Section 20.4. Privacy as a Process

20.4. Privacy as a Process

As we progressed, it became more and more apparent that the most natural way to look at the privacy space was to view privacy as a process using the framework to model that process. In the process model, there is a "building up" of information feeding back to the user. We could say that the more categories a solution's features belong to, the more comprehensive it must be (and assume that a more comprehensive solution is better, as it gives the user more control over his privacy). Hence, the "best" solutions have features to address each stage of the process. Figure 20-3 illustrates this idea, showing examples of features from the study^[28] along each stage in the privacy process.

^[28] Features of high agreement from phase two were selected for these examples; recall that there was strong evidence to conclude that the ratings for these were highly reliable.

The privacy process shown in this figure begins with general awareness of privacy needs and issues and includes feedback from each stage, with each stage adding to our knowledge and ability to make informed decisions, as follows:

• Awareness. Provides the basis for all privacy-protective behaviors .

• Prevention. Implies having awarenesswe cannot try to prevent privacy invasion unless we know about the problems (e.g., why they should be addressed), as well as about techniques for prevention. Prevention is passive, but without preventative measures in place, privacy invasions are undetectable.

  Figure 20-3. The Privacy Space Framework as a process

  
  
  

• Detection. When detection features are activated (as preventative measures), the information they relay gives us the ability to respond if a problem is found. In other words, without detection, a responsive action has no cause because no information would exist to support such an action.

• Response. Stops the violation from continuing.

• Recovery. Returns the system to an acceptable state. Because recovering before the incident is addressed would not prevent it from happening again, response must come first.

This process description may seem confusing because there is a lot of interplay between stages, and because our vocabulary to describe what is happening is somewhat limited. Still, it is important for users to understand that privacy is an ongoing process that requires continuous attention.