A New Conceptual Framework within Information Privacy: Meta Privacy

1
A New Conceptual Framework within Information
Privacy Meta Privacy

• Mr. Geoff Skinner
• Dr Song Han
• Prof. Elizabeth Chang
• Curtin University of Technology
• Perth, WA, Australia.

2
Overview

• Introduction
• Information Privacy
• Metadata and Meta-Structure
• Meta Privacy Definition
• Meta Privacy Principles
• Meta Privacy Components
• Meta Privacy Protection
• Conclusion
• Questions

3
Introduction

• The need for excessive and increasing data
  collection habits is a cause for concern.
• Management of metadata and metastructure
  information involves serious privacy
  considerations.
• Entities are not given a reasonable spectrum of
  choices for what information you provide in order
  to use a service.

4
What is Privacy?

• What is Privacy?
• The right to be left alone.
• The maintenance of personal space.
• Subjective, context and environmentally specific.

5
What is Privacy?

• Privacy has a number of dimensions Clarke
• Privacy of the person medical conditions, etc.
• Privacy of personal behaviour religion, sex,
  etc.
• Privacy of personal communication.
• Privacy of personal data.

6
Privacy and Security

• Information Privacy is the interest an
  individual has in controlling, or at least
  significantly influencing, the handling of data
  about themselves Clarke.
• Data / Information Security IS NOT Data /
  Information Privacy. Rather Information Security
  is a tool that can be used to facilitate
  Information Privacy.

7
Privacy and Security

• The concepts of Information Security, Privacy,
  and Trust are closely inter-related and often
  inter-dependant.
• PETs Privacy Enhancing Technologies. Include
  encryption, filters, anonymizers, cookie cutters,
  etc.

8
Metadata and Meta-Structure

• Metadata provides information about, or
  documentation of, other data managed within an
  application, system, or environment.
• Metadata can also provide descriptive information
  about an organizations data, data activities,
  systems, and holdings.

9
Meta-Structure

• The Metastructure components are composed of the
  data concerned with the functioning and
  structural details of the information systems and
  their many components.
• This may include
• information on the access controls used in the
  systems
• the system and policy frameworks which supplies
  rules regarding the relationships within the
  systems and policies
• other information about the system and component
  structures.

10
Understanding Meta Privacy

• Current privacy protection approaches unable to
  provide protection across a broad spectrum of
  information privacy issues.
• Solutions applied in an ad-hoc fashion resulting
  in a piecemeal approach to privacy protection.
• Need system privacy controls designed and
  integrated into the system that entities are
  unable to circumvent.

11
Meta Privacy - Definition

• Meta Privacy means ensuring the security and
  privacy of data about privacy and personal data.
  Meta privacy is concerned with the security and
  privacy of the information used to support other
  system services and processors that may impact
  upon an entities privacy. This encompasses the
  protection of metadata and metastructure
  information that may reveal an entities identity
  and other personal information.

12
Meta Privacy - Definition

• Entity may be an individual, group, or
  organization.
• Individual represents a singular entity, most
  often a human being.
• A group is defined as a non-committed informal
  relationship between entities.
• An organization is defined as a committed formal
  relationship between entities.
• The members of an groups and organization may be
  individuals, groups, and other organizations.

13
Meta Privacy
14
Meta Privacy Practices

• Proper Meta Privacy practises would ensure that
  none of the personal information contained in the
  metadata and metastructure is used for any
  purpose other than that specially agreed upon by
  the personal information owner.
• Also metadata is not provided to any third party
  not authorized to access the data without the
  owners express permission.

15
MPR and MPB

• Meta-information and processes making use of
  metadata and metastructure information can be
  classified as either
• Meta Privacy Risks (MPR)
• Meta Privacy Benefits (MPB).

16
Meta Privacy Risks

• Where metadata provides information about the
  content, quality, condition, and other
  characteristics of entity data it can be
  classified as being in a Meta Privacy Risks (MPR)
  category.

17
Meta Privacy Benefits

• The use of meta-information for privacy
  protection.
• Meta privacy tags and metadata can be used for
  entity privacy policy preferences representation
  and enforcement.
• The use of metadata and metastructure information
  in this way is classified as Meta Privacy
  Benefits (MPB).

18
Meta Privacy Benefits

• The leading example of use of metadata for
  representing privacy preferences is P3P.
• Other approaches have been proposed that use
  metadata and metastructure information to protect
  personal data and privacy in a number of
  alternate operational settings.
• E.G. associating and storing metadata for
  representing individual items of personally
  identifiable information (PII).

19
Meta Privacy Components

• Meta Privacy therefore encompasses both Meta
  Privacy Risk and Meta Privacy Benefit categories.
• Where metadata and metastructure information
  contains details that reflect some level of
  knowledge pertaining to an individuals identity
  or other forms of personal information
• They are a potential risk to privacy.

20
(No Transcript)
21
Meta Privacy Protection

• Metadata and metastructure information has to be
  protected by the same levels of security used to
  protect personal information.
• System owners and the entities providing their
  personal information need to be aware of metadata
  generation and usage.
• Should be subjected to the same privacy policy
  guidelines selected by an entity to protect their
  personal data.

22
Meta Privacy Protection

• Unlinkability
• Unobservability
• Use of Pseudo-Anonymous and Anonymous Data
• Requires same levels of protection provided to
  personal data and PII.

23
Concluding Remarks

• Have formally defined Meta Privacy.
• Meta Privacy has two main elements
• Meta Privacy Benefits
• Meta Privacy Risks
• Have shown that meta-data and meta-structural
  information must be afforded to the same levels
  of privacy and security protection given to
  personal data and PII.
• Highlighted the need to understand and give due
  consideration to meta privacy protection.

24
Questions

• ?
• ??