Background

Increasing use of computers and networks in business, government, recreation, and almost all aspects of daily life has led to a proliferation of sensitive data about people and organizations. Concern about the ownership, control, privacy, and accuracy of these data has become a top priority legally, socially, and technologically. Many organizations have developed "privacy policies" (and other forms of "user agreements" and "partner agreements") in order to communicate to potential users and organizational partners the rules that govern their collection, mining, sharing, and retention of sensitive data. In addition to these private policies, processing of personal information on the Web is also governed by a range of legal requirements. Diverse technologies have been developed to enable anonymous or pseudonymous transactions, thus protecting stakeholders from abuse of their sensitive databy preventing the linkage of their data to their identities. Web standards have been set out to enable better communication of policies and preferences between data collectors and data subjects.

Despite all of this, policies, anonymizers, and pseudonymizers and even laws cannot be effective without enforcement and accountability.

Some Questions for Discussion

• How can a potential user know that an organization actually follows the policy that is posted on its website or the laws to which the site operator is subject? What legal recourse does she have if she discovers that it doesn't?
• How can an organization that has carefully crafted a privacy policy actually ensure that its database and other information systems, as well as its employees and organizational partners, comply with that policy?
• How can we represent the various privacy rules (legal or private) and reason over them to assess compliance?
• How can anonymous or pseudonymous entities be held accountable for their actions?
• How can the vendors of anonymity and pseudonymity technology be held accountable for the security and privacy claims that they make about their products and services?

Workshop Goals and Scope

This workshop will bring together computer scientists, technology developers, lawyers, and other researchers interested in the general issues of accountability for and enforcement of rules for handling sensitive data. The main workshop goals are exchange of information about the state of the art in accountability and enforcement and formulation of research-agenda items, both short- and long-term, in this burgeoning area.

Participation

If you would like to participate in this workshop, please register by contacting the organizers as instructed below. A small amount of travel funding isavailable for participants who do not have access to other sources of support.

Workshop Organization

Organizers

• Joan Feigenbaum, Yale <joan.feigenbaum@yale.edu>
• Daniel Weitzner, MIT <djweitzner@csail.mit.edu>

Schedule

See the Workshop Agenda

The Workshop program will run from 9 am to 6 pm on both days. A dinner will be organized (but likely self-funded) on Wednesday evening.

Venue

The workshop will be held at the MIT Computer Science and Artificial Intelligence Lab in the Stata Center (Classroom 144) on the first floor of the building.

Directions to Stata and parking information.

Hotel Information

Important Dates