Subject: [ietf-privacy] Article, toward a definition of privacy (or perhaps not).

From: Dean Willis <[email-masked]>
Date: Tue, 17 Dec 2013 18:00:07 -0600

See:

http://www.foreignpolicy.com/articles/2013/11/07/privacy_red_herring_debate_NSA_surveillance_debate#sthash.6ygfpfyV.dpbs

An exceprt:

"I'd add one more item to Solove's list of definitions: when people speak of privacy, often what they're really concerned about is not privacy at all, but very concrete kinds of economic and physical harm: job loss, theft, injury, imprisonment, and even death. That is: when people speak of privacy they're often speaking -- albeit indirectly -- about power, and its uses and abuses.”

"It's one thing to know, in the abstract, that anyone walking by your house can see into your kitchen window, but it's another thing altogether to look out the kitchen window and discover someone staring fixedly at you. It's one thing to know that the soccer mom sitting one table over at Starbucks can probably make out the words on your laptop screen; it's another thing altogether to know that "the government" can do the same thing.”

"The man staring fixedly through our kitchen window bothers us not because we think he might discover us doing something "secret," but because he has violated norms of socially acceptable behavior in a way that makes him unpredictable: if he's willing to violate norms against staring, what other norms might he also violate? Will he become a stalker, a blackmailer, a burglar, a rapist, a murderer?"

"Privacy is a red herring in the debate about NSA surveillance (and many other kinds of covert activities). If we want meaningful reform, we need to set aside the rhetoric of privacy, and focus instead on creating genuine safeguards against the abuse of government power."

—
Dean

---

From: Nat Sakimura <[email-masked]>
Date: Wed, 18 Dec 2013 20:58:03 +0900

It does not have to be government though.

It could be somebody from entirely private sector.
Still harm can be done on you.

Agree that people use the word privacy without clearly defining or
understanding what it is. In this sense, we should avoid dictionary term -
layman's term entirely. When we need to discuss properly, we need to define
it first and then use it.

In this sense, as I wrote in one of my blog post [1], the original Warren
and Brandeis [2] definition seems to be pretty good, though it is one of
the most misunderstood definition, IMHO.

They said privacy is right to be let alone. This "let alone" is the
specific words from Cooley [3] but people seem to have taken it as
dictionary word and hence much confusion. If you read it, it means: "right
of complete personal immunity".

I suppose, to avoid confusion, it probably is better to use the definition
portion of it instead of the defined word in the usual conversation.

[1]  Nat Sakimura, Why “privacy” confuses people,
http://nat.sakimura.org/2012/05/02/why-privacy-confuses/

[2] Warren and Brandeis, “The Right to Privacy”, Harvard Law Review, Vol.
IV December 15, 1890 No. 5

[3] Thomas McIntyre Cooley, “Law of Torts”, Callaghan, 1888

2013/12/18 Dean Willis <[email-masked]>

> "I'd add one more item to Solove's list of definitions: when people speak
> of privacy, often what they're really concerned about is not privacy at
> all, but very concrete kinds of economic and physical harm: job loss,
> theft, injury, imprisonment, and even death. That is: when people speak of
> privacy they're often speaking -- albeit indirectly -- about power, and its
> uses and abuses.”
>
> "It's one thing to know, in the abstract, that anyone walking by your
> house can see into your kitchen window, but it's another thing altogether
> to look out the kitchen window and discover someone staring fixedly at you.
> It's one thing to know that the soccer mom sitting one table over at
> Starbucks can probably make out the words on your laptop screen; it's
> another thing altogether to know that "the government" can do the same
> thing.”
>
> "The man staring fixedly through our kitchen window bothers us not because
> we think he might discover us doing something "secret," but because he has
> violated norms of socially acceptable behavior in a way that makes him
> unpredictable: if he's willing to violate norms against staring, what other
> norms might he also violate? Will he become a stalker, a blackmailer, a
> burglar, a rapist, a murderer?"
>
> "Privacy is a red herring in the debate about NSA surveillance (and many
> other kinds of covert activities). If we want meaningful reform, we need to
> set aside the rhetoric of privacy, and focus instead on creating genuine
> safeguards against the abuse of government power."
>
> —
> Dean
> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: S Moonesamy <[email-masked]>
Date: Wed, 18 Dec 2013 05:17:43 -0800

Hi Nat,
At 03:58 18-12-2013, Nat Sakimura wrote:
>understanding what it is. In this sense, we should avoid dictionary 
>term - layman's term entirely. When we need to discuss properly, we 
>need to define it first and then use it.
>
>In this sense, as I wrote in one of my blog post [1], the original 
>Warren and Brandeis [2] definition seems to be pretty good, though 
>it is one of the most misunderstood definition, IMHO.
>
>dictionary word and hence much confusion. If you read it, it means: 
>"right of complete personal immunity".
>
>I suppose, to avoid confusion, it probably is better to use the 
>definition portion of it instead of the defined word in the usual conversation.

