Privacy in the Age of Big Data: The Challenges and Opportunities for Privacy Research

Transcription

1 Privacy in the Age of Big Data: The Challenges and Opportunities for Privacy Research Brian Mennecke Iowa State University Ames, IA USA Panel Heng Xu The Pennsylvania State University University Park, PA USA Chuan-Hoo Tan City University of Hong Kong New Kowloon, Hong Kong SAR CN H. Jeff Smith Miami University Oxford, OH USA Malcolm Crompton Integrity Solutions Pty Ltd Chippendale, New South Wales AU Marie Shroff New Zealand Press Council and the New Zealand Consumer Board Auckland NZ Joey F. George Iowa State University Ames, IA USA Abstract Recent revelations about corporate use of customer data, government collection of personal data, and security lapses resulting in the release of private information call to light the increasing threats to privacy made possible by information systems (IS). Questions such as identity management, data ownership, secondary use, information disposal, etc. come into play when we consider the ramifications of how IS impinge on individual privacy. Recent trends in IS research and pedagogy relate to big data and business analytics and as we see these technologies continue to grow in importance, so too will the issues they raise related to privacy. It is important and timely for the IS community to address privacy as we consider how to build information systems that collect personal data. In this panel, we will focus on research issues and trends related to privacy, particularly as it relates to designing, building, and teaching about IS. Keywords: privacy, software design, regulation, information value and use Introduction Privacy appears to be rapidly becoming one of the major issues of the information age. Organizations and government are increasingly acquiring and storing vast quantities of information on individuals. Our Thirty Fifth International Conference on Information Systems, Auckland

2 Privacy in the Age of Big Data mobile devices such as smart phones and tablet computers, eventually, the internet of things (e.g., smart meters, smart refrigerators, smart cars and etc.) record the minutiae of our daily activities and interactions. In addition, advancement in big data analytics enables companies to examine these vast amounts of data to uncover hidden patterns and unknown correlations. While this promises many positive consequences, social theorists and researchers are also discussing the 'end of privacy.' For years, businesses in many industries have sought to collect data about existing and potential customers and the resultant demand for these data has fostered the growth of various industries specializing in customer profiling, segmentation, and monitoring. While many users of the web have become accustomed to seeing recently queried products showing up in banner ads on subsequently visited websites, the fact is that the detailed tracking of customers has and will continue to be part of the experience individuals face not only online but also in retail and public spaces they visit. In many cases, individuals choose to be tracked by opting into location-based social media, rewards programs, or other service that pays them for their data in the form of rewards or services. In other cases, however, venders are not giving their customers the option to opt in or out because they are passively tracking them through cell phone signals, facial recognition, or other personally-identifiable information. The primary reason for this is to provide tailored and relevant services to individuals based on the collected data. In these and other situations, the challenge faced by individuals who are the focus of tracking and, for that matter, by managers seeking to use the data generated from tracking, is how are these data used for primary and, increasingly, secondary purposes. Questions such as identity management, data ownership, secondary use, information disposal, etc. come into play when we consider the ramifications of how modern technologies impinge on individual privacy. Yet, while customers are the targets and business are the users, the information systems (IS) community is also a stakeholder in that we as a community will be instrumental in advising business on how best to build, manage, and use systems that are instrumental in the collection, management, use, and dissemination of individual and customer data. The fact is that during much of the history of the IS field, an important focus has been on how to best leverage information technologies and databases for the benefits of individuals and organizations. Of course, a recent trend in IS relates to big data and business analytics, and as we see these technologies continue to grow in importance, so too will the issues they raise related to privacy. Do we need to track individuals to provide tailored services? How much data is needed to be collected to provide tailored services? Can we achieve a balance between the need for privacy and the desire for personalized services or content? It is important and timely for the IS community to address privacy as we consider how to build these and other types of systems that are collecting very personalized data about individuals. These and several other related questions will be raised and discussed in this panel. Specifically, we will focus not only on general, yet pertinent, research issues and trends related to privacy, but also on the issue of engineering privacy into systems, providing guidelines for policy and use, and pedagogical considerations for the new business intelligence and analytics curricula that are becoming a common feature of IS programs. Key Issues The topic of privacy in the age of the Big Data brings with it a number of challenges for the IS community. As a community, we will continue to see a number of competing forces that will pull stakeholders in divergent directions. On the one hand, the forces motivating organizations to develop systems that collect, manage, and disseminate personally identifiable information (PII) are continuously increasing. For example, retail firms are challenged by competition from online venders that, given the digitized nature of online shopping, can easily collect not only PII, but also data about behavioral patterns and tendencies. Retailers have up until recently lacked the ability to collect detailed information about their customers, but technologies like mobile phone tracking and facial recognition are changing the playing field by enabling retailers to track customers within and between stores as well as other venues. Of course, there is another side to the issue that will affect stakeholders. Specifically, there is a growing awareness in the mind of the public about surveillance and privacy invasions. The Snowden case has brought with them an increasing awareness about issues of privacy invasion and surveillance in the minds of individuals in the public at large as well as by regulators and policymakers. The challenge this brings for businesses, for example, is that as information about the degree to which firms are monitoring their 2 Thirty Fifth International Conference on Information Systems, Auckland 2014

