Making Modest Moves: Individual Users and Privacy in the Cloud
2 Pages Posted: 3 Apr 2012
Date Written: April 1, 2012
It is generally accepted that no one reads these agreements. They click accept, because otherwise they could not use the service of their choice, and these terms are typically almost entirely disregarded as a factor when services are chosen. If a user is asked why he does not read these terms, he might offer reasons like the dense legalese, or the length of these agreements.
As part of this work, we analyzed and categorized the terms of TOS agreements and privacy policies of several cloud services to aid in our assessment of the state of user privacy in the cloud. Our empirical analysis showed that providers take similar approaches to user privacy, and were consistently more detailed when describing the user’s obligations to the provider than when describing the provider’s obligations to the user. This asymmetry, combined with these terms’ nonnegotiable nature, led us to conclude that the current approach to user privacy in the cloud is in need of serious revision.
Privacy and autonomy are often discussed as values necessary for a free society, and these values are threatened by the asymmetric terms and unawareness of parties agreeing to such terms. Based on analysis of the law, theories of privacy developed by scholars, and findings of research into human-computer interaction, and analogizing to the ethical guidelines of informed consent followed by social science researchers, we propose the following modest but realistically achievable goals to advance user privacy in the cloud. First, we suggest adopting a legal regime that requires companies to provide baseline protections for personal information, provide privacy enhanced services to customers that demand it, and also take steps to enhance the parties’ control over their own data. We further suggest applying laws governing fiduciary relationships in some circumstances. Second, we argue that collectors and users of personal information in the cloud should be held to ethical guidelines mandating informed consent. We argue that to remove the informational asymmetry, it is also essential that consumers become more informed about the contents of these agreements, and provide suggestions for how that can be accomplished. Ultimately, our goal with this piece is to apply established law and privacy theories to services in the cloud, and set forth a model for the protection of information privacy that recognizes the importance of informed users.
Keywords: privacy, privacy law, human computer interaction
Suggested Citation: Suggested Citation