start	end	text
26750	28430	Hey, AJ.
28950	31310	Hello. How are you?
33010	34090	Hi.
34090	35430	I'm doing good.
39530	43050	Alright, it looks like our presenters are here.
43570	47850	It sounds like there is a slight echo somewhere.
51830	53030	Ah, no worries.
53590	58970	How about now? Let's see.
58970	60490	Yep, it seems to be gone.
60490	61490	Let me...
65190	67670	I like your t-shirt, Jason.
68550	70890	Yes. I like it.
71330	74770	So, is it backwards for you or forwards?
75930	79890	It's forwards. I'm just going to go straight through. It looks like it's mirrored.
79990	84370	Yeah, on mine, I get the mirror image.
84770	85670	Nice.
89690	95630	Alright, let me get your all slides queued up really quick, and we will go from there.
95850	99010	We are almost at the hour, so let me share my screen.
100850	104490	Let's share the screen. Let us share the slides.
104490	107950	So, I'm going to introduce you all in a few. Let me go from there.
108370	110270	Alright, can you all see the slides?
110790	111930	Let's see.
112830	113710	Yep.
114950	116270	I can see.
119090	120050	Okay, that's perfect.
120050	121190	I'm getting...
122970	125010	Okay, now I see it.
125510	128890	Perfect, perfect. And we will commence just shortly.
129370	133310	Give folks a few more minutes to pop on. It looks like...
133310	134170	Sure.
140340	144440	There's about nine folks on the Twitch chat.
145220	150580	We have another maybe ten or so on the voice chat, so...
151940	153800	Alright, let us commence.
153800	155800	So, hi everybody.
155940	159220	I'd like to welcome our next set of speakers.
159220	162940	We have Art Jason Kronk and A.J. Gmusel.
162940	166740	They're going to be talking about the models of privacy norms.
166740	168880	So, a little bit about Jason.
168880	173580	Jason is a privacy consultant with the Interprivacy Consulting Group,
173680	175740	a boutique privacy consulting firm,
175740	181920	where his current focus is on helping companies overcome the socio-technical challenges of privacy.
182160	184900	He is a certified information privacy professional,
185260	187460	a certified information privacy manager,
187600	190040	a certified information privacy technologist,
190040	192660	and a floor member of the IAPP faculty,
192820	195060	a licensed attorney in the United States,
195060	196640	an author, blogger, speaker,
196640	200860	and is a passionate advocate for understanding privacy.
200860	203320	He writes regularly for both his own blog and others,
203320	206980	and he has been a guest speaker at his alma mater, FSU College of Law,
206980	212280	and he frequently speaks at IAPP events and tweets at Privacy Maverick.
213180	214200	Welcome, Jason.
214200	219720	And then our next speaker, who is also in the talk, is A.J. Gmusel.
219740	224500	So, A.J. is an editor, legal researcher, lecturer, and licensed attorney.
224500	228680	Her interests are privacy, privacy by design, technology law,
228680	231300	contract law, and cybersecurity law.
231300	235420	She received her LL.M. from the University of Illinois College of Law in 2019,
235420	238620	where she focused on intellectual property and technology law.
238620	245660	After her graduation, she started her research for Privacy Wiki at privacy.wiki,
245660	248040	and now she's a chief legal editor at the wiki,
248040	252640	with Professor Faye Jones and R. Jason Gronk of Pender Privacy,
252640	254540	one of our other speakers.
254800	257020	She's been working with Jason for over a year
257020	260000	as a legal editor at Privacy Wiki.
260140	263460	She remains at her work and researches in the wiki
263460	265660	at the Interprivacy Consulting Group.
265660	269800	She's also a visiting researcher at the Turkish Personal Data Protection Authority,
269800	274580	and she teaches the course of health and privacy law at a Turkish university.
274840	280060	Thank you, everybody, for being here as well, our Ethics Village attendees.
280060	285420	I'd like to say welcome to our speakers, and without further ado, we will go forward.
287220	291480	Thanks, Steve, for the introduction, and thanks, everyone, for taking time and joining us today.
291480	293920	Hope everyone is healthy and safe.
303570	306770	I can hear the Jason's voice, which is weird.
308610	309930	Can't hear me?
310150	312670	Yeah, I can hear you right now.
314510	315470	Okay.
316610	319090	So, you know, what is privacy?
319090	320990	I often get this question.
321090	322450	You may get this question.
322450	324070	You may have this question.
324070	329090	Oftentimes, you know, we run into situations where, you know, we talk about privacy,
329090	335570	and it seems very ambiguous, ethereal, hard to pinpoint.
335570	341530	We know it when we feel it, just like the old U.S. Supreme Court pornography case.
341530	343110	I know it when I see it.
343270	352210	But, you know, it's kind of hard to define, you know, say in a simple sentence or easily state.
353730	364610	You know, I run into this situation all the time when people, you know, ask me what I do or ask me, you know, to try to help them.
364610	368690	You know, companies want to build more privacy into their products.
368690	370210	But what does that mean?
370210	372850	What do we mean by privacy?
373690	380590	AJ, I'm assuming, you know, you have the same questions or people have asked you the questions as well.
380590	385410	Yeah, privacy is a complex social norm that has been tried to define for over decades.
385410	391130	So as you can mention that privacy is very ambiguous and broad and depends on individuals,
391130	400930	their psychology, responsibilities, cultural effects, sociological backgrounds, personal choices or preferences and experience and so on.
400930	408430	Maybe in a chat screen, someone has a description of privacy.
410090	415270	If you have like description of privacy by your own, just think about what privacy is for you.
415270	418650	And do you care about that? Do you care about others' privacy?
418650	422490	Or is it ethical for you to violate someone's privacy?
423930	431930	That would be great to share your thoughts in a chat screen if you have one.
434980	437420	What is your own privacy?
442890	449390	I think that there is no real answers for privacy right now.
451780	453420	Let me look again.
459960	464680	Okay, what is privacy for you then, Jason? Like how do you describe it?
472240	477640	Jason will be back in a few. It seems his chat has crashed or Discord has gone.
477640	479620	So he will be back in a second.
480360	486960	And if anybody has any questions, please feel free to field them to AJ over in the chat.
486960	496780	If any of you all have any ideas on what privacy means to you, please post it in the chat as we wait for Jason to come back on.
498680	513720	Okay, while we're waiting for Jason, I just wanted to talk about what we are going to talk in models of privacy norms under this talk.
514140	522140	Jason and I are going to talk and discuss about models of privacy norms and how to use them in organizations, businesses, or daily lives.
522140	530820	We're questioning the definition of privacy and diving in solo taxonomy and looking to Nest privacy framework.
530840	536240	Lastly, we also talk about our privacy wiki. Again, thanks for joining us.
536240	540900	But I think that we will be waiting for Jason.
547280	553800	Just some technical difficulties, folks. Unfortunately, Discord is a little bit glitchy sometimes.
553800	564140	I think it crashed the thing twice yesterday. So while we wait for Jason, if anybody has any idea of what privacy means to them, please post in the chat.
564140	573880	I think for me, AJ, kind of moving a little bit forward, especially nowadays with social media and how people are constantly taking our data.
573880	577800	Oh, it looks like Jason is back. There we are.
577800	579280	Thanks for the definition.
580080	584420	Definitely, definitely. Let's see. Jason, can you hear us?
589480	592320	Let's wait a few seconds. Let's see while he goes live.
595550	602190	So to finish my thought on that, you know, especially nowadays with people are being sold as a service.
602190	607350	So all of your data that is essentially being sold, you know, as a product.
607350	616970	So, you know, when everything is free, you are the product when it comes to Facebook, Google, when it comes to all the social media applications, Reddit and what have you.
616970	624710	I think privacy to me means can I have control over that, that data, my information, all my posts.
624710	632670	For all of you that have used, you know, social networking, online dating apps, online health, body checkers, Fitbits and what have you.
632670	637130	Where is your data going? That's a question. And do you even own it?
637570	642630	Because technically you have sold it to a company by using their application.
642630	651570	So to me, that is what privacy is, I guess, in the 21st century, you know, in current times, what it means to me, I would say.
652730	658070	And let's see if we can hear Jason really quick. I'll be right back, folks.
709250	715610	So, I guess while we wait for Jason, let's see if we can double check.
716130	724670	For those of you, can you all hear us clearly on the Ethics Talks voice channel? Just to double check.
724670	728390	Please give us a shout out in the general text, just to double check and see.
797690	804850	So, folks, give us one quick second. It looks like our speaker's computer probably decided to randomly reset itself when it shouldn't.
804850	811130	Thanks, Microsoft, wherever you are. Billy G and what's-his-face, Palmer.
811230	820130	Anyhoo, while we wait for our speaker to come back, I will put the slides up temporarily and we will continue forward.
820130	830570	Again, this talk will continue just in a little while as our speaker, RJ Sincron, comes back from the form-dreaded Microsoft crashing death and doom.
831050	834790	And thank you all for your patience. We will commence just shortly.
834790	837270	And yeah, hang in there.
954780	965180	Alright, folks, while we're waiting, does anybody have any ideas or any ideas when it comes to privacy, what it means to them?
965540	975480	Please post it into the general chat. Earlier I was talking with AJ a little bit about how a lot of our, I guess, privacy,
976600	980300	a lot of our privacy is kind of being taken nowadays with the idea of social media.
980840	988900	Ah, here we go. So we got something from our very own The Fixer, one of our Ethics Village staff.
988900	995740	So The Fixer says, for those of you that are on Twitch and other non-discord things,
995740	1003100	privacy within an application on the internet is the ability to do what I wish to do without attribution when I am not authenticated.
1003100	1009240	When I am authenticated, then my activity should only be visible with whom I should choose to make visible without a warrant.
1009240	1014220	Or actually, no, I'm sorry, that was from a Twitch comment from Denny Ma.
1014220	1017600	So thank you, The Fixer, for relaying that from there.
1018020	1022800	Let us double check and see now if our speakers are back.
1023020	1024320	Hi, Jason, are you with us?
1024320	1025940	Can you hear me?
1025940	1026280	Yeah.
1026280	1027900	Yeah, I hear you very well.
1031850	1037410	A windowed blue screen in like years and years.
1037410	1039670	Now I've pulled up Discord.
1039670	1044350	It won't give me video, and it says your Discord installation is corrupt.
1044970	1047690	But if you can hear me, that's good.
1047690	1052190	I don't see the... are you still sharing the screen or no?
1052990	1054950	Yes, I am currently sharing the screens.
1054950	1058650	I am on the very first slide, Models of Privacy Norms.
1058670	1063670	Jason, I was going to say you can also join our Twitch stream if you want to mute it.
1063950	1065610	Oh, that was from Walt Williams.
1065610	1069330	If you want to join, let me post that really quick.
1069610	1073470	It's twitch.tv forward slash Ethics Village.
1073470	1076350	You'll be able to see the slides as I go through them.
1077090	1079570	Yeah, let me do that.
1082370	1084750	And Dr. Wardog, you are correct.
1084750	1089970	You can use Gen 2 and never update anything, but then you'll be stuck in cyclic dependency hell
1089970	1093910	when you forget to update your box because Gen 2 likes to be bleeding edge.
1093910	1095590	Although, yes, use Gen 2.
1095590	1098070	If you want to heat up your apartment in the winter.
1112040	1115500	Okay, we're back.
1115500	1117660	So I see the original first screen.
1117660	1118780	Is that correct?
1118780	1119660	That is correct.
1119660	1120520	Awesome.
1120760	1123340	We can start if you'd like.
1123340	1125140	I'm going to mute myself.
1125140	1127000	And yeah, we'll start again.
1127360	1132120	Everybody, welcome our speakers, R. Jason Kronk and A.J. Gumusel.
1132140	1135800	I will stop speaking now and I'll let you all commence.
1138240	1141120	So, okay, go ahead and advance to the next slide.
1145540	1155820	So we often get the question of, and I'm going to repeat, and hopefully I don't know where everybody left off, but this may be a repeat for some people.
1155920	1159460	But, you know, I often get the question, what is privacy?
1160480	1164700	You know, it tends to be a very subjective topic.
1164700	1169860	You know, everybody has their own opinion of what constitutes privacy.
1170100	1172960	Everybody has a hard time defining it.
1173140	1179420	And in defining it, it makes it really hard to manage it in a company.
1179420	1185020	You know, a lot of people, I gave an example just a moment ago, but I'll say it again.
1185180	1191500	Similar to the Supreme Court case around pornography, I know it when I see it.
1191500	1200240	When I see a privacy violation or I feel a privacy violation, I know it's a privacy violation, but I have a hard time defining it.
1200260	1203100	So, AJ, you were kind of expanding on that.
1203100	1209080	Do you want to repeat what you were saying before my technical glitch?
1210000	1218300	Well, I was saying that privacy, as you said, is a complex social norm that has been tried to define for over decades.
1218300	1223040	However, there's no specific definitions or description for privacy.
1223300	1227100	And you told, like, privacy is very ambiguous and broad.
1227100	1234240	So, it depends on individual social backgrounds or preferences or personal choices.
1234300	1239940	And there are tons of, like, and other, like, definitions from the chat.
1239940	1243780	I saw Anna's definitions for privacy.
1244600	1248320	Anna says that everybody has different privacy thresholds.
1248320	1251800	And that's why, to me, it's important that we default to privacy.
1251800	1256820	Any data sharing should only happen as a result of personal choice.
1257300	1259140	That was good.
1260720	1264000	And SushiPens agrees that.
1264000	1271600	And it's sad to see that the norm on a lot of platforms is to opt into privacy instead of opt out.
1272600	1274940	The user says, SushiPens says.
1275360	1287060	And another comment on Twitch was privacy is the right to own data about yourself and not have others use that data without your express permission.
1287060	1295740	Privacy is the right to own data about yourself and not have others use that data without your express permission.
1295740	1299500	I don't know. It's just more security in privacy.
1300560	1317940	Well, certainly, I think a lot of people, you know, especially if they have a technical background or even a security background, you know, they tend to gravitate towards that, you know, concept of confidentiality and, you know, you know, right to control data.
1318620	1328480	But, you know, as I hope, you know, as we get into it, we'll expand on that and talk more about, you know, different thoughts around privacy.
1328480	1330040	Next slide.
1334230	1341310	So I want to give a little anecdotal story.
1341310	1346990	I was at an event two years ago, maybe a year and a half ago or so.
1346990	1349930	It was a IAPP KnowledgeNet.
1349930	1353290	So the IAPP is the International Association of Privacy Professionals.
1353290	1355870	And I was at a local chapter meeting.
1355870	1369210	And we were doing an exercise, we were being led in an exercise to consider if there was an ethical issue around a specific scenario.
1369210	1378170	So we were given a scenario and asked to say, you know, is there an ethical issue with what's going on?
1378170	1380990	And should we, you know, what should we do about it?
1380990	1384010	And I was really struck.
1384610	1389170	I, you know, we were each kind of cordoned off into tables.
1389170	1392990	And I had about three or four or four or five other people at my table.
1393270	1396350	And at first, I just kind of sat back and listened.
1396490	1403210	I was really struck by the number of people who were like, oh, there's no ethical issue.
1403390	1406050	Or, yeah, I see an ethical issue.
1406050	1410670	They didn't really have a frame of reference.
1410830	1420930	They were just kind of talking in a vacuum of seeing an ethical issue or not seeing an ethical issue.
1420930	1437330	And it was really problematic from my perspective because it makes it much more difficult to deal with if you're not working from a common frame of reference in terms of what is ethical and what is unethical.
1437330	1445750	Because when I prodded, when I asked the person who said there's no ethical issue, I was like, well, what are you measuring this against?
1445750	1448710	What do you consider ethical and unethical?
1448710	1451330	And he sat there and he thought for a minute.
1451330	1458270	I'm like, what is the measuring tool by which you're deciding this is unethical or not?
1458310	1460250	And he sat and thought for a minute.
1460250	1466510	And he's an attorney, and I'll be forthcoming and say I'm an attorney as well.
1466510	1470070	So I don't want to disparage all attorneys, just some of them.
1470070	1481210	So he was like, well, yeah, I'm an attorney and they don't have a duty of confidentiality here like an attorney would.
1481210	1483070	So there's no ethical issue.
1483750	1495350	So that's the only measuring stick by which you determine there's an ethical issue is whether or not there's a duty of confidentiality and they breach that duty.
1495350	1500970	So he sat and thought about it and he's like, well, maybe there's a fiduciary duty.
1500970	1505290	You have a duty to, you know, clients to protect data.
1505710	1516510	Again, he was very narrow minded in his thought pattern about what, you know, what is privacy or what was what was ethical in this situation.
1516770	1522850	So I want to introduce you to two concepts in the law.
1522850	1533190	So Latin terms, malum in se and malum prohibitum. Malum in se means evil, wrong in itself.
1533390	1537790	We typically think of the stereotypical example here is murder.
1537790	1543810	You know, we as a society almost universally view murder as as wrong.
1543810	1550050	It's an evil unto itself. You don't need a law to tell you that murder is wrong.
1550050	1559010	So then there's a concept of malum prohibitum, and this is wrong because a statute law or regulation says so.
1559010	1573110	So if the law says that going over 55 miles an hour on this road is a violation of the law, it's only wrong because that statute set that speed limit on that road.
1573110	1578990	Going 55 miles per hour is not wrong in and of itself.
1578990	1587890	It's not it's not an evil unto itself. It's only wrong because a law says so in particular.
1588110	1599510	So I would position that privacy is more in the in the realm of or violations of privacy are more in the realms of malum in se.
1599510	1605590	In other words, you know, violating somebody's privacy is evil or wrong into itself.
1605590	1612370	But but how do we again, how do we determine murder? Pretty obvious. OK, killing somebody, you know, taking out their life.
1612370	1618290	But when I when I say privacy is is wrong in or violations of privacy is wrong in itself.
1618530	1628430	And we're back to that question of what is privacy and is there an is there or can there be agreement around that?
1628430	1637310	I think in this concept, I think complying a rule without considering and evaluating is also a concern for privacy.
1638330	1642170	Sorry, you said compliance. Say that again?
