Social Media Sites & T he Privacy Paradox

1. Social Media Sites & The Privacy Paradox

2. Public vs. Private Expectations Millions of users have integrated Social Media sites into their daily routines. That being said…….

3. Privacy “When personal data about individuals are collected, processed, stored and retrieved without their consent, their information security is under threat. Information security also means that people are free to determine what information about themselves they want to share with others.”1 1Hamelink, 2000, p. 132

4. Public vs. Private Expectations Do police officers have the right to access content posted to Facebook without a warrant? This hinges on our expectation of privacy and whether or not Facebook profiles are considered public or private.

5. Public vs. Private Expectations • Social Media Sites are challenginglegal conceptions of privacy. • Hodgeargued that the fourth amendment to the U.S. Constitution and legal decisions concerning privacy are not equipped to address social network sites.2 2Hodge, 2006

6. Privacy can be viewed from a number of perspectives: • Political policies • Schement and Curtis describe privacy “as security against intrusion by government.” 3 • Rights of citizens • The word privacy does not indicate the scope of the issues of privacy in the United States today.4 • Privacy is the “right of people to control what details about their lives stay inside their own houses and what leaks to the outside.”5 • Protection for consumers • Citizens and consumers should know who collects what information and how it is going to be used. 3 Schement and Curtis, 1995, p. 136 4 Garfinkel, 2000 5 Garfinkel, 2000, p. 4

7. Privacy Do we have a problem with the sharing of private information on social networking sites? • The erosion of individual privacyoccurs with the consent of the individual. • Credit applications collect personal information and requests for catalogs can be used to compile direct mailing lists.6 • Collecting, analyzing, and interpreting personal information stored in databases has become a data–mining industry. 6Hamelink, 2000

8. “Information is Gathered so the Economy Can Support its Participants.”7 Marketers can use stated, personal information gathered from social networking sites for purposes other than what users intend. • The commoditization of information has made it necessary to consider the invasion of privacy by corporations. • In a capitalistic society, marketers can use personal information collected in public online databases for commercial purposes. • Companies such as Coke, Apple Computer and Proctor & Gamble are using social networking sites as promotional tools. Hempel and Lehman, 2005 7Schement and Curtis, 1995, p. 137

9. Solution to protecting privacy • Social responses to privacy in social networks do not tend to deal with the potential misuse of personal information. Awareness is key….. We need to be more proactive about educating each other and protecting our privacy on the Internet.

10. Solution to protecting privacy Responsibility lays with the individual when using social networking sites. • Commercial social networking sites have been set up to support the flow of information created by individuals. • The purpose of these sites is to advertise and promote brand recognition in consumers. • Individuals need to clearly know how their personal information is being stored and used by others. • Social networking sites and advertisers need policies about the proper use of personal information posted on these sites.

11. Top 5Social Media Privacy Concerns • Merging Social Media Websites • As social media websites rush to add even more features and functionality to their websites, they could potentially overlook key privacy considerations. • When one company merges with another or when they add new technological features, there always seem to be a few “growing pains” along the way.

12. Top 5Social Media Privacy Concerns • Single access sign-on can raise red flags for security and privacy • Users can log in once and then use multiple websites without the need to sign in again. • With time single access sign-on may open the door to websites sharing information. • This will make it easier for a single social media website to show your actions and activities on other websites. • Social media websites will have to ensure user privacy; otherwise this highly convenient feature could become a liability.

13. Top 5Social Media Privacy Concerns • New website security restrictions and universal legislation • As the amount of information people share on social media websites increases so does the need for heightened security and privacy controls. • The main Social Media Sites possess a mind-boggling amount of personal information about the people who use their websites. • Universal guidelines on how this information can be gathered and used is needed, otherwise it could be misused, either intentionally or unintentionally.

14. Top 5 Social Media Privacy Concerns • Websites have been pretty much on their own to set their privacy policies, there is currently a vast amount of variation between websites. • Users are often confused as to what privacy controls are available and how they should be used. • With universal legislation in place, social media sites will have standard guidelines and policies to followcreating a more secure and less confusing user experience. • People share information innocently because they want to use a specific feature, or because they wish to qualify for a free product or service and do not recognize the potential for information misuse.

15. Top 5Social Media Privacy Concerns • Walking a fine line between effective marketing and privacy intrusion • Companies arebeginning to leverage the advertising and marketing potential of social media and discovering the vast audiences that can be reached. • Social media sites as well as the companies who use them will have to be careful to walk a fine line between effective marketing and privacy intrusion. • Companies will have to pay close attention to the privacy needs of their users. • As people become aware of privacy intrusion issues, they may become more leery and distrustful.

16. Top 5Social Media Privacy Concerns • Social media websites using location-based services need to avoid privacy nightmares • Without overall legislation and privacy laws, websites will be on their own to figure out how best to leverage location-based services. • Users will using these services could potentially be leaving themselves exposed to privacy risks. • Social media sites using location-based services will have to focus on user privacy and security concerns. • Used properly, these services could open up a whole new world of social media interactivity. • Using a good online privacy and reputation management service such as can help with privacy concerns.

