Privacy and Release of Personal Information

-includes definition of personal information Personal Information (PI) 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. -name, address, telephone, email (personal not business) -race, ethnic origin or religious political beliefs or associations -age, sex, sexual orientation, marital status or family status -identifying number (e.g. Dalcard ID, SIN, cc #, health #, &) -fingerprints, blood type, or inheritable characteristics -medical or personal history -educational, employment, financial, or criminal history -personal views or opinions Policy/Law in brief: 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. PI storage 3to be stored & backed-up in Canada (exceptions require VP approval) PI Access from outside Canada 3okay if it's your own PI 3okay under limited conditions: Disclosure of PI outside Canada 3only under limitedconditions Transportation of PI outside Canada 3only under limitedconditions (must be strictly necessary & precautions taken) Encryption 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved.<br><br> -a process of translating data into a form that's unreadable to those without the key. Uses a Cryptographic Cipher (algorithm) and a secret Encryption Key. Trivial Example: ROT13 ROT = rotation (the algorithm) 13 = the 'secret' key Encryption 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. -password protection ` encryption -AES256, et al -proprietary algorithm \x2 -encoding ` encryption Storage 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved.<br><br> Do Not keep data on your computer -servers can be professionally secured (security is difficult) -servers are harder to steal or loose -600,000 to 1.5M laptops are stolen every year -97% are never recovered Storage solution #1 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved. Instead, store on Dalhousie servers using: "Novell Client ('G Drive') " NetStorage (Web accessible; via MyDal) If you have old copies on workstation, do a secure erase (example: use 'Eraser' from http://ww.heidi.ie/eraser ) Storage solution #2 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. If you need to take the data with you &because data is too large or you won't have internet access: Caveats "easy to loose (backup regularly to network storage) "use a strong password & don't forget "label it "only buy mandatory encryption models) Use an encrypting USB flash drive 3automatically encrypts 3lockdown after 10 wrong passwords Storage solution #3 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved.<br><br> Whole disc encryption using: "PGPDisksoftware "laptops with encryption built-in (TPM) "Vista's BitLocker "& ALL files encrypted. (same caveats apply: backup, strong password.) Data gathering 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved.<br><br> HTML forms "need https (encryption) enabled server "need secure (professionally managed) web server "needs to be hosted in Canada (PIIDPA/Dal policy) Data gathering &continued 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved. Web-based surveys "need https server "need secure (professionally managed) server "needs to be hosted in Canada (PIIDPA/Dal policy) 3Opinio is hosted at Dal ( https://surveys.dal.ca/ ) "was setup in direct response to PIIDPA 3SurveyMonkey.comhosted in US "geeks can use traceroute to test Data gathering &continued 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. Email "difficult to guarantee privacy "anonymity also problematic "is the mail stored or transmitted outside Canada? 3Dal email is stored in Canada 3Gmail, HotMail, &are stored in US Data gathering &continued 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. Files from research participants may be rare now 3take as a cautionary note "JPEGs, PDFs, DOCs, all have metadata "you may not know what is being collected 3time & date 3owner's name 3make/model/serial number/version 3old versions & Sanitizing software/methods exist and should be used. Anonymizationissue Example1 3AOL 'data spill' "AOL deliberately released search data to aid researchers in 2006 "20M queries from 650k users over three months "data was 'anonymized' (login names replaced with numbers) "within hours NY Times could name user #4417749 ( searched: "effects of nicotine", "bipolar," "paranoia", "60 single men", &) "data will live on forever ( http://www.aolstalker.com ) 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. Anonymizationissue &continued Example1 3Netflix dataset "Netflix published 10 million movie rankings by 500,000 customers "data was 'anonymized' (names replaced with numbers) "U of Texas researches prove it can be de-anonymized "using publicly available data at IMDB 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved.<br><br> Solution to anonymizationissue "get independent verification it is really anonymous "use peers and mathematics/crypto experts, computer science experts, & "remember techniques/hardware only get better 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved. Disposing of PI 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock.<br><br> Some rights reserved. CD/DVD, floppy(?) "same as for paper; Shred them Individual files on disc "'Eraser' ( http://ww.heidi.ie/eraser ) or equivalent Disposing of PI &continued 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved.<br><br> Whole disc "not necessary with proper encryption ! (same for USB) "SW/HW to do 'DoDShort' or better wipe ( DBAN option 3) "if disc has failed 3drive destruction Future "UCIS currently developing policies, procedures, & "We (or your IT support) will be able to help you with this Conclusion 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved.<br><br> PIIDPA : :: : Dal Policy : :: : "We've seen it is possible to follow these rules. "Doing so will help ensure your research can continue. Questions?<br><br> 2008 March 28Training in Research Ethics 3IWK Health Centre©2008 John Bullock. Some rights reserved. Resources USA PATRIOT Act USA PATRIOT Act 3official US government site (2001 October 25th) U.S.<br><br> Senate Roll Call for USA PATRIOT 3official US government site NSA'sDomestic Spying Grows As Agency Sweeps Up Data 3The Wall Street Journal Senators won't take away FBI surveillance power 3CNetNews.com Canadian privacy laws, Dal policy, privacy map Canadian Provincial / Territorial Privacy Laws 3links from CDN Privacy Commissioner Personal Information Protection & Electronic Documents Act (PIPEDA) (Canada, 2004) Personal Information International Disclosure Protection Act (PIIDPA) (NS, 2006) Policy for the Protection of Personal Information from International Disclosure (Dal, 2007) Directives to Researchers (from Dal research services) State of Privacy Map (Privacy International, 2007) Some privacy Trends Rising laptop thefts push prevention initiatives 3Denver Business Journal on laptop thefts Data Mining: Staking a Claim on Your Privacy 3paper by Ontario's Privacy Commissioner Spychips.com 3Website devoted to RFID privacy implications Nike+iPodraises RFID privacy concerns 3news article about this research Anonymity Why 'Anonymous' Data Sometimes Isn't 3Wired magazine AOL data spill 3a blogger's comment on the story; also see http://www.aolstalker.com Netflix de-anonymization 3paper from University of Texas researchers Encryption PGPDisk 3commercial product for whole disc encryption Secret algorithms 3avoid them; old, but well written, article Verbatim USB Flash Drive 3get the mandatory encryption model ('Corporate Secure') IronKeyUSB Flash Drive 3another possibility Secure USB Review 3just make sure it uses a known, good, algorithm & that it's mandatory TrueCrypt 3free and open-source software for USB or disc; requires some technical savvy http://pcpc.dal.ca 3the campus supplier all slides archived at http://ucis.dal.ca/depts/security/events Disposal Dalhousie University Shredding Program 3Dalhousie's DocuSHREDcontract Think before you bin it 3poster for locating near recycling boxes Eraser 3free software for securely erasing file(s) from a Windows computer DBAN 3free software for securely wiping a disc; use 'DoDshort' (option 3) as a minimum Metadata 3are you collecting participant created files? IrfanView 3can be used to clean JPEGs of metadata ExifTool 3read and edit JPEG metadata; multi-platform Microsoft Remove Hidden Data Tool 3Microsoft's tool for cleansing Office Docs of metadata Metadata awareness article 3from UCIS Google services Awareness 3Google Services 3PIIDPA issues with Google Services & some alternatives CDN School Protests Google Tools Use 3article from Web Host Industry Review [ additional topics arising from the Q&A ] Wireless http://ucis.dal.ca/services/internet/wireless/index.html 3use VPN when working wirelessly ! http://ucis.dal.ca/services/internet/vpn 3 VPN explanation and download link Passwords http://news.zdnet.com/2100-1009_22-5716590.html (Microsoft says it's okay to write it down) http://www.schneier.com/blog/archives/2005/06/write_down_your.html (Schneier say's it's okay) 3 do NOT write your user id with the password 3 store in a safe place such as a wallet; NEVER store on or near computer 3 do NOT identify as ' passwords ' 3 record partial passwords if possible and consider using other obscuring techniques http://ucis.dal.ca/publications/policies/5.2.1-passwords.pdf 3page 4 of Policy document has helpful guidelines for remembering & increasing strength Low-tech remembering/writing is best, but Password Managers okay IF they properly encrypt Password Safe 3 excellent; but Windows only Password Gorilla and KeePass 3also good; both are multi-platform All text in these slides is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 license ( http://creativecommons.org/licenses/by-nc-nd/3.0/ ) .<br><br> The images used here are being used under 'Fair Use' principles and are copyrighted by their respective owners.

less