Welcome to Future of Privacy Forum!

 

The Future of Privacy Forum (FPF) is a nonprofit organization that serves as a catalyst for privacy leadership and scholarship, advancing principled data practices in support of emerging technologies. FPF brings together industry, academics, consumer advocates, and other thought leaders to explore the challenges posed by technological innovation and develop privacy protections, ethical norms and workable business practices.

 

FPF Welcomes New Senior Fellow

FPF is pleased to welcome Henry Claypool as a senior fellow. Henry is currently Policy Director at the Community Living Policy Center at the University of California, San Francisco. He is the former Director of the U.S. Department of Health and Human Services Office on Disability and a founding Principal Deputy Administrator of the Administration for Community Living.  He also served as a presidentially-appointed member of the Federal Commission on Long-Term Care, advising Congress on how long-term care can be better provided and financed for the nation’s older adults and people with disabilities, now and in the future, and was Executive Vice President of the American Association of People with Disabilities, which promotes equal opportunity, economic power, independent living and political participation for people with disabilities.  He is Affiliated Faculty at the Institute for Health & Aging at UCSF and principal of Claypool Consulting.

At FPF, Henry will lead our outreach and research efforts to promote understanding of the range of ways Internet of Things (IoT) technologies are being used to empower those with disabilities and bring disability advocates into privacy-data-technology policy debates. He will be responsible for convening a series of meetings to advance understanding of core privacy issues related to IoT, to address issues, concerns, and goals of the disability community, and to ensure input of disability groups into IoT policy development.

Please join us in welcoming Henry to the team!

House Passes Email Privacy Act (H.R. 387)

Yesterday, the U.S. House of Representatives passed the Email Privacy Act (H.R. 387). The bill updates the Electronic Communications Privacy Act (ECPA), the law that sets standards for government access to private internet communications. Although ECPA was forward-thinking for its time, the developments of technology and communications in the 30 years since its passage have greatly surpassed its scope and the effectiveness of its policy direction.

The Email Privacy Act recognizes the central role of email messages in modern society, and ensures that individuals and organizations can maintain their communications in reasonable confidence – requiring law enforcement to obtain a warrant based on probable cause for access,” said Brenda Leong, FPF’s Senior Counsel and Director of Strategy.

FPF has joined numerous other privacy and advocacy organizations to urge immediate passage of the bill. We will continue to keep you updated with developments as the bill moves through the Senate. 

FPF in Brussels: The Law and Science of De-Identification

Last week, FPF brought together a panel of technology, legal, regulatory, and business voices to discuss “The Law and Science of De-Identification” at the 10th annual Computers, Privacy, and Data Protection conference.

De-identification—the process of modifying personal data to ensure that data subjects are no longer identifiable—is one of the primary measures that organizations take to protect privacy. Over the past few years however, computer scientists and mathematicians have demonstrated that de-identification is not foolproof. At the same time, by necessity, organizations around the world continue to rely on a wide range of technical, administrative and legal measures to reduce data identifiability. The EU General Data Protection Regulation recognizes the concept of pseudonymization, albeit with limited legal implications compared to its stricter relative, anonymization.

This panel of interdisciplinary experts discussed the technology, law, policy, and implementation of de-identification techniques in Europe. Claudia Diaz, Professor at KU Leuven, chaired the session and introduced the complicated landscape in which de-identification is studied, implemented, and debated. Kelsey Finch, Policy Counsel for the Future of Privacy Forum, moderated the session, and tied the discussion at CPDP to its origins in the November 2016 Brussels Privacy Symposium workshop on Identifiability: Policy and Practical Solutions for Anonymization and Pseudonymization.

The papers on which Claude Castelluccia and Sophie Stalla-Bourdillon, and Alessandro Spina based their comments were also selected finalists at the Brussels Privacy Symposium, available here and here.

In a robust question and answer session with the audience and their fellow panelists, the speakers touched on questions, including: how to incentivize robust de-identification within organizations and across sectors; the implications of open data or release-and-forget styles of de-identification; transparency about de-identification commitments and techniques for consumers; and what contextual factors matter most in risk-based de-identification approaches.

