Transparent government, not transparent citizens: a report on privacy and transparency for the Cabinet Office

1. Privacy is extremely important to transparency. The political legitimacy of a transparency programme will depend crucially on its ability to retain public confidence. Privacy protection should therefore be embedded in any transparency programme, rather than bolted on as an afterthought. 2. Privacy and transparency are compatible, as long as the former is carefully protected and considered at every stage. 3. Under the current transparency regime, in which public data is specifically understood not to include personal data, most data releases will not raise privacy concerns. However, some will, especially as we move toward a more demand-driven scheme. 4. Discussion about deanonymisation has been driven largely by legal considerations, with a consequent neglect of the input of the technical community. 5. There are no complete legal or technical fixes to the deanonymisation problem. We should continue to anonymise sensitive data, being initially cautious about releasing such data under the Open Government Licence while we continue to take steps to manage and research the risks of deanonymisation. Further investigation to determine the level of risk would be very welcome. 6. There should be a focus on procedures to output an auditable debate trail. Transparency about transparency – metatransparency – is essential for preserving trust and confidence. Fourteen recommendations are made to address these conclusions.

[1]  Charles E. Gilbert.  The Framework of Administrative Responsibility , 1959, The Journal of Politics.

[2]  Raymond Wacks,et al.  Privacy: A Very Short Introduction , 2010 .

[3]  Cynthia Dwork,et al.  Differential Privacy , 2006, ICALP.

[4]  Vitaly Shmatikov,et al.  De-anonymizing Social Networks , 2009, 2009 30th IEEE Symposium on Security and Privacy.

[5]  Charles D. Raab.  Privacy, Social Values and the Public Interest , 2012 .

[6]  K. Kernaghan.  The Post-Bureaucratic Organization and Public Service Values1 , 2000 .

[7]  Edgar A. Whitley,et al.  Informational privacy, consent and the "control" of personal data , 2009, Inf. Secur. Tech. Rep..

[8]  John T. Soma,et al.  Privacy Law in a Nutshell , 2008 .

[9]  A. Littlejohn,et al.  Thriving in the 21st century: Learning Literacies for the Digital Age (LLiDA project) , 2009 .

[10]  Chris Reed,et al.  Computer Law: The Law and Regulation of Information Technology , 2007 .

[11]  D. Weil,et al.  Full disclosure : the perils and promise of transparency , 2007 .

[12]  Colin J. Bennett,et al.  3. From Balancing to Steering: New Directions for Data Protection , 1999 .

[13]  J. Mill.  Considerations on Representative Government , 1861 .

[14]  H. Haja Mydin.  On Liberty , 2010, BMJ : British Medical Journal.

[15]  Ross J. Anderson.  Security engineering - a guide to building dependable distributed systems (2. ed.) , 2001 .

[16]  Simson L Garfinkel.  Information of the world, unite! , 2008, Scientific American.

[17]  Latanya Sweeney,et al.  Computational disclosure control: a primer on data privacy protection , 2001 .

[18]  Ivan Flechais,et al.  Usable Security: Why Do We Need It? How Do We Get It? , 2005 .

[19]  Ian Brown.  Data Protection: The New Technical and Political Environment , 2010 .

[20]  Anil Kumar.  Understanding Privacy , 2010 .

[21]  Kieron O'Hara,et al.  Intimacy 2.0: Privacy Rights and Privacy Responsibilities on the World Wide Web , 2010 .

[22]  Vitaly Shmatikov,et al.  Robust De-anonymization of Large Sparse Datasets , 2008, 2008 IEEE Symposium on Security and Privacy (sp 2008).

[23]  Helen Nissenbaum,et al.  Privacy in Context - Technology, Policy, and the Integrity of Social Life , 2009 .

[24]  Paul Ohm.  Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization , 2009 .

[25]  Ian R. Kerr,et al.  Seizing control?: The experience capture experiments of Ringley & Mann , 2007, Ethics and Information Technology.

[26]  Christopher T. Marsden,et al.  Privacy and data protection , 2013 .

[27]  Amitai Etzioni,et al.  The Limits Of Privacy , 1999 .

[28]  Douwe Korff.  EC Study on Implementation of Data Protection Directive 95/46/EC , 2002 .

[29]  Blake J. Roessler,et al.  The Value of Privacy , 2004 .

[30]  Spyros Kokolakis,et al.  Privacy Perceptions among Members of Online Communities , 2007 .

[31]  P. D. Laat.  Online diaries: Reflections on trust, privacy, and exhibitionism , 2008, Ethics and Information Technology.

[32]  Colin Scott,et al.  Regulation in the Age of Governance: The Rise of the Post-Regulatory State , 2004 .

[33]  Ninghui Li,et al.  Provably Private Data Anonymization: Or, k-Anonymity Meets Differential Privacy , 2011, ArXiv.

[34]  Keith William Fairchild,et al.  The Politics of Regulation , 2012 .

[35]  Douwe Korff,et al.  Using NHS Patient Data for Research Without Consent , 2010 .

[36]  Frank McSherry,et al.  Privacy integrated queries: an extensible platform for privacy-preserving data analysis , 2009, SIGMOD Conference.

[37]  Colin J. Bennett,et al.  Visions of Privacy: Policy Choices for the Digital Age , 1999 .

[38]  H. P Gassmann,et al.  OECD guidelines governing the protection of privacy and transborder flows of personal data , 1981 .

[39]  Cynthia Dwork,et al.  Differential Privacy: A Survey of Results , 2008, TAMC.

[40]  Latanya Sweeney,et al.  k-Anonymity: A Model for Protecting Privacy , 2002, Int. J. Uncertain. Fuzziness Knowl. Based Syst..

[41]  Isaac Kramnick.  The Portable Enlightenment Reader , 1995 .

[42]  Vitaly Shmatikov,et al.  Myths and fallacies of "Personally Identifiable Information" , 2010, Commun. ACM.

[43]  Lizzie Coles-Kemp,et al.  On-line privacy and consent: a dialogue, not a monologue , 2010, NSPW '10.

[44]  F. Hayek.  The economic nature of the firm: The use of knowledge in society , 1945 .

[45]  Dear Mr Sotiropoulos.  ARTICLE 29 Data Protection Working Party , 2013 .

[46]  A. Joinson,et al.  Self-disclosure, Privacy and the Internet , 2009 .

[47]  Lizzie Coles-Kemp,et al.  Principled Electronic Consent Management: A Preliminary Research Framework , 2010, 2010 International Conference on Emerging Security Technologies.

[48]  D. Boyd.  Taken Out of Context: American Teen Sociality in Networked Publics , 2010 .

[49]  L Sweeney,et al.  Weaving Technology and Policy Together to Maintain Confidentiality , 1997, Journal of Law, Medicine & Ethics.