the privacy fallacy [book review]

“The World changed significantly since 1973.” (p.10)

I read this book, The Privacy Fallacy: Harm and Power in the Information Economy, by Ignacio Cofone, upon my return from Warwick the past week. This is a Cambridge University Press 2023 book I had picked from their publication list after reviewing a book proposal for them. A selection made with our ERC OCEAN goals in mind, but without paying enough attention to the book table of contents, since it proved to be a Law book!

“People’s inability to assess privacy risks impact people’s behavior toward privacy because it turns the risks into uncertainty, a kind of risk that is impossible to estimate.” (p.31)

Still, this ended up being a fairly interesting read (for me) about the shortcomings of the current legal privacy laws (in various countries), since they are based on an obsolete perception that predates AIs and social media. Its main theme is that privacy is a social value that must be protected, regardless of whether or not its breach has tangible consequences. The author then argues that notions that support these laws such as the rationality of individual choices, the confusion between privacy and secrecy, the binary dichotomy between public and private, &tc., all are erroneous, hence the “fallacy” he denounces. One immediate argument for his position is the extreme imbalance of information between individuals and corporations, the former being unable to assess the whole impact of clicking on “I agree” when visiting a webpage or installing a new app. The more because the data thus gathered is pipelined to third parties. (“One’s efforts cannot scale to the number of corporations collecting and using one’s personal data”, p.93) For similar reasons, Cofone further states that the current principles based on contracts are inappropriate. Also because data harm can be collective and because companies have a strong incentive to data exploitation, hence a moral hazard.

“Inferences, relational data, and de-identified data aren’t captured by consent provisions.” (p.9)

“AI inferences worsen information overload (…) As [they] continue to grow, so will the insufficiency of our processing ability to estimate our losses.” (p.75)

As illustrated by the surrounding quotes, the statistical and machine-learning aspects of the book are few and vague, in that the additional level of privacy loss due to post-data processing is considered as a further argument for said loss to be impossible to quantify and assess, without a proper evaluation of the channels through which this can happen and without a reglementary proposal towards its control. This level of discourse makes AIs appear as omniscient methods, unfortunately.

“Inferences are invisible (…) Risks posed by inferences are impossible to anticipate because the information inferred is disproportionate to the sum of the information disclosed.” (p.49)

“The idea of probabilistic privacy loss is crucial in a world where entities (..) mostly affect our privacy by making inferences” (p.121)

The attempts at regulation such as opt-in and informed consent are then denounced as illusions—obviously so imho, even without considering the nuisance of having to click on “Reject” for each newly visited website!—. De- and re-identified data does not require anyone’s consent. Data protection rights, as of today, do not provide protection in most cases, the burden of proof residing on the privacy victims rather than the perpetrators. The book unsurprisingly offers no technical suggestion towards ensuring corporations and data brokers comply with this respect of privacy and on the opposite agrees that institutional attempts such as GDPR remain well-intended wishful thinking w/o imposing a hard-wired way of controlling the data flows, with the “need of an enforcement authority with investigating and sanctioning powers” (p.106) . The only in-depth proposal therein is pushing for stronger accountability of these corporations via a new type of liability, with a prospect of class actions (if only in countries with this judiciary possibility).

[Disclaimer about potential self-plagiarism: this post or an edited version will eventually appear in my Books Review section in CHANCE.]

data protection [not from Les Houches]

While running a “kitchen” workshop on Bayesian privacy in Les Houches, Le Monde published on π day a recap of a recent report on AI commanded by the French Government. Among other things, it contains recommendations on alleviating the administrative blocks in accessing personal data, based on a model for data protection created decades earlier around the CNIL structure. The final paragraph wishes for the creation of a “laboratory” that would test collaborative, altruistic, efficient models towards sharing data for learning, which is one of the main goals of OCEAN. Without mentioning any technical aspect, like an adoption of some privacy measure at a national or European level.

postdoctoral research positions at PariSanté

Thanks to the 2023-2029 ERC Synergy grant OCEAN (On intelligenCE And Networks: Synergistic research in Bayesian Statistics, Microeconomics and Computer Sciences), I am seeking one or two postdoctoral researchers with an interest in Bayesian federated learning, distributed MCMC, approximate Bayesian inference and computing, and data privacy.

The project is based at Université Paris Dauphine, on the new PariSanté Campus.  The postdocs will join the OCEAN teams of researchers directed by Éric Moulines and myself (Christian P Robert) to work on the above themes with multiple possibilities of focus from statistical theory, to Bayesian methodology, to decision theory, to algorithms, to medical applications. Collaborations with the OCEAN teams of researchers directed by Michael Jordan (Berkeley) and Gareth Roberts (Warwick) will further be encouraged and related travel will be supported.

Qualifications

The candidates should hold a doctorate in applied maths, statistics or machine learning, with demonstrated skills in Bayesian analysis, game theory, Monte Carlo methodology or numerical probability, an excellent record of publications in these domains, and an interest in working as part of an interdisciplinary international team. Scientific maturity and research autonomy are a must for applying. There is no deadline for the positions, which will be filled when a suitable candidate is selected.

Funding

Besides a 2 year postdoctoral contract at Université Paris Dauphine (with possible extension for another year), at a salary of 31K€ per year, the project will fund travel to OCEAN partners’ institutions (University of Warwick or University of Berkeley) and participation to yearly summer schools and conferences. Standard French university benefits are attached to the position and no teaching duty is involved, as per ERC rules.

The starting date of the postdoctoral positions is negotiable depending on the applicants’ availability.

Application Procedure

• To apply, please send the following entries in one pdf file to Christian Robert (bayesianstatistics@gmail.com).
• a letter of application,
• a CV,

Letters of recommendation are to be sent directly by their author.

Novemberly MCMC

off to Banff, almost [23w5106]

I am almost off to a BIRS workshop on differential privacy taking place on the Okanagan UBC campus rather than at the original BIRS place in Banff, three hours (drive) West, on the Okanagan Lake. When I saw the announcement for the workshop on the BIRS webpage, I saw it as a perfect opportunity to jump into this central topic of our ERC Synergy grant and I contacted the organisers applying for a potential participation, which was successful! This is quite exciting, as the topic of privacy is, and also because I know none of the participants and hence the immersion into a new community should prove most fruitful. While not in my beloved Banff!, the location does not hurt either, with a nearby lake perfect for morning swims, and surrounding mountains for a hike or two. Before heading East, closer to Banff, for a vacation week.