Cover Privacy Papers for Policy Makers 2012 Inside front cover The publication of “Privacy Papers for Policy Makers” was supported by AT&T, Microsoft, and GMAC. November 7, 2012 We are delighted to provide you with FPF’s third annual “Privacy Papers for Policy Makers,” representing cutting-edge research and analysis on a variety of important privacy issues. The featured works were selected by members of the Future of Privacy Forum Advisory Board (scholars, privacy advocates, and Chief Privacy Officers) based on criteria emphasizing clarity, practicality and overall utility. Given the excellent submissions we received, choosing was a difficult task. But we believe our Advisory Board has chosen well, and has put together a diverse and thought-provoking collection. Two of the papers were recipients of the IAPP award for best papers presented at the 2012 Privacy Law Scholars Conference. We hope this relevant and timely scholarship helps inform and stimulate thinking among policy makers and policy influentials in the US and around the world, with whom we are sharing this compilation. We are delighted to share new ways of thinking about privacy. We want to thank AT&T, Microsoft, and GMAC for their special support of the “Privacy Papers” project. Sincerely yours, Christopher Wolf Jules Polonetsky Founder and Co-chair Director and Co-chair Future of Privacy Forum Advisory Board Alessandro Acquisti Simon Davies Jeff Jarvis Associate Professor of Information Technology Founder, Privacy International Associate Professor; Director of the Interactive and Public Policy at the Heinz College, Program, Director of the Tow-Knight Center for Carnegie Mellon University Michelle De Mooy Senior Associate, National Priorities, Entrepreneurial Journalism at the City University Jim Adler Consumer Action of New York Chief Privacy Officer & General Manager, David Kahan Data Systems, Intelius Elizabeth Denham Information and Privacy Commissioner General Counsel, Jumptap Ellen Agress for British Columbia Ian Kerr Senior Vice President and Deputy General Canada Research Chair in Ethics, Counsel, News Corporation Michelle Dennedy Chief Privacy Officer, McAfee Law & Technology, University of Ottawa, Annie I. Antón Faculty of Law Leslie Dunlap Professor and Chair, Georgia Tech School Bill Kerrigan of Interactive Computing Vice President of Privacy, Policy and Trust, Yahoo! Inc. CEO, Abine, Inc. Stephen Balkam Brian Knapp CEO, Family Online Safety Institute Benjamin Edelman Assistant Professor, Harvard Business School Chief Privacy Officer and Vice President, Kenneth A. Bamberger Corporate Affairs, Loopt Professor of Law, Berkeley School of Law Erin Egan Chief Privacy Officer, Policy, Facebook Jerry Kovach Elise Berkower Senior Vice President, External Affairs, Neustar Associate General Counsel, Privacy, Keith Enright Senior Corporate Counsel, Google John Kropf The Nielsen Company Deputy Counsel, Privacy and Information Debra Berlyn Leigh Feldman Governance, Reed Elsevier President, Consumer Policy Solutions SVP, Senior Privacy Executive Global Compliance Risk – Enterprise Privacy, Bank of America Fernando Laguarda Joan ( Jodie) Z. Bernstein Vice President, External Affairs and Policy Counselor, Counsel, Kelley Drye & Warren, LLP and former Eric Friedberg Time Warner Cable Co-President, Stroz Friedberg director of the Bureau of Consumer Protection Manuj Lal at the Federal Trade Commission Rip Gerber Vice President, Legal Affairs, Press Ganey Michael Blum President and CEO, Locaid Associates, Inc. General Counsel, Quantcast Scott Goss Barbara Lawler Bruce Boyden Senior Privacy Counsel, Qualcomm Chief Privacy Officer, Intuit Assistant Professor of Law, Susan Gindin Peter Lefkowitz Marquette University Law School Sr. Privacy Manager, Wal-Mart Chief Privacy Officer, Oracle Allen Brandt Jennifer Barrett Glasgow Adam Lehman Corporate Counsel, Data Privacy & Protection, Chief Privacy Officer, Acxiom Chief Operating Officer and GM, Lotame Solutions Graduate Management Admission Council Greg Goeckner (GMAC) Gerard Lewis Executive Director, Merchant Risk Council Senior Counsel and Chief Privacy Officer, Comcast Jim Brock Kimberly Gray CEO, PrivacyChoice Chris Libertelli Chief Privacy Officer, IMS Health Head of Global Public Policy, Netflix Justin Brookman Sean Hanley Chris Lin Director, Consumer Privacy, Director of Compliance, Zynga Game Network, Inc. Center for Democracy & Technology Executive Vice President, General Counsel Pamela Jones Harbour and Chief Privacy Officer, comScore, Inc. Kathryn C. Brown Former Federal Trade Commissioner; Partner, Brendon Lynch Senior Vice President, Public Policy Development Fulbright & Jaworski LLP and Corporate Responsibility, Verizon Chief Privacy Officer, Microsoft Megan Hertzler Mark MacCarthy James M. Byrne Director of