Video of the session is available below.

If you would like to participate in this and future discussions regarding EU privacy issues, make sure you Save the Date! The next Brussels Privacy Symposium is November 6, 2017.

The Top 10: Student Privacy News (Dec 2016-Jan 2017)

The Future of Privacy Forum tracks student privacy news very closely, and shares relevant news stories with our newsletter subscribers.* Today, we are launching “The Top 10,” a monthly blog with our top student privacy stories from the past month (or month-and-a-half, in today’s case).

  1. Today, the Data & Society Research Institute released their great new report exploring “The Legacy of inBloom.” Simultaneously released were a few blogs from stakeholders responding to the report, including a response from FPF.
  2. The California Student Privacy Alliance (a branch of the Student Data Privacy Consortium, made up of districts from 13 states who create a model contract for vendors) has released their CA model contract.
  3. The Mississippi Attorney General filed a complaint against Google, alleging that Google was violating the Student Privacy Pledge. Co-creators of the Pledge SIIA and FPF disagreed. There were also some great responses and thoughts about the allegations from Bill Fitzgerald and Jim Siegl.
  4. A school district has been found in violation of FERPA due to a little-known clause in the federal law which requires that family law courts suspend FERPA rights proactively (as opposed to their automatic suspension when custody rights are suspended).
  5. There is a great deal of concern about student data potentially being used to identify and deport undocumented students (read the fantastic EdWeek article). Nominated USED Secretary DeVos was asked whether she would allow federal authorities to arrest those students at school, and she deferred the question to DOJ.
  6. Today, Common Sense Media released the script from their encryption test of ed tech products late last year (see that study here) so others can run this test themselves on any ed tech product.
  7. FPF filed comments with the Commission on Evidence-Based Policymaking on privacy in the context of a federal student-level data system.
  8. There has been a great deal of contradictory information on DREAMers and DACA over the past month and a half: the former Homeland Security Secretary said that federal authorities should not use DACA data to deport students; immigration handliners are upset that the President may not end DACA; Vox obtained an alleged draft order that ends DACA; and Congress has introduced a bill that requires that DACA data cannot be used for the purpose of immigration enforcement proceedings. While many colleges have said they will not turn over data about immigrant student to the federal government following the President’s immigration Executive Order, the Chronicle for Higher Education reported that these pledges “don’t mean much.”
  9. PTAC issued guidance on “Integrated Data Systems and Student Privacy” and “Use of Financial Aid Information for Program Evaluation and Research.”
  10. A London university “admits to monitoring student emails under pressure [from] Government anti-terror programme.”

*Want more news stories? Email Amelia Vance at avance AT fpf.org to subscribe to our student privacy newsletter.

Good Data Collaborative to Advance Responsible Data Use

FPF is pleased to be working with SIMLab, The Engine Room, and Center for Democracy & Technology on the Good Data Collaborative.

The Good Data Collaborative seeks to identify gaps in resources to assist civil society in using data responsibly through distinct activities: a landscape assessment of existing tools and resources, as well as academic literature; a consultation with key stakeholders and current and potential users of the resources; and a redesigned, central repository of resources to help them address responsible data challenges in their work.

The project will be hosted by the Digital Civil Society Lab at the Stanford Center on Philanthropy and Civil Society.

FPF Joins National Cyber Security Alliance in San Francisco for Data Privacy Day 2017

Held every year on January 28, Data Privacy Day commemorates the 1981 signing of Convention 108, the first legally binding international treaty dealing with privacy and data protection. On January 26, 2017, Jules Polonetsky, FPF’s CEO, joined the National Cyber Security Alliance and many other FPF members and friends at Twitter headquarters for its Data Privacy Day Event 2017.

Leading up to the event, FPF participated in two #ChatSTC #PrivacyAware Twitter chats on January 18 and 25, 2017. The January 18 chat centered around how personal information is being used, collected, and shared. Experts shared tips about how to best manage your privacy online. The purpose of the January 25 chat was to discuss why privacy is good for business and how organizations can create cultures of privacy awareness and educate their consumers about their data use practices.

