Collaborative Research: DASS: Empirically Evaluating Data Fiduciary Privacy Laws

超过160个国家制定了数据隐私法，但对数字隐私的威胁仍然是一个主要问题。对计算机、心理学、社会和法律的研究证实了这种担忧，发现这些法律中的大多数都采取了相同的方法，即为人们提供透明度，并在一定程度上控制他们的个人数据的使用。不幸的是，研究发现，这种方法无法保护隐私的原因有很多，包括人们缺乏时间和专业知识来管理大量在线服务的隐私，以及服务在实施隐私规则时破坏隐私规则的方式。法律学者已经提出了隐私法的替代方法，但这些方法都还没有经过立法机构的测试或颁布。因此，在这个项目中，项目组正在研究这些拟议的替代类型的隐私法，以便预测在线服务将如何变化，从而如何影响隐私，特别是对那些隐私侵犯风险最大的人。通过这样做，该团队希望提供所需的信息，以制定能够维护我们隐私的社会价值观的法律。项目团队正在评估数据受托的想法，作为一个案例研究，如何在新的隐私法范例在法律颁布之前对其进行经验评估。评估分两个阶段进行：(1)定性方法，以唤起专家对公司将如何在特定背景下实施数据信托法的预测，以及(2)用户访谈和推测性设计研讨会，以评估这些预测的实施是否将满足隐私脆弱用户的背景最佳利益。这些方法将通过将它们应用于新的和现有的法律，并将结果与这些法律在不同司法管辖区和不同时间的野外影响的实地观察结果进行比较，从而产生项目结果，其中包括评估未来隐私法范例的新方法和作为案例研究的评估数据受托人。该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

Over 160 countries have data privacy laws, yet threats to digital privacy remain a major concern. Research on computers, psychology, society, and the law validates this concern, finding that most of these laws take the same approach of offering people transparency and some measure of control over the use of their personal data. Unfortunately, research finds that this approach fails to protect privacy for many reasons, including people's lack of time and expertise to manage privacy across a vast number of online services and the ways that services undermine privacy rules as they implement them. Legal scholars have proposed alternate approaches to privacy law, but none of them have yet been tested or enacted by legislatures. In this project, therefore, the project team is studying these proposed alternative types of privacy laws in order to predict how online services would change and, thus, how they would affect privacy, especially for those most at risk of privacy violations. By doing so, the team hopes to provide the information needed to make laws that can uphold our societal values of privacy.The project team is evaluating the idea of data fiduciaries as a case study of how it is possible to empirically assess new paradigms of privacy law prior to their being enacted in law. The evaluation takes place in two phases: (1) qualitative methods to evoke expert predictions of how companies would implement data fiduciary laws in specific contexts, and (2) user interviews and speculative design workshops to evaluate whether those predicted implementations would meet the in-context best interests of privacy-vulnerable users. These methods will be validated by applying them to both new and existing laws and comparing results to ground-truth observations of the effects of those laws in the wild across jurisdictions and time, thus resulting in project outcomes that include both new methods for evaluating prospective privacy law paradigms and the evaluation data fiduciaries as a case study.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.