Government officials tell companies at Web 2.0 Summit that they are asking for trouble if they collect data first and ask questions later.
10 Lessons Learned By Big Data Pioneers
(click image for larger view and for slideshow)
Would-be data miners were urged to dig carefully at the Web 2.0 Summit in San Francisco on Tuesday.
Ann Cavoukian, information and privacy commissioner of Ontario, Canada, and David Vladeck, director of the Federal Trade Commission's Bureau of Consumer Protection, took turns advising the entrepreneurs and business leaders in the audience to gather only data that's necessary and to do so in a way that respects user privacy.
Cavoukian advocated what she called privacy by design, building privacy protections into products because it's better business and better for consumers. Privacy and business interests are not a zero-sum game, she insisted. It can be a positive-sum game, where businesses can gain better, more actionable information by involving consumers in the process.
Businesses have a choice between privacy-by-design or privacy-by-disaster, she suggested.
"Privacy is about control," said Cavoukian. "The individual should control what happens to the information."
[ Facebook has been mentioned frequently at the Web 2.0 Summit because it has so much data. Ironically, its biggest problem may be that it presents users with too much information. ]
If Cavoukian's vision of proactive privacy protection represented the carrot, Vladeck described the stick. As the U.S. government's consumer privacy enforcer, Vladeck acknowledged that the business leaders in the audience didn't want to hear from him and he insisted that he didn't want to hear about them.
Don't collect data you don't need, urged Vladeck. "It's an albatross that can come back and really bite you," he said.
He urged entrepreneurs to familiarize themselves with privacy laws like the Children's Online Privacy Protection Act, which forbids the collection of personal information from children under 13 without parental consent. He cited the FTC's recent settlement with mobile app maker Broken Thumb Apps as an example of how companies can get in trouble when they fail to follow the law.
And lest anyone be tempted to ignore the call to self-regulate, Danny Weitzner, from the White House Office of Science and Technology Policy, spoke briefly to remind conference attendees that the openness of the Internet should not be taken for granted.
Those who have been paying attention to the global tide of Internet policy will know that the tradition of leaving the Internet loosely regulated is being reevaluated in various countries, he said. This is happening not just in countries like China but in European countries like Germany, he said.
The message coming out of these sessions was clear: Be careful with your data, or be prepared to deal with regulators.
Published: 2015-07-06 Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.
Published: 2015-07-06 Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block.
Published: 2015-07-06 Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username, a (2) node title, or a (3) team entity title.
Published: 2015-07-06 Cross-site scripting (XSS) vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields.
Published: 2015-07-06 Cross-site scripting (XSS) vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the (1) question and (2...