Data Privacy Day Event 2017 featured livedstreamed panels, TED-style talks, and interviews focusing on the latest privacy issues for consumers and business. FPF participated in several segments including, Privacy and Connected Toys, How to Read a Privacy Policy in Less Than 60 Seconds Even if It Was Written By A Lawyer, and Growing Up Online and the Need for Teaching Privacy in Schools, among others.

Jules was interviewed by Jeff Frick of SiliconANGLE about FPF’s mission to advance principled data practices in support of emerging technologies. Jules discussed FPF’s extensive work on consumer data privacy issues, including many of our recent releases:  Always On: Privacy Implications of Microphone-Enabled Devices2016 Mobile Apps StudyKids & The Connected Home: Privacy in the Age of Connected Dolls, Talking Dinosaurs, and Battling Robots, and Personal Data In Your Car. You can watch the full interview below.

Related Coverage

Data Privacy Day Stresses Online Safety Tips (The Mercury News), Larry Magid

Data Privacy Day: Will you ever have control of your personal info? (c|net), Laura Hautala

Are you safeguarding your data? Tech leaders talk digital privacy (The Mercury News), Queenie Wong

Twitter gathering: Data protection in forefront (Monterey Herald), Queenie Wong

When a doll rats out a parent: Tech firms struggle with thorny privacy issues (SiliconANGLE), Gabriel Pesek

To learn more about Data Privacy Day, please visit https://staysafeonline.org/data-privacy-day/about.

The 2nd Annual FPF Tech Lab Open House | April 18, 2017 in Washington, DC

The 2nd Annual FPF Tech Lab Open House is an opportunity for us to welcome our members, friends, and colleagues in town for the IAPP Global Privacy Summit. Hosted at our home office in Washington, DC, this event provides a rare occasion for policymakers, regulators, and thought leaders to interact with the latest in privacy-impacting gadgets and new technologies.

Join us on Tuesday, April 18th, from 5:30 -7:30pm at the FPF Office and check out the latest in tech:

– Play with Smart Toys: CognitToys Dino, ChiP Robot, and more

– Outsmart our Smart Home gadgets

– Learn how Wi-Fi and Proximity Sensors can be used to track smartphones in our space

– Come face to face with facial recognition

– Experience virtual reality

– Share fun moments with Snap Spectacles

– And more!

Plus, network with locals and out-of-towners, engage in lively discussions about privacy, all while enjoying drinks and hors d’oeuvres.

Doors open at 5:30 pm; a short program begins at 6:00 pm with remarks from special visiting guests.

By invitation only. Please contact [email protected] for more information.

VIEW PHOTOS

FOR IMMEDIATE RELEASE: FPF and NADA Launch Guide to Consumer Privacy in the Connected Car

FOR IMMEDIATE RELEASE             

January 26, 2017

Contact:

Melanie Bates, Director of Communications, FPF, [email protected]

Jared Allen, Senior Director of Media Relations, NADA, [email protected]

FPF and NADA Launch Guide to Consumer Privacy in the Connected Car 

The Alliance of Automobile Manufacturers, General Motors, Global Automakers, and Toyota support Guide’s efforts to educate consumers about data in today’s cars

Washington, DC – Today, the Future of Privacy Forum (FPF) and the National Automobile Dealers Association (NADA) released a first-of-its kind consumer guide, Personal Data In Your Car. The Guide will help consumers understand the kind of personal information collected by the latest generation of vehicles, which use data to further safety, infotainment, and customer experience. The Guide will be made available to consumers by FPF, NADA, automakers, and dealers in order to explain the kinds of information that may be collected, the guidelines that govern how it is collected and used, and the options consumers may have. Copies of the Guide are being distributed by NADA and Ford Direct at the 2017 NADA Convention & Expo in New Orleans.

“The release of this Guide is a critical step in communicating to consumers the importance of privacy in the connected car, as well as the benefits that car data can provide,” said FPF CEO Jules Polonetsky. “As car data grows in volume and gains attention from both the media and regulators, we think it is critical to find creative ways to communicate with consumers in plain language how it works, how it can serve them, and what options and protections exist.”

