8-533 / 8-733 / 19-608 / 95-818: Privacy Policy, Law, and Technology

Fall 2015: Tuesday and Thursday 3 - 4:20 pm, NSH 3002
Class web site: http://cups.cs.cmu.edu/courses/pplt-fa15/ [previous semesters]
Class mailing list: http://cups.cs.cmu.edu/mailman/listinfo/privacy-class

Instructor: Lorrie Cranor, Professor of Computer Science and Engineering & Public Policy

• Email: lorrie AT cs DOT cmu DOT edu
• Web: http://lorrie.cranor.org/
• Office: CIC 2207
• Office hours: by appointment

Instructor: Rebecca Balebako, Adjunct instructor, Institute of Software Research

• Email: rebeccabalebako AT gmail DOTcom
• Web: http://www.rebeccahunt.com
• Office: ---
• Office hours: by appointment

Teaching Assistant: Abby Marsh

• Email:  acmarsh AT cs DOT cmu DOT edu
  
• Web:  ---
• Office: CIC 2222E
• Office hours: by appointment

This course focuses on policy issues related to privacy from the perspectives of governments, organizations, and individuals. We will begin with a historical and philosophical study of privacy and then explore recent public policy issues. We will examine the privacy protections provided by laws and regulations, as well as the way technology can be used to protect privacy. We will emphasize technology-related privacy concerns and mitigation, for example: social networks, smartphones, behavioral advertising (and tools to prevent targeted advertising and tracking), anonymous communication systems, big data, and drones.

This course is part of a three-course series of privacy courses offered as part of the MSIT-Privacy Engineering masters program. These courses may be taken in any order or simultaneously. Foundations of Privacy (offered in the Fall semester) offers more indepth coverage of technologies and algorithms used to reason about and protect privacy. Engineering Privacy in Software (offered in the Spring semester) focuses on the methods and tools needed to design systems for privacy.

This course is intended primarily for graduate students and advanced undergraduate students (juniors and seniors) with some technical background. Programming skills are not required. 8-733, 19-608, and 95-818 are 12-unit courses for PhD students. Students enrolled under these course numbers will have extra assignments and will be expected to do a project suitable for publication. 8-533 is a 9-unit course for undergraduate students. Masters students may register for any of the course numbers permitted by their program. This course will include a lot of reading, writing, and class discussion. Students will be able to tailor their assignments to their skills and interests, focusing more on programming or writing papers as they see fit. However, all students will be expected to do some writing and some technical work. A large emphasis will be placed on research and communication skills, which will be taught throughout the course.

Peter P. Swire and Kenesa Ahmad. Foundations of Information Privacy and Data Protection: A Survey of Global Concepts, Laws and Practices. IAPP: 2012.

J.C. Cannon. Privacy in Technology: Standards and Practices for Engineers and Security and IT Professionals. IAPP: 2014.

Order these books from the IAPP at https://privacyassociation.org/certify/get-started/cipt/.

All online papers are either publicly available for free, available through the CMU library for free, or available in a password-protected part of this website to students in this course. (The CMU library provides a VPN for off-campus and wireless access to library materials.)

Note on the IAPP certification exam:

This year IAPP is offering CMU students a Student Certification Package which includes: 1 year IAPP membership + textbooks + online training materials + practice exam + 1 Computer Based Test Exam for $120 per student.

Normally you would have to pay $50 for student membership, $550 to take the exam, over $100 for the books, and over $1000 for access to the online training materials and practice tests. So this is a good deal. If you are taking 8-533 / 8-733 / 19-608 / 95-818 Privacy Policy, Law and Technology you will need these books for class, so even if you don't plan to take the exam you might want to get the student package.

Exams will take place at local Kryterion testing centers (see http://www.kryteriononline.com/Locate-Test-Center - the most convenient center to CMU is at 118 52nd Street 15201). You can schedule the exam whenever you want. If you are taking CMU privacy engineering classes this fall, we recommend you take the exam in December or January.

If you would like to sign up for the student certification package, please fill out the form at: http://goo.gl/forms/omLXMjgpJ4. We will send this information to IAPP and they will contact you to collect your payment information. We would like to get people signed up by September 4 so that everyone who needs their books for class will get them promptly.

Optional texts

Dave Eggers. The Circle. Knopf, 2013.

Objectives:

• Be able to discuss why privacy is important to society
• Be familiar with the fair information practice principles as well as the privacy law and policy landscape in the United States
• Understand the differences between privacy regulation in the US and EU, and be able to discuss different regulatory approaches to privacy
• Be able to read, understand, and evaluate privacy policies
• Understand the mechanics of online tracking and other technologies with privacy implications
• Be able to communicate the privacy implications of a technology with policy-makers, lawyers, and engineers
• Be prepared to pass the IAPP Certified Information Privacy Professional exams (These exams will be given on campus this spring. They will be offered free of charge to students who are IAPP student members. See https://privacyassociation.org/certify/programs/ )

Note, this schedule is subject to change. The class web site will have the most up-to-date version of this calendar. Assignments will be finalized at least one week before due date or as announced in class.

Your final grade in this course will be based on:

• 10% class participation (class attendance, participation in class and online discussions)
• 15% quizzes
• 25% homework assignments
• 25% project
• 25% Midterms

You are expected to complete the reading assignments before the class session for which they were assigned. Class discussions will often be based on these assignments and you will not be able to participate fully if you have not done the reading. It is suggested that you write up summaries and highlights as you read each chapter or paper and bring them with you to class.

Quizzes at the beginning of each class will be based on the readings for that day. It is suggested that you arrive on time in order to complete the daily quiz with sufficient time.

All homework assignments must be typed and submitted in hard copy in class on the day it is due. Every homework submission must include a properly formatted bibliography that includes all works you referred to as you prepared your homework. These works should be cited as appropriate in the text of your answers.

All homework is due at the beginning of class on the due date. You will lose 10% for turning in homework late (5 minutes or more after class has started) on the due date. You will lose an additional 10% for each late day after that. I reserve the right to take off additional points or refuse to accept late homework submitted after the answers have been discussed extensively in class. Reasonable extensions will be granted to students with excused absences or extenuating circumstances. Please contact me as soon as possible to arrange for an extension.

Cheating and plagiarism will not be tolerated. Students caught cheating or plagiarizing will receive no credit for the assignment on which cheating occurred. Additional actions -- including assigning the student a failing grade in the class or referring the case for disciplinary action -- may be taken at the discretion of the instructor. Please familiarize yourself with the CMU Policy on Academic Integrity.

A class mailing list has been setup for announcements, questions, and further discussion of topics discussed in class. Students will be expected to contribute to mailing list discussions. Students should post (non-personal) course-related questions to this mailing list rather than sending them to the instructor directly. Students are encouraged to post course-related items of interest to this mailing list.