How do we make decisions about the privacy and security of our personal information? In this talk, I will first highlight how research in behavioral economics can help us make sense of apparent inconsistencies in privacy (and security) decision-making. Then, I will present results from a number of experiments conducted at Carnegie Mellon University, including a recent study of the complex relationship between privacy and control. Normatively, privacy is often associated with an individual's control over her personal information. However, in a series of experiments, we investigated the effect that granting more control over information revelation has on individuals' propensities to share sensitive data. We found that real or perceived control over information publication increases the likelihood that individuals will disclose sensitive information, even when the objective risks associated with such disclosures actually increase. We call this the privacy control paradox. Our findings highlight that merely granting users more "control" over their personal information or privacy settings does not guarantee that they will be able to find a desirable balance between information disclosure and information protection. In fact, technologies that make individuals feel more in control over the publication of personal information may potentially carry the unintended consequence of eliciting more risky disclosures.

The U.S. Office for Human Research Protections (OHRP) has proposed a set of sweeping changes to the federal regulations that govern research involving human subjects (the "Common Rule"), in the form of an Advance Notice of Proposed Rule Making (ANPRM) and is soliciting comments from investigators, Institutional Review Boards (IRBs), and any other interested parties.

These comments are due by October 26, 2011.

This TIP session will provide an opportunity to discuss the ANPRM, its potential effect on the research community, and possible constructive suggestions that could be offered. While some of these changes will be viewed favorably by the research community, particularly by researchers in the social and behavioral sciences, others (including increased consent and data security requirements) could potentially make some kinds of research more difficult or even impossible.

Comments are solicited, and encouraged, from individuals. Harvard's office of the Vice Provost for Research is also working on a response, as are other entities at the university and many scientific and professional organizations.

The areas addressed in the ANPRM include

• Changes to the IRB review process including
  • changes in types of research considered "exempt" or "expedited"; and
  • changes to continuing review requirements for low-risk research
  • changes to recommendations regarding the administrative review of exempt studies
• Changes to criteria for IRB approval of proposed research
• A mandate for single IRB review for multi-site studies
• A mandate to require consent for use of non-identified bio specimens
• Greater specificity regarding the content and form of informed consent
• Extension of HIPAA data security requirements to all human subjects data, not just "protected health information"
• Extension of Common rule requirements to all research at any institution receiving federal funding for human subjects research
• Creation of a single web site for mandated reporting of adverse events and unanticipated problems in human subjects research
• Coordination of guidance from federal regulatory entities regarding human subjects research

As discussed last week, the U.S. Office for Human Research Protections has proposed sweeping changes to the rules that govern human subjects research. The Data Privacy Lab and those involved in data privacy research can offer unique and critical insight into proposed rules by sharing and operationalizing what we know about de-identification and re-identification risks and remedies and making sure proposed changes build on and not pave over data privacy research. In this TIP session, we will look at proposed changes specific to de-identification and re-identification and offer some sample responses for open discussion and brainstorming. Final responses to the proposed changes are due October 26, 2011 but no further TIPs are currently reserved for this topic.

The right to privacy in the United States covers an array of issues. Although based on the same right, these different issues are treated dissimilarly by the courts. I argue that the distinguishing feature that gives us the greatest foothold into understanding the right to privacy in the United States is whether the activity or protection being claimed is justified in terms of property or liberty. The first category, proprietary privacy, covers such issues as medical records, wiretapping and owning one's own image. The second category, decisional privacy, involves making decisions about intimate matters and covers such issues as the right to die, same-sex marriage, and abortion. The two categories are treated differently, giving greater or lesser protection to individuals based on the type of privacy. Decisional privacy has evolved more slowly towards constitutionalization. By constitutionalization, I mean the transition away from group-based social norms to an individual-based and universally-applied "right." The slower evolution of decisional privacy rights has led to a situation in which those matters involving the liberty to determine intimate matters are much more likely to be limited by community standards and social norms. To examine these differences, I track higher court cases in two subject areas: marital privacy (as a representative of decisional privacy) and conversational privacy (as a representative of proprietary privacy). The resulting comparison demonstrates how discrepancies in the way the two categories of privacy are handled impact the protections granted by the right to privacy, thus leading to a dual system of privacy rights in the United States.

Discussant: Mary McThomas, Assistant Professor of Political Science at Mississippi State University and a Visiting Assistant Professor at Brown University.

The purpose of this session is to generate ideas for improving access to research data produced, collected or disseminated by the U.S. Bureau of the Census ("Census"). Highlights from the discussion will inform ongoing conversations with Census, and may result in a future paper or research report.

KEY QUESTIONS

On the privacy side...
Are there ways in which Census could make confidential data available in a more usable form and still provide adequate protection? Do current mechanisms offer adequate protection for privacy? What are the vulnerabilities? What are privacy solutions?

