Cybersecurity Policy Report, Privacy Stakeholders Debate Ways to Disclose Data-Sharing Practices, (Feb 4, 2013)

By Lynn Stanton

Participants in the privacy multistakeholder process convened by the National Telecommunications and Information Administration to develop a code of conduct on mobile app transparency this week debated whether a short-notice screen should list and distinguish between various types of entities — such as affiliates, third parties, content publishers, and data brokers — with which an app might share information about the user.

Mark Blafkin, executive director of Innovators Network, who has been investigating possibilities for usability testing for options the stakeholders are considering, said, "I think this is an area where we could do some testing."

One participant suggested that the "overlap" among the various types of entities could confuse consumers and might even confuse app developers. Pam Dixon, executive director at the World Privacy Forum, who has been working on a proposed voluntary code on transparency screens and revising the draft between meetings to reflect stakeholder input, said the "new draft" that was still in revision "collapses these categories."

A poll of participants yielded a 22-4 majority for removing affiliates from the list of entities with which information-sharing must be disclosed in the on-screen short notice.

A related issue debated at the Jan. 31 meeting was whether to change the term used to describe data brokers to "data providers" or "data furnishers," and what exactly was meant by "data brokers." One drafter said the use of the term was meant to reflect the perception that consumer care about "whether they knew the entity that was getting their information."

"We were trying to say, if you [the app] are sharing with a company that doesn't have a relationship with consumers and they repurpose and sell that data, you should disclose that sharing," he said.

Drafters urged industry members who might sign onto the final product — which will be a voluntary code — to provide input. "We've gotten a lot of feedback, but sometime in the near future we're going to reach the point where we feel like we're negotiating with ourselves," one member of the drafting team said.

Some participants expressed concern that the version of the draft code under discussion would require any app that allowed general searches to make disclosures based on the possibility that a user might enter a search string related to medical issues.

One of the drafters said the need to disclose would be based on whether the app collected that information, not on the possibility of searching for medical information. Another drafter said it would depend on whether the app associates the search string with a particular user.

Another participant pointed out that the language in the draft only spoke of disclosing the "collection" of medical information, and did not reference either "use" of the information or association of the information with a particular user. One of the drafters said a change had already been made in the draft but the new version was not finished in time to be distributed and discussed at the meeting.

John Verdi, director-privacy initiatives in NTIA's Office of Policy Analysis and Development, suggested tabling issues related to the descriptions of medical and financial information, and that the drafters incorporate suggestions offered at the meeting into revised language to be circulated later. The next stakeholder meeting is planned for Feb. 21.

Stakeholders also debated whether the short-notice screen should disclose "sharing with the government that is not required," such as sharing information with the National Institutes of Health, or sharing consumer complaints with the government.

Some suggested that such sharing is for the benefit of consumers and didn't need to be included in the short notice. But Jeff Chester, executive director of the Center for Digital Democracy, said, "We think there is a concern when entities are selling information to the government, and that needs to be disclosed."

News: Cybersecurity