1642210	1648710	Complying a rule without considering and evaluating is also a concern for privacy.
1648710	1659810	Sure, sure. Agreed. So, you know, so how do so what are the social norms to which I'm referring, you know, and how do we define them?
1659810	1666800	And they may be different. You know, we talked about privacy being subjective, but it may be different based on different cultures,
1667610	1676770	certainly different contexts and situations. Sorry, AJ, I know I went on a little bit of a rant there on the compliance issue.
1676770	1680370	Do you have anything else you wanted to add here?
1680670	1689130	Well, I just wanted to add like you're thinking you're we're talking about it depends on privacy depends upon individuals to individuals,
1689130	1693650	but it's considering as a human rights as well. I just want to edit it.
1693650	1700030	And while we're talking about privacy as social norm, I just wanted to remind it.
1700030	1707490	I remember the event in 2016, you know, Mark Zuckerberg is just like leading Facebook.
1707490	1714590	And he in 2016, he considered privacy is not a social norm in 21st century.
1714590	1723070	But here is we're talking about privacy as a social norm, as professionals.
1723070	1726910	And I think that it's just valuable for all humanity.
1726910	1737250	So like we're not only thinking that privacy as a social norm, but also we should consider about a human right.
1737870	1749130	Yeah, I would say, you know, going back to that Mark Zuckerberg quote, you know, I think, again, this is what is is makes privacy confusing is,
1749130	1753850	you know, he was using a certain concept or definition of privacy.
1753850	1757750	You know, if you started probing and asking him questions about that,
1757750	1766590	he might feel that there are other things that fall within the privacy rubric that, you know, certainly are social norms.
1766650	1772570	Clearly, he was using that for, you know, defensive purposes of Facebook's actions.
1772650	1778550	But, you know, but again, it depends on what you mean.
1778550	1789930	And oftentimes when somebody says privacy, they're usually talking about one aspect and not the entire spectrum of what what people might consider privacy.
1789930	1790610	Of course.
1790610	1793710	OK, let's go on to the next slide.
1794570	1798210	So let's talk about models of privacy norms.
1798670	1803830	You know, there are several models of privacy norms and we respect them.
1803830	1807370	However, we selected the most popular and well-known models.
1807370	1817760	They're Hartzog's Privacy Pillars, Weston's States of Privacy, Presser's Privacy Torts, Callot's Harm, Solow's Taxonomy.
1817950	1824970	And we're going to talk about also Nissenbaum's Obfuscation, which Hartzog also discussed in his articles.
1825090	1830550	When Hartzog and Weston defined privacy, they considered privacy values.
1830550	1833670	Therefore, it is in white color in the left side.
1833670	1843130	On the other hand, Presser, Callot, and Solow categorized privacy with its harms, which is why it is colored in black.
1843810	1850530	Let's first talk about Weston and Hartzog, who defined privacy based on its values.
1850530	1853510	Then Jason will speak about Presser, Callot, and Solow.
1853510	1863890	And he will give an example about Solow's Taxonomy in order to illustrate what it is, what they are describing as privacy.
1864130	1870850	L.L. Weston was a well-known privacy law professor and a legend in privacy.
1871130	1881250	He shaped privacy law. He wrote his doctoral dissertation in the 1960s, which later got funding to turn into a book called Privacy and Freedom.
1881250	1887690	I can quick quote his definition of privacy.
1887690	1899410	It's like the claim of individuals, groups, or institutions determined to themselves when, how, and to what extent information about them is communicated to others.
1899930	1905090	He pointed out privacy, either physical and psychological.
1905090	1916030	He outlined these four states of privacy as solitude, intimacy, anonymity, and reserve, respectively.
1916550	1923830	In its states of privacy, solitude means to be alone and free from observation by others.
1923830	1926610	Weston was involved in the threat of freedom.
1926610	1935910	For him, intimacy refers to being alone with a small group to the exclusion of others, such as family, and concerns close relationships.
1936390	1942970	We can say that solitude and intimacy both involve freedom from observation of others.
1942970	1952070	Everyone may be familiar with anonymity because everyone is just popping up the information security definitions in a chat.
1952070	1959790	His anonymity is involving freedom from being identified by others.
1959790	1964030	It depends on the choices available in one's environment.
1964030	1970410	In other words, it refers to being unrecognized in a public place to be bland in the crowd.
1970690	1975350	The last one is reserve.
1975470	1980490	It's about freedom from disclosing information about yourself to others.
1980490	1988290	It's not keeping information secret, but limiting communication of self to others in different ways.
1988290	1992150	It is based on a desire to limit disclosure to others.
1992150	2004990	So before talking about Herzog, I would also like to quote here Professor Elisa Austin's perspective to Weston's state of privacy to clarify.
2004990	2011410	She states that in her re-reading article, like this,
2011410	2018410	we choose a state of privacy when we choose to not share information about ourselves,
2018710	2027350	either through shielding ourselves from observation, which refers solitude and intimacy,
2027770	2034970	shielding ourselves from identification, which refers anonymity in Weston's state of privacy,
2034970	2045010	or shielding ourselves from disclosure, which refers to reserve in states of privacy.
2045030	2052230	So let's talk about Rudra Herzog values privacy with his pillars of privacy.
2052230	2057090	He defined privacy in three pillars, obscurity, autonomy, and trust.
2057090	2064010	We may familiar with it, but let's dive in his pillars of privacy.
2064010	2069890	Obscurity is when information and people are hard or unlikely to be found or understood.
2069890	2076070	People are relatively safe and rely on that risk calculus.
2076070	2087150	It is continual presence of some facts, such as search visibility, unprotected access, identification, clarity.
2087310	2090390	These are diminishes obscurity.
2090390	2097090	His autonomy is defined as freedom to develop reliable and sustainable relationships of trust
2097090	2100430	and create and maintain those zones of obscurity.
2100430	2106430	It is like freedom from external interference or something leads us what we want or not.
2106430	2114590	It's kind of a value, and it's kind of slows decisional interference, which Jason will talk about later on.
2114590	2116910	But just remind it.
2117890	2123430	And think about social media users, YouTubers, Instagrammers, or influencers.
2123430	2129750	Maybe we don't like them, but they disclose every detail about their lives because of their followers.
2129930	2133050	And also they're making money for that.
2133250	2141910	We therefore say that privacy leads us solutions that helps us choose and hour us in control of our own unique lives.
2144130	2147650	So think about this for a second.
2147650	2151950	Privacy is right to what we want to do or not.
2151950	2157190	So he's just literally considering privacy as a value.
2157250	2163930	And when we think about privacy as a right to what we want to do or not, it's just a value.
2163930	2169170	And it's just a robust value that we ever had.
2170170	2174610	So he described autonomy as one of the values of privacy.
2174710	2178290	And the Herzog's one of the players is also trust.
2178290	2183150	Trust is also familiar with us.
2183150	2187430	Trust is always a valuable thing in our lives and relationships.
2187430	2195630	Even when you're talking with your relatives, your friends, trust is always leading your relationship with being them.
2195630	2201950	According to Herzog, trust is willingness to become vulnerable to the actions of another.
2203250	2210210	Think about you're okay with something, what other people behave to you in every circumstance.
2210210	2213170	It happens in every second of our lives.
2213170	2221010	Even when you opt in for a company's privacy policy or notice or something maybe pop out in their website.
2221010	2227650	You're just like opting in and then you're just literally trusting that company while you're opting in.
2227650	2236430	So Herzog is just defining privacy with his pillars of privacy.
2236430	2237750	So Jason?
2238610	2248590	Yeah, so AJ just went over kind of those are all things to aspire to.
2248590	2252890	You want to give people obscurity. You want to give people autonomy.
2252890	2254710	You want to give people trust.
2255630	2262490	Where it's a privacy torts and cable harms are things that as a society we want to avoid.
2262490	2275870	So Prosser was a famed law professor who wrote the primary text on torts in the United States.
2275870	2280590	And a tort is just a wrongful act.
2280590	2292210	And this under common law in the United States, you can sue people for violation, for impedance onto you.
2292210	2301090	So there are four privacy related torts that Prosser defined in his seminal text.
2301090	2309770	And these are still found in common law, though most states have adopted statutory interpretations of them.
2309930	2312450	So false light is the first one.
2312450	2317070	And that is publicity which puts somebody in a false light.
2317210	2325910	So when you think of the National Enquirer, you know, describing somebody's alien baby or something,
2325910	2329870	that would be an example of putting somebody in a false light.
2331330	2340650	Intrusion upon seclusion or intrusion upon somebody's private affairs or solitude,
2340650	2347150	that is essentially like prying into somebody's, you know, private life.
2347150	2354250	You know, digging up information or finding information that really is none of your business.
2354790	2358910	Public disclosure of embarrassing private facts.
2358910	2363330	So it's not just disclosure of private facts.
2363330	2370930	One of the things that makes this a little bit narrow and hard to use in a lot of times as far as like a lawsuit,
2370930	2374250	because it has to be embarrassing private facts.
2374910	2385230	And then appropriation is what we think of when we think somebody takes a celebrity's image and uses it for financial gain.
2385230	2390490	And we'll talk a little bit about that in a little bit more detail in a minute.
2391030	2399570	So Ryan Calo has come up with his objective and subjective harms.
2399790	2412530	These are fairly broad categories, but they still kind of run the gamut of a lot of different type of activity we would consider privacy.
2412530	2421730	So his objective harm is unanticipated or coerced use of information.
2422150	2427870	So if I have information about you and I use it in a way you weren't expecting,
2428070	2436130	that is an objective harm or if I coerce the use of information from you.
2436130	2438550	AJ, were you saying something?
2439710	2441610	Okay.
2441610	2442610	Okay.
2442610	2448950	And then subjective is the perception of unwanted observation.
2448950	2463470	Now, notice the word perception there, because what Calo was suggesting is that subjective harm doesn't need to come from actually having unwanted observation.
2463470	2481470	If I think the NSA is surveilling me, I may do things like not talk on the phone or I may change my behavior or be anxious or have anxiety about it.
2481470	2491530	So even if I have the perception of unwanted observation, even if I just have that perception, that is in itself a harm.
2491530	2496990	And you can see this in thinking about surveillance.
2496990	2506310	If somebody wants to just get me convinced that I'm being surveilled, hey, by the way, I put a camera in your house.
2506310	2507870	What? Where is it? What?
2507870	2510710	I may not actually be surveilled.
2510710	2512850	I may not actually have a camera in my house.
2512850	2518050	But if I have that perception, it's still going to affect me.
2518050	2521910	And that's what Calo was trying to get across with his subjective harms.
2522350	2539330	Now, you know, one of the things I want to, going back to my anecdote a little bit ago about the conversation around ethics I had at the IAPP KnowledgeNet, you know, by picking, and this is not all of the privacy norms we're going to discuss,
2539330	2549030	but by picking a model of privacy norms, now the discussion isn't what is ethical and what is unethical.
2549030	2556970	The question is whether your scenario fits within one of these models, and then what do you do about it?
2556970	2569230	So, for instance, if you were to pick Harzog's privacy pillars, now it's not just this kind of ambiguous discussion of is this ethical, is this unethical?
2569290	2576250	Now you just have to relate, well, you know, are we subscribing to obscurity?
2576250	2578970	Are we giving people obscurity or not?
2578970	2582010	Are we giving people autonomy or not?
2582010	2586790	Are we giving people, you know, are we instilling trust or not?
2586790	2594010	And then it just becomes a line-drawing exercise of where are you within or without the model?
2594010	2604010	Not a question of is it ethical or not, and kind of that, you know, almost unanswerable question.
2604010	2607190	I just want to add something.
2607610	2614250	It shouldn't be expected that organizations use it for checklists in developing privacy values.
2614250	2637730	While you're just saying that, if we're thinking in any circumstances and considering those privacy norms, whether it is ethical or not, organizations or businesses or any individual should use it for a checklist.
2637730	2650970	It's a guidance on how to think about privacy values and how to distinguish them from privacy principles and privacy outcomes in the consumer environment or organizations, businesses, that I would say.
2651230	2653930	And I just want to ask something.
2654270	2657210	That will be great for the audience as well.
2658750	2666210	So it can appear in, like, different privacy harms or values may occur at the same time, right?
2672330	2675950	I'm sorry, was that a question to me or to the audience?
2676670	2678190	Like, both.
2678190	2688070	Like, it may occur, like, all the privacy norms may occur at the same time in any circumstance, right?
2688070	2689630	I was just, like, asking.
2690790	2697750	I mean, from my perspective, certainly an activity can fall under many of these models.
2697750	2701790	I'm not sure I quite follow if that's the question.
2701790	2703790	Yeah, I would agree.
2704770	2708190	For instance, hard dogs obscurity.
2708610	2728150	If you're, you could potentially, you know, being losing obscurity, you know, and also violating Prosser's privacy tort of public disclosure because something happened in private and by you exposing it to a larger audience, you know, disclosing it to the public.
2728150	2743350	You've essentially ruined that person's, you know, obscurity in what they were doing because they were reliant on that, that they were doing it, you know, and nobody was paying attention.
2744350	2745270	Yes.
2746230	2749670	Okay, let's dive into solo taxonomy then, right?
2749670	2755950	Well, let me, yeah, so before we do that, hit next real quick, Steve.
2760950	2770190	Yeah, so I just want to point out one additional one that it's not, it's not a model of privacy norm in the traditional sense.
2770390	2778430	Nissenbaum, Helen Nissenbaum is a philosophy professor who has come up with the concept of contextual integrity.
2778430	2805830	And this is related to information privacy harms and it's not a norm as we've described to others where there are certain buckets of activities that we say are normative or non-normative behaviors, but rather it's a way of examining an activity to determine if it meets or does not meet a social norm.
2805830	2814430	And that is looking at five different aspects around an information activity.
2814430	2825210	You have a sender who is transmitting information, have some transmission principle, and then a recipient of that information.
2825210	2834690	And then the black silhouette is meant to represent the data subject about who the information refers.
2835010	2847430	And then I is the actual type of information. Are we talking about health information? Are we talking about, you know, identifying information, contact information?
2847430	2868990	And by looking at these five different factors, then we can essentially, you know, describe this and look, you know, in a given culture or society, does this type of activity exceed or undermine, you know, social norms?
2868990	2893950	So just by way of example, you know, sticking with, say, healthcare information about a particular person, if the sender is a doctor and it's being sent to an insurance company, you know, probably for the most part, you know, they need that information to, you know, to pay the doctor or something like that.
2893950	2914210	So generally, that probably wouldn't violate social norms. If, however, they were posting that information on Facebook and their recipients were their Facebook friends, that could be viewed as a violation of social norms around health data. So that's how that would work. But yeah, next slide.
2922200	2952180	So another model of privacy norm to which I am particularly fond of is Professor Dan Solov's taxonomy of privacy. Now, Dan Solov is a professor of law at George Washington University, and in 2008, he developed this taxonomy of privacy by looking at case law and laws and trying to,
2952180	2968180	from the bottom up, trying to discern what are the different categories or buckets in which we can kind of place things that, you know, people would consider violations of privacy or privacy harms.
2968180	2991940	And what I like about it is the items are fairly discrete and small. It breaks privacy up into 16 different categories or different discrete harms. And so it's much easier than, say, Ryan Calo's objective-subjective harms, which are still kind of broad.
2991940	3014320	So instead of saying a violation of privacy, you might say a violation of objective harms or subjective harms, although they're still very broad categories. Solov's taxonomy is very narrow and easily, you know, easily digestible and discussable. And it's also very comprehensive.
3014320	3030420	I have yet to find, and not to say that there isn't, but I have yet to find something that somebody would say, yeah, that's a violation of privacy that doesn't fall under one of these privacy harms in the Solov taxonomy.
3030420	3050840	Now Solov breaks up privacy into four broad categories. That is information processing, information dissemination, which are both forms of information privacy violation, collection, and then a kind of generic invasions.
3050840	3066060	So we certainly don't have time today to go over each of the 16 individual privacy harms, but I want to touch upon one from each category. Next slide.
3076710	3098770	Okay. So the first one is under information processing and it's identification, linking of information to a particular individual. And I'm going to use an example here. So about two decades ago, about 20 years ago, the state of Massachusetts released medical records from state employees.
3098770	3117450	And it was done so that they could do analysis of, you know, what diseases are happening where, et cetera. Well, a researcher from the Massachusetts Institute of Technology re-identified the then governor of William Weld on that information.
3117450	3137110	And it's because the information, though it was de-identified, they had taken off names and social security numbers, you know, addresses, they still had some information that was particularly identifying. That was the person's gender, their date of birth, their postal code.
3137110	3154170	And the researcher from MIT was able to re-identify the governor based on that information because he was the only one with that date of birth and that gender in that postal code. And she matched it up against, I think, voter rolls or something like that.
3154170	3174490	So it turns out that this sort of information, this gender, date of birth, and postal code, will actually uniquely identify or uniquely identified about 95% of that state employee database release.
3174490	3187450	So there was only a very small minority of people who, you know, had the same date of birth, same gender, and lived in the same postal code. So it was fairly uniquely identifying. Click Next.
3188430	3209850	So the point here isn't to be able to, like, re-identify the governor or even re-identify somebody by name and pinpoint them. The point is to be able to single out a person within your data.
3209850	3237330	And I think this is very apparent or obvious when you start talking about facial recognition. So, I mean, let's say we had a database of photos. Yes, we might be able to re-identify William Weld in those photos. But even being able to say, look, here's person 2, if we can re-identify that person in other photos as that person 2, that's about identification.
3237330	3265270	It doesn't matter that we've necessarily, you know, named them, you know, found out what their legal name is. I mean, it could be John Smith. There could be hundreds of John Smith. But the fact that we can re-identify the same person across multiple photos, that's what, you know, linking of information to a particular person is, to this person number 2. That's what identification, the privacy harm of identification under the Solov taxonomy is.
3268070	3294480	I'm checking. You know, if anybody sees any, has any questions or comments, please feel free to post them. I don't want to feel like this is a one-way street. But go ahead. I heard a beep. No, it's not. Okay. So, maybe I'm not right.