On the utility side...
How has the diversity of historical ways Census has shared data affected research using census data? How can Census better support the scientific need for replication, integration of multiple data sources, citation and provenance? Are current practices sufficient to ensure long-term (archival) access? What can Census do to make data, and especially confidential data more easily discoverable, accessible, and usable in the short and long term?

MOTIVATION FOR INCREASED DATA USE BY SOCIAL SCIENTISTS

Social scientists in the US have relied heavily on data collated and distributed by the U.S. Census Bureau. Some of the Census bureau's best known data products include the Decennial Census, American Community Survey, Census of Government, Economic Census and Tiger geography. In addition, the Census distributes data for other agencies such as the Bureau of Labor Statistics and the center for disease control, and provides data collection that supports public data produced by other government agencies including the National Science Foundation, National Center for Science and Engineering Statistics.

This talk will cover the background and alpha release of Portable Legal Consent (PLC). PLC is being developed as a tool to allow patients to tell the doctors, researchers, and companies that are experimenting on them, that they, the patients own the rights to the data generated from their bodies. When a patient chooses PLC, it's a statement that what the patient desires is for the data to be shared broadly in the public domain, to serve scientific progress as a whole, regardless of the particular individual or institution that makes the breakthrough. PLC is voluntary, opt-in, and will be submitted for IRB approval in the first quarter of 2012.

The presentation attempts at providing an insight into the conceptual world of the EU-Directive, the normative-analytical framework that follows from the concept and the way the framework drives the applications of data protection laws in the Member States.

Charles Allen, a Harvard Law Student, is investigating the current and potential legal consequences of Aadhar, India's new national ID program. In preparation for his visit to India, he would like to use a TIP session to brainstorm about issues. The TIP discussion will begin with an introduction to the system by Joe Pato, senior architect and researcher at HP and MIT.

Aadhar (meaning "foundation") is a revolutionary effort to provide 12-digit identification numbers, linked to a database of biometric fingerprint and retina records, to all of India's 1.2 billion citizens. While the effort is still in its infancy, its proponents see potential to provide India's underclass of over 400 million with the benefits of a rapidly-growing globalized economy, including access to bank accounts and credit, cell phones, and more efficiently-distributed government benefits. The planned system is intended to be both accurateÑusing biometric data to create unique and difficult-to-forge recordsÑand scalable, using dispersed field teams to reach even the country's poorest and most remote citizens.

While Aadhar's goals are noble and far-reaching, the program raises significant legal questions. First, India's has comparatively weak privacy laws, and has had a history of pushing even those limits with extensive citizen surveillance. Putting the world's largest database of personal information in its hands raises significant civil liberty concerns. Second, India's system of government welfare, currently managed largely through jobs and in-kind grants of food and supplies, stands to be replaced cash transfers. While the ID system will lead to more accountability for these payments, it will create questions of what individuals are actually guaranteed by their government, and where the boundaries of state intervention in local markets actually lie. Third, as the effort is being run by a group of private partners under government supervision, there will be ongoing conflicts between the more entrepreneurial managers of the program, and the entrenched bureaucracy within which it is intended to operate. If Aadhar reaches its intended scale, India will require fundamental changes to its regulatory state.

Charles Allen's resulting paper will explore these anticipated issues, as well as potential challenges to hypothetical applications of Aadhar in election law, human resources management, and taxation.

Related links

Harvard researchers recorded Facebook social network data and cultural preferences from a cohort of undergraduates over their 4-year time in the College, and linked it with student room assignments, demographics and other school information. This longitudinal enriched network dataset could prove an invaluable asset for social scientists studying social networks, social stratification, homophily, and culture. The researchers intended to make an anonymized version of his dataset publicly available in the IQSS Dataverse Network so that other social science researchers could benefit from it. Indeed, this was also an expectation of the National Science Foundation, who funded the work in part. Working with the Harvard Institutional Review Board (IRB), the IQSS, and the Berkman Center Cyberlaw Clinic, the researcher engaged in due diligence, making reasonable but ad hoc decisions about how to anonymize the data and how to control the data flow. The resulting data had no explicit identifiers and no explicit dates or ZIP codes, which were known vulnerabilities. However, Prof. Sweeney expressed concerns of the possibility of student re-identifications because the dataset did not use a scientific approach to de-identification. She vowed to work with the researchers to assess actual reidentification risks and to then develop remedies so the data can be shared widely with privacy guarantees. The researchers have not shared the data widely, pending a satisfactory long-term resolution for sharing useable data with a community of scholars. This talk reports on a series of experiments to answer the question Óhow many Harvard students could actually be re-identified in the data?Ó. The answer is more than 85% of the 1600 students. These findings offer significant insight into reidentification risks and de-identification standards used for research, including HIPAA.