Private Data & Policies Readings

[Frijol]

To be facilitated by @jnthnvctr and @Frijol . Schedule for 2020 semester here: https://github.com/datatogether/reading_datatogether/issues/71

How have particular implementations of data privacy policies impacted humans, economics, and legal systems? What are appropriate expectations around data privacy, and who should inform, create, or enforce policies?

We use these issues to solicit additional reading suggestions from the community. Please add suggestions below! Ultimately, the facilitators will choose the reading selections for their session.

Here are some readings that were suggested for this topic in the Data Together Annual Meeting:

• Monetization, consent and transparency in data Business models for a web 2.5 world
• Is there an ethical version of advertising? GDPR / Data privacy laws
• What would (should) GDPR look like for the US?
• Country agnostic - what should the internet as an ecosystem enforce through its architecture?
• Sort of side relevance is the political influence of countries on top of a connected world (China controversy with Blizzard / HK / NBA vs US)
• Facebook’s dilemma
• Encrypted data with whatsapp
• Myanmar and misinformation
• Connectedness
• VP’s blogpost about Facebook’s goal being connected even if it enables badness
• Censorship
• Christchurch shooting
• Facebook refusing to censor political ads
• Problems of Triangulation
• Homomorphic Encryption
• I’d love to take a look at recent developments in homomorphic encryption and ask the question: Are zero-knowledge proofs a feasible answer to the relationship between the state and total encryption?
• From Wikipedia: Homomorphic encryption is a form of encryption that allows computation on ciphertexts, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext.
• What if there were a law that says “we (the government) have a court order to run this query against your encrypted data”? Could this form a compromise where internet users can still have privacy, and governments can still enforce laws?

[Frijol]

This has some great material: https://dataresponsibly.github.io/courses/spring19/

[Frijol]

Some ideas:

Grounding privacy in ethics principles

• The Belmont Report (1979) outlines ethical principles and guidelines for the protection of human research subjects. A bit dense/long, but picking a section might work well
• Alternatively, this set of lecture slides from dataresponsibly outlines data science practices for privacy for research. Gets a bit technical in a code sense. Some of the slides pose really great questions esp. in the context of our Polity theme (e.g. slide 35). Again maybe pick and choose

More in the data science/research direction (not sure if this is interesting to us?)

• Wikipedia page Differential privacy

About understanding a citizenry

• De-identification and the census in Science
• Maybe something from Seeing Like a State?

Applications in justice

• Predictive policing
• "How data privacy laws could make the criminal justice system even more unfair" in the LA Times

I'm not sure I'm hitting the right themes here, just some resources that jumped to mind

[jnthnvctr]

@Frijol - sorry for the late reply, I feel like weekends are my only breathing space :D

But I like the idea of starting with grounding! Maybe to add to your list for the overview, I thought this was a useful framing piece: https://fpf.org/wp-content/uploads/Brookman-Why-Collection-Matters.pdf

A little more broad, but this had some pretty good links into it as well:

• https://www.cfr.org/report/reforming-us-approach-data-protection

Re: the lecture, maybe we trim the slides to specific ranges?

• How about these sections: (1-9, 14, 18-19, 35-37)? I think it touches on an intro, some of the challenges, and some of the proposed solutions?

I think the Belmont one feels a bit too broad, but if we do want to keep it I'd vote for section B (Ethics) and Section C (Applications). I think my gripe with this one, while I think it is interesting, is that it focuses a bit more in the research-y sense, where I feel like a lot of the tension that exists is that the data thats being collected (in the general sense) is actually done with much less purpose. Maybe that's worth including to at least the differences across fields/industries wrt the treatment of data.

If we get to a proposed solutions bit, I think it could be interesting to talk about the political side and what people have proposed:

• Consumer Privacy Bill of Rights proposed by the Obama administration?

• Review of GDPR (unfortunately I think CCPA came in a little too recently for this to have any good metrics on it)

• Maybe we add some of the differential privacy articles in here (as proposed technical solutions)? Either the Science article, Wikipedia page, or both?

There are a few misc. topics I don't know how to work in, but I feel like are interesting case studies:

• Clearview AI
• Data brokers and what happens to your data outside of "first party" collectors
• The LA Time article you linked I thought was fascinating - I think it also stretches into another topic I think would be super fascinating which is encryption and the legal system. Would love to also discuss Apple/San Bernadino - there's definitely a tension between how US law works and some of the realities of technology.

[Frijol]

Whoa, love these selections! Here's what I'm thinking (and, I haven't read all your links, so this isn't comprehensive):

Reading selections

Grounding

• Brookman & Hans, Center for Democracy & Technology (2013) Why Collection Matters: Surveillance as a De Facto Privacy Harm on why data collection matters
• (optional) Hochfellner, Lane, and Kreuter, Responsible Data Science, NYU Center for Data Science (2019) Privacy and Confidentiality slides 1-9, 14, 18-19, 35-37 definitions and introductions to challenges and tools

Attempted and proposed solutions

• Sobers, Varonis (a cybersecurity company) (2020) A Year in the Life of the GDPR: Must-Know Stats and Takeaways a review of one year of GDPR implementation
• Office of the Press Secretary, The White House (2012) We Can’t Wait: Obama Administration Unveils Blueprint for a “Privacy Bill of Rights” to Protect Consumers Online Obama White House proposed approach
• O'Connor, Digital and Cyberspace Policy Program, Council on Foreign Relations (2018) Reforming the U.S. Approach to Data Protection and Privacy a critique of current U.S. approach and suggestion for path forward
• (optional) Balkin & Zittrain, The Atlantic (2016) A Grand Bargain to Make Tech Companies More Trustworthy on applying the legal concept of a fiduciary to information as well as to finances (intersection with Trust conversation)

Case studies

• (optional) FTC (2017) Informational Injury Workshop insight on how the U.S. government collects public comment on this topic

Themes

• Intersections with Trust conversation: does it make sense to apply the concept of trust to a corporation? and other questions
• Intersections with Monopolies and Consent conversations: does "consent" really apply in situations where you have to click "ok" to access the one service you need?
• Feasibility & implementation vs principles (esp with respect to GDPR reading)

[greggish]

re Balkin & Zittrain on platforms as fiduciaries, Lina Khan offered some solid pushback, basically saying the platform-as-fiduciary concept misdiagnoses the problem while handwaving away conflicts of interest that compromise it as a solution: A Skeptical View of Information Fiduciaries

[Frijol]

• do we have anything that intersects with algorithmic racism? Seems like something we should have here

[Frijol]

Possibly this one? https://journals.sagepub.com/doi/pdf/10.1177/2053951719895805

[jnthnvctr]

Works for me! Will submit a pr!

[StefanMorales]

@Frijol was this rescheduled in the end? I missed it as I was on vacation at the time.

[Frijol]

Yes! We're still deciding on when is best for it (and, related, when is best for the Polity discussion). Your input would be very helpful! Are you getting the list emails? I'll send out one today asking for date clarification.

[StefanMorales]

Do you mean these emails through the google group? If so, yes I'm getting those.