisation furnishing the data
> and the organisation receiving it and which describes the degree of
> protection which will be provided."."
>
>
> Including the term "privacy" is important for reasons of discoverability
> and establishing context; beyond that I do not think it's a very useful
> term.
>
>
>
> RFC 3552 doesn't attempt to define "security".  But it does have something
> to say on the generic nature of the term:
>
> Defining each of the properties we're interested in paints a more accurate
> picture of the concept than a single trite statement.
>
>
>
> Hannes' doc then needs to introduce terms that can help people express how
> privacy is affected in their specific context and domain using a common
> language: things such as linkability and whatnot. This would be extremely
> helpful to people and very useful for readers.
>
>
>
> In a security context, you might see the following description for privacy:
>
>  "Privacy refers to the right of an entity, normally a person, acting in
>   its own behalf, to determine the degree to which it will interact with
>   its environment, including the degree to which the entity is willing to
> Maybe describing privacy as context specific and exploring the development
> of a common formula for assessing privacy in context may be a more fruitful
> approach for how to understand and define what privacy 'actually' is.
>
> 1. The context and purpose to which information is gathered is important
> and should be locked to data and use.
> To help visualise this approach I have put together a visualisation of what
> a Privacy ICON could look like that provides a more contextual understanding
> of privacy.(attached)    This is an over simplified view of three
> categorical context of information control in which privacy dramatically
> differs. This visualisation is presented in the likeness of a stoplight
> ICON.
>
> In no way do I suggest that this is a definition but I do present this as
> perhaps a more productive methodology to explore defining privacy.
>
> Kind Regards,
>
> Mark Lizar
>
>
>
>
>
>
>
>
>
> Mark Lizar
> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Fri, 15 Jul 2011 03:05:24 +0200

* Mark Lizar wrote:
>need privacy.

Most of us can relate to an occasional need for solutide, for being left
alone with our thoughts undisturbed, which is an aspect of "privacy" but
this usage seems more colloquial than conceptual. "Needing privacy" is a
bit like "needing dignity". Your usage leaves out that "privacy", much
like "dignity", is also seen as a state of mind which is always present,
even if deeply buried in the subconscious.

We are always in need of assurance that others in society will treat us
fairly and reasonably, and we need a clear idea of what that means. The
black van with the antennas and blinking lights I park in front of your
house every night, that I remove each day when the sun rises, does not
actually have to gather information to affect your feeling or behavior.

>E.g. context + circumstances + level of control + level of protection  

You are in a room with someone else and have to undress. You ask them
to turn around and they do it; then that is not because you control the
situation or because they are protecting your privacy, they're granting
you an increased degree of privacy. If you like heterosexuality, mono-
gamy, and not taking hard drugs, and society has no issues with that,
then that grants you a greater degree of privacy; you can then, for in-
stance, practise these things in the open without spending much thought
on the matter. Ease of mind is a central aspect, in good and bad ways.

A simple way to look at this is to recognize that knowledge is power,
and knowledge about people is power over people, directly if you use it
to give someone a little nudge in some direction, and indirectly, if
they adapt to you knowing something, or your ability to know something,
to expose something, to infer new things from what you know, and so on.
Recognition of "privacy" is supposed to limit and balance this power,
the idea being that you should be free from the power of others, to the
extent possible, while also maintaining some level of social cohesion.

>http://www.identity-trust.com

This web site uses some third party "analytics" service. I'd encourage
you to locate and read through the Terms of Service for it in british
english and american english and compare what they say about "privacy".
Anyone comparing the two will understand cultural differences better.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Mark Lizar <[email-masked]>
Date: Fri, 15 Jul 2011 15:47:56 +0100

Thanks Bjoern for such a thoughtful response,

> on the matter. Ease of mind is a central aspect, in good and bad ways.

I think I understand what you mean here but it seems hard to quantify  
or discuss what you are saying in a  technically operable manner.   
Technically there seems to be a clear difference between digital  
privacy and physical privacy because  digitally all one must  
physically do is turn off the video on a computer to achieve the  
privacy you describe above.  I do agree there is an evolving societal  
view of what privacy is and this view also changes upon circumstances  
and people (possible observers) present.

In an effort to focus more on the physical and operational components  
of what makes up privacy online (digitally) it seems that in  
conjuction with a  "laundry list of privacy harms" it would also be  
fruitful to somehow visually describe the digital privacy landscape  
(or lifecycle), to which these harms can be more operationally useful.

My approach here, was trying to define privacy by discussing how  
personal control over identity based data (e.g. anonymity, or  
pseudonymity) would operate throughout the full information (or  
privacy) lifecycle;  namely  collection, use, retention, and  
disclosure of identifying data.  It seems clear that if the data (or  
attributes) shared was locked to context and purpose when it was  
shared, then measured by level of control and protection, and exposure  
- e.g. (over retention and disclosure) this would help define privacy  
in a specific (and even visually observable) context.

With this example in mind I would be sure to include; context,  
purpose, and consent to the key definitions to incorporate into the  
document. Perhaps even going so far as to discuss entering terms such  
as levels of identity control, assurance, protection and exposure as  
indicators of personal data privacy.

What I was exploring here, with these terms, is  whether or not these  
components could add up to provide a 'picture' or metric or even a  
'degree of privacy'. Wistfully thinking that this may offer a useful  
'ray of light' on the topic.   But, it is becoming quite clear that  a  
degree of privacy would only have meaning if it was relative to a  
state of privacy that can already be technically defined and useful.  
(bringing me back full circle to the start of this thread)

Ultimately, I do agree that defining Privacy writ large is not  
possible with a single definition. Even a laundry list of definitions,  
although desirable, may be very difficult (if not impossible) to  
achieve.  It does seem that defining a 'state' of privacy digitally  
(perhaps even calling it something that is categorised as a context  
specific privacy) may be an approach to making privacy more  
technically define-able and useful.

Hope this is helpful,

Mark Lizar