There has been some discussion on other IETF mailing lists about the 
definition of the word "privacy".  Warren and Brandeis are often 
cited in a U.S context.  The "right of personal immunity" is broader 
than privacy.

Within an IETF context it might be a problem if the "right to be let 
alone" is used.  In my opinion a right is guaranteed by law and that 
doesn't fit in with what the IETF does.

Regards,
S. Moonesamy

---

From: Nat Sakimura <[email-masked]>
Date: Wed, 18 Dec 2013 23:57:01 +0900

Perhaps you did not read my blog post.

Warren and Brandeis quoted "to be let alone" from Cooley. It goes this way:

Recent inventions and business methods call attention to the next step
> which must be taken for the protection of the person, and for securing to
> the individual what Judge Cooley calls the right "to be let alone"

In turn, Cooley used the phrase this way:

Personal immunity. The right to one’s person may be said to be a right of
> complete immunity: to be let alone.

Therefore, what was meant by W&B is indeed is the right of complete
immunity. Somehow, American lawyers started to take them narrower than what
is apparently stated in the paper. However, going back to the original, it
is pretty good actually.

As to the "right" is concerned, I am not sure if it is "guaranteed by law"
all the time. It is not always that clear. In this particular case, what
belong to the person, and what to the community and the public is not
always clearly delineated.

As a standard body which sets standards, which are not regulations (in the
sense of ISO Guiide 2), there is no value if we go below the regulations as
it is going to be illegal then. It has to set a higher standard and thus
the amount that we have to cover is larger than those regulations covers.

Nat

2013/12/18 S Moonesamy <[email-masked]>

> definition of the word "privacy".  Warren and Brandeis are often cited in a
> U.S context.  The "right of personal immunity" is broader than privacy.
>

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Wed, 18 Dec 2013 10:00:31 -0500

On 12/18/13 8:17 AM, S Moonesamy wrote:
> There has been some discussion on other IETF mailing lists about
> the definition of the word "privacy".  Warren and Brandeis are
> often cited in a U.S context.  The "right of personal immunity" is
> broader than privacy.
> 
> Within an IETF context it might be a problem if the "right to be
> let alone" is used.  In my opinion a right is guaranteed by law and
> that doesn't fit in with what the IETF does.

Many of us from academia (in my case, having recently jumped ship for
civil society) that study privacy are more persuaded by Helen
Nissenbaum's notion of privacy as "contextual integrity". Here's the
skiny in shorter-than-book-length form:

"I give an account of privacy in terms of expected flows of personal
information, modeled with the construct of context-relative
informational norms. The key parameters of informational norms are
actors (subject, sender, recipient), attributes (types of
information), and transmission principles (constraints under which
information flows). Generally, when the flow of information adheres to
entrenched norms, all is well; violations of these norms, however,
often result in protest and complaint. In a health care context, for
example, patients expect their physicians to keep personal medical
information con½dential, yet they accept that it might be shared with
specialists as needed. Patients’ expectations would be breached and
they would likely be shocked and dismayed if they learned that their
physicians had sold the information to a marketing company. In this
event, we would say that informational norms for the health care
context had been violated." [1]

Much of the scholarship these days in privacy thinking is increasingly
based on this kind of contextual definition of privacy (and in the
U.S., at least, the Obama administration embraced this in a recasting
of fair information principles in their Consumer Privacy Bill of Rights).

At CDT, we argue that "abuse" or "harm" is an anemic framing, and that
there are important privacy interests implicated after information has
been fixed and collected but before any use has been made. See
Brookman and Hans [2], if you're interested in reading more.

