Privacy-by-Design: Integrating Human Rights and Technology in Education

PReparing Industry to Privacy-by-design by supporting its Application in REsearch Teaching Privacy by Design to university and post graduate students Susan Perry and Claudia Roda The American University of Paris

Curricular Objectives Our PbD curriculum aims to: explore a new educational space at the theoretical intersection of human rights and digital technology, while integrating a practical component that allows students to produce educational materials for stakeholder audiences, such as the general public. 22 May 2014 2 PRIPARE - CSP Forum 2014

PbD Principles Our curriculum incorporates Ann Cavoukian s seven principles as core learning goals that: enable students to practice privacy-by- design as they learn about it; produce knowledge materials for other stakeholder groups. Note: our curriculum does not address principles in order, but proposes a modification that allows for greater pedagogical cohesiveness. 22 May 2014 3 PRIPARE - CSP Forum 2014

Participatory Action Research methods The interaction between theory and practice, or discussion and production, privileges Participatory Action Research. This enables students to engage in meaningful inquiry and to model the dissemination of their own knowledge. 22 May 2014 4 PRIPARE - CSP Forum 2014

I.1. Full Functionality Positive Sum Historical overview of human rights law and digital technology from 1945 to the present. Identification of trade-offs that occur as new technologies are regulated, or not regulated, by the public sector. No public or private actor is above the law or the general public interest, hence functionality may not apply in all circumstances. 22 May 2014 5 PRIPARE - CSP Forum 2014

I.2. Proactive, not Reactive Focus on digital hardware, an often-ignored aspect of the digital revolution. Make the argument for proactive regulation and extend the case to protection of human health and the environment. Example of electromagnetic emissions (EMF) regulation. 22 May 2014 6 PRIPARE - CSP Forum 2014

I.3. Privacy as a default setting Ethics of design (David Wright) Application of a human rights framework to software production before the rollout of the final product. Discussion of Privacy Impact Assessments (PIAs) 22 May 2014 7 PRIPARE - CSP Forum 2014

I.4. Visibility and Transparency Censorship Students note precarious balance between national security and citizen privacy, as disclosed by the Snowden revelations. Explore reasons for government control of the Internet. Assess impact of violations ranging from freedom of expression to private property to privacy. 22 May 2014 8 PRIPARE - CSP Forum 2014

I.5. Privacy embedded into design Internet of Things (IoT) Ubiquity of potential privacy violations in a world where things are more connected than people. Discussion of the possibility of a social contract between people and objects. Questions of human autonomy Questions of IoT viablility longterm 22 May 2014 9 PRIPARE - CSP Forum 2014

I.6. End-to-End Privacy POPCORN: design of electric car rental protocol in a German city (Frank Kargl). Example of end-to-end privacy implementation within a strict human rights framework. Discussion of technical viability + cost + user expectations. 22 May 2014 10 PRIPARE - CSP Forum 2014

I.7. Respect for User Privacy Material for non-specialized audiences, created by social science students. Within three months, students produced rich, yet streamlined educational material. Demonstrated a mature understanding of the theoretical convergence of human rights and digital technology as manifested in online privacy issues. 22 May 2014 11 PRIPARE - CSP Forum 2014

II. Student-produced materials for PbD Incorporation of their own user experiences into the design of educational materials; commitment to striking visual design; sophisticated awareness of the Internet as a public good, an online extension of their heterogeneous and thickly integrated social lives. 22 May 2014 12 PRIPARE - CSP Forum 2014

22 May 2014 13 PRIPARE - CSP Forum 2014

22 May 2014 14 PRIPARE - CSP Forum 2014

II. Participatory Action Research Participatory Action Research methodology: created positive group dynamics validated students personal experience set high production standards, especially for visual component may have led our students to think of PbD as a legal or technical recourse. 22 May 2014 15 PRIPARE - CSP Forum 2014

III. The General Public Curricular material is aimed at a general public that is unfamiliar with privacy-by-design as a concept, or the idea that privacy could be a default mechanism on social media sites. Starting point for educational materials on privacy, since all sectors of society must be brought on board if privacy is to become the default setting, expected by the general public when using the Internet, or purchasing digital objects and software. 22 May 2014 16 PRIPARE - CSP Forum 2014

Conclusion By transferring privacy principles to the larger domain of human rights and digital technology, our students were able to view privacy protection as part of a larger exploration of how we are going to live in a digitally connected society. This curriculum may be adapted to businesses and public sector officials. 22 May 2014 17 PRIPARE - CSP Forum 2014

Resources Perry, S., Roda, C. (2014) Teaching Privacy by Design to Non-Technical Audiences. Cyber Security and Privacy (CSP) Forum 2014. Springer CCIS Series, Vol. 470. Perry, S., Roda, C. (2014) Privacy-by-Design Curriculum. Selected by the European Union Agency for Network and Information Security (ENISA) for the Roadmap for NIS Education Programmes in Europe. 22 May 2014 18 PRIPARE - CSP Forum 2014

PReparing Industry to Privacy-by-design by supporting its Application in REsearch Thank you for your kind attention. Any questions? Website: www.pripareproject.eu Project Co-ordinator Antonio Kung (Trialog) Technical Co-ordinator Christophe Jouvray (Trialog)