Proactive IT Security
 

Default privacy - what is the problem?

2011-05-27 [Privacy issues, Spam, Trends & predictions]

The issue

Some of the Internet's giants have recently joined forces against a U.S. of California bill proposal.

The main controversy is over a new part - Social networking privacy act:

A 60. (a) A social networking Internet Web site shall establish a default privacy setting for registered users of the site that
prohibits the display, to the public or other registered users, of any information about a registered user, other than the user's name and city of residence, without the express agreement of the user.
(b) A social networking Internet Web site shall establish a process for new users to set their privacy settings as part of the
registration process that explains privacy options in plain language. The Internet Web site shall not complete the process of registering a new user until privacy settings are selected by the user. The Internet Web site shall make privacy settings available to all users of the Internet Web site in a conspicuous place and an easy-to-use format that allows the user to adjust his or her privacy setting.
(...)


The reason for this new section about social privacy is to enforce stricter privacy rules, thereby protecting the users of the social networks. Users under 18 years get a particular protection, as the social networking sites are obliged to remove personal information by request from the user's parents.

Strongly opposed by social network providers 

The reactions from the owners of social networks were strongly negative. A letter signed by Google, Facebook, Yahoo!, Twitter, Skype and several others, was sent to senator Ellen Corbett, who proposed the section. In the letter the underwriters argued:

(...)
SB 242 would decrease overall consumer privacy
Sections 60(a) and (b) of SB 242 would require social networking sites to force users to make decisions about privacy and visibility of all  of their information well before they have ever used the service. Known as “privacy shrink wrap,” this practice results in users clicking quickly through the available options without contextual understanding of or serious thought to the case-by-case implications of the choices being made. A common just-in-time, contextual privacy notice on a popular social networking site has fewer than forty words, describes exactly the information to be shared and with whom, and is easily understood by a layperson. A description of all availability privacy and visibility options to a consumer who has never used the service in question could take thousands of words and up to half an hour to read. Making abstract, acontextual choices about privacy would be quite difficult for an educated adult; that difficulty would be even greater in the case of minor users of social networking sites.
(...)
Internet commerce is an inherently interstate activity and SB 242 would regulate businesses far beyond California's borders. Social networking sites cannot reliably know if a visitor is a California resident. Therefore every covered site in the world would need to change their practices in order to comply with California law.
(...)

 

Pro et contra

The main issue here seems to be to choose between two different approaches towards privacy. To put it a bit bluntly, these alternatives

  1. Everything is private, and the user should choose what he/she wants to share publicly.
  2. Everything is public, and the user should choose what he/she wants to restrict from public availability.

Each day we can read in the media about people who have experienced all kinds of problems because they have not been restrictive regarding how they share their personal information. These problems range from minor harassments on the one end, to economic disaster and identity theft on the other.

In our view, it is obvious that a default restrictive approach to public sharing of personal information will result in less information shared. Conscious choices to make personal information public will result in less information being public.

And that is probably the real problem seen from the social network companies' point of view. A social network's success depends on its ability to create strong community/communities among its users. This is much easier accomplished if more information about any member is available to other users of the community.

Additionally the marketing aspect should be considered. The ability to make successful marketing campaigns targeted special demographic groups, is obviously increasing the more information that is available to identify the members of that group.

What is next

In an interview with the Huffington Post, senator Corbett commented:

You’ll hear all sorts of characterizations made to confuse people on this measure. I’m up for a very tough fight. I have heard from so many people who are grateful that we’re trying to protect their privacy and security and protect young people from harm.

Privacy issues are increasingly focused upon. If this bill is passed in California, other states in U.S. as well as other countries may introduce similar legislations.

At the very least, the initiative from Senator Ellen Corbett have resulted in an increased awareness of privacy issues, which in itself is welcomed.

References