Information Governance, Xcel Energy Chief Privacy Officer, Vice President of Public Policy, The Software Lockheed Martin Corporation Michael Ho & Information Industry Association VP Business Development, Bering Media Ryan Calo Siobhan M. MacDermott Assistant Professor, University of Washington David Hoffman Chief Privacy Officer, AVG Technologies School of Law Affiliate Scholar, Stanford Center Director of Security Policy and Global Privacy Fran Maier for Internet and Society Officer, Intel Founder and Board Chair, TRUSTe Dr. Ann Cavoukian Marcia Hoffman Jennifer Mardosz Information and Privacy Commissioner of Ontario Staff Attorney, Electronic Frontier Foundation Chief Privacy Officer, Fox Entertainment Group Brian Chase Tim Hollenbeck William McGeveran General Counsel, Foursquare Labs, Inc. Director of Global Ethics and Compliance, Associate Professor, University of Minnesota Procter & Gamble Danielle Citron Law School Professor of Law, University of Maryland Chris Hoofnagle Terry McQuay Law School Director, Berkeley Center for Law & Technology’s President, Nymity information privacy programs and senior fellow Maureen Cooney to the Samuelson Law, Technology Scott Meyer Senior Counsel and Deputy Chief Privacy Officer, & Public Policy Clinic CEO, Evidon Sprint Nextel Jane Horvath Doug Miller Lorrie Faith Cranor Apple, Inc. Global Privacy Leader, AOL, Inc. Associate Professor of Computer Science and Saira Nayak Engineering, Carnegie Mellon University Sandra Hughes Sandra Hughes Strategies, Ltd. Director of Policy, TRUSTe Mary Culnan Professor Emeritus, Bentley University Brian Huseman Director, Public Policy, Amazon Future of Privacy Forum Advisory Board (continued) Lina Ornelas JoAnn Stonier General Director for Privacy SVP and Global Privacy & Data Protection Officer, Self-Regulation, Federal Institute for Access MasterCard to Information and Data Protection Mexico Zoe Strickland Kimberley Overs VP, Chief Privacy Officer, United Health Group Assistant General Counsel, Pfizer, Inc. Greg Stuart Harriet Pearson CEO, Mobile Marketing Association Partner, Hogan and Lovells Lior Jacob Strahilevitz George Pappachen Sidley Austin Professor of Law, University of Chicago Chief Privacy Officer, Kantar Group Law School Christina Peters Peter Swire Senior Counsel, Security Professor, Ohio State University Moritz College and Privacy, IBM of Law Robert Quinn Omar Tawakol Chief Privacy Officer and Senior Vice President CEO, BlueKai for Federal Regulatory, AT&T Omer Tene Peter Rabinowitz Associate Professor, College of Management School Chief Privacy Counsel, American Express of Law, Rishon Le Zion, Israel MeMe Rasmussen Owen Tripp VP, Chief Privacy Officer, Associate General Co-Founder and Chief Operating Officer, Counsel, Adobe Systems Reputation.com Katie Ratté Catherine Tucker Executive Counsel, Privacy Policy and Strategy, Mark Hyman, Jr. Career Development Professor The Walt Disney Company and Associate Professor of Management Science, Joel R. Reidenberg Sloan School of Management, MIT Professor of Law, Fordham University School Steven Vine of Law Chief Privacy Officer, PulsePoint Neil Richards Hilary Wandall Professor of Law, Washington University Chief Privacy Officer, Merck & Co., Inc. Law School Mark Weinstein Shirley Rooker Founder and CEO, Sgrouples President, Call for Action Michael Zimmer Mike Sands Assistant Professor in the School of Information President and Chief Executive Officer, BrightTag Studies, University of Wisconsin-Milwaukee Russell Schrader General Electric Chief Privacy Officer and Associate General Counsel – Global Enterprise Risk, Visa Inc. Paul Schwartz Professor of Law, University of California-Berkeley School of Law Cary Sherman Chairman and CEO, The Recording Industry Association of America Ho Shin General Counsel, Millennial Media Meredith Sidewater Senior Vice President and General Counsel, Lexis Nexis Risk Solutions Emery Simon Counselor, Business Software Alliance Dale Skivington Chief Privacy Officer, Dell Daniel Solove Professor of Law, George Washington University Law School Cindy Southworth Vice President of Development & Innovation, National Network to End Domestic Violence (NNEDV) Table of Contents Bridging the Gap Between Privacy and Design Deidre Mulligan and Jennifer King .....................................................................................................1 ‘Going Dark’ Versus a ‘Golden Age of Surveillance’ Peter Swire and Kenesa Ahmad ............................................................................................................3 How Come I’m Allowing Strangers to go Through My Phone? Smart Phones and Privacy Expectations Jennifer King ......................................................................................................................................5