EDUCAUSE | Privacy Policies

Are Online Targeted Advertising Practices Violating Wiretap Laws?

agould — Thu, 10 Jul 2008 15:08:12 -0500

Released one day before the Senate Commerce Committee held its hearing on the privacy implications of online advertising, a new report says targeted ads may involve practices that violate state and federal wiretap laws.

On Tuesday, the Center for Democracy and Technology (CDT) issued a memo, saying Internet service providers (ISPs) that allow an advertising network to copy [their] customers' Web traffic contents are defying "reasonable consumer expectations and may [be violating] communications privacy laws."

Currently, some ISPs are working with third party advertising agencies, which are copying consumer data in order to target specific ads at users. One such firm, NebuAD, testifed before the Senate Commerce Committee yesterday. NebuAd claims it does not violate any laws because they do not collect personally identifiable information. Some, though, argue that any collection of data can ultimately be tied to an individual and disagree with NebuAd's assertion that privacy is completely protected. CDT's memo says the practice most likely violates legal protections provided in the Electronic Communications Privacy Act.

"Consumers do not expect their ISP to be copying their Internet communications and selling them to third parties," said CDT Vice President Ari Schwartz. He stressed that consumers need to be aware that their information is being sold to outside groups, and there should be "clear notice and prior consent."

CDT acknowledges that federal laws may allow these practices with the consent of subscribers, but they say they fear consumers are "ill-equipped" to know how or even if their information is being tracked.

And while CDT President Leslie Harris said the larger ISPs have shied away from using firms like NebuAd, she says this model is not going away anytime soon. Harris says they want to see the Federal Trade Commission adopt enforceable guidelines and a sensible privacy regime for handling these evolving challenges to Internet privacy.

Hearing Highlights: Senate Commerce Committee Holds Hearing on the Privacy Implications of Online Advertising

agould — Wed, 09 Jul 2008 15:12:01 -0500

Today the Senate Commerce, Science, and Transportation Committee held a hearing on privacy concerns related to online advertising. In what will probably be the first of several hearings, the committee asked panelists about their thoughts on privacy threats vis-a-vis online advertising. Chairman Dorgan noted that no Internet Service Providers (ISPs) wanted to participate at today's hearing, but he hoped to address this issue with them at another hearing in the future. Panelists at this well-attended event included Lydia Parnes of the Federal Trade Commission, Chris Kelly of Facebook, Leslie Harris of the Center for Democracy and Technology, Jane Horvath of Google, Robert Dykes of NebuAd, Mike Hintze of Microsoft, and Clyde Wayne Crews of the Competitive Enterprise Institute.

HIGHLIGHTS:

