Internet Privacy Policy Paradoxes: The Electronic Communications Privacy Act (ECPA) Amendments Act of 2013 & the Consumer Privacy Bill of Rights of 2012

The rapid growth of the Internet has been accompanied by a proliferation of e-services targeting consumers. E-services are available for banking, shopping, learning, government online, and healthcare. However, each of these services requires a consumer’s personally identifiable information (PII) in one form or another. This leads to concerns over privacy. In order for e-services to be successful, privacy must be protected (Ackerman, Cranor, & Reagle, 1999). An effective and flexible way of handling privacy is management via privacy policies. In this approach, a consumer of an e-service has a personal privacy policy that describes what private information the consumer is willing to give up to the e-service, with which parties the provider of the e-service may share the private information, and how long the private information may be kept by the provider. The provider likewise has a provider privacy policy describing similar privacy constraints as in the consumer’s policy, but from the viewpoint of the provider, (i.e., the nature of the private information and the disclosure/retention requirements that are needed by the e-service). Before the consumer engages the e-service, the provider’s privacy policy must match with the consumer’s privacy policy. In this way, the consumer’s privacy is protected, assuming that the provider complies with the consumer’s privacy policy. Note that policy compliance is outside the scope of this work but see Yee and Korba (July, 2004). Initial attempts at conserving consumer privacy for e-services over the last few years have focused on the use of Web site privacy policies that state the privacy rules or preferences of the Web site or service provider. Some of these policies are merely statements in plain English and it is up to the consumer to read it. This has the drawback that very few consumers take the trouble to read it. Even when they do take the time to look at it, online privacy policies have been far too complicated for consumers to understand and suffer from other deficiencies (Lichtenstein, Swatman, & Babu, 2003; Jensen & Potts, 2004). Still other privacy policies are specified using P3P (W3C) that allows a consumer’s browser to automatically check the privacy policy via a browser plug-in. This, of course, is better than plain English policies but a major drawback is that it is a “take-it-or-leave-it” approach. There is no recourse for the consumer who has a conflict with the Web site’s P3P policy, except to try another Web site. In this case, we have advocated a negotiations approach to resolve the conflict (Yee & Korba, Jan., May, 2003). However, this requires a machine-processable personal privacy policy for the consumer. We assume that providers in general have sufficient resources to generate their privacy policies. Certainly, the literature is full of works relating to enterprise privacy policies and models (e.g., Barth & Mitchell, 2005; Karjoth & Schunter 2002). Consumers, on the other hand, need help in formulating machine-processable privacy policies. In addition, the creation of such policies needs to be as easy as possible or consumers would simply avoid using them. Existing privacy specification languages such as P3P, APPEL (W3C; W3C, 2002), and EPAL (IBM) are far too complicated for the average internet user to understand. Understanding or changing a privacy policy expressed in these languages effectively requires knowing how to program. Moreover, most of these languages suffer from inadequate expressiveness (Stufflebeam, Anton, He, & Jain, 2004). What is needed is an easy, semi-automated way of seeding a personal privacy policy with a consumer’s privacy preferences. In this work, we present two semi-automated approaches for obtaining consumer personal privacy policies for e-services through seeding. This article is based on our work in Yee and Korba (2004). The section “Background” examines related work and the content of personal privacy policies. The section “Semi-Automated Seeding of Personal Privacy Policies” shows how personal privacy policies can be semi-automatically seeded or generated. The section “Future Trends” identifies some of the developments we see in this area over the next few years. We end with ”Conclusion”.

Download Full-text

The development of consumer privacy protection policy in China: a historical review

Journal of Historical Research in Marketing ◽

10.1108/jhrm-08-2014-0022 ◽

2015 ◽

Vol 7 (2) ◽

pp. 232-255 ◽

Cited By ~ 3

Author(s):

Zhihong Gao ◽

Susan O’Sullivan-Gavin

Keyword(s):

Privacy Protection ◽

Policy Making ◽

Technological Development ◽

Historical Review ◽

Privacy Policy ◽

The European Union ◽

Content Type ◽

Consumer Privacy ◽

Chinese Policy ◽

The Usa

Purpose – Given the unique cultural-political context of China, this paper aims to investigate two research questions: What has been the development trajectory of policy-making on consumer privacy protection in China, and what factors have shaped its development over the years? Design/methodology/approach – This paper adopts a historical approach and examines the development of Chinese consumer privacy policy during four periods: 1980s, 1990s, 2000s and 2010-present. Findings – Chinese policy-making on consumer privacy protection has made steady advancement in the past few decades due to factors such as technological development, elite advocacy and emulation of other markets; however, the effects of these factors are conditioned by local forces. Originality/value – To date, most studies of consumer privacy issues have focused on Western countries, especially the European Union and the USA. A better understanding of how consumer privacy policy has developed in China provides important lessons on the promotion of consumer privacy protection in other developing countries.

Download Full-text

An Overview of Recent Development in Privacy Regulations and Future Research Opportunities

Research Anthology on Privatizing and Securing Data ◽

10.4018/978-1-7998-8954-0.ch001 ◽

2021 ◽

pp. 1-14

Author(s):

Tawei Wang ◽

Yen-Yao Wang

Keyword(s):

Economic Consequences ◽

Future Research ◽

Research Opportunities ◽

General Data Protection Regulation ◽

Consumer Privacy ◽

Privacy Act ◽

General Data ◽

Security Compliance ◽

New Research ◽

Data Broker

This chapter provides an overview of several recently proposed or passed privacy-related regulations, including General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Illinois Video Interview Act, Data Broker Regulations in Vermont, and Privacy Bill of Rights Act, and related but very limited studies. Toward the end, several research opportunities are discussed. These research opportunities include (1) economic consequences of these new regulations and (2) the new research framework to capture novel features of these regulations to explain security compliance. The authors further discuss possible research designs to address the proposed research opportunities. This chapter provides both professionals and researchers additional insights on the regulation of privacy issues.

Download Full-text