3295980	3299420	Okay. Go ahead and next slide, Steve.
3308020	3320340	So, Solov's category of information dissemination, one of the harms is appropriation, that is using an individual's identity to serve the aims and interests of another.
3320340	3332020	So, this was also a privacy tort under Prosser's list of four privacy torts. So, we typically think about this in terms of celebrities.
3332020	3351400	So, Elon Musk here is not hawking smart pills. But in fact, he is, you know, his image had been appropriated by the seller of these smart pills to try to, you know, promote the sale of these pills.
3351400	3358060	But he didn't endorse them. He wasn't paid for them. So, this is a form of appropriation.
3358060	3366460	Now, while we typically think about this happening to celebrities, it's not just celebrities. Go ahead and click next.
3373120	3392520	This happens to you and me. So, this is my image I found using a Google reverse image search that was on a few years back that was on an Asian dating site that had been appropriated by that dating site to promote their site.
3393560	3406980	And I had never joined or had no intention of joining the site. So, the site was actually, I did the translation, it was promoting Western millionaires, which isn't exactly accurate.
3406980	3418220	Although I'd like to be a millionaire, I'm not quite. So, it's, you know, interesting appropriation. But it's not just, you know, me either.
3418220	3437060	I would say that many people have been appropriated. For instance, when you think about social media, if you click like on something on a product or a website, you know, many social media sites will then promote your name and likeness saying,
3437820	3452380	hey, Jay, you know, like this product to her friends and family. So, it's not a huge privacy invasion, but it is a form of appropriation because she wasn't compensated.
3452380	3466060	Now, one could make the argument, as I'm sure the social media sites do, that the free use of the service is compensation for that appropriation of her image and name.
3467060	3491360	But if you think about it, it's a social media site that you're getting a free use of. It's not the product or service that is essentially getting the advantage, the sellability of her name and likeness that is, you know, they're not taking it or they're not compensating her in any way.
3491360	3494660	Okay. Next slide.
3502420	3520200	So, now we move outside of the information privacy harms under the Solov taxonomy. We move to collection. And interrogation is one of the harms, that is, the questioning or probing for personal information.
3520200	3530390	We typically think of this in terms of like a police interrogation or a suspect or a terrorist being interrogated. But go ahead and click next.
3531570	3544350	This is not necessarily the case. It can be really any questioning or probing for information that's out of context for the situation.
3544350	3557830	So, think about a job interview and a candidate being interviewed for a job. There may be completely appropriate questions. You know, what are your qualifications? Do you have any, you know, background or history in this kind of work?
3557830	3569050	But there may be completely inappropriate. You can imagine a hiring manager asking, and especially in a female candidate, if she was pregnant or planning on becoming pregnant.
3569370	3581270	And, you know, an inappropriate question, a privacy norm violating question, an interrogation that's inappropriate for the interview.
3581270	3589130	So, is it ethical to ask the candidate's ethnicity while you're applying a job?
3591830	3593090	Ethnicity?
3593270	3605330	Yeah. Like, while you're applying a job, the company is always, like, companies always ask the candidate what ethnicity they involve.
3605330	3623270	Okay. So, let me caveat that, say, by, you know, if you're asking if it's ethical, you know, I would, again, refer to the privacy norm of, you know, interrogation.
3623270	3633030	It's a questioning or probing for information that's out of context and irrelevant to the purpose of hiring.
3633030	3647730	Now, in the United States, you'll often see the EEOC questions about gender, ethnicity, veteran status.
3648910	3651470	It seems like there's one other question.
3652130	3667730	And so, you know, those are not supposed to be used for hiring. They're supposed to be kept separate and just reported to the EEOC to try to limit discrimination in hiring.
3668190	3674770	So, there may be a purpose there. So, that questioning is separate.
3675150	3679710	So, you have to really kind of dive into the context of what's going on.
3679710	3692050	Similarly, with the pregnancy question, generally, we would say that it's completely inappropriate for a hiring manager to ask a candidate whether she was pregnant or planning on becoming pregnant.
3692390	3702590	Now, if the job were working with hazardous chemicals that could put a pregnancy at risk, it might be appropriate.
3702590	3716790	Although, I would probably suggest that maybe a better way of handling it is giving information to the candidate that says, this, you know, this job will put a pregnancy at risk.
3717110	3725810	If you're pregnant, you should seriously consider not applying or, you know, waiting until your pregnancy is determined or something to that effect.
3725810	3733550	So, giving the candidate control rather than the probing or asking questions there.
3733550	3744130	Now, notice, I want to pinpoint something that's important on this and why this is not under the information privacy harms under SOLOV's kind of categorization.
3744130	3759730	And notice, it isn't the actual information. It's not, you know, what the candidate responds, whether she's pregnant or not, or even the information of knowing, you know, of a response or a non-response.
3759730	3775650	The actual privacy violation here, the harm, is the asking, the questioning, because she may feel uncomfortable, you know, that she's going to feel violated by having that question posed to her.
3775650	3785010	Not in answering, not in deciding whether or not to answer, but just in the asking of the question, you know, makes her uncomfortable.
3785010	3800830	And certainly, you know, this is an interesting question or interesting thing related to this specific thing. If she was overweight, it may make her embarrassed by the question being asked, because it's like, no, I'm not pregnant. I'm just overweight.
3800830	3819490	I had something happen. I was with a friend at a bar, and we were told the waitress was pregnant. And my friend asked the waitress, when are you due? The waitress was like, what are you talking about? Because our waitress was overweight. It was another waitress that was pregnant.
3819490	3832750	So again, just the questioning or probing for personal information is not the answer. It's not about the information. It's about that act of questioning or probing. Okay. Next slide.
3839610	3856010	This is the last one I will go over. Again, this is the category of invasion. And the harm here is intrusion. That is disturbing an individual's tranquility or solitude.
3856010	3873240	So when Polkman Go came out a number of years ago, certainly there were a lot of questions about the privacy of the app. What is it doing with people's data? Is it tracking people 24-7, especially if children are playing the game? There was another privacy issue at play.
3873670	3883610	So Polkman Go used churches and a number of other places as gyms where people could train their characters and earn points and stuff.
3883610	3896010	And we'll go ahead and click next. But a number of people had transformed those churches into their private residences.
3896010	3916650	So you think about people and they're trying to enjoy their home and all of a sudden they've got Polkman Go players trotting through their yard trying to catch their Polkman Go or Polkmans.
3916650	3924430	So this is about disturbing an individual's tranquility or solitude while they're trying to enjoy their house.
3924430	3935410	Now, it's not just Polkman Go players, it's vacuum cleaner salespeople, it's religious pamphleteers, you know, showing up while you're trying to eat dinner and they're knocking on your door.
3935830	3940050	These are all intrusions into your personal space.
3940110	3952470	Not just about the home, but think about the spam you get. Or back in the old days before browsers kind of put a stop to it, you would go to a website and all of a sudden you get a bunch of pop-up ads.
3952470	3962950	You're trying to view the website, but you're being intruded upon, you know, and interrupted while trying to do that.
3963130	3970650	So that concludes our examples of these four privacy harms under the Solove taxonomy.
3970650	3977630	Like I said, there are a lot more, but what I like about them is they're very discreet and very easy to work with.
3977630	3986450	And again, you can imagine a company, you know, you're setting, here are the privacy norms to which we subscribe.
3986510	3990210	We don't want to intrude upon people's tranquility and solitude.
3990210	3994770	You know, we don't want to interrogate people out of context.
3994770	4006030	And it just becomes a question of matching, you know, does the scenario that you're considering, are you violating people's privacy, you know, match with the privacy norm?
4006030	4014850	Not this kind of generic, you know, are we being ethical or not?
4015710	4017970	Okay, next slide.
4020700	4029280	AJ, sorry, I know I tend to kind of go off there. Did you have any comments on the Solove taxonomy?
4032250	4042510	Well, I do think that a Solove taxonomy is the most granular and comprehensive categorization of privacy.
4042510	4047450	Therefore, it involves all the scenarios under his taxonomy.
4047450	4053330	I was just like, I liked your slides of Solove taxonomy.
4054450	4067310	Like, but I would like to, I would like to, I would like to hear more about using these norms in business side and organizations.
4067310	4079530	Yeah, sure. So, so, you know, I mentioned kind of a broad way of using them. It's just kind of looking at a situation and seeing if you're violating a social norm.
4079750	4092610	But let's, let's, let's look at a more concrete method of kind of using the norms to drive your privacy, you know, privacy aspects of your business.
4092610	4094330	Go ahead and click Next.
4098890	4099450	So...
4100270	4102030	Oh, go ahead.
4102030	4102530	So here is...
4102530	4105350	Oh, right. We were going to compare. Sorry. Yeah, we, right.
4105350	4110350	Okay. Herzog and Weston are colored with purple in this slide.
4110390	4115810	And we're going to talk with Jason more about a Solove taxonomy in this table as well.
4115810	4119710	But purple side is harm-based privacy definitions.
4119710	4125890	As we stated at the beginning, an orange color refers to their harm-based privacy definitions.