[1]: http://www.amacad.org/publications/daedalus/11_fall_nissenbaum.pdf
[2]:
http://www.futureofprivacy.org/wp-content/uploads/Brookman-Why-Collection-Matters.pdf

- -- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 19 Dec 2013 00:15:52 +0900

Indeed the context matters especially as the consent is only given in a
context.
Also actors are very important since even "identification" has to do with
the observer and the domain.
(Otherwise, we would not have a notion such as "partially anonymous,
partially unlink-able". )
Also, issues around generated/inferred attributes are important.
Acquired attributes + auxiliary knowledge may generate additional
attributes.
This is often captured as "use" or "acquisition" and implicit but is worth
making note.

Nat

2013/12/19 Joseph Lorenzo Hall <[email-masked]>

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (Darwin)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJSsbiPAAoJEF+GaYdAqahxrI4QAIuv0oLj2ypQ5lTQ99FlFz+w
> /V5/LCOIkV0ELJneEKJYvttZFI86bl2d2ZnZ6OH58PjFRing3/cuUAlF2aqnlRey
> wQnkRqijU9ULhH0sGfTXHhjlR4nHvBi6OWV8GramG9GYOZHQZObCFEyeK7UIUmuT
> w4whhXmCe9r78b03BoFab8QWi0bZNt6HWD7ln5MQcHk3ERX/1qg0PzqjAaLiSIDV
> TyoVp5cUUf9SdyA6xijQ1GRswgGUHFj62GkJ5bGX6bJhUAYbgGmdHkuYqhsumI+6
> lE7+3OT5vqOl9i4iqXLXlXnilqGo6lxTf9i3uSrDtfPSNKbIQIJcQokY+rsPjQqR
> zS6rZ779RG0vrff/rVombLYvQE+NuQricUt2QqiFdQmVG7gZyyjupt/on7uJjjxU
> QSYDXYVk8hnKZJqxnlNWTOyDiRrIl25lFx47vVitD2X4oactxrIdF2bpIzvdqFoE
> g41cooUAIWWn5J6ZpwtuhlQj3ML8kwZqk1+Iv8vJkp6z5vRtwiScrMNSN+82TGA9
> KbB87KHzCVeUoDDpHGwUyLnefSj9LXhAGuEtEacJ9KMygCjGTjeKnRulCjOXBJ5Z
> fEDC0KJd63PJml+kGCcabozP5NB25tMHScMY+1PoGny908IA+PmuSY2XChLLf5Fg
> f4pqNw75JypzxD7jX7Z7
> =6UgP
> -----END PGP SIGNATURE-----
>

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Wed, 18 Dec 2013 10:22:04 -0500

On 12/18/13 10:15 AM, Nat Sakimura wrote:
> Indeed the context matters especially as the consent is only given
> in a context.

There are a lot of contexts where consent is problematic to obtain,
where people simply click right through informed consent prompts,
and/or where obtaining consent is directly against the public interest
(e.g., public health monitoring of disease would not work very well if
folks could opt-out of such data sharing).  I say this because this is
a big difference between the US and EU views on privacy regulation,
with the EU favoring explicit, informed consent pretty heavily. I
think the US view is less coherent, but would probably be
characterized as "consent or opt-in is required for especially
sensitive contexts, demographics, and data types".

Nissenbaum's book talks at length about how consent is increasingly
outdated and ineffective and shifting the obligation to "respect
context" on the data management side has many benefits, but is quite
hard to police/enforce.

