Privacy helps reinforce user trust of online services, yet online privacy is under constant pressure of being undermined. Promoting strong, technology-neutral data-privacy laws, privacy-by-design principles, and ethical data-collection and handling principles is a key approach to protecting and fostering online privacy.
Privacy is an important right [1] and an essential enabler of an individual’s autonomy, dignity, and freedom of expression. Yet, there is no universally agreed definition of privacy. In the online context, however, a common understanding of privacy is the right to determine when, how, and to what extent personal data can be shared with others.
In today’s digital age, information gathering is fast, easy, and less expensive than ever. Progress on a variety of technological fronts contributed to this new world. For instance:
Data storage is cheap, making data accessible online for long periods of time.
Personal data has become a profitable commodity. Every day, users are sharing more personal data online, often unknowingly, and the Internet of Things will increase this dramatically. These factors have the potential to expose personal data and create privacy challenges on a greater scale than ever before.
With this in mind, it is important to encourage the development and application of privacy frameworks that apply an ethical approach to data collection and handling. Frameworks that incorporate, among other things, the concepts of fairness, transparency, participation, accountability, and legitimacy.
Although there is no universal privacy or data protection law that applies across the Internet, a number of international and national privacy frameworks have largely converged to form a set of core, baseline privacy principles. The following principles are derived from the Organisation for Economic Co-operation and Development (OECD) 2013 Privacy Guidelines, and are widely recognized as providing a good foundation for developing online privacy policies and practices:
It should be noted that many of these principles imply transparency concerning who is collecting data, and what it is being used for.
Policy developers must consider a number of key challenges when determining action related to online privacy. Some widely recognized challenges include:
1 Determining what data needs to be protected. Typically, privacy and data protection laws apply to personal data, also known as personal information in some jurisdictions. A common definition for personal data is “any information relating to an identified or identifiable individual”.[2] Not all definitions are the same. In addition, it can be difficult to determine which specific types of data should be considered personal information in a particular context. Furthermore, the fast-paced evolution of services, as well as the technology used to process data, make determining what should be required to be protected an ongoing challenge.
2 Different legal data protection requirements. Privacy laws are not the same across all countries. This means that some data may be legally protected in one country, but not in another. Also, even where the data is covered by the laws of both countries, the protections may vary (e.g., data collection may be opt-in or opt-out). To complicate matters further, more than one country may assert that its laws apply. For example, one country may assert its data protection law applies because the personal data relates to its citizens, while another may assert that its law applies because the company collecting the data is based in its territory. Giving effect to individual’s privacy rights and expectations can be especially problematic when countries’ laws are in direct conflict or otherwise incompatible. In particular, recent controversies relating to mass surveillance have raised the question of whether “necessary and proportionate” clauses in legislation provide enough protection for citizens. Global debates about surveillance highlight how hard it is for nation states to agree on consistent interpretations of international conventions in the privacy sphere, such on human rights, or civil and political rights.
3 Protecting privacy when data crosses borders. The Internet spans national borders, yet privacy and data protection laws are based on national sovereignty. Therefore, special provisions are needed to protect personal data that leaves one country and enters another in order to ensure the continuity of data protection for users. Approaches vary, but tend to have regard to whether the receiving country has “adequate” protection. Various frameworks have emerged to facilitate transborder data flows within a region or between regions. [3]
4 Real meaningful consent. Privacy and data protection laws typically permit some degree of collection and use of personal data if the individual gives his or her consent. In theory, this approach empowers Internet users to have some level of control or choice over the way their data is collected and used by others. However, in practice, users of online services may not read or may not understand what it is that they are agreeing to (e.g., because the terms of service are lengthy and written in complex legal language). Even if they understand the terms, users may be unable to negotiate them. The widespread use of mobile devices with sensors and small screens with which to display privacy options, and frequent secondary uses of personal data (e.g., targeted advertising) create additional challenges for users to exercise control over their personal data. One technical approach might be to encourage the development of systems that make it easier for the user to understand and manage the information that is collected by the intelligent, connected devices surrounding them.
As personal data has monetary and strategic value to others, it is a challenge to ensure that it is only collected and used appropriately. The following guiding principles promote achieving this outcome:
The Internet Society has published a number of papers and additional content related to this issue. These are available for free access on the Internet Society website.
[2] For personal data definitions, see: OECD 2013 Revised Privacy Guidelines; Council of Europe Convention 108; EU Data Protection Directive (1995) and AU Convention on Cyber Security and Personal Data Protection.
[3] Example cross-border frameworks include: APEC Cross Border Privacy Rules (CBPR) system, US-EU Safe Harbor Framework, EU Binding Corporate Rules.
