3 Projects Prove Privacy Is Not Dead

With all of the mobile apps, Web sites and free services clamoring for your personal data, whereabouts and preferences, it might seem as though privacy is at death’s door. Not so. Several projects underway aim to provide virtual lockboxes or screening technologies that can help people to reassert control over their digital lives.
 
In general, privacy-enhancing approaches to online data sharing require any company, app developer or government agency that wants to know more about you to ask permission for access to specific information. The rest of your data stay locked away.
 
Services such as Britain’s Mydex offer the ability to store, manage and share personal information in an encrypted central repository called a data store, which only the person who creates the store can fully access. Anyone wanting information contained within that personal data store—an insurance company or marketer, for example—must connect to Mydex’s network and agree to terms of use created by the person owning the data before Mydex will release it. Personal, based in Washington, D.C., offers a similar “data vault” service.
 
A system called the open personal data store (openPDS) platform, under development at the Massachusetts Institute of Technology, likewise consolidates information into a single location that can be stored on one’s computer or with a service provider (aka in the “cloud”). OpenPDS, however, deals specifically with metadata—which can describe a person’s location, phone use or Web searches, for example. The M.I.T. approach protects privacy by refusing to share any of that data directly. Instead, a mobile app, Web site or research firm looking for information protected by an openPDS must query the data store directly—to check, for instance, whether your shipping address has changed or to confirm your present location. OpenPDS responds specifically to that query with answers that the openPDS owner approves for release, according to a study published July 9 in PLOS ONE.
 
Simply anonymizing records by stripping out names and other identifying information is not enough protect one’s privacy, says Yves-Alexandre de Montjoye, an M.I.T. graduate student in media arts and sciences and first author on the new paper. de Montjoye and colleagues at M.I.T. and the Catholic University of Louvain in Belgium have demonstrated in past experiments that as few as four pieces of data from a person’s mobile phone checking in with the nearest cell tower is enough for them to identify the owner of that phone 95 percent of the time. The researchers are now testing openPDS with telecommunications companies in Italy and Denmark.
 
A service in the Netherlands called the Qiy Trust Framework offers a slightly different model for privacy protection. Since 2012 people that country have been able to create their own online portal for organizing and protecting the personal information they give to utility companies, government agencies and businesses. Unlike MyDex or openPDS, Qiy is not a data repository—any data that someone gives to, say, a wireless provider stays in the database of that entity. If such organizations participate in the Qiy program, individuals access their accounts with those agencies by logging into their own Qiy account. They gain protection because participating organizations are required to adhere to guidelines established by the nonprofit Qiy Foundation, including mandatory data encryption.
 
Such data centralization projects are likely to be received lukewarmly in the U.S., at least at the moment. Here, two trends conspire against them: stories about data stolen from supposedly secure corporate or government databases have become commonplace; and many consumers show little reluctance to hand over access to their phones’ address books and GPS trackers in exchange for free mobile apps.
 
Still, as the controversy over the U.S. National Security Agency’s data collection practices deepens and data breaches proliferate, greater demand for improved privacy tools is likely to emerge eventually. The New York State Attorney General’s officeissued a report on July 15, for example, saying that in 2013 alone 7.3 million records of New Yorkers were exposed in more than 900 data security breaches, thanks in part to the “retail mega-breaches” at Target and Living Social. Five of the 10 largest data thefts reported to that office have occurred since 2011.
 
The N.Y. Attorney General’s office recommends that, to protect themselves and their clients, companies and other organizations should cut down the amount of data they themselves collect and store. This advice is exactly the kind that could pave the way for new types of privacy protection technologies.