best, Joe

> Also actors are very important since even "identification" has to
> do with the observer and the domain. (Otherwise, we would not have
> a notion such as "partially anonymous, partially unlink-able". ) 
> attributes. This is often captured as "use" or "acquisition" and
> implicit but is worth making note.
> 
> Nat
> 
> 
> 
> 2013/12/19 Joseph Lorenzo Hall <[email-masked] <mailto:[email-masked]>>
> 
> 
> 
>>> I suppose, to avoid confusion, it probably is better to use
>>> the definition portion of it instead of the defined word in
>>> the usual conversation.
> 
>> often cited in a U.S context.  The "right of personal immunity"
>> is broader than privacy.
> 
>> let alone" is used.  In my opinion a right is guaranteed by law
>> and that doesn't fit in with what the IETF does.
> 
> Many of us from academia (in my case, having recently jumped ship
> for civil society) that study privacy are more persuaded by Helen 
> Nissenbaum's notion of privacy as "contextual integrity". Here's
> the skiny in shorter-than-book-length form:
> 
> "I give an account of privacy in terms of expected flows of
> personal information, modeled with the construct of
> context-relative informational norms. The key parameters of
> informational norms are actors (subject, sender, recipient),
> attributes (types of information), and transmission principles
> (constraints under which information flows). Generally, when the
> flow of information adheres to entrenched norms, all is well;
> violations of these norms, however, often result in protest and
> complaint. In a health care context, for example, patients expect
> their physicians to keep personal medical information con½dential,
> yet they accept that it might be shared with specialists as needed.
> Patients’ expectations would be breached and they would likely be
> shocked and dismayed if they learned that their physicians had sold
> the information to a marketing company. In this event, we would say
> that informational norms for the health care context had been
> violated." [1]
> 
> Much of the scholarship these days in privacy thinking is
> increasingly based on this kind of contextual definition of privacy
> (and in the U.S., at least, the Obama administration embraced this
> in a recasting of fair information principles in their Consumer
> Privacy Bill of Rights).
> 
> At CDT, we argue that "abuse" or "harm" is an anemic framing, and
> that there are important privacy interests implicated after
> information has been fixed and collected but before any use has
> been made. See Brookman and Hans [2], if you're interested in
> reading more.
> 
> [1]:
> http://www.amacad.org/publications/daedalus/11_fall_nissenbaum.pdf 
> [2]: 
> _______________________________________________ ietf-privacy
> mailing list [email-masked] <mailto:[email-masked]> 
> -- Nat Sakimura (=nat) Chairman, OpenID Foundation 
> http://nat.sakimura.org/ @_nat_en

- -- 
Joseph Lorenzo Hall
Chief Technologist

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 19 Dec 2013 00:37:08 +0900

So in the Personal Data Working Group of Ministry of Economy, Trade and
Industry in Japan which I was a member of,  last year, we discussed the
issue at length. We saw problems in explicit consent model as it is just
training the users to click yes: Turning an internet dog to a Pavlov's dog.
This is problematic especially because of the common attack which burry
important / sensitive thing in 30 pages of benign things to have the user
click "yes". In this respect, contextual consent is much better, requiring
the explicit consent in an out-of-context data collection and usage case
only. We even went on to discuss "banning" explicit consent when it is
"clear" from the context, i.e., the data is minimized and purpose
specification requirement is met.

Cheers,

Nat

> iQIcBAEBCAAGBQJSsb2cAAoJEF+GaYdAqahxVccQAL0TfywfHMna0kGRyuSoH7lz
> GIgrBgh2vA195IijqFzKjKv0bZ4YAGOPksjwuUWnumSHgiqbtArOk3t664NH6hlO
> M6IV7dAc31f4wVFU05Fn+bhU0wEFLsMR49hdyu5GbqRPEWQIG9TA9Rzk0xo3LF+f
> w++6wEl/LZ29j4xfe9+W7omoPKxZDELpVY0xgkFpMHlm0l0RbaP0kRgxfVBSExcg
> LQiIsDeibjMPQ1sP4KK3570bvX1aaUCSBKr56yj51Rxp8F2JhnWmQxEX4nHK4ruW
> fBfzQ35uQHxOoCtVXhsr2j6LPtjBNwNbsschL9jSRTDGE1Gr9E9NVPTN8fDD2OP5
> DhlV7DC3slSEyPIRUB2V6RLAch25s5mmUs3wCQI4WZyLHBUg/tWVx9sTpJEEG6ht
> Z5Gqg4SJU4xwHgshJLmX+Pjwn+MC0xxCGLpOdsVegejUbRWneDt+7kEeHz8sgFsU
> zYTKGFs6HplaAhnh4ktZTzFf67jyBT48J6+aR8Wn8yk8IVEJ4dXuRTxg3XdhyJHu
> M2iTU/9huz/PNpnkl88ZdwM5jkFxLgJFbKxTUEngmv553iqwUWqo9QZRg3geY1Cx
> dsAX3ATgULRVjgkNxmwa/Ut2ZhQY/QlI5ztkTyB9Hl75F1CysK5+VyPhb6mSMNGR
> g9kLuDVBrTF6+2rxeQ2C
> =FeRd

---

From: Josh Howlett <[email-masked]>
Date: Wed, 18 Dec 2013 15:48:58 +0000

>sensitive contexts, demographics, and data types".

In the EU, consent can be used as a legal grounds for data processing, but
it is not the only one, nor is there any preference given to it over the
other six grounds. If anything there has been a tendency to use one of the
other grounds, because it can be difficult to implement in practice.

