Concepts for personal location privacy policies

ABSTRACT

A Location Based Service (LBS) is a service where knowledge of the location of an object or individual is used to personalise the service. Typical examples include the E911 emergency location service in the US and 'Where is the nearest xx' type of services. However, since these services often may be implemented in a way that exposes sensitive personal information, there are several privacy issues to consider. A key question is: "Who should have access to what location information under which circumstances?It is our view that individuals should be equipped with tools to become in the position to formulate their own personal location privacy policies, subject to applicable rules and regulations.This paper identifies concepts that may be useful when formulating such policies. The key concept is that of an observation of a located object. An observation typically includes the location, the identity of the object, the time the observation was made and the speed of the object. The idea is that the individual should be able to adjust the accuracy at which these observations are released depending on parameters such as the intended use and the identity of the recipient.We provide fragments of a language for formulating personal location privacy policies and give some small examples illustrating the kind of policies that we have in mind.

REFERENCES

• 1: Giusseppe Ateniese , Amir Herzberg , Hugo Krawczyk , Gene Tsudik, Untraceable mobility or how to travel incognito, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.9, p.871-884, April 23, 1999
• 2: Giusseppe Ateniese , Amir Herzberg , Hugo Krawczyk , Gene Tsudik, Untraceable mobility or how to travel incognito, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.9, p.871-884, April 23, 1999
• 3: Bahl, P., and Padmanabhan, V. N. "Radar: An in-building rfbased user location and tracking system," In Proceedings of the IEEE Infocom 2000, Tel-Aviv, Israel, vol. 2, Mar. 2000, pp. 775--784.
• 4: Oliver Berthold , Marit Köhntopp, Identity management based on P3P, International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability, p.141-160, January 2001, Berkeley, California, United States
• 5: Fox, S. The Internet Life Report. Trust and Privacy Online: Why Americans Want to Rewrite the Rules. The Pew Internet & American Life Project. August 20, 2000. http://www.pewinternet.org/reports/pdfs/PIP_Trust_Privacy_ Report.pdf
• 6: Chii-Hwa Lee , Min-Shiang Hwang , Wei-Pang Yang, Enhanced privacy and authentication for the global system for mobile communications, Wireless Networks, v.5 n.4, p.231-243, July 1999 [doi>10.1023/A:1019103228471]
• 7: Ulf Leonhardt , Jeff Magee, Security Considerations for a Distributed LocationService, Journal of Network and Systems Management, v.6 n.1, p.51-70, March 01, 1998 [doi>10.1023/A:1018777802208]
• 8: Norwegian parliament. 'Act of 14. April 2000 No. 31 relating to the processing of personal data (Personal Data Act)'. http://www.personvern.uio.no/regler/peol_engelsk.pdf
• 9: Kai Rannenberg, How Much Negotiation and Detail Can Users Handle? Experiences with Security Negotiation and the Granularity of Access Control in Communications, Proceedings of the 6th European Symposium on Research in Computer Security, p.37-54, October 04-06, 2000
• 10: Reservasjonsregisteret. The Br~nn~ysund Register Centre. http://www.brreg.no/oppslag/reservasjon/index.html
• 11: Robinson, T. Location is everything. Internet week online, tuesday September 12, 2000. http://www.internetwk.com/lead/lead091200.htm
• 12: Mike Spreitzer , Marvin Theimer, Providing location information in a ubiquitous computing environment (panel session), Proceedings of the fourteenth ACM symposium on Operating systems principles, p.270-283, December 05-08, 1993, Asheville, North Carolina, United States
• 13: Michael Spreitzer , Marvin Theimer, Scalable, secure, mobile computing with location information, Communications of the ACM, v.36 n.7, p.27, July 1993 [doi>10.1145/159544.159558]
• 14: Sun Microsystems. JAVA Location Services. Java- Location Services: The New Standard for Location-enabled e-Business. http://www.mapinfo.com/community/free/library/java_locati on_svcs_whitepaper.pdf http://www.jlocationservices.com/company/ImageMatters/jav alocationServices.html
• 15: W3C. P3P and Privacy on the Web FAQ. http://www.w3.org/P3P/P3FAQ
• 16: W3C. Platform for Privacy Preferences (P3P) Project. http://www.w3.org/P3P/
• 17: XMARC INC., WISE 2.0, http://www.xmarc.com/news_events/2001/press_air-xmarc. htm

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.1 Network Architecture and Design
          Subjects: Wireless communication

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

General Terms:
Legal Aspects, Management, Security

Keywords:
EDGE, GPRS, GSM, PCS, UMTS, iMode privacy policy