Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • Video Privacy Protection Act: when journalists got Robert Bork’s video rental records during his Supreme Court confirmation hearings, congress responded with this act, which forbids rental store proprietors from disclosing the viewing habits of their customers. (interestingly, the act does not appear to cover the online delivery of content, such as DIVX films)
  • 52
  • 52
  • 52
  • 52
  • 52
  • 52
  • Privacy policies often change, and most of the time users have know way of knowing about changes unless they check the privacy policy every time they visit a site. A P3P user agent can do this check automatically to make sure a policy continues to match a user’s preferences. P3P user agents can also identify objects embedded in web pages that may have different privacy policies.
  • Example 3.1 of the spec
  • priv4.ppt

    1. 1. Lecture 4: Privacy
    2. 2. Outline <ul><li>Proliferation of data </li></ul><ul><li>What is privacy? </li></ul><ul><li>Driver’s License Data </li></ul><ul><li>Privacy Laws </li></ul><ul><li>De-identification </li></ul><ul><li>Medical privacy </li></ul><ul><li>P3P </li></ul><ul><li>European Union approach </li></ul>
    3. 3. What is Privacy? <ul><li>Many different concepts all collected under the single word “privacy” </li></ul><ul><li>Protection against intrusion into one’s “space” </li></ul><ul><ul><li>Protection from Government (4 th Amendment) </li></ul></ul><ul><ul><li>Freedom from publicity, disclosure of embarrassing facts (“Invasion of Privacy”) </li></ul></ul><ul><ul><li>Protection from telemarketers </li></ul></ul><ul><li>Protection in cyberspace </li></ul><ul><ul><li>Anti-spam </li></ul></ul><ul><ul><li>Web data collection </li></ul></ul>
    4. 4. What is Privacy? <ul><li>Bodily privacy ( Roe v. Wade ) </li></ul><ul><li>Communications privacy </li></ul><ul><ul><li>Against eavesdropping, wiretapping </li></ul></ul><ul><ul><li>Electronic Communications Privacy Act </li></ul></ul><ul><li>Identity privacy </li></ul><ul><ul><li>Anonymity </li></ul></ul><ul><li>Data privacy </li></ul><ul><ul><li>Right to control collection, use and dissemination of non-public personal information </li></ul></ul>
    5. 5. Data Privacy <ul><li>Who “owns” data about you? Can data be owned? </li></ul><ul><ul><li>Facts (residence, phone #, age) e.g. Allegheny County Property </li></ul></ul><ul><ul><li>Sales information </li></ul></ul><ul><ul><li>Habits, personal preferences </li></ul></ul><ul><ul><li>Message traffic </li></ul></ul><ul><li>Problem: electronic collections are subject to greater abuse than paper ones </li></ul><ul><li>Problem: having everything on line is different from just having records be public </li></ul><ul><li>Policy: is it the data or its use that requires protection? </li></ul>
    6. 6. U.S. Privacy Law <ul><li>No definition of “privacy”; few legal principles </li></ul><ul><li>Federally protected categories: financial, educational, medical </li></ul><ul><li>State: limited, usually embarrassing facts or photos </li></ul><ul><li>Constitutional basis? </li></ul><ul><ul><li>4th amendment: government searches </li></ul></ul><ul><ul><li>“ liberty” as right of privacy </li></ul></ul><ul><li>State constitutions </li></ul><ul><ul><li>California Const. Art. I, §1 : “All people are by nature free and independent and have inalienable rights. Among these are ... pursuing and obtaining safety, happiness, and privacy.” (Not in the 1849 Constutution) </li></ul></ul><ul><ul><li>Hawaii Const. Art. 1, §6 : “The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest.” (Added in 1978) </li></ul></ul>
