Privacy 3.0 := Data Minimization + User Control + Contextual Integrity

Abstract

Over the last two decades, privacy has been fading away. Some people have even stated: You have zero privacy -get over it! As privacy researchers, we are not willing to accept this statement. Therefore, we analyze the causes for this fading away of privacy, and develop a set of approaches to preserve or even regain privacy. We argue that Privacy 3.0 should be a combination of (1) Data minimization, (2) User control of personal information disclosure, and (3) Contextual integrity. Data minimization is one of the main motivations for the development of privacy-enhancing technologies, which aim to limit collection and processing of personal data by data controllers. User control of personal information disclosure supports users in deciding which personal information is released to whom and in which situation. Contextual integrity provides a new quality of privacy by making the original context in which particular personal data have been generated easily accessible to all entities that are aware of that particular personal data.Zusammenfassung In den letzten zwei Jahrzehnten nahm das Gefühl von Privatheit im Internet bei den Benutzern immer mehr ab. Manche konstatierten sogar: Es gibt keine Privatheit -findet Euch damit ab! In diesem Artikel analysieren wir die Gründe hierfür und beschreiben synergetische Ansätze zur Erhaltung bzw. sogar Rückgewinnung von Datenschutz und Privatheit. Aus unserer Sicht sollte Privatheit 3.0 einem dreistufigen Ansatz folgen: (1) Datenminimierung, (2) Nutzerkontrolle und (3) Kontextuelle Integrität. Datenminimierung war und ist eine der treibenden Motivationen für die Entwicklung Privatheit fördernder Technik, die die Begrenzung von Datensammlung und Datenverarbeitung zum Ziel hat. Mit Hilfe der Nutzerkontrolle werden die Nutzer bei der Entscheidungsfindung unterstützt, welche persönlichen Daten sie wem und in welcher Situation zugänglich machen. Die Durchsetzung von Kontextueller Integrität hebt den Datenschutz auf eine qualitativ neue Stufe, indem der originale Kontext, in welchem persönliche Daten erstellt wurden, all den Entitäten, die Kenntnis von diesen persönlichen Daten haben, zugreifbar gemacht werden.

Analyzing settings for social identity management on Social Networking Sites: Classification, current state, and proposed developments

“…Multiple authors argue that privacy is a growing concern as SNS usage has increased over the years (Irani et al, 2009;Borcea-Pfitzmann et al, 2011). Two major threats to privacy can be distinguished, stemming either from SNS service providers or other SNS users (Ziegele and Quiring, 2011).…”

Personal Information Markets and Privacy: A New Model to Solve the Controversy

“…Thus, people always have the right to a privacy-friendly service (Right 2). This right repackages the existing concept of "data minimization" [13] but limits its scope to users preferring data minimal over information rich services. Consider, for example, a web search engine, look.com, which offers three service options.…”

“…While most PET proposals imply that consumers will invest time into privacy management, people simply expect regulators to protect them and companies to behave in an ethical way [12]. Finally, the PET community insists on terms such as "data minimization" [13], which are hardly realistic in times when users submit 95 million tweets on Twitter and send about 47 billion (non-spam) e-mails on an average day. The result is a patchwork of PET solutions that are adopted by neither industry nor governments.…”

An Analysis of Implemented and Desirable Settings for Identity Management on Social Networking Sites

“…Multiple authors argue that privacy is a growing concern as SNS usage has increased over the years [9], [10]. Two major threats to privacy can be distinguished, stemming either from SNS service providers or other SNS users [11].…”