Going against the (Appropriate) Flow: A Contextual Integrity Approach to Privacy Policy Analysis
Going against the (Appropriate) Flow: A Contextual Integrity Approach to Privacy Policy Analysis
复制标题
逆（适当）流程：隐私政策分析的上下文完整性方法
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
H. Nissenbaum
中科院分区：
文献类型：
--
作者：
Yan Shvartzshnaider;Noah J. Apthorpe;N. Feamster;H. Nissenbaum
我们提出了一种使用上下文完整性（CI）的框架来分析隐私策略的方法。这种方法允许系统化地检测隐私政策声明中的问题，这些问题阻碍了读者理解和评估公司数据收集实践的能力。这些问题包括缺少上下文细节，模糊的语言，以及对所描述的信息传递的压倒性的可能解释。我们在两种不同的设置中演示了这种方法。首先，我们比较了剑桥Analytica丑闻前后Facebook隐私政策的版本。我们的分析表明，更新后的政策仍然包含基本的模糊性，限制了读者对Facebook数据收集做法的理解。第二，我们成功地众包了来自17家公司的48份隐私政策摘录的CI注释，共有141名众包工作者。这表明普通用户能够可靠地识别隐私政策声明中的上下文信息，并且众包可以帮助将我们的CI分析方法扩展到更多的隐私政策声明。
We present a method for analyzing privacy policies using the framework of contextual integrity (CI). This method allows for the systematized detection of issues with privacy policy statements that hinder readers’ ability to understand and evaluate company data collection practices. These issues include missing contextual details, vague language, and overwhelming possible interpretations of described information transfers. We demonstrate this method in two different settings. First, we compare versions of Facebook’s privacy policy from before and after the Cambridge Analytica scandal. Our analysis indicates that the updated policy still contains fundamental ambiguities that limit readers’ comprehension of Facebook’s data collection practices. Second, we successfully crowdsourced CI annotations of 48 excerpts of privacy policies from 17 companies with 141 crowdworkers. This indicates that regular users are able to reliably identify contextual information in privacy policy statements and that crowdsourcing can help scale our CI analysis method to a larger number of privacy policy statements.