4126770	4138990	Like we can see the autonomy of the Herzog's pillars of privacy refers to decisional interference, exclusion, blackmail, and distortion in Solove's taxonomy.
4138990	4143670	And it includes the objective harms in Callow.
4143670	4159270	And we don't see any reference, reference between the connection between Prosser's false light with Herzog's pillars of privacy, Weston's status privacy, and Callow's subjective and objective.
4159710	4162190	But we can see the Solove's distortion.
4162630	4167770	We, I mean, Jason didn't get involved in the whole Solove taxonomy.
4167770	4177950	But we would like to hear about decision interference definition because it's also in Asian and it's more broad.
4177950	4187590	It has more broad definition in decision interference, which also refers in Herzog's pillars of privacy.
4187590	4197730	We can see the definition of decision interference as intruding into an individual's decision-making regarding their private affairs.
4197730	4204230	There is another side of, another perspective in decision interference as manipulation.
4204810	4208850	So do you want to talk about this, Jason?
4209090	4222070	So what I just want to say, so first off, just to clarify and what this chart, and I think we've got a couple more, illustrate is that you can map the different models together.
4222070	4231850	So as AJ pointed out, autonomy under Herzog can be mapped to Solove's decisional interference, exclusion, and blackmail.
4231850	4242150	So the prototypical case for decisional interference was a case at the Supreme Court level.
4242370	4259150	It was Griswold v. Connecticut that decided under the U.S. Constitution, since there's not a direct right to privacy, but it found a right to privacy in the penumbra of rights, as the Supreme Court called it,
4259150	4268710	that there was a question, the state of Connecticut was not allowing married couples to purchase contraceptives.
4268710	4273350	They made contraceptives illegal. This was back in the 50s and 60s.
4273610	4281390	And it went up to the Supreme Court, and the Supreme Court said that that was not the purview of the state,
4281390	4290810	that that was a violation of essentially the right of privacy under the Constitution, even though there is no constitutional amendment that says right of privacy.
4290810	4307450	It was found in a penumbra of other rights, and this was an interference into the decision-making into the private affairs of that couple, and that the state did not have a right to make that decision.
4307450	4324550	This goes similar to Lawrence v. Texas, which says the state doesn't have a right to preclude homosexual couples or homosexuals from engaging in sexual activity in the privacy of their own bedroom,
4324550	4335350	because it's a decision that they alone have the right to make, and that the state should not interfere with that decision-making.
4335350	4349370	And again, you can see how this relates to autonomy and that individuals have a decision, a freedom to act as their own decision-makers.
4349710	4353290	Similarly, if you just go down to blackmail, I want to compare that.
4355630	4366370	Blackmail also, it's about decisions about the use of information and saying, hey, unless you pay me $100, I'm going to release this photo.
4366370	4379490	I'm essentially interfering with your decision and your right to make a decision of how to release or when or if to release information about you, again, interfering with your autonomy.
4379490	4388090	And if you look at Kalo's objective harms, which as you see maps up here, that is about the coerced use of information.
4388330	4400370	I'm using information, you know, a photo of you, and I'm doing it in a coercive manner that says either you pay me $100 or I'm going to release this information.
4400470	4405950	So you can see how that, you know, those things map together.
4408070	4412710	Next slide. I know we've got a couple to get through, so I want to go to the next slide.
4413710	4424410	And you can do this for all of the different, you know, all of the different categories under all of these models.
4424630	4425190	AJ?
4426160	4441830	I don't want to get involved in all of the things, but you can see that, like, in Solo's taxonomy, it just, it refers to all the privacy norms in this chart.
4441830	4456020	So we can see that in Hard Sock's pillars of privacy, obscurity refers to disclosure, exposure, appropriation, surveillance, interrogation, intrusion, identification, aggregation, increased accessibility.
4456020	4466740	However, we're not seeing in, like, Prosser's kind of law of privacy towards, and we're not seeing this in Weston.
4466740	4476480	They're so, they're so just involving, they're just so not, they're just broad, and they're not referring to all things.
4476480	4480280	And I think that there's some issues in the table.
4480280	4489120	If Jason, if Steve shows the next slide, I was, I was concerning something in this.
4490080	4495500	This model of privacy norms is just a model.
4495500	4498460	So it shouldn't be, it shouldn't be correct.
4498460	4501580	And it depends upon the persons of persons.
4501580	4505040	We, I have to, I have to just add it.
4505040	4511840	For example, the trust means a willingness to become vulnerable to the actions of another.
4511840	4514840	So it depends on the individuals to individuals.
4514840	4524940	And we're just, we just stated that in Solow's taxonomy, breach of confidentiality, secondary use, and insecurity in here.
4524940	4533340	So I was questioning, and I was concerning whether we could add the privacy harm of exclusion to this table.
4535420	4539100	It's more relevant with the Hartzog's trust definition too.
4539100	4540760	What do you think, Jason?
4543460	4544760	It's possible.
4544760	4546940	I, you know, maybe we should take that offline.
4547580	4550940	Just because we haven't really explained to people what exclusion is.
4550940	4554180	I'm sure they don't want us going down the weeds too far.
4554580	4560660	But certainly, you know, this isn't, this, this, this chart isn't meant to be.
4560660	4572620	In the chart I published, there is actually a disclaimer that there may be mappings that are uncovered by the chart.
4572620	4588800	But the point I want to use, go into here with this last one is we can use this, a business can use this to create its own privacy values specific to its business.
4588800	4591240	So go ahead and click the next slide.
4597530	4608950	So let's say we wanted to use Hartzog's trust, Weston's intimacy, Kalo's objective harm, and then Solov's breach of confidentiality, secondary use, and insecurity.
4608950	4615050	And we don't want to use any of those in particular, but we wanted to create something specific for our organization.
4615310	4616770	Go ahead and click next.
4618870	4625670	Let's say we were running a service called Texacleric.
4625670	4638130	And the purpose of this service is to allow parishioners to send a message to a religious leader and get back advice or, or just hold a confessional.
4638130	4654530	So we could develop a privacy value for this service, and we're going to call it seal of confession, and say Texacleric will protect and not use or reveal any information divulged.
4654670	4665750	So in that simple declarative statement, we've kind of combined all of these normative values into a privacy value for the organization.
4665750	4678010	So we've imbued trust, because we want our parishioners to trust that we're going to protect their information, not use it, or not reveal it.
4678870	4693390	Intimacy, we've created this intimate environment where individuals can feel that they're in an intimate, closed environment with their religious leader that they're talking to.
4694370	4703910	We are not using, you know, we're not violating Kalo's objective harms. We're not using it in an information in an unanticipated or coerced way.
4704050	4711290	We're also not breaching confidentiality. You know, again, we're not going to use or we're not going to reveal this information.
4711390	4719890	And we typically think of, you know, the clergy as having a duty of confidentiality when things are said in a confessional.
4719890	4730670	We're not violating secondary use. Again, we're not using this information for other than religious, you know, providing religious salvation.
4730710	4737110	And insecurity, we are not, you know, handling the information in an insecure manner.
4737130	4745830	So this is how we would develop a very simple privacy value that then we can manage, you know, the organization against.
4745830	4755670	Now, how would you use this in a proactive way in developing your organization's activities?
4755670	4758310	So go ahead and click Next.
4765230	4772890	So NIST earlier in the year published their Privacy Framework.
4772890	4787250	And what the Privacy Framework does is it provides a lot of functions and activities that an organization can do to have a functioning privacy program.
4787250	4794050	So it divides these into five functional areas.
4794050	4801610	That is identify, govern, control, communicate, and protect.
4801610	4808550	And they actually have 100 different subcategories of activities that organization can do.
4808550	4813710	And you can think of these activities in the NIST Privacy Framework as muffin pans.
4813730	4816610	So they're like muffin pans.
4816610	4825110	And then your job as an organization is to figure out which muffin pans to fill in and what kind of muffins you're going to actually bake in them.
4825110	4828030	Are you baking cornbread muffins, blueberry muffins?
4828030	4829890	Are you making cupcakes?
4829890	4836010	And what are the ingredients that you're going to use to bake all of these different muffins?
4836010	4838430	Go ahead and click Next.
4842110	4854990	So by having this privacy value, this can help us identify what are the ingredients that are going to go into these muffin pans into this framework.
4854990	4867410	And so, for instance, related to identity, one of the identity subcategories, one of the muffin holes, is data actions of the system, product, service, or inventory.
4868510	4877510	So here, in order to meet this privacy value of seal of confession that we've defined,
4877510	4890190	we may say all touch points for confessional message data are kept in system architecture diagrams so that we can identify, you know, where we need to protect this data,
4890190	4902730	where we need to make sure we're not using it for other purposes, and where we're, you know, make sure it's not being revealed or disclosed to people outside of our system.
4902730	4914390	So if our architecture diagram shows a, you know, a line going off to a marketing company, hey, whoa, we're breaking our seal of confessional, our privacy value.
4914550	4922530	So that would help us along. And I'm not going to read all of these. But, you know, I might go down to the bottom one of protect.
4922530	4932950	Data in transit are protected. Well, in order to meet our seal of confessional value, you know, our particular ingredient, our particular activity,
4932950	4940470	is that data between the parishioners app in which they are sending these messages, and our system are encrypted.
