8-533 / 8-733 / 19-608 / 95-818: Privacy Policy, Law, and Technology

Computation, Organizations and Society

Fall 2010: Tuesday and Thursday 3 - 4:20 pm, GHC 4211
Class web site: http://cups.cs.cmu.edu/courses/privpolawtech-fa10/ [previous semesters]
Class mailing list: http://cups.cs.cmu.edu/mailman/listinfo/privacy-class

Professor: Lorrie Cranor

Course Description

Privacy issues have been getting increasing attention from law makers, regulators, and the media. As a result, businesses are under pressure to draft privacy policies and post them on their web sites, chief privacy officers are becoming essential members of many enterprises, and companies are taking pro-active steps to avoid the potential reputation damage of a privacy mistake. As new technologies are developed, they increasingly raise privacy concerns -- the World Wide Web, wireless location-based services, and RFID chips are just a few examples. In addition, the recent focus on national security and fighting terrorism has brought with it new concerns about governmental intrusions on personal privacy. This course provides an in-depth look into privacy, privacy laws, and privacy-related technologies and self-regulatory efforts. Students will study privacy from philosophical, historical, legal, policy, and technical perspectives and learn how to engineer systems for privacy.

This course is intended primarily for graduate students and advanced undergraduate students (juniors and seniors) with some technical background. Programming skills are not required. 8-733, 19-608, and 95-818 are 12-unit courses for PhD students. Students enrolled under these course numbers will have extra reading and presentation assignments and will be expected to do a project suitable for publication. 8-533 is a 9-unit course for undergraduate students. Masters students may register for any of the course numbers. This course will include a lot of reading, writing, and class discussion. Students will be able to tailor their assignments to their skills and interests, focusing more on programming or writing papers as they see fit. However, all students will be expected to do some writing and some technical work. A large emphasis will be placed on research and communication skills, which will be taught throughout the course.

Required Texts

Readings will be assigned from the following texts. Additional readings will be assigned from papers available online or handed out in class. The web sites for the two required texts also contain pointers to a variety of other books and online resources relevant to this course.

Course Schedule

Note, this is subject to change. The class web site will have the most up-to-date version of this calendar. Reading assignments aren't final until one week before due date. Homework assignments will generally be finalized on day previous assignment is due.




Tuesday, August 24


  • Introductions and review of syllabus
  • Overview of topics to be covered in this course
  • Course preview picture tour, Part I

Thursday, August 26

Conceptions of privacy

  • Course preview picture tour, Part II
  • What is privacy? What does privacy mean to you?

Required reading:

Tuesday, August 31

History and philosophy of privacy [slides]

  • Privacy throughout history
  • Philosophical underpinnings of privacy
  • Why does privacy matter?

Research and communication skills

Required reading:

  • Privacy, Information, and Technology, 1C Introduction: Perspectives on Privacy, pp. 39-76.

Optional reading:

Thursday, September 2

Homework 1 discussion

  • Paraphrasing vs. plagiarism
  • Wallet collages
  • Web cams and Street View
  • Privacy in art, literature, and pop culture

Required reading:

Homework 1 due

Tuesday, September 7

Fair Information Practices and Privacy Principles [slides]

  • Privacy terminology
  • Fair Information Practices
  • Generally Accepted Privacy Principles (GAPP)
  • APEC Privacy Framework

Research and communication skills

Introduce course project

Required reading:

Optional reading:

Thursday, September 9

Privacy law [slides]

  • US privacy laws - common law, constitutional law, statutory law
  • European Union Directive

Required reading:

  • Privacy, Information, and Technology, 1A Introduction: Information Privacy, Technology, and the Law, pp. 1-7.
  • Privacy, Information, and Technology, 1B Introduction: Information Privacy Law: Origins and Types, pp. 10-38.

Optional reading:

Tuesday, September 14

Privacy self-regulation and the privacy profession

  • Privacy self-regulation
  • Privacy seal programs - TRUSTe, etc.
  • Chief privacy officers
  • Industry codes and voluntary guidelines
  • Privacy policies
  • Is privacy self-regulation working?
  • International Association of Privacy Professional (IAPP)
  • Privacy-related organizations

Required reading:

  • Privacy, Information, and Technology, 4A Privacy of Financial and Commercial Data: The Financial Services Industry and Personal Data, pp. 361-402.
  • Privacy, Information, and Technology, 4B Privacy of Financial and Commercial Data: Commercial Entities and Personal Data, pp. 402-470.

Optional reading:

Thursday, September 16

Homework 2 discussion

  • Privacy risks of technology
  • Privacy laws from around the world

Break class into groups for privacy policy group assignment

Required reading:

Homework 2 due

Tuesday, September 21

Guest lecture, Alessandro Acquisti: Economics of privacy

Required reading:

Optional reading:

Thursday, September 23

Privacy attitudes and behavior

  • Privacy surveys - overview and role
  • CMU Privacy Finder study
  • CMU Behavioral Advertising studies

Research and communications skills

Required reading:

Optional reading:

Tuesday, September 28

Online privacy

  • Online vs. offline privacy concerns
  • Data collection through web browsers - cookies, web bugs, referer, behavioral targeting, etc.
  • Spam

Research and communication skills

Required reading:

Optional reading:

One-paragraph project description due

Thursday, September 30

Introduction to P3P

  • How P3P works
  • P3P user agents
  • P3P history, politics, and evaluation
  • P3P legal and policy issues
  • Writing privacy policies

Group privacy policy project discussion

Required reading

  • Web Privacy with P3P, Chapter 4: P3P History, pp. 43-57.
  • Web Privacy with P3P, Chapter 5: Overview and Options, pp. 61-80.
  • Web Privacy with P3P, Chapter 12: P3P User Agents and Other Tools, pp. 203-213.

