Collaborative Research: DASS: Empirically Evaluating Data Fiduciary Privacy Laws

超过160个国家有数据隐私法，但数字隐私的威胁仍然是一个主要问题。对计算机、心理学、社会和法律的研究证实了这一点，发现这些法律中的大多数都采取了相同的方法，为人们提供透明度，并对个人数据的使用进行某种程度的控制。不幸的是，研究发现，这种方法无法保护隐私，原因有很多，包括人们缺乏时间和专业知识来管理大量在线服务的隐私，以及服务在实施隐私规则时破坏隐私规则的方式。法律的学者们提出了隐私法的替代方法，但没有一种方法得到立法机构的检验或颁布。因此，在本项目中，项目小组正在研究这些拟议的替代类型的隐私法，以预测在线服务将如何变化，从而预测它们将如何影响隐私，特别是对那些最有可能侵犯隐私的人。通过这样做，该团队希望提供所需的信息，制定法律，可以维护我们的社会价值观的隐私。该项目团队正在评估数据受托人的想法，作为一个案例研究，它是如何可能的经验评估新的范式隐私法之前，他们被制定为法律。评估分两个阶段进行：（1）定性方法，以唤起专家对公司如何在特定环境中实施数据信托法的预测，以及（2）用户访谈和推测性设计研讨会，以评估这些预测的实施是否符合隐私脆弱用户的最佳利益。这些方法将通过将其应用于新的和现有的法律，并将结果与这些法律在不同司法管辖区和时间的野外影响的地面实况观察进行比较，从而产生了项目成果，包括评估未来隐私法范例的新方法和作为案例研究的评估数据受托人。该奖项反映了NSF的法定使命，并被认为值得支持通过使用基金会的知识价值和更广泛的影响审查标准进行评估。

Over 160 countries have data privacy laws, yet threats to digital privacy remain a major concern. Research on computers, psychology, society, and the law validates this concern, finding that most of these laws take the same approach of offering people transparency and some measure of control over the use of their personal data. Unfortunately, research finds that this approach fails to protect privacy for many reasons, including people's lack of time and expertise to manage privacy across a vast number of online services and the ways that services undermine privacy rules as they implement them. Legal scholars have proposed alternate approaches to privacy law, but none of them have yet been tested or enacted by legislatures. In this project, therefore, the project team is studying these proposed alternative types of privacy laws in order to predict how online services would change and, thus, how they would affect privacy, especially for those most at risk of privacy violations. By doing so, the team hopes to provide the information needed to make laws that can uphold our societal values of privacy.The project team is evaluating the idea of data fiduciaries as a case study of how it is possible to empirically assess new paradigms of privacy law prior to their being enacted in law. The evaluation takes place in two phases: (1) qualitative methods to evoke expert predictions of how companies would implement data fiduciary laws in specific contexts, and (2) user interviews and speculative design workshops to evaluate whether those predicted implementations would meet the in-context best interests of privacy-vulnerable users. These methods will be validated by applying them to both new and existing laws and comparing results to ground-truth observations of the effects of those laws in the wild across jurisdictions and time, thus resulting in project outcomes that include both new methods for evaluating prospective privacy law paradigms and the evaluation data fiduciaries as a case study.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.