Are new technologies sacrificing privacy?

Are companies being fair with what they do with the data they collect. If they aren’t, then we need some rules in place.

Patrick Thibodeau

Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC), gives his take on how young people view privacy and discusses the privacy ramifications of shopping courtesy cards, radio frequency identification (RFID) tags and bar-coded driver’s licenses.

Some privacy advocates argue that the younger generation of Internet users — the Facebook and MySpace users — are less guarded about data privacy. Is this younger generation in the vanguard of a new way of thinking about privacy, or are they just naïve?

Younger people today have a different way of thinking about privacy. I think it’s a mistake to believe that they value privacy less [than other users do]. And in many respects, that’s actually the experience we’ve often had in this country: notions of privacy evolve based on what technology makes possible. But I think the mistake that people sometimes make is to believe that because kids have a different expectation of privacy, somehow it’s a diminished expectation.

Do you think, though, that young users are sharing more information about themselves in public environments than they should be?

I think the interesting issue, and where the privacy debate begins, is when the information that they make available to their friends — for example, on a social network site — is gathered surreptitiously and used for marketing purposes. And there, I think there really is a [valid] debate about whether people, and kids in particular, understand what’s going on and if it’s really fair.

The courtesy cards that retailers issue to customers to qualify for discounts can be used to record everything that someone like me buys. How can that information be used? And as a consumer, should I worry about it?

I generally think that being worried is a helpful way to talk about privacy. In terms of how businesses collect and use personal information, the right approach is really to ask the question, “Are companies being fair with what they do with the data they collect?” If they aren’t, then we need some rules in place.

Do you think that retailers are being fair about how they use the purchasing information they collect?

I think it’s a very serious issue. One of the big paradoxes about privacy is that the companies that collect and use so much information about consumers tend to be very secretive about their own practices, and as a result, it’s just very difficult for people to really know what’s happening to the data that is provided to [the companies]. So typically, when we talk about privacy laws, one of the main things we’re arguing for is simply making companies more accountable in the collection and use of data that they collect.

At an IBM conference that I was at recently, the ID badges for attendees included RFID tags that automatically tracked what sessions people attended. IBM’s conference organizers had a reasonable explanation: instead of scanning people’s badges as they went into sessions, they just RFID’ed them. But where can this all go if things like driver’s licenses or library cards get RFID tags?

Your story is very interesting, and in fact, [IBM's] analogy is imperfect. When you scan a card, there’s a moment when the card is removed, it’s turned over to a reader and the person is aware of the fact that the card is being read. The problem, of course, with an RFID tag is that it can be read at any time by anyone who is in possession of a reader — whether or not the person knows that their card is being scanned. And this is precisely the debate we are having right now with the Department of Homeland Security over many of the identity schemes.

How do you think the DHS is going to use RFID tags?

We know that they are adopting a standard that a lot of people, not only in the privacy community but also in the security community, are not very happy about. It’s the so-called vicinity read or contactless read RFID tag. It’s designed precisely to prevent the ability of people to know when the data on the tag is being read. That violates a central principal of [personal] security, and that is basic access control — you want people to know when information about them is being requested by others, if for no other reason than to be able to make sure that it’s being requested for an appropriate purpose and not a purpose that might create a problem.

RSS TrackBack URL

Translate: