Note: this blog is a mirror of my HP Labs Blog, on the same topic, accessible at: http://h30507.www3.hp.com/t5/Research-on-Security-and/bg-p/163

Monday, July 23, 2007

Privacy Management: A Reality Check …

Ben Laurie and Kim Cameron have been recently posting on their respective blogs (links.org, identityblog.org) about potential violations of identity laws, related privacy issues (on linkability), etc. This discussion was triggered in the context of their respective user-centric identity management work on InfoCard/CardSpace and “Selective Disclosure” - where users are enabled to have degrees of control on the disclosure of their personal data.
Interestingly, at the same time this debate was taking place, Google was warned by the EU data protection advisory group that it could be violating European privacy laws by keeping data on people’s searches for as long as two years …
This is just an example. Large amounts of personal data have already been disclosed to enterprises - by millions of people! Privacy laws and legislation are violated by too many organisations (worldwide) – not only because of lack of (strong) punishment but also (and especially) because of lack of internal processes, expertise, tools and solutions to enforce privacy policies and check for compliance.
Let’s have a reality check … I really see the urgency and priority of investing and contributing at fixing privacy problems and issues in the enterprise space!

No comments: