Database privacy: balancing confidentiality, integrity and availability

ABSTRACT

The emphasis in database privacy should fall on a balance between confidentiality, integrity and availability of personal data, rather than on confidentiality alone. This balance should not necessarily be a trade-off, but should take into account the sensitive nature of the data being stored and attempt to increase all three dimensions to the highest level possible.To achieve such a balance, technological means should be developed.The paper illustrates some of the inherent problems in database privacy that should be addressed by technical solutions. It next demonstrates that the notion of privacy is complex; this complexity is likely to impede development of technical solutions.Finally, the paper finally uses the notion of informed consent to illustrate how the privacy problem can be viewed from multiple angles to flesh out the underlying problems that may be addressed by technical solutions.

REFERENCES

• 1: Constitution of the Republic of South Africa, 1996. Act 108 of 1996.
• 2: Code of Federal Regulations, title 45, Public Welfare, part 46 Protection of human subjects, November 2001.
• 3: Anne Wells Branscomb, Who owns information?: from privacy to public access, Basic Books, Inc., New York, NY, 1994
• 4: D. Brin. The Transparent Society --- Will Technology Force us to Choose between Privacy and Freedom? Perseus Books, Reading, MA, 1998.
• 5: Council for International Organizations of Medical Sciences (CIOMS). International Ethical Guidelines for Biomedical Research Involving Human Subjects. 2002.
• 6: A. Etzioni. The Limits of Privacy. Basic Books, New York, NY, 1999.
• 7: A. Etzioni. Medical records --- enhancing privacy. preserving the common good. Hastings Center Report, 23(2):14--23, 1999.
• 8: J. Fox. Chomsky and Globalisation. Icon Books, Cambridge, UK, 2001.
• 9: Eran Gabber , Phillip B. Gibbons , David M. Kristol , Yossi Matias , Alain Mayer, Consistent, yet anonymous, Web access with LPWA, Communications of the ACM, v.42 n.2, p.42-47, Feb. 1999 [doi>10.1145/293411.293447]
• 10: Simson Garfinkel, Database nation: the death of privacy in the 21st century, O'Reilly & Associates, Inc., Sebastopol, CA, 2001
• 11: J. Garret. John rawls on moral principles for individuals: With emphasis on implications for business ethics, February 2002. http://www.wku.edu/~jan.garrett/320jrpfi.htm.
• 12: David Goldschlag , Michael Reed , Paul Syverson, Onion routing, Communications of the ACM, v.42 n.2, p.39-41, Feb. 1999 [doi>10.1145/293411.293443]
• 13: D. Hume. Of the standard of taste. In I. Aalen, editor, Philosophical Works, 3: Essays, moral, political and literary, pages 266--284. Scientia Verlag, 1964.
• 14: I. Kant. Critique of Judgment. Hackett, 1987. Originally published in German in 1790; translated by Werner S. Pluhar.
• 15: Frans A. Lategan , Martin S. Olivier, Enforcing Privacy by Withholding Private Information, Proceedings of the IFIP TC11 Fifteenth Annual Working Conference on Information Security for Global Information Infrastructures, p.421-430, August 22-24, 2000
• 16: F. A. Lategan and M. S. Olivier. PrivGuard: A model to protect private information based on its usage. South African Computer Journal, 2002. In press.
• 17: A. Margalit. The Decent Society. Harvard University Press, Cambridge, MA, 1996.
• 18: Nordic Committee on Bioethics. Who owns our genes?, Tallin, Estonia, October 1999.
• 19: M. S. Olivier. Position for panel on privacy. In Sixteenth IFIP Working Conference on Database and Application Security, August 2002. To be published in Database and Application Security XVI in 2003.
• 20: J. Rawls. A Theory of Justice. Harvard University Press, 1971.
• 21: Joseph Reagle , Lorrie Faith Cranor, The platform for privacy preferences, Communications of the ACM, v.42 n.2, p.48-55, Feb. 1999 [doi>10.1145/293411.293455]
• 22: Michael K. Reiter , Aviel D. Rubin, Anonymous Web transactions with Crowds, Communications of the ACM, v.42 n.2, p.32-48, Feb. 1999 [doi>10.1145/293411.293778]
• 23: A. Rosenberg. Privacy as a matter of taste and right. In E. F. Paul, F. D. Miller, and J. Paul, editors, The Right to Privacy, pages 68--90, Cambridge, 2000. Cambridge University Press.
• 24: L. B. Sauerwein and J. J. Linnemann. Handleiding voor Verwerkers van Persoonsgegevens --- Wet Bescherming Persoonsgegevens. Ministerie van Justitie, Den Haag, Nederland, April 2002.
• 25: R.-C. Serban. The Private Cyberspace: Modeling Electronic Environments inhabited by Privacy-concerned Agents. PhD thesis, Vrije Universiteit, Amsterdam, The Netherlands, 2002.
• 26: Reginald Whitaker, The End of Privacy: How Total Surveillance Is Becoming a Reality, New Press, 1998
• 27: M. Winston. On Chomsky. Wadsworth, Bellmont, CA, 2002.
• 28: J. Wise. Patients do not read consent forms. BMJ, 313:1421, December 1996.

INDEX TERMS

General Terms:
Security

Keywords:
availability, confidentiality, database privacy, dataveillance, integrity, personal data