Disaster privacy/privacy disaster

Abstract

Privacy expectations during disasters differ significantly from nonemergency situations. This paper explores the actual privacy practices of popular disaster apps, highlighting location information flows. Our empirical study compares content analysis of privacy policies and government agency policies, structured by the contextual integrity framework, with static and dynamic app analysis documenting the personal data sent by 15 apps. We identify substantive gaps between regulation and guidance, privacy policies, and information flows, resulting from ambiguities and exploitation of exemptions. Results also indicate gaps between governance and practice, including the following: (a) Many apps ignore self‐defined policies; (b) while some policies state they “might” access location data under certain conditions, those conditions are not met as 12 apps included in our study capture location immediately upon initial launch under default settings; and (c) not all third‐party data recipients are identified in policy, including instances that violate expectations of trusted third parties.

Digital divide, critical‐, and crisis‐informatics perspectives on K‐12 emergency remote teaching during the pandemic

“…In the past, these breaches of privacy and surveillance have been found to be context‐specific, and discontinued when the crisis subsided (Reuter & Kaufhold, 2018). However, with growth of private technologies used by the government, companies shirk due diligence around privacy protection because of how lucrative these data can be (Sanfilippo et al, 2020). Soden and Palen (2018) interrogate the failed, culturally a‐contextual aid distribution decisions and efforts in the aftermath of the 2010 earthquake in Haiti by the IMF and World Bank as a case context, noting crisis informatics deployment carry unintended consequences that critical interrogation can demonstrate.…”

Sins of omission: Critical informatics perspectives on privacy in e‐learning systems in higher education

“…Examination of policy documents as data sources occur frequently in information policy scholarship (Brown & Klein, 2020; Sanfilippo et al, 2020), critical legal theory (Crenshaw, 1989; Zalesne, 2013), and Black feminist standpoint epistemology (Collins, 1990). We combine the case study method with discourse analysis to compare language within extant policy documents; past work has employed this combination of methods for instance to understand how organizations that comprise the analytical units of the case study, determine and enforce policy (Allan et al, 2009; Sanfilippo et al, 2020). The case study method can reveal analytically significant problems related to power imbalances, such as discursive deception in policy documents, and the mismatch between promises and actual material processes among stakeholders.…”

Digital Contact Tracing in the EU: Data Subject Rights and Conflicting Privacy Governance

“…We also employed computational linguistic methods, including sentiment analysis of privacy policies, specifically assessing assertiveness and tentativeness around data collection (Boukes et al, 2020), and automated annotation relative to an ontology of modal normative language (Siddiki et al, 2019) and a taxonomy of privacy considerations (Solove, 2005). As part of static app analysis, we examined permissions leveraged by apps, drawing on established methodologies to assess data collection by mobile applications, platforms, and devices of specific data types (e.g., Sanfilippo et al, 2020), and compared outcomes around governance and practice.…”