17. Cyber Security • Last April Sony suffered one of the largest ever Internet security break-inswhen hackers stole millions of customers’ personal information, including: • Birth dates • Email addresses • User names • Passwords • Logins • Security questions   • The security breach could ultimately cost the entertainment giant over $1 billion.8 8Sony PlayStation suffers massive data breach, Reuters, April 26, 2011

18. Cyber Security • Chase • Citigroup • Best Buy • Walgreens ……..were also hit by major hack attacks   • During a routine monitoring of its commercial data Citigroupdiscovered the theft of names, account numbers and email addressesof over 200,000 customers.  

19. The Ramifications of a Security Breach • The cost of: • Rectifying the breach, • Performing security investigations, • Customer notification, • Network repairs, • Marketing costs, • Substantial lost revenue Data breaches can also expose a company to a  variety of lawsuits.

20. To Minimize Risks Companies should ….. • Devise more robust data security plans. • Regulate how they collect, maintain, secure and use private data. • Develop more transparent policies for the data they collect and share with third parties.  • Conduct periodic risk assessments and update data control mechanisms.   • Embed data privacy into software designs to make customer privacy the “default setting.”   • Assess what information needs to be secured and where it is located. • Restrict administrator access to that information and scramble the data to make it unreadable  • Having ample documentation of security systems in case government regulators decide to investigate. 

21. Policymakers are concernedwith... • Consumers’ lack of understanding of the collection and use of their private information and their lack of ability to make informed choices about it.9 • The blurring distinction between personally identifiable information and supposedly anonymous or “de-identified” information.10 • Protecting Privacy while continuing to encourage e-commerce innovations.11 9Protecting consumer Privacy in an Era of Rapid Change FTC, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers 10Protecting consumer Privacy in an Era of Rapid Change 11Protecting consumer Privacy in an Era of Rapid Change

22. U.S. Privacy Regulations vs. the Rest of the World • The EU approach • Comprehensive national laws, prohibitingthe collection of data without a consumer’s consent and requiring companies that process data to register their activities with government authorities. • As per the EU’s 1995 Data Protection Directive12personal data should not be processed except in limited circumstances. • The U.S. approach • More ad hoc and industry-based.   • A mixture of laws, regulations and industry self-regulation rather than a single, comprehensive federal data protection law.   • Free market and freedom-of-speech principles predominate.   12Directive 2009/136/EC of the European Parliament and of the Councilof 25 November 2009, Official Journal L 337 , 18/12/2009 P. 0011 - 0036

23. U.S. Privacy Regulations vs. the Rest of the World • Privacy laws are internationally trending toward the EU model. • Conflicting foreign data privacy requirements pose an obstacle to implementing global information management systems and imposes significant costs in tracking and complying with data protection laws in each country.  

24. U.S. Privacy Regulations vs. the Rest of the World • The 2009 EU Cookie Directive13is a major restriction on the collection of consumer data.   • Calls for tighter regulations on the way companies track online customers for behavioral advertising and targeted marketing.   • Users are to be given a greater opportunity to opt out of receiving certain types of cookies on their personal computers.   13Directive 2009/136/EC of the European Parliament and of the Councilof 25 November 2009, Official Journal L 337 , 18/12/2009 P. 0011 - 0036

25. Cloud Computing & Privacy Concerns • Cloud computing enhances the ability to collect and centrally store consumer data and to share that data with third parties.   • Companies, such as Google, Microsoft, Amazonand Facebook, offer various cloud-hosted applications for customers.   • Cloud applications are cost-effective and allow companies to access computing resources and storage that would be out of reach for on-premise installations.  

26. Cloud Computing & Privacy Concerns • Will the government continue to rely on industry self-regulation or will the FTC issue comprehensive rules.  • Emerging cloud computing issues: • European governments are increasingly concerned that U.S. companies will turn over their citizens’ private information to the U.S. government if demanded to do so under the Patriot Act.  

27. Location – Based Services • Location-based services pinpoint geographic locations via mobile devices. • Increasingly used in e-commerce. • Users can tell a social network (e.g., Facebook) they are visiting a retail establishment in order to get a coupon for discounts and prizes.   • Can help find a nearby restaurant or ATM. • Location information is often shared with advertisers who use the information to target-advertise.  

28. Location – Based Services • Access to location history is often without user consent.   • According to a Nielsen study of U.S. smartphone users last April, many consumers are reluctant to “check in” using a LBS because of privacy concerns.   • Some LBS vendors are requiring explicit opt-ins, reduced positioning accuracy and other privacy protections.   • Social networks and other LBS vendors privacy policies may not protectagainst leaking of private information to third parties.  • Best practices and self-regulation for mobile phone providers, technology companies and equipment makers will continue to evolve.  

29. Thank you for your time.