Hi everyone,

I've gone through most of the paper and here's a summary of what's being discussed.
The paper is mainly intended "to initiate a debate on the issue of privacy and to make
the technology potential widely known and understood".
The paper addresses the issue of privacy both from an ethical/philosophical/humanistic
(excuse my poor resolution!) and a technological perspective.

Of interest, may be to my colleagues in the philosophy and law tracks, is the authors'
linking of privacy loss to economic loss (which intersects in a way with Marc Rotenberg's
recent post). Here's an excerpt :

"Economic Research
-------------------

Lack of economic research about privacy has left many economists puzzled
about the role of privacy in economic life. Economists consider the
restriction of information flow to result in information asymmetries and
market inefficiencies. Recently it is also becoming increasingly evident
that it is the negative consequences from the unconstrained flow of
personal data that should be studied, rather than simply considering the
subject as an example of restriction of information in general.

The immaturity of economic theory with respect to privacy can be
illustrated by comparing a business suffering from an information security
breach resulting in loss of intellectual property and one that suffers
from a security breach resulting in loss of personal data. The direct
economic losses in the former case are clear, and hence businesses have a
strong incentive to protect their infrastructure against such losses. The
economic losses in the latter case are less clear, manifesting themselves
in the form of damage to the reputation of the business. The customers
suffer losses in the form of invasion of their privacy and theft of their
identity. The cost of repairing these damages is borne by the victims and
society at large. As long as businesses are able to externalise the costs
of better privacy and identity management, we can not expect them to adopt
measures which they feel will impact their cost structure. The desire of
many companies to do good business through appropriate technology and
sound ethics is insufficient to convince all companies to adopt the proper
measures. Incentives need to be found to have businesses internalise the
costs of more advanced ways of dealing with personal data and thereby
limit the negative effects on society."

On the technological side however, nothing seems to be radically new in their
proposal (although further analysis of the technical details once published may be needed).
In fact, the main idea being advocated is the use of central trusted third parties
to broker and coordinate all data transactions.

"The PRIME consortium envisions the Information Society as a domain where people
can use information services in a reliable and trustworthy way while keeping
sovereignty over their private sphere under the same or better conditions that
they are offered in the paper-based world.

In this vision, the digital world reconciles privacy and accountability, and ensures
continuity and compatibility with the traditional world. In particular, the digital
world does not enable erosion of the individual's right to privacy.

People ****need mediators**** in order to really benefit from the information services,
and this is also true for privacy protection. The mediators make the digital world
understandable by all human beings, and they provide a reliable, secure, and trustworthy
environment around people's needs. Such mediators can be human beings or organisations
that provide third-party services such as network operators, Internet service providers, etc."

The second idea proposed in the paper is to enforce privacy policies, and user privacy
preferences using Ontologies, and technologies like P3P. in my opinion, these are labels.
And labels are usually ignored or circumvented.

"Ontologies are used to ***formally*** specify concepts and their relationships.
Ontologies are the enabler for automated reasoning which is used for multiple tasks
within the architecture. PRIME defines languages for the request and release of data
and the remaining functionality of the trust negotiation process and the protocols for
interactions between parties, in particular the negotiation protocol. The above-mentioned
languages and protocols are key building blocks within PRIME, since they enable interoperability
between parties and the controlled release and management of identity data after their disclosure."