4940470	4952070	That might be one of many ingredients that goes into saying data in transit are protected, and also meeting our privacy value of seal of confession.
4953650	4956090	Jay, did you have any comments on this?
4956370	4965930	We can also combine it with solo taxonomy as well. In the first column, foredraw, it says data are destroyed according to policy.
4965930	4973230	I would say it's the privacy harm of insecurity in solo taxonomy. So we can combine with solo taxonomy, right?
4974290	4982230	Yeah, so certainly you'll see a lot of overlap in terms of... so she's looking at the second line from the top.
4982230	4987610	And one of the subcategories is data are destroyed according to policy.
4988330	5002090	And so defining that policy is going to help with insecurity. But remember, insecurity get into creating our seal of confession privacy value.
5002090	5016590	So whether you want to go directly against the solo taxonomy, or against our synthetic derived privacy value specific to our organization, you can go about it either way.
5016590	5024930	You don't have to derive your own privacy values, you can go directly against any of the models that we've suggested or others.
5024930	5041370	Harzog, Weston, Prosser, Kalo, Solove, Nissenbaum. Again, there are many others or you can create what I'm suggesting is it might be easy to create sort of these hybrid privacy values specific to your organization.
5043110	5044530	Thank you.
5044530	5046390	Okay, next.
5048950	5062790	Okay, now we're going to talk about a privacy wiki. We created privacy wiki in order to see what the United States laws protect individuals from the privacy harms on a solo taxonomy and those social norms.
5062790	5078110	I would like to thank for Professor Fay Jones with her support and into privacy. We also thought it could be better to demonstrate latest privacy articles and privacy related cases combined with taxonomy as well.
5078110	5086070	In this wiki, it now includes over 100 privacy related articles. So you may go check them out as well.
5086070	5087730	So next slide.
5088990	5110030	So privacy wiki is basically a wiki dedicated to privacy laws, events and articles. It is organized around solo taxonomy and its 16 privacy harms. It currently has 78 US federal laws and over 300 state laws that were met with solo taxonomy.
5110030	5125400	Furthermore, when we're editing articles, which are also like, as I said, over 100, we also use some other aspects of privacy by design like in Huffman strategies and tactics.
5127050	5129400	So next slide.
5131500	5148560	Before starting this research or wiki, the issue was whether the United States privacy related laws generally protect or preserve citizens or individuals from privacy violations or harms on our solo taxonomy.
5148560	5163520	We had at this table at the beginning, which you can see, we had only had some federal laws, and we did not even establish the harms of appropriation, decisional interference, interrogation or even item scattering.
5163520	5181900	So you may see it in the right upper corner, appropriation. So we're not seeing any harms under all the federal laws in this listed table.
5181900	5199900	However, we just involved it and mapped the 40 over 100 or over 400 state over 400 United States laws. So we just dive in and found a lot of protection privacy harms under those laws.
5199900	5213860	However, we always say that the United States privacy related laws do not protect all citizens from the privacy violations or harms on the solo taxonomy. So next slide.
5216580	5227610	In taxonomy page of the wiki, we are stating as this, the United States law has been failed by not addressing privacy harms and violations.
5227610	5241750	However, under the fourth amendment, over 300 state privacy laws, specific privacy related federal laws and precedents identify and protect some privacy violations and harms that has been addressed by sole law.
5241750	5256270	Moreover, although some state laws do not cover all the privacy violations, the other state all industry violations such as California, he argues that privacy and society are indivisible integrity.
5256270	5266190	Therefore, it is categorized to identify and understand socially recognized privacy violations with basic groups of harmful activities.
5266550	5281070	It mainly covers what we did. If you scroll down the page in the wiki, you can see all the column links that indicates all 16 privacy harms and laws that are related with the harms.
5281070	5294090	If you would like to discover it or are interested in taking a look at it, you can see the harms of blackmail, appropriation, distortion and intrusion have less protected than the harms in the United States.
5294090	5298510	If Steve may click it, you can see all the laws.
5301630	5309310	Yeah, here are the interrogation, aggregation, security identification, secondary use.
5315580	5331760	See, there are more laws than the beginning of this research. So if you're interested in how to look at it, that will be great for covering all the presentations and slides.
5331760	5361940	So next slide. It takes time. Can you click the next slide? Okay.
5362460	5380620	Okay. We have in this wiki, we have sample forms for federal laws. And this list includes short title for understanding which law refers it.
5380620	5394520	In this example, in the sample forms, we stated FERPA, DPPA and HIPAA, which are literally more broad and most popular privacy-related federal laws.
5394520	5411180	And we just added the official text in this form in order to provide an official text and in order to provide a current text via link.
5411180	5427980	And we included the country because we're going to involve in the EU laws as well in the future. Therefore, we included the country and we just cannot understand which, I mean, where the law is enacted, was enacted.
5427980	5437420	And we added the state or province for the state laws. Therefore, it's in here. But we may change it for federal laws in the future.
5437420	5453520	We stated regulatory bodies in this form. However, because they're sample forms, they're just wrong. Regulatory bodies shouldn't be stated as United States Congress.
5453520	5469100	We added the dates enacted, time for showing the time and scope of the law in the list and personal information. And we stated the taxonomy.
5469100	5487360	And we're going to add the strategies and tactics under the Hoopman strategy in the future. But we generally mapped over 400 United States privacy-related laws with the taxonomy. So you may see these forms in the wiki.
5487360	5507940	So next slide. State laws also include the same form. So it still includes a short title, official tax, country, jurisdiction, state or province, regulatory bodies, date enacted, scope of the law, personal information, taxonomy, strategies and tactics.
5507940	5521140	So we show the Illinois BIPA in here and California's CCPA. We also add those laws in this wiki. So next slide.
5523840	5544880	Maybe everyone's just like concerning, okay, you just mapped those laws on soil taxonomy. And you're stating those things in your form. However, like, how can we see those taxonomy forms in a specific law?
5544880	5565140	So here's an Illinois BIPA example. In the right side, we're just seeing the form. In the left side, on the whole page, we are seeing the whole laws and provisions and sections in this site.
5565140	5593540	And if you would like to see a taxonomy harm that is protected under the law, you can see after the provision or after the section, a little font, the name of the privacy harm that is stated on a soil taxonomy.
5593540	5616900	And if you're interested in learning those privacy harms, and if you would like to see the related laws that protect surveillance or any other harm on a soil taxonomy, you can access with those little links.
5617900	5619240	So next slide.
5619240	5627020	Hold on, just to clarify. And sorry, if you covered this, I distracted momentarily.
5627020	5628080	Yeah, of course.
5628080	5652740	So it's hard to see in this slide, because I know it's kind of small, but in the kind of insert that's popped up, the actual law is written, but there is a text that says surveillance, and it pinpoints the part of the law that covers surveillance.
5652740	5662200	For instance, in BIPA, it says no private party may collect, and then it's about a person's biometric identifier.
5662200	5665960	So remember that collection, surveillance was part of collection.
5665960	5669620	So that is recording, watching, listening to, monitoring.
5670240	5678300	So that collection process is what BIPA is trying to stop or one of the things that BIPA is trying to stop.
5678300	5683560	And so that's why it's related to the SOLA surveillance harm.
5683600	5685120	So that's why we tag it.
5685120	5692640	So it's tagged specifically in the law, exactly where in the text of the law it aims to prevent surveillance.
5692980	5694280	Thanks for adding.
5695840	5696560	Okay.
5702860	5707700	Would you like to talk about a simple form for articles and privacy news?
5707700	5708240	Oh, sure.
5708240	5718440	So in addition to over 300 laws in the wiki right now, there's at least 100, maybe over 200 articles.
5718480	5724820	And by the way, Steve, I just looked to see if there was anything about Hobby Lobby in there yet.
5724820	5737420	The only thing related to Hobby Lobby was something about some guy following women around with a camera and happened to be following people in a Hobby Lobby, but not the particular...
5737420	5743680	I know the incident you're talking about. Unfortunately, we don't have that article in yet, but we can hopefully issue it.
5744260	5745240	By the way, somebody...
5745240	5747240	I expect that from Hobby Lobby. Sorry.
5747340	5747920	Pardon?
5751560	5752360	Again?
5754020	5758480	Oh, no, sorry. I was saying I'd expect that from somebody at Hobby Lobby with a camera being followed.
5759680	5762860	So somebody was... Oh, okay. So we've got it.
5762860	5769420	Okay. Anyway, so like I was saying, there's a couple hundred articles, certainly room for more.
5770320	5776500	You know, we have one person right now that is putting in articles, Maria, who is not on the call.
5777200	5782140	But, you know, I mean, there's certainly opportunity for hundreds of more articles.
5782140	5792800	What I love about this is it provides an opportunity to people see examples and kind of categorize and it's like, oh, yeah, this is an example of surveillance.
5792800	5795500	This is an example of interrogation.
5795520	5804200	And it really kind of makes these concepts much more concrete by having very real life examples of this.
5805540	5808720	So within this, you know, we have a short title.
5808720	5810820	We have, you know, where did this happen?
5810820	5818020	The location, the date that it happened, you know, if it's a specific date or maybe just a year.
