Consensual and Privacy-Preserving Sharing of Multi-Subject and Interdependent Data

Abstract

Individuals share increasing amounts of personal data online. This data often involves-or at least has privacy implications for-data subjects other than the individual who shares it (e.g., photos, genomic data) and the data is shared without their consent. A popular example, with dramatic consequences, is revenge pornography. In this paper, we propose ConsenShare, a system for sharing, in a consensual (wrt the data subjects) and privacy-preserving (wrt both service providers and other individuals) way, data involving subjects other than the uploader. We describe a complete design and implementation of ConsenShare for photos, which relies on image processing and cryptographic techniques, as well as on a two-tier architecture (one entity for detecting the data subjects and contacting them; one entity for hosting the data and for collecting consent). We benchmark the performance (CPU and bandwidth) of ConsenShare by using a dataset of 20k photos from Flickr. We also conduct a survey targeted at Facebook users (N = 321). Our results are quite encouraging: The experimental results demonstrate the feasibility of our approach (i.e., acceptable overheads) and the survey results demonstrate potential interest from the users.

SoK: Managing Longitudinal Privacy of Publicly Shared Personal Online Data

“…Furthermore, the approach does not take into account the effect of types of data items under consideration. In a rather restrictive proposal by Olteanu et al [66], photos can only be uploaded to a social network site with all faces detected in it being removed, only allowing to display them after the corresponding person has explicitly agreed.…”

A Survey on Interdependent Privacy

“…In general, cryptography can be helpful in the case of interdependent privacy (mostly for co-owned data as cryptographic techniques are data agnostic, and therefore cannot address data correlation issues per se), to hide information to certain adversarial parties. For instance to share content online or decide on the visibility of some shared content without the service providers and unauthorized users having access to it [Beato and Peeters 2014;Ilia et al 2015;Olteanu et al 2018;Palomar et al 2016] (see Sec. 5.2 and more specifically Table 4 on page 31).…”

“…Manuscript submitted to ACM photo users access control (trust, sensitivity, visibility) [Hu et al 2013] photo users access control (weighted voting) [Beato and Peeters 2014] photo users cryptography (secret sharing) [González-Manzano et al 2014] photo users access control (fine-grained) [Guo et al 2014] generic mobile apps access control (fine-grained) [Ilia et al 2015] photo users access control (fine-grained) + obfuscation [Aditya et al 2016] photo users cryptography (homomorphic encryption) [Mehregan and Fong 2014] generic users access control (discretionary) [Mehregan and Fong 2016] generic users access control (relationship-based) [Such and Rovatsos 2016] photo users access control (negotiation/action vector) [Keküllüoğlu et al 2016] photo users access control (negotiation/action vector) [Palomar et al 2016] photo users cryptography (attribute-based credential) [Rathore and Tripathy 2016] generic users access control (majority voting) [Misra and Such 2017a,b] photo users policy recommandation [Ilia et al 2017] generic service provider cryptography (secret sharing) [Guarnieri et al 2017] medical data users access control (inference control) [Li et al 2017a] photo users obfuscation [Xu et al 2017] photo users access control (veto voting) [Li et al 2017b] photo users access control (fine-grained) [Harkous and Aberer 2017] file cloud storage apps privacy meter (for users) [Zhong et al 2018] photo users access control (neural network detection) [Olteanu et al 2018 show that, despite their popularity, blurring and pixelating are ineffective at obfuscating users, and that inpainting (i.e., removing the user entirely and replacing her with something visually consistent with the image) and avatar (i.e., replacing the user with an avatar that preserves some of the elements of the initial representation) are the best options.…”

“…This terminology was later used by Humbert et al, Pu and Grossklags, and Olteanu et al. Extending this terminology, Olteanu et al coined the term interdependent personal data to refer to the case where data (seemingly) concerns a single individual but is, in fact, related to others because of data correlation [Olteanu et al 2018].…”

“…Manuscript submitted to ACM collective privacy [Squicciarini et al 2009] [Ilia et al 2017;Jia and Xu 2016a,b;Ratikan and Shikida 2014;Squicciarini et al 2010Squicciarini et al , 2011] multi-party privacy [Thomas et al 2010] [Fogues et al 2015;Hu et al 2013;Li et al 2017a;Such and Criado 2014Such and Rovatsos 2016] networked privacy [Boyd 2012] [Cho and Filippova 2016;Marwick and Boyd 2014;Vitak et al 2015] interdependent privacy Chia 2013] [Ayday andHarkous and Aberer 2017;Olteanu et al 2018Olteanu et al , 2017Olteanu et al , 2019Pu and Grossklags 2014Symeonidis et al 2016a;Weidman et al 2018] peer privacy [Chen et al 2015] [Ozdemir et al 2017] group privacy [Bloustein 1978] [Radaelli et al 2018] multiple-subject privacy [Gnesi et al 2014] [ Olteanu et al 2018]…”