Prof Hal Abelson of MIT recently shared his thoughts on privacy in the digital realm, at a online alumni webcast. Amongst the noise that one hears on this topic these days, his thoughtful comments resonated. Partly for sharing and partly for my own memory, I felt it justified a blog post and I capture his main points below:
- People don’t really know what they want when they think of privacy. They describe their privacy needs through use-case scenarios for e.g. “I want my friends to know this, but not that”, ” I want amazon to be able to suggest books to buy, but I don’t like that it knows so much about my past history”. Obviously these are not the most precise way to define an individual’s privacy needs, but this is how most of us think.
- There is a lot of confusion between privacy and security.
- Notice and consent does not work. It’s “stupid” (Yes he called it stupid to my delight) to ask the consumer “We are going to record the following information for x and y purpose. Is that ok?” since it puts the onus on the individual who doesn’t have the ability to evaluate what harm could come from this recording.
- On the other side of the equation, people need to realize that personal information is often not really personal. What you say about yourself can also reveal something about your friends. Case in point, he referred to a study where it was possible to predict the sexual orientation of a person by analyzing the gender and sexuality of their friends on a social networking site.
- In designing systems, the principle of least-revealing means should be followed. This is where you only collect enough information for what you want to do and nothing more. There are few incentives right now to follow this. Companies would be tempted to collect as much information as possible (on the chance that it may be of use down the line) and there are few if any barriers for them to do so. Consumers who often don’t know what they want, would probably agree to giving the extra information without question. Consumers start to question ONLY when a problem occurs.
The above a just a few of the nuggets. I suggest a viewing of the full talk which is available HERE.
Comments are closed.