5818340	5822760	And what privacy harms under the taxonomy were relevant?
5823040	5828360	What information, types of information were appropriated?
5828360	5834000	So this one, which was about the Twitter account hack, you know, we talk about insecurity.
5834000	5836200	So Twitter was being insecure.
5836640	5843480	Appropriation, the hacker used the names and likeness of those people's accounts.
5843480	5847000	He appropriated those accounts for his own purpose.
5847320	5854300	Interrogation, I forget what the interrogation was, but maybe they were asking some type of questions of people.
5854300	5860520	So the information here was authentication information, was at play.
5860520	5862380	Identifying information.
5862380	5864620	Social network, again, Twitter.
5865000	5870960	And communication information that was being communicated from one party to another.
5870960	5872680	Go ahead and click.
5874980	5878740	And so that's kind of like the high profile panel.
5878740	5890620	But then, of course, we have a much more detailed description and discussion of what actually happened and why these particular privacy harms were at play.
5890740	5896980	And all of our articles, we don't write articles, you know, nothing is new to us.
5896980	5903540	These are related to articles, you know, that pop up in major news sources.
5903540	5914540	So, you know, once in a while we get something that maybe, I've seen a couple of incidences on Twitter that, you know, people, you know, more personal incidents.
5914540	5915860	Oh, this happened to me.
5916000	5923040	There was one I wanted to put in, but didn't get permission of the, again, we asked for permission if it's something like that.
5923040	5933060	I didn't get permission of the account poster, but they were, you know, they had ordered a pizza and then the pizza delivery guy had solicited a date with her afterwards.
5933060	5936500	Using her phone number to contact her later that evening.
5936500	5940340	Hey, I delivered your pizza. Are you available to date?
5940340	5948620	So, but generally we try to put in major news stories, which there are certainly no shortage of.
5948620	5956220	And, you know, another issue, one of the reasons I wanted to work on this is because I was always having trouble doing Google searches.
5956220	5960780	I was like, oh, wasn't there some issue about Hobby Lobby, for instance?
5960780	5967820	And I would put in Hobby Lobby privacy into, you know, Google or another search engine and what would come up?
5967820	5973580	Well, Hobby Lobby's privacy policy or a news story about Hobby Lobby.
5973580	5979660	But then, you know, the only thing privacy was that, you know, CNN's privacy link.
5979660	5981980	It wasn't about Hobby Lobby and privacy.
5981980	5991180	So I wanted a centralized place that I could research articles and stories about privacy related to all these issues.
5991960	5993400	Click next.
5994760	5999040	I can't remember, is that, or is that our last, that's not our last slide, is it?
5999600	6000580	It was.
6000580	6002820	Okay, so discussion.
6002880	6009600	Now that we've used up almost our entire two hours, and I don't know how we did that, except lots of talking.
6009600	6016100	And I appreciate everyone for sticking around so long and not running away.
6017240	6023840	But certainly if there's, you know, any questions, comments, thoughts about this.
6024840	6027840	Walt wants the new law from Brazil.
6027880	6028920	That would be great.
6028920	6031540	So what we are doing...
6031540	6036740	Oh, yeah, AJ says it includes the Turkish data protection law.
6037720	6041780	Because AJ is in Turkey and knows a lot about that, knows a lot about that.
6041780	6045420	So we are adding international laws.
6045420	6049840	We have somebody in the UK who is adding UK laws.
6049900	6050420	Australia.
6051200	6052520	What now, Australia?
6052520	6053460	Oh, we do?
6053460	6054460	Okay, good.
6055100	6063580	And, you know, so we're kind of reliant on volunteers for all the international ones.
6064420	6066620	You know, just because it's so overwhelming.
6066620	6070100	I mean, we had enough work putting in the U.S. state laws.
6070100	6073520	And we're actually looking for volunteers to keep the states updated.
6073520	6076820	I think we have slightly less than 10 volunteers.
6076820	6079520	And we asked for a volunteer per state.
6079520	6085540	Just as new states, like I'm in Florida, and we just enacted a new law recently.
6086500	6090840	And, you know, so all laws get updated or changed.
6090980	6095320	So having to keep track of that is a monumental undertaking.
6095680	6102580	Not to mention adding all the stories that are coming at a breakneck pace every day.
6102580	6106700	And even trying to catch up with privacy-related stories.
6106900	6108280	But, yeah.
6113060	6115700	Yeah, feel free to ask questions.
6117140	6124460	And we will certainly stick around until the top of the hour and the next speaker.
6125020	6128160	Yeah. And, of course, we're going to share the slides.
6129460	6133260	Yeah, and Steve, do you want us to send that to you?
6133600	6137020	Or you already have it, I guess, so we don't need to send it to you.
6137020	6138140	You have it.
6138420	6139360	Yeah, definitely.
6140080	6143340	I'm more than happy to share them a little bit later on.
6143340	6149620	So I'll make sure to post those somewhere and see if you all can flip them a little bit, moving down the line.
6149820	6154980	I want to thank Jason and AJ again for doing this really awesome talk.
6155560	6157240	This is something that we really need.
6157240	6161140	We need to really define a lot of these different privacy laws moving forward.
6161140	6167160	Because, I mean, honestly, it's going to be the future with all these services, especially.
6167160	6172920	So everybody, I guess, do a round of applause, I guess, wherever you're at, for our speakers.
6172920	6176920	And it looks like they'll be sticking around if anybody has any questions.
6177280	6181600	They have the voice channel for another at least 20 minutes.
6181600	6184620	So thank you again, y'all, and yeah.
6187530	6192190	I'm looking for... so I'm new to Discord. How do I do an applause?
6192190	6201210	Is there a... I'm looking for... I guess, maybe, is there a GIF I can do with applause?
6204130	6205490	I think you'll...
6206490	6208150	Yeah, there we go.
6210910	6214950	And that's applause for the people who stuck around to listen.
6260450	6263930	AJ, what is it, about 2 o'clock in the morning there?
6273400	6277800	She must have dropped off because it is about 2 o'clock in the morning there.
6277800	6280920	She must have fallen asleep. It's pretty late.
6282740	6286540	Hopefully, she was able to stay up. And luckily, it was on a Friday night.
6286540	6289840	So hopefully, she's got nothing going on tomorrow.
6300610	6306490	I guess we didn't get any trolls or anybody trying to hack the channel, huh?
6306490	6313130	I was a little bit happy for that, because we had, I think, yesterday, and even on Thursday,
6313130	6318250	we had Discord completely crash, slash, shut down, slash, I don't know what happened.
6318330	6322890	So I'm really glad that it didn't go down, because, yeah, that was interesting.
6322890	6327430	We were doing some live training, and everything just pretty much died.
6327430	6331330	And in the true fashion of DEF CON, if we haven't crashed Discord, it's not really a DEF CON.
6331330	6335050	Or done anything unintentionally malicious.
6335050	6342670	So you've done Ethics Village. I've never been to actual DEF CON.
6342670	6345970	I go to a lot of conferences, but that's not one I've touched upon.
6345970	6356590	Although I do have a DEF CON deck of playing cards from 2015 that I won in a poker game.
6357030	6360030	So that's about as close as I've gotten.
6360030	6363710	It's actually pretty cool. I meant to bring them out, because they're...
6363710	6366810	Although my screen shut down.
6367770	6372070	The jokers are hackers, and it's got a pretty good...
6372070	6374810	The graphic design is pretty interesting.
6375290	6380190	So you've done Ethics Village before, at the actual event?
6380370	6383610	Yeah, definitely. So this is, I think, I believe...
6383610	6387730	And if the Fixer, or at Irish Bug, or anyone who's listening,
6387730	6391850	and I believe this is the third year we're doing it,
6391850	6393610	or maybe possibly the fourth year.
6393610	6400590	So essentially, Ethics Village originally started, believe it or not, as a university project.
6401010	6406530	Irish Bug and Dr. Wardog were both... third year, there you go, third year.
6406530	6410170	They're both faculty slash staff at the University of Illinois.
6410710	6414230	Also the same university where AJ was mentioning.
6414750	6419730	And they essentially created a... there's a privacy and ethics class,
6419730	6422490	and Ethics Village was born out of that.
6422570	6426690	So what ended up happening was one day, the class assignment was,
6426690	6430770	hey, let's do a DEF CON Ethics Village,
6430770	6434490	and Irish Bug can attest a little more to that.
6434490	6439670	He's actually the... him and Dr. Wardog are the original creators.
6439670	6445510	So I just kind of tagged along since I've worked with them on some security stuff as well.
6445510	6448110	So yeah, we're in our third year.
6448110	6451530	And unfortunately, you know, this is a... we can't do it live.
6451530	6454850	We usually have fun, and we even have cool t-shirts.
6455110	6457050	You'll see my shirt.
6457530	6462690	So hopefully next year we all get to see folks again, you know, personally,
6462690	6467790	because it tends to be pretty fun, just in general, and seeing people's faces.
6468630	6471190	Yeah, I'll definitely have to check it out,
6472810	6477910	because I do go to a lot of conferences normally, in a normal world.
6477910	6480870	In fact, so the last two years...