In our modern information age, recent technical developments and trends, such as mobile and pervasive computing, big data, cloud computing, and Web 2.0 applications, increasingly pose privacy dilemmas. Due to the low costs and technical advances of storage technologies, masses of personal data can easily be stored. Once disclosed, these data may be retained forever, often without the knowledge of the individuals concerned, and be removed with difficulty. Hence, it has become hard for individuals to manage and control their personal spheres. Both legal and technical means are needed to protect privacy and to (re-)establish the individuals' control. This chapter provides an overview to the area of Privacy-Enhancing Technologies (PETs), which help to protect privacy by technically enforcing legal privacy principles. It will start with defining the legal foundations of PETs, and will present a classification of PETs as well as a definition of traditional privacy properties that PETs are addressing and metrics for measuring the level of privacy that PETs are providing. Then, a selection of the most relevant PETs is presented.

Informational privacy of individuals has significantly gained importance after information technology has become widely deployed. Data, once digitalised, can be copied, distributed, and long-term stored at negligible costs. This has dramatic consequences for individuals that leave traces in the form of personal data whenever they interact with information technology, for instance, computers and phones; or even when information technology is recording the personal data of aware or unaware individuals. The right of individuals for informational privacy, in particular to control the flow and use of their personal data, is easily undermined by those controlling the information technology.

The objective of this thesis is to study the measurement of informational privacy with a particular focus on scenarios where an individual discloses personal data to a second party which uses this data for re-identifying the individual within a set of other individuals. We contribute with privacy metrics for several instances of this scenario in the publications included in this thesis, most notably one which adds a time dimension to the scenario for modelling the effects of the time passed between data disclosure and usage. The result is a new framework for inter-temporal privacy metrics.

The goal of this work is to reason on the complexity of the relationship between three non-functional requirements in cloud comput-ing; privacy, accountability, and transparency. We provide insights on the complexity of this relationship from the perspectives of end-users, cloud service providers, and third parties, such as auditors. We shed light onthe real and perceived conflicts between privacy, transparency, and accountability, using a formal definition of transparency and an analysis on how well a privacy-preserving transparency-enhancing tool may assist in achieving accountability. Furthermore, we highlight the importance of the privacy impact assessment process for the realisation of both transparency and accountability.

In our modern information age, recent technical developments and trends, such as mobile and pervasive computing, cloud computing, and Web 2.0 applications, increasingly pose privacy dilemmas. Due to the low costs and technical advances of storage technologies, masses of personal data can easily be stored. Once disclosed, these data may be retained forever, often without the knowledge of the individuals concerned, and be removed with difficulty. Hence, it has become hard for individuals to manage and control their personal spheres. Both legal and technical means are needed to protect privacy and to (re)establish the individuals’ control. This chapter provides an overview to the area of privacy-enhancing technologies (PETs), which help to protect privacy by technically enforcing legal privacy principles. It will start with defining the legal foundations of PETs and will present a classification of PETs as well as a definition of traditional privacy properties that PETs are addressing and metrics for measuring the level of privacy that PETs are providing. Then, a selection of the most relevant PETs is presented.

The data protection laws in Europe require that data controllers provide privacy policies to inform individuals about the prospective processing of their personal data. The ever growing expressiveness of privacy policy languages allows to specify policies in a growing number of details. This and new options for policy negotiations transformed rather general privacy policies into specific privacy contracts between the data controller and the individual.

In this report, we specify a privacy contract language and call it the Privacy Option Language. It is modelled after the analogy between financial option contracts and data disclosures which has been presented in previous work and led to the Privacy Option notion. The language specification provides privacy by design through its data minimisation provisions, i.e., all contracts are automatically reduced to their canonical form so that individual differences in the contract formulation are inherently normalised. The language specification is extensible in two ways. First, hooks are specified in the core language and can be used to connect sublanguages. The freedom to choose any suitable sublanguage allows to specify language details independent of the core language. Second, the Privacy Option Language itself can be used as a sublanguage within a more general-domain language. We give examples for both types of extensions. Additionally, we provide tools for evaluating semantics such as human-readable presentations of Privacy Options and contract management. The definitions of the semantics are kept simple and serve as templates for more practical ones.

All functionality can be checked by interactive tests in a standard multi-purpose programming language interpreter, since the Privacy Option Language is specified as an embedded domain-specific language within Haskell. Hands-on examples are provided along with the language specification.

Informational privacy of individuals has significantly gained importance after information technology has become widely deployed. Data, once digitalised, can be copied and distributed at negligible costs. This has dramatic consequences for individuals that leave traces in form of personal data whenever they interact with information technology. The right of individuals for informational privacy, in particular to control the flow and use of their personal data, is easily undermined by those controlling the information technology.

The objective of this thesis is the measurement of informational privacy with a particular focus on scenarios where an individual discloses personal data to a second party, the data controller, which uses this data for re-identifying the individual within a set of others, the population. Several instances of this scenario are discussed in the appended papers, most notably one which adds a time dimension to the scenario for modelling the effects of the time passed between data disclosure and usage. This extended scenario leads to a new framework for inter-temporal privacy metrics.

The common dilemma of all privacy metrics is their dependence on the information available to the data controller. The same information may or may not be available to the individual and, as a consequence, the individual may be misguided in his decisions due to his limited access to the data controller’s information when using privacy metrics. The goal of this thesis is thus not only the specification of new privacy metrics, but also the contribution of ideas for mitigating this dilemma. However a solution will rather be a combination of technological, economical and legal means than a purely technical solution.

While confidentiality of telephone conversation contents has recently received considerable attention in Internet telephony (VoIP), the protection of the caller--callee relation is largely unexplored. From the privacy research community we learn that this relation can be protected by Chaum's mixes. In early proposals of mix networks, however, it was reasonable to assume that high latency is acceptable. While the general idea has been deployed for low latency networks as well, important security measures had to be dropped for achieving performance. The result is protection against a considerably weaker adversary model in exchange for usability. In this paper, we show that it is unjustified to conclude that low latency network applications imply weak protection. On the contrary, we argue that current Internet telephony protocols provide a range of promising preconditions for adopting anonymity services with security properties similar to those of high latency anonymity networks. We expect that implementing anonymity services becomes a major challenge as customer privacy becomes one of the most important secondary goals in any (commercial) Internet application.

One of the key challenges in the information society is responsible handling of personal data. An often-cited reason why people fail to make rational decisions regarding their own informational privacy is the high uncertainty about future consequences of information disclosures today. This chapter builds an analogy to financial options and draws on principles of option pricing to account for this uncertainty in the valuation of privacy. For this purpose, the development of a data subject's personal attributes over time and the development of the attribute distribution in the population are modelled as two stochastic processes, which fit into the Binomial Option Pricing Model (BOPM). Possible applications of such valuation methods to guide decision support in future privacy-enhancing technologies (PETs) are sketched