Privacy Value Networks Project• Research Project funded by

TSB/EPSRC/ESRC, £2m, 09/08-08/11• Oxford Internet Institute• Bath University• St Andrews University• University College London• Consult Hyperion• BT

• http://www.pvnets.org/

Project Aims• To account for value (and devalue) of data items

from the perspective of all stakeholders• Company/government and customer/citizen• Secondary users (e.g. other family members,

neighbours)

• To account for individual, commercial andsocietal costs and benefits• Immediate and long-term

• To model impact of data quality and transparency

Reality: Value and De-value

• Customers/citizens feel privacy is violated evenwhen data is handled in accordance with DPA

• Take action to protect themselves, e.g.• Abandoning forms when phone number requested• False DOB on social networking sites

• Decreasing data quality• Discrepancy between customer/citizen and

“data shadow”• Value networks – impact on 3rd parties?

FacebookFacebookUserUser

AdvertisersAdvertisers

FacebookFacebookOrgOrg

FriendsFriends

ID thiefID thiefW

ho I

am, w

hat

I do

Who

I am

, wha

t I d

o

Knowledge ValueTangible Value

Intangible ValueKnowledge DevalueTangible Devalue

Intangible Devalue

Personal data

SN data

Behavioural targeting

SN Service

SN Service

AdvertisingCPM payments

Who I am, what I do

loyalty

Community

withheld info, deception, PETs

LimitedSNservice

Identity theft

Bra

nd d

amag

e

Reduced CTR, increased CPA

ThirdThirdPartiesParties

Payment

ID data

PotentialPotentialemployeremployer InsuranceInsurance

RegulatorRegulator

Case studies1. Biographical data (Identity and Passport Service)2. Communications usage data on families and

geographical groups (BT)3. Sensor-enhanced Facebook (students and young

professionals)4. Longitudinal data families (MORI)5. Financial data6. HIV+ patient records

Mobile social sensing

Financial Services• Methods #1 of 2• Interview financially excluded people

• Seeking• Role of personal information and privacy in service uptake?• Value of protecting/ sharing personal financial info. w.r.t.

• Other family members• Friends / neighbours / community• Service providers

• Desired properties of services• Recruitment

• Approaching voluntary credit support agencies (Citizens Advice,CCCS, etc.) to recruit for us, so

• Trusted party engages the family member that deals withfinancial management, at the point of doing it

Financial Services• Methods #2 of 2• Interview service providers

• Seeking• What information is used to assess service provision risk?• What information would allow ‘better’ decisions?• How could existing information be better used to provide

services the users want?• Values of personal information providers hold about customers

w.r.t.• The customers• The providers themselves• Their competitors / other service providers

• Recruitment• In talks with a high street bank• Looking for wider range of service providers

Conclusions• Time to re-think approach to data collection,

processing and retention• Applying DPA, and beyond

• Consider value and de-value for all stakeholders• Wider and long-term impacts for value networks• Tool for impact modelling• Can be used to facilitate Privacy Impact Assessments

(PIA)• Improved data quality will benefit all

stakeholders