3 Short Title up to 8 words customers becomes known, push back will increase and, as a result, diminish a firm s goodwill or lead to unwanted regulation. A middle ground may be to build privacy safeguards into the business processes and information systems as a default, rather than as an afterthought. By building systems that not only respect and protect customer privacy but also proactively address the problems that arise when privacy is violated, a firm can potentially increase customer trust and goodwill. An important question is whether and how this default integration can be accomplished. Importantly, this also raises the question of what motivations there are to engage in building or using privacy-protecting systems; that is, should such systems be mandated by governments or adhered to volitionally by private sector organizations? Thus, an important focus of our discussion will be on these two opposing motivational forces. We will also discuss the practical issues faced in making privacy a part of systems design and development. Each of the panelists represent experts on various issues related to privacy, surveillance, regulatory systems, and organizational uses of privacy-invading technologies. For each, an important point of the discussion will not be whether privacy can or should be maintained, but rather how the IS community can become involved to facilitate privacy protection? Panelists Positions 1. Marie Shroff: Ms. Shroff takes the position that we should constantly reassess the information environment and the power of its players and strongly assert human values, expectations and controls over the use of personal data about individuals. As a result, her position will be that scholars can contribute to a good information environment by developing and using tools such as Privacy by Design and building privacy principles into the information architecture rather than being forced to bolt it on when things go awry. 2. Malcolm Crompton: What, when and how should the organization tell users and other stakeholders about the collection and uses of personal information? Furthermore, when is enough, enough; that is, just because a firm can, should it collect data and use it? These and similar questions present many challenges for business leaders and software developers and beg the question of where the controls should come from the government through laws or the individual firm through responsible use? Crompton will raise questions and offer answers based on applying all five Layers of Defense: Business as Usual, the Law, Technology, Governance and the Safety Net when failures occur, starting by recognizing the real value of personal information 3. Heng Xu: System improvements are incremental, and seldom revolutionary. As a result, the integration of privacy enhancing features into existing systems often took place using an ad hoc approach. Thus a careful design of appropriate privacy features from the outset was not always prioritized in the design process. Dr. Xu will take the position that Privacy by ReDesign might be a more feasible approach for building systems that support privacy in an age of Big Data. 4. Chuan-Hoo Tan: Dr. Tan will argue that upholding privacy of individuals and providing customized services by venders based on data are not paradoxically opposing. In fact, through appropriate design, a balance could be achieved with a clear definition of information boundary. 5. H. Jeff Smith: Traditionally, organizations have made privacy-related decisions by unconsciously embracing a model of drift-external threat-reaction. Until they perceive an external threat (often legislative, but possibly competitive), their privacy policies and practices have drifted, usually driven solely by pursuit of organizational goals (usually, profits, although perhaps some other goal in nonprofit organizations). With the emergence of trends related to social media sharing, analytics, and governmental scrutiny, the external threats are changing in degree and, in some cases, in kind. Dr. Smith will comment on how these changes in the threat-space will likely change the organizational model of privacy management. 6. Brian Mennecke: Many systems that consumers demand and rely on for provisioning services require increasingly large and intrusive forms of data; yet, consumers continue to seek out these services in spite of increasing awareness of and concerns about privacy violations. The privacy paradox remains and Dr. Mennecke will offer insights on where these perceptions arise and how they influence the need for privacy protection. In this light, he will discuss the role of perceptions of information ownership and its impact on privacy protection. Thirty Fifth International Conference on Information Systems, Auckland