   "If incorrectly used, the data subject¹s control becomes illusory
    and consent constitutes an inappropriate basis for processing."

(http://ec.europa.eu/justice/data-protection/article-29/documentation/opini
on-recommendation/files/2011/wp187_en.pdf)

Josh.

Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

---

From: David Singer <[email-masked]>
Date: Wed, 18 Dec 2013 11:14:16 -0800

I think in an ‘automated’ context (such as the internet), other problems arise which are not so evident in the physical world:  repetition or degree, and persistence and reach.

For example, it has been (speciously) argued that
*  if I allow myself to appear in someone’s photo when we are both in a public place (and I do), then I don’t mind having my photo taken in public, so it’s not a privacy concern, so I can be monitored 24x7 by public video cameras, or be followed by someone with a video camera.
*  if I allow someone to see what I am buying at the cash register in a store (and I do), then it’s not a privacy concern to track my purchases, so a complete record of all my purchases can be assmebled and kept.

*  if I allow people to observe (and implicitly remember) something, it’s also fine for a computer to observe and record that
*  if I allow people to report on something they learned, to others, it’s OK for computers to share the data with others also

The first two concern ‘degree’ – something that is ‘rare’ and isolated is not a privacy concern, whereas something that is persistent and continuous may well be.

The second two concern ‘reach’ in space and time: people forget, and they don’t spread information very far, and those told also forget: the data fades away.  Computers do not ‘forget’, and the data can be spread far and wide.

Now, maybe rare events and finite propagation (in space and time) ARE privacy issues, but nigglingly small and not to be worried about, but I am not sure that’s true.  “Was your privacy violated when the guy behind you noticed you bought a Mars bar?” would usually get the answer “no”, I think, not “yes, but to an insignificant degree”.

David Singer
Multimedia and Software Standards, Apple Inc.

---

From: S Moonesamy <[email-masked]>
Date: Wed, 18 Dec 2013 12:04:41 -0800

Hi Nat,
>Perhaps you did not read my blog post.

I read the blog post.  The image in the post highlights the different angles.

>Recent inventions and business methods call attention to the next 
>step which must be taken for the protection of the person, and for 
>securing to the individual what Judge Cooley calls the right "to be let alone"

Yes.  There is a newspaper article that led to the above.

>Personal immunity. The right to one's person may be said to be a 
>right of complete immunity: to be let alone.

The paragraph containing the sentence is about Torts.

>immunity. Somehow, American lawyers started to take them narrower 
>than what is apparently stated in the paper. However, going back to 
>the original, it is pretty good actually.

Yes.

>As to the "right" is concerned, I am not sure if it is "guaranteed 
>by law" all the time. It is not always that clear. In this 
>particular case, what belong to the person, and what to the 
>community and the public is not always clearly delineated.

The word "guaranteed" (which I used) is not the correct term.  What 
you wrote above sums it up.

>As a standard body which sets standards, which are not regulations 
>(in the sense of ISO Guiide 2), there is no value if we go below the 
>regulations as it is going to be illegal then. It has to set a 
>higher standard and thus the amount that we have to cover is larger 
>than those regulations covers.

I look at it this way; it has to be something IETF participants will 
agree to.  That's the difficult part. :-)

Regards,
S. Moonesamy

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 19 Dec 2013 05:55:41 +0900

2013/12/19 S Moonesamy <[email-masked]>

>> Personal immunity. The right to one's person may be said to be a right of

Right. And as I view, privacy is almost synonymous to a certain branch of
torts.

(Having said that, we have a lot of problem in Japan because the control
around torts are pretty weak here.
It is one of the main issue that we are dealing with now. We are now
changing our personal data protection law.)

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 19 Dec 2013 05:57:06 +0900

Yup. And that's why OpenID Connect refers to "conditions for processing"
per UK ICO.
Not to mention, we have discussed these in the WG as well.

2013/12/19 Josh Howlett <[email-masked]>

> (
> http://ec.europa.eu/justice/data-protection/article-29/documentation/opini

---

From: S Moonesamy <[email-masked]>
Date: Wed, 18 Dec 2013 21:58:56 -0800

Hi Joseph,
At 07:00 18-12-2013, Joseph Lorenzo Hall wrote:
>information confidential, yet they accept that it might be shared with
>specialists as needed. Patients' expectations would be breached and

Thanks for the links.  I have to read the material again.