Chairman Dorgan acknowledged that there are benefits to having personalized online ads, since they are relevant to the user. He said he has personally enjoyed using amazon.com because that website will suggest books or other products related to the books you may already be buying. However, Dorgan said that while he understands the need for revenue from these ads, he is troubled by the privacy implications.
Another senator said that Congress has been arguing for years over the Patriot Act's controversial section on allowing government authorities to inspect library patrons' borrowed book lists. He noted that while this is not a "Big Brother" situation with the government, the same activity is going on with behavior advertising. The only difference, he said, is that private companies are gaining access to people's sensitive online search information.
Lydia Parnes, Director of the Bureau of Consumer Protection at the FTC, said many consumers have expressed concerns about privacy on the Internet, especially as it relates to health, finances, and children. After conducting hearings and a townhall on this topic, the FTC determined that 1) behavioral (targeted) ads may provide good benefits, 2) invisibility and the collection of data are concerns, and 3) businesses and consumers want more transparency.
Jane Horvath, Senior Privacy Counsel at Google, says Google makes privacy a top priority because they know consumers can choose other search engine competitors. Horvath said her company targets ads based on users' interests, but does not build up detailed profiles. She also said Google stresses transparency by providing privacy information, as well as choice in what information users provide. Additionally, Horvath said the "world's best engineers" are devoted to Google's security. Finally, she said they support a comprehensive privacy law and agree with the FTC's online privacy principles.
Robert Dykes, Chairman and CEO of NebuAd, said his advertising agency partners with ISPs in order to target specific ads at Internet users. He said NebuAd uses a select set of a user's activities to target the ads, but does not collect personally identifiable information (PII) on people. He also said his company allows for people to "opt-out," though some questioned whether consumers were even aware of the tracking or how to stop it.
Leslie Harris, President of the Center for Democracy and Technology, said behavioral advertising is growing and citizens are ill-equipped to protect themselves. She said that while each piece may not be identifiable, collections can ultimately be tied to a person. Additionally, she expressed concerns about data being maintained for extended periods of time. Harris said the fact that ISPs are disclosing consumers' traffic to unknown third parties may violate federal and state wiretap laws. CDT released a memo yesterday, offering information and evidence as to why they believe ISPs that work with companies like NebuAd are violating wiretap laws.
Chris Kelly, Chief Privacy Officer of Facebook, stressed that Facebook members have control over their privacy settings and that his company is constantly looking for ways to provide even more control to users. He said that while the targeted ads "generally benefit" users, Facebook does not provide outside businesses with profile information. However, people who choose to add applications do surrender some privacy, because application owners have a set amount of time to look at a consumer's personal page. Kelly said Facebook penalizes any application companies that violate his company's policies.
Clyde Wayne Crews, Director of Technology Studies at the Competitive Enterprise Institute, said there is no guarantee for privacy on the Internet, which he said is defined by its openness and constant evolving. He stressed that competition, rather than burdensome regulations, is better for addressing privacy concerns. Crews said that if someone does not like a search engine, there are literally hundreds of other ones from which to choose. The best ones, of course, will strive for greater privacy protections, thus encouraging more people to use their services.
Finally, Mike Hintze, Associate General Counsel at Microsoft, said his company has three privacy principles: transparency, control (ability to opt-out of features), and security. He said Microsoft advocates for a privacy policy even broader than the FTC's in order to better protect their customers.

Podcast: The Big Brother Dilemma

gbayne — Wed, 11 Jun 2008 17:52:18 -0500

This podcast features a 50 minute keynote address from the EDUCAUSE 2008 Enterprise Conference. The speech, "The Big Brother Dilemma," is by Gregory A. Jackson, Vice President & CIO, University of Chicago.

We want cameras watching for problems, but we worry that they will observe or disclose things we'd like to keep private. We want network administrators to track harassing e-mail to its source, but we don't want anyone monitoring our e-mail. We want our buildings to admit occupants and keep strangers out, but we don't want anyone keeping track of when we arrive and leave. In other words, we want big brothers to watch out for us, but we don't want Big Brother to watch us. And IT is caught in the middle.

note: commercial material from television and movies was used in this speech and has been cut out of the recording with as little effect on the speech as possible.

EDUCAUSE Podcast: The Privacy Landscape in the Academy

gbayne — Tue, 05 Feb 2008 04:50:49 -0600

On this podcast we feature a keynote speech from the EDUCAUSE 2008 Mid-Atlantic Regional Conference featuring Lauren Steinfeld, Chief Privacy Officer and Institutional Compliance Officer at the University of Pennsylvania. Her presentation is entitled, "The Privacy Landscape in the Academy".

Lauren B. Steinfeld serves as Chief Privacy Officer for the University of Pennsylvania. In that position, Ms. Steinfeld works on privacy issues involving medical information, student records, electronic data, Social Security numbers, and other personal information. Recently, Ms. Steinfeld has worked extensively on developing policies, procedures and tools to mitigate risks in the information technology area. Ms. Steinfeld has also taught a Privacy Law course at Penn Law.

2008 Southwest Conference Will Address Empowering Community Through Technology

cluckett — Thu, 06 Dec 2007 17:44:00 -0600

The 2008 Southwest Regional Conference, "Empowering Community Through Technology," will be held February 20–22 in Houston, Texas. View the program and register by January 23 to save money with low, early-bird rates.

Jean E. Engle, chief knowledge officer, NASA/Johnson Space Center, will present a general session (topic TBA) on Friday, February 22.

The conference will focus on these topic areas:

Empowering Our Teaching and Learning Communities
Leading the Charge for Change
Making IT Work: The Confluence of Technology, People, and Expectations
Corporate and Campus Solutions

View the list of speakers, who will address pertinent topics such as IT governance structure recommendations, succession planning for CIOs, tracking assessment data for general education, and active learning with mobile and wireless technologies. In addition, half-day preconference seminars will cover topics such as blended learning, effective leadership strategies, and privacy practices for academic organizations.

Tune in Oct. 17: FERPA Refresher

ecoghlan — Tue, 09 Oct 2007 17:04:45 -0500

Tune in October 17 for a refresher on FERPA, the federal statute that governs the privacy of student records and information. In light of recent incidents, and with another school year now under way, it’s a good time to remind ourselves of our obligations—and rights—under this law. Steven J. McDonald, Rhode Island School of Design general counsel, and Nancy E. Tribbensee, Arizona University System general counsel will be the presenters for this this hour-long, free EDUCAUSE Live! Web seminar.

If you are unable to attend, you may wish to visit the EDUCAUSE Live! archives, where a recording of this seminar will be posted shortly afterward. You can also browse FERPA resources in EDUCAUSE Connect.

Podcast: Privacy and Security in Higher Education: Filling the Policy Vacuum

gbayne — Mon, 13 Aug 2007 11:57:22 -0500

In this hour and ten minute long podcast from the 2007 Seminars on Academic Computing, we hear from Fred H. Cate, Distinguished Professor at the School of Law and Director of the Center for Applied Cybersecurity Research at Indiana University, with a speech entitled, Privacy and Security in Higher Education: Filling the Policy Vacuum .

Colleges and universities possess an exceptional volume and variety of personal information. Our stewardship of such information has been inconsistent and inadequate, and we often implement new technologies and systems without considering systemic privacy and security implications. Although many publicly reported security breaches occur on campuses, we have been slow to provide training in privacy and security issues, rarely audit for compliance, and lag far behind industry and government in appointing privacy and security officers. This session will address the information policy challenges facing colleges and universities, today and in the future, and will offer practical steps for overcoming them.

2007 Policy Conference: Year In Review

gbayne — Tue, 05 Jun 2007 11:59:10 -0500

The 2007 Policy Conference kicked off with a top-ten style list of Policy Issues currently facing higher education. This entertaining and insightful list was compiled and delivered by Tracy Mitrano, Director of IT Policy and Computer Policy and Law Program at Cornell University. What's past is prologue. As we look ahead to the policy questions facing the Internet today and tomorrow, it's useful to recall what we've seen over the past 12 months. This speech, entitled the Year In Review, runs approximately 33 minutes.

EDUCAUSE2006 Podcast: Policing the Internet

Carie417 — Sat, 31 Mar 2007 23:14:43 -0500

In this 48-minute recording from the 2006 EDUCAUSE Annual Conference, we'll hear from Rodney Petersen and Wendy Wigen in a session entitled Policing the Internet: Higher Education Law and Policy. They discuss recent government initiatives and emerging legal and policy issues in higher education, such as the USA PATRIOT Act, CALEA, and the European Union Data Directive.

CALEA Update: Higher Ed Reporting Due Dates Announced

lgesner — Wed, 03 Jan 2007 17:55:55 -0600

Due dates for the two reports that must be filed by higher education institutions that must comply with CALEA (the Communications Assistance for Law Enforcement Act) have now been announced. One report is due on February 12, and the other on March 12. EDUCAUSE has updated its CALEA resource page to describe the reports and provide additional information for those who must file, using attorney Matthew A. Brill, who has consulted on this issue for higher education, for expert advice.

It is important to note that not all institutions must file these reports. In fact, according to the earlier recommendations of ACE and EDUCAUSE most institutions do NOT have to comply with CALEA, and do NOT need to file the reports. EDUCAUSE suggests that member institutions’ primary representatives notify their presidents of this situation, since it is not recommended that an institution file the reports unless it in fact must comply with CALEA. For further information on the CALEA resource page.