A vision for global privacy bridges: Technical and legal measures for international data markets

Abstract

From the early days of the information economy, personal data has been its most valuable asset. Despite data protection laws and an acknowledged right to privacy, trading personal information has become a business equated with "trading oil". Most of this business is done without the knowledge and active informed consent of the people. But as data breaches and abuses are made public through the media, consumers react. They become irritated about companies' data handling practices, lose trust, exercise political pressure and start to protect their privacy with the help of technical tools. As a result, companies' Internet business models that are based on personal data are unsettled. An open conflict is arising between business demands for data and a desire for privacy. As of 2015 no true answer is in sight of how to resolve this conflict. Technologists, economists and regulators are struggling to develop technical solutions and policies that meet businesses' demand for more data while still maintaining privacy. Yet, most of the proposed solutions fail to account for market complexity and provide no pathway to technological and legal implementation. They lack a bigger vision for data use and privacy. To break this vicious cycle, we propose and test such a vision of a personal information market with privacy. We accumulate technical and legal measures that have been proposed by technical and legal scholars over the past two decades. And out of this existing knowledge, we compose something new: a four-space market model for personal data.

The challenges of personal data markets and privacy

“…In the US and in Europe, it is now intensively discussed whether personal data could be seen as "property" (Schwartz 2004 ;; Purtova 2012 ;; Spiekermann and Novotny 2015 ). The OECD and scholars around the world have started to think about how personal information could be priced (OECD 2013 ;; Acquisti 2010; Acquisti , 2014; Spiekermann et al 2012 ).…”

Designing a Primary Personal Information Market as an Industry Platform:_a Service Innovation Approach

“…Data contributing individuals also receive requests to access their personal data via their chosen channel (email, SMS, IM etc.). The data contributing individuals' emotive experience of this service is designed to be one of trust engendered by the transparency and immediacy of the service which grants them visibility of and control over the uses to which their personal data are being put [36]. Their emotive needs of fairness and equity are addressed as they are compensated for the use of the valuable personal data they have generated.…”

“…This service concept design fulfils individuals' expectations of transparency [36] (via the individuals' dashboard), opt out ability (by the ability to withhold and withdraw permission), fair compensation (via the payments system), low transaction costs and security of data. It also fulfils model developers' and data feed developers' expectations that PDP consumers can search for, locate and compare their offerings, and that they receive fair compensation for the use of them.…”

“…Spiekermann and Novotny [36] explored the tension between sharing personal information with companies while maintaining personal privacy. By focusing on the type of relationship which exists between the individual and the company, they developed a four-space model of personal information management.…”

Assessing the Privacy of mHealth Apps for Self-Tracking: Heuristic Evaluation Approach (Preprint)

“…In response, some vendors have made privacy part of their value proposition, such as Apple's attempts to contrast the restrained ways they use their customers' data to advertising networks such as Google [9] and Silent Circle's Blackphone which offers more pervasive encryption than most Android smartphones. Academics have also proposed privacy-friendly business models [10]. Many mHealth technologies operate in an uncertain regulatory space, without the protections and scrutiny of other medical data, such as HIPAA in the ; United States, or NHS oversight in the United Kingdom.…”