Towards measuring privacy

Abstract

The acceptable threshold for privacy is an individual choice, informed by culture, tradition and experience. That it is important, conversely, is self-evident. We use it to moderate personal information disclosure, how we choose to act and dress every day. However, the debate about privacy has struggled because of an incomplete scholarship that often halts with the question ‘what is privacy?’ Similarly, the affirmative statement ‘privacy is dead’ is often made without further explanation of what we have lost. This thesis provides a clarification of privacy by presenting a formal model and tool for precise discussion. It can be implemented, for example, in a mobile application or embedded on a website. The utility of the formal model is supported by survey research of professionals in the field and those with no particular related work experience. The formal model has given us several insights to how privacy behaves enabling progress towards an interdisciplinary understanding of terminology. In particular, it demonstrates and solves for the problem of transitivity in privacy because it can follow each personal information disclosure as it travels beyond the data subject through a network of people, processes and technologies. In addition to the formal model and observations about the behaviour of privacy, a contribution of this thesis is its review of computer science literature specifically for contributions to privacy research, an assessment of current privacy practitioner methods, a study of privacy impact assessment practices at Ontario hospitals, and a detailed exploration of the possibilities of future work.