Government officials tell companies at Web 2.0 Summit that they are asking for trouble if they collect data first and ask questions later.
10 Lessons Learned By Big Data Pioneers
(click image for larger view and for slideshow)
Would-be data miners were urged to dig carefully at the Web 2.0 Summit in San Francisco on Tuesday.
Ann Cavoukian, information and privacy commissioner of Ontario, Canada, and David Vladeck, director of the Federal Trade Commission's Bureau of Consumer Protection, took turns advising the entrepreneurs and business leaders in the audience to gather only data that's necessary and to do so in a way that respects user privacy.
Cavoukian advocated what she called privacy by design, building privacy protections into products because it's better business and better for consumers. Privacy and business interests are not a zero-sum game, she insisted. It can be a positive-sum game, where businesses can gain better, more actionable information by involving consumers in the process.
Businesses have a choice between privacy-by-design or privacy-by-disaster, she suggested.
"Privacy is about control," said Cavoukian. "The individual should control what happens to the information."
[ Facebook has been mentioned frequently at the Web 2.0 Summit because it has so much data. Ironically, its biggest problem may be that it presents users with too much information. ]
If Cavoukian's vision of proactive privacy protection represented the carrot, Vladeck described the stick. As the U.S. government's consumer privacy enforcer, Vladeck acknowledged that the business leaders in the audience didn't want to hear from him and he insisted that he didn't want to hear about them.
Don't collect data you don't need, urged Vladeck. "It's an albatross that can come back and really bite you," he said.
He urged entrepreneurs to familiarize themselves with privacy laws like the Children's Online Privacy Protection Act, which forbids the collection of personal information from children under 13 without parental consent. He cited the FTC's recent settlement with mobile app maker Broken Thumb Apps as an example of how companies can get in trouble when they fail to follow the law.
And lest anyone be tempted to ignore the call to self-regulate, Danny Weitzner, from the White House Office of Science and Technology Policy, spoke briefly to remind conference attendees that the openness of the Internet should not be taken for granted.
Those who have been paying attention to the global tide of Internet policy will know that the tradition of leaving the Internet loosely regulated is being reevaluated in various countries, he said. This is happening not just in countries like China but in European countries like Germany, he said.
The message coming out of these sessions was clear: Be careful with your data, or be prepared to deal with regulators.
Published: 2015-06-29 CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 22.214.171.124 and 7.0 before 126.96.36.199 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Published: 2015-06-29 EMC Unisphere for VMAX 8.x before 188.8.131.52 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
Published: 2015-06-29 IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 through 184.108.40.206 on UNIX allows local users to write to executable files, and consequently obtain root privileges, via unspecified vectors.
Published: 2015-06-28 IBM Unified Extensible Firmware Interface (UEFI) on Flex System x880 X6, System x3850 X6, and System x3950 X6 devices allows remote authenticated users to cause an unspecified temporary denial of service by using privileged access to enable a legacy boot mode.