Optional reading:

Homework 3 due

Tuesday, October 5

P3P Deployment

  • Creating P3P policies
  • P3P validation and authoring tools

Homework 3 discussion

Required reading:

  • Web Privacy with P3P, Chapter 6: P3P Policy Syntax, pp. 81-109.
  • Web Privacy with P3P, Chapter 7: Creating P3P Policies, pp. 110-132.
  • Web Privacy with P3P, Chapter 13: A P3P Preference Exchange Language (APPEL), pp. 214-235.

Optional reading

Thursday, October 7


  • identity, identification, credentials, and authentication
  • Identity management systems

Required reading:

Optional reading:

Tuesday, October 12


  • anonymity
  • anonymity tools
  • Privacy Enhancing Technologies (PETs)

Required reading:

Optional reading:

Thursday, October 14

Data privacy

  • K-anonymity
  • L-diversity
  • de-identification and re-identification
  • Data linking and data profiling
  • Techniques for protecting data privacy
  • Privacy and search engine data

Homework 4 discussion

Required reading:

Optional reading:

Homework 4 due

Tuesday, October 19

Privacy on social networks

Privacy policy group assignment feedback

Required reading:

Optional reading:

Project proposal due

Thursday, October 21

Biometrics (field trip to Marios Savvides' Biometrics Lab

Required reading:

  • Anil K. Jain, Arun Ross and Salil Prabhakar, An Introduction to Biometric Recognition, IEEE Transactions on Circuits and Systems for Video Technology, Special Issue on Image- and Video-Based Biometrics, Vol. 14, No. 1, January 2004.

Optional reading:

Tuesday, October 26

Guest lecture, Travis Breaux: Analyzing regulatory rules for privacy requirements

Required reading:

Thursday, October 28

Guest lecture, Patrick Kelley: Privacy and location tracking

  • privacy in ubiquitous computing
  • privacy and location-based services
  • RFID

Homework 5 discussion

Required reading:

Optional reading:

Homework 5 due

Tuesday, November 2 (election day)

Guest lecture, Michael Shamos: Workplace privacy and medical privacy [slides]

Thursday, November 4

Engineering privacy

  • Privacy by policy vs. privacy by architecture
  • Privacy guidelines for software developers

Required reading:

Optional reading:

Tuesday, November 9

Identity theft

  • phishing and anti-phishing
  • spyware and malware
  • data breaches

Required reading:

Optional reading:

Thursday, November 11

Law enforcement and government surveillance

  • law enforcement and surveillance
  • wiretapping and bugging
  • new surveillance technologies
  • US crypto regulation
  • government surveillance initiatives: Clipper chip, Carnivore, TIA, Echelon, airline passenger screening etc.
  • The USA PATRIOT Act and post-911 national security initiatives
  • government computer searches
  • Public access to government records

Research and communications skills

Required reading:

  • Privacy, Information, and Technology, 2A Privacy and Law Enforcement: The Fourth Amendment and Emerging Technology, pp. 77-137.
  • Privacy, Information, and Technology, 2B Privacy and Law Enforcement: Federal Electronic Surveillance Law, pp. 138-157.
  • Privacy, Information, and Technology, 2C Privacy and Law Enforcement: Digital Searches and Seizures, pp. 158-191.
  • Privacy, Information, and Technology, 2C Privacy and Law Enforcement: National Security and Foreign Intelligence, pp. 192-242.

Optional reading

Tuesday, November 16

Homework 6 discussion

  • Privacy guideline analysis
  • Government surveillance programs

Homework 6 due

Thursday, November 18

Guest lecture, Brian Geffert, privacy consultant

No required reading

Optional reading:

Tuesday, November 23

Current issues

Research and communications skills

No required reading

Draft project paper due

Thursday, November 25

Thanksgiving break, no class

Tuesday, November 30

Poster fair - NSH Atrium

No required reading

Thursday, December 2

current issues, project presentations

No required reading

Tuesday, December 7, 5:30-8:30 pm, GHC 5222

Final project presentations

This class will have no final exam. However, project presentations will be scheduled during our final exam slot. All students are expected to attend.

Final project papers are due December 13 at noon.

Course Requirements and Grading

Your final grade in this course will be based on:

You are expected to complete the reading assignments before the class session for which they were assigned. Class discussions will often be based on these assignments and you will not be able to participate fully if you have not done the reading. It is suggested that you write up summaries and highlights as you read each chapter or paper and bring them with you to class.

All homework assignments must be typed and submitted in hard copy in class on the day it is due. Every homework submission must include a properly formatted bibliography that includes all works you referred to as you prepared your homework. These works should be cited as appropriate in the text of your answers.

All homework is due at the beginning of class on the due date. You will lose 10% for turning in homework late on the due date. You will lose an additional 10% for each late day after that. I reserve the right to take off additional points or refuse to accept late homework submitted after the answers have been discussed extensively in class. Reasonable extensions will be granted to students with excused absences or extenuating circumstances. Please contact me as soon as possible to arrange for an extension.

Cheating and plagiarism will not be tolerated. Students caught cheating or plagiarizing will receive no credit for the assignment on which cheating occurred. Additional actions -- including assigning the student a failing grade in the class or referring the case for disciplinary action -- may be taken at the discretion of the instructor.

A class mailing list has been setup for announcements, questions, and further discussion of topics discussed in class. Students will be expected to contribute to mailing list discussions. Students should post (non-personal) course-related questions to this mailing list rather than sending them to the instructor directly. Students are encouraged to post course-related items of interest to this mailing list.