The health care context is relatively easier to argue for as a 
patient would expect that his/her medical information would be kept 
secret.  There is the legal context for privacy, e.g. see message 
from Nat Sakimura about torts.  The discussion is usually around that 
as the body of work is focused on the legal arguments which have been 
made over the years.

It could be said that there are several schools of thought about the 
topic.  For example, the above (see quoted text) looks at privacy in 
terms of the flow of information.  It may seem a better fit in the 
context of technology.  Some people will likely look at privacy in 
terms of harm or abuse.  It is difficult to argue against that in an 
IETF discussion.  Privacy considerations, up to now, can be described 
as lacking.

Regards,
S. Moonesamy

---

From: Robin Wilton <[email-masked]>
Date: Thu, 19 Dec 2013 14:53:42 +0000

This is a huge topic, so rather than attempt any kind of a comprehensive response, I just want to point people to the definition we use in ISOC/Trust and Identity....

"Privacy is about retaining the ability to disclose data consensually, and with expectations about the context and scope of sharing."

Everything is in there for a purpose.

- "retaining the ability to disclose" : privacy depends on user control; if you don't have meaningful control over whether or not you disclose something, you don't control your own privacy.

 - "disclose data" : privacy is about disclosure, not about keeping all your data to yourself (that is secretiveness... and taken to extremes, it's a symptom of what we might even call paranoia) Privacy is a social construct, or set of conventions, relating to the disclosure of data, not to secrecy.

- "consensually" : orthogonal to the idea of control; not only is it important that I consent to reveal things about myself, it's also important that I respect others' wishes about disclosure of data relating to them. This is a key principle in two respects: (1) if Alice tells Bob something, her privacy depends on Bob not telling Carl. (2) If the only way Alice and tell Carl something is via Bob, Bob's role and obligations are a factor. (1) is the problems of "privacy beyond first disclosure", and (2) is especially true in today's online world, where all interactions are mediated via third parties.

- "expectations" ; note that, for global applicability, we don't use the word "rights"... but bear in mind that in some cultures/jurisdictions, our expectations about privacy may well stem from the fact that privacy is regarded as a fundamental right (not necessarily an unqualified one, but fundamental nonetheless). Expectations may be well- or -ill-founded; and they are often subject to being disappointed. 

- "context of sharing" : if I tell my doctor personal details in order to be treated, I don't expect those details to crop up on "Hilariously Embarrassing Ailment of the Month" website. The healthcare context may appear to be clear-cut, but it really is not. For example: justification for disclosure of healthcare data is often claimed on the grounds that it helps medical research... but the medical research benefits are speculative, while the financial benefit to research companies is not; genetic data about one person is intimately revealing about their parents, siblings and (potential) descendants; supposedly "anonymised" clinical trials data may prove to be easily de-identifiable... This is not argue one way or the other - just to illustrate that healthcare privacy is not a simple context.

- "scope of sharing" : as danah boyd puts it "publishing, to a wider audience, something that was intended for a narrow one may be just as much a violation of privacy as publishing something that was not meant to be published in the first place". Scope is important, and intimately related, of course, to example (1) under "consensus", above, and to the matter of "expectations" and "control".

The meta-issue we face, here, IMO, is that none of the questions raised by this definition of privacy has a single simple answer, let alone a binary one. I think that's why we have such a hard time translating social concepts that we all understand implicitly, into technical solutions that adequately reflect their subtlety.

Yrs.,
Robin

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 19 Dec 2013, at 05:58, S Moonesamy wrote:

> The health care context is relatively easier to argue for as a patient would expect that his/her medical information would be kept secret.  There is the legal context for privacy, e.g. see message from Nat Sakimura about torts.  The discussion is usually around that as the body of work is focused on the legal arguments which have been made over the years.
> 
> It could be said that there are several schools of thought about the topic.  For example, the above (see quoted text) looks at privacy in terms of the flow of information.  It may seem a better fit in the context of technology.  Some people will likely look at privacy in terms of harm or abuse.  It is difficult to argue against that in an IETF discussion.  Privacy considerations, up to now, can be described as lacking.
> 
> Regards,
> S. Moonesamy

---

From: <[email-masked]>
Date: Tue, 31 Dec 2013 20:53:16 +0000

these are really good points: degree, repetition and reach/persistence matter greatly. this was well said.

regards, Frederick

Frederick Hirsch
Nokia