“For so many consumers, the idea that their connected vehicle is constantly collecting personal information is completely new to them, and often times something they’ve never even thought about,” said NADA President and CEO Peter Welch. “Consumers have every right to know what kind of personal data may be collected by any vehicle they drive – but knowledge has to start with awareness. It is our hope that this guide helps generate awareness about privacy and vehicle technology, and ultimately leads to more consumers feeling confident and safe in any vehicle they drive.”

Today’s vehicles come equipped with a wide array of equipment and features that rely on the collection and use of data about consumers and their vehicles. These new features support a range of technologies that enhance safety, efficiency, performance, convenience, and entertainment. The Guide describes several components that are integral to properly protecting consumer data. For example, services that collect and share personal information should be accompanied by a clear privacy policy. The reality is that yes, cars are starting to know more about you, but what it knows may save your life.

In addition, Personal Data In Your Car highlights that nearly all leading automakers have committed to protecting consumer information by committing to the Automotive Privacy Principles. These Principles guide privacy practices in the automotive industry. They went into effect beginning with model year 2017 vehicles and for subscription services beginning on January 2, 2016.

The two major automaker trade groups voiced support for the Guide, with CEO of the Alliance of Automobile Manufacturers Mitch Bainwol saying, “We’ve long said that strong consumer data privacy protections are essential to maintaining the trust of our customers, and our Privacy Principles were a major step in protecting personal information collected in the vehicle.  Efforts like this FPF/NADA guide are an important part of helping drivers – and others – understand the many steps automakers take to safeguard data.”

“Automobiles increasingly make use of innovative technologies designed to save lives, time and the environment,” said Global Automakers President and CEO John Bozzella.  “Consumers have a right to know and trust that connected car platforms and the benefits that flow from them will not compromise their privacy or security, and we applaud FPF and NADA for developing a guide to help inform the public.”

As vehicles become more connected, it will be increasingly important to communicate with consumers how their information is collected and shared. For further information about technology in the car, consumers should contact their local dealer and review their vehicle’s owner’s manual.

The Guide launched at the Washington Auto Show on January 26th.

###

The Future of Privacy Forum is a non-profit organization that serves as a catalyst for privacy leadership and scholarship, advancing principled data practices in support of emerging technologies. To learn more, visit www.fpf.org.

The National Automobile Dealers Association is a national trade association representing franchised new-car dealers. To learn more, visit www.nada.org.

FPF and NADA Launch Guide to Consumer Privacy in the Connected Car

The Future of Privacy Forum (FPF) and the National Automobile Dealers Association (NADA) released a first-of-its kind consumer guide, Personal Data in Your Car. The Guide will help consumers understand the kind of personal information collected by the latest generation of vehicles, which use data to further safety, infotainment and customer experience. The Guide will be made available to consumers by FPF, NADA, automakers, and dealers in order to explain the kinds of information that may be collected, the guidelines that govern how it is collected and used, and the options consumers may have.

Today’s vehicles come equipped with a wide array of equipment and features that rely on the collection and use of data about consumers and their vehicles. These new features support a range of technologies that enhance safety, efficiency, performance, convenience, and entertainment. The Guide describes several components that are integral to properly protecting consumer data. For example, services that collect and share personal information should be accompanied by a clear privacy policy. The reality is that yes, cars are starting to know more about you, but what it knows may save your life.

Personal Data In Your Car highlights that nearly all leading automakers have committed to protecting consumer information by committing to the Automotive Privacy Principles. These Principles guide privacy practices in the automotive industry. They went into effect beginning with model year 2017 vehicles and for subscription services beginning on January 2, 2016.

As vehicles become more connected, it will be increasingly important to communicate with consumers how their information is collected and shared. For further information about technology in the car, consumers should contact their local dealer and review their vehicle’s owner’s manual.

The Guide launched at the Washington, DC Auto Show on January 26th. Watch the launch below.

Video

Other Resources