4 Privacy in the Age of Big Data 7. Joey George (moderator): Dr. George will moderate the discussion and take a neutral position on these issues. Panel Structure Segment 1 Segment 2 Segment 3 Segment 4 Issues and Definitions: We will begin the panel with a discussion of the general question, what is personal privacy in the digital age? Each panelist will discuss their individual views of privacy as well as the issues impinging on personal privacy violations. The Imperative to Intrude: The second set of issues the panel will discuss are related to trends that are leading to the diminution of personal privacy. Each panelist will discuss technologies, business processes, and competitive pressures that are impinging on privacy. In other words, this segment will address the question of why we see privacy at risk in today s competitive environment. Solutions and Constraints: In this segment, the panelists will discuss potential solutions that can be applied to protect privacy. An important point of this segment will be to critically discuss where and how privacy safeguards and policies can be developed, enacted, and managed. In this discussion the panelists will highlight where and how scholars can contribute to fostering privacy through development guidelines, pedagogy, and research? Audience Questions: The audience will be encouraged to engage the panel with questions and comments. Panelist Biographies Marie Shroff was New Zealand's Privacy Commissioner from late 2003 to early Over that time she had to respond to many controversial issues including high profile complaints, breaches by government departments and emerging information technologies that challenged the boundaries of privacy protection. She worked with the Law Commission on its recommendations to increase privacy safeguards for New Zealanders in the information technology environment. Since stepping down, she has continued to deal with consumer and privacy protection issues through becoming a member of the Board of Consumer New Zealand and of the NZ Press Council. Before becoming Privacy Commissioner, Marie headed the New Zealand Cabinet Office for 16 years. Ms. Shroff will bring several insights to the discussion but will have as a primary focus the question of whether government regulation versus self-regulation can foster privacy safeguards. Malcolm Crompton is Managing Director of Information Integrity Solutions Pty Ltd (IIS), a global consultancy specializing in data protection and privacy strategies. IIS works with companies to increase business value and customer trust and to ensure government meets the high standards expected in the handling of personal information. He was Australia s Privacy Commissioner from 1999 to 2004 and led the implementation of private sector privacy law. Malcolm was founding President of iappanz and has been a director of IAPP. Brian Mennecke studies biometric technologies such as facial recognition and its impact on privacy and perceptions of surveillance. He has written about biometric technologies and their role in privacy invasion as well as the role of regulation versus preemptive industry action. His research interests focus on privacy and security, the adoption of information systems in organizations and by individuals, computer-mediated communication and virtual worlds, and spatial and location based systems. He will discuss the role of information ownership and its impact on privacy protection. Heng Xu is an associate professor of Information Sciences and Technology at the Pennsylvania State University and she also leads the Privacy Assurance Lab, an interdisciplinary research group working on a diverse set of projects related to understanding and assuring information privacy at Penn State. Her research projects have been dealing with individuals' privacy concerns and behaviors, strategic management of organizational privacy practices, and design of privacy-enhancing technologies. Dr. Xu will discuss the role of Privacy by ReDesign in the age of Big Data. 4 Thirty Fifth International Conference on Information Systems, Auckland 2014

5 Short Title up to 8 words Chuan-Hoo Tan is an Associate Professor of Information Systems at City University of Hong Kong. His current research interests include the design and evaluation of consumer-based IT interfaces, electronic commerce, mobile commerce as well as technology adoption and usage in organization. Dr. Tan will discuss the seemingly paradox of information privacy and tailored service provision (i.e., privacypersonalization paradox) and present some thoughts on how the paradox could be addressed. H. Jeff Smith is the George and Mildred Panuska Professor in Business in the Farmer School of Business at Miami University in Oxford, Ohio. His research focuses on ethical, societal, and regulatory issues associated with strategic uses of information technology. He will discuss the traditional organizational pattern of responses to privacy challenges (drift-external threat-reaction) and how it may be changing due to emerging trends related to social media sharing, analytics, and governmental scrutiny. Joey F. George is Professor of Information Systems and the John D. DeVries Endowed Chair in Business in the College of Business at Iowa State University. His research interests focus on the use of information systems in the workplace, including deceptive computer-mediated communication, computer-based monitoring, and group support systems. He is a past president of the Association for Information Systems (AIS), and in 2008, he was selected as a Fellow of AIS. Acknowledgements The panelists would like to express their gratitude to Fiona Fui-Hoon Nah (Missouri University of Science and Technology) and Shu Schiller (Wright State University) for their assistance in developing and organizing this panel. Heng Xu is supported by the U.S. National Science Foundation. Any opinion, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the U.S. National Science Foundation. Thirty Fifth International Conference on Information Systems, Auckland