    7. 7. Sample Federal Privacy Statutes <ul><li>Gramm-Leach-Bliley (financial privacy) </li></ul><ul><li>Health Insurance Portability and Accountability Act of 1996 (medical) </li></ul><ul><li>Children’s Online Privacy Protection Act of 1998 </li></ul><ul><li>Privacy Act of 1974 (covers U.S. government) </li></ul><ul><li>Driver’s Privacy Protection Act of 1994 (driver’s license info) </li></ul><ul><li>Video Privacy Protection Act of 1998 (videotape rental and sale records) </li></ul><ul><li>Electronic Communications Privacy Act of 1986 </li></ul><ul><li>Family Education Rights and Privacy Act of 1974 (academic) </li></ul><ul><li>Fair Credit Reporting Act of 1970 </li></ul><ul><li>Cable Communications Policy Act of 1984 . . . </li></ul>
    8. 8. Driver’s Privacy Protection Act of 1994 <ul><li>Deals with release of information obtained by a State department of motor vehicles </li></ul><ul><li>Designed to prevent sale of driver’s license information </li></ul><ul><li>“ personal information” means information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status </li></ul><ul><li>“ highly restricted personal information” means an individual's photograph or image, social security number, medical or disability information; </li></ul>
    9. 9. Driver’s Privacy Protection Act of 1994 <ul><li>A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity: </li></ul><ul><ul><li>personal information … about any individual obtained by the department in connection with a motor vehicle record, except [lots of exceptions]; or </li></ul></ul><ul><ul><li>highly restricted personal information … without the express consent of the person to whom such information applies, except [small list of exceptions] </li></ul></ul><ul><li>Statute makes it a crime. Penalty: fine + prison </li></ul><ul><ul><li>For a State Department of Motor Vehicles, $5000/day </li></ul></ul><ul><li>Is this constitutional? </li></ul><ul><li>Where does Congress get the power to regulate state drivers’ licenses? </li></ul>
    10. 10. Reno v. Condon <ul><li>South Carolina made driver’s license information available to anyone (except telephone solicitors) </li></ul><ul><li>Charlie Condon was the Attorney General of South Carolina </li></ul><ul><li>When the DPPA was passed, Condon sued the U.S. Attorney General to prevent enforcement (or he would become a criminal) </li></ul><ul><li>Claimed it makes “state officials the unwilling implementors of federal policy” </li></ul><ul><li>U.S. Constitution, Art. 1, Sec. 8, Clause 3: “The Congress shall have Power … To regulate Commerce with foreign Nations, and among the several States, and with the Indian Tribes” </li></ul><ul><li>“ sale or release of … information in interstate commerce is … a proper subject of congressional regulation” </li></ul><ul><li>Information as an article of commerce </li></ul><ul><li>Reno v. Condon , 528 U.S. 666 (2000) </li></ul>
    11. 11. Data Collection <ul><li>Public birth records now contain 226 fields of information, including name, DOB, gender, ZIP, parents’ race, level of education, genetic risk factors </li></ul><ul><li>Voter registration data contains name, address, gender </li></ul><ul><li>Public hospital discharge records contain 50 fields, including DOB, gender, ZIP, diagnosis, treatments, medical bills (no name) </li></ul><ul><li>Grocery store data include name, address, bank account, SSAN, weekly spending </li></ul><ul><li>Linking produces huge dossiers </li></ul>
    12. 12. Data Anonymity <ul><li>Data is “anonymous” if it cannot be associated with a a specific individual </li></ul><ul><li>Data that includes a name, SSAN, address, etc. is not anonymous. </li></ul><ul><li>Data can be made anonymous by abridging or modifying it, e.g. change ZIP from 20011 to 200** (de-identifying) </li></ul><ul><li>Problem: abridging data affects its integrity </li></ul><ul><li>How much data must be eliminated to make it anonymous? Is it ever possible? </li></ul>
    13. 13. Methods of De-Identification <ul><li>Quasi-identifier, profile {Birth 0.5 , ZIP 0.7 , Sex 0.3 } </li></ul><ul><li>Generalization 10/27/59  1959 </li></ul><ul><li>Suppression 02139   </li></ul><ul><li>Encryption 3245123  2168582 </li></ul>SOURCE: LATANYA SWEENEY Idea: one becomes many
    14. 14. Data Anonymity <ul><li>Problem: de-identifying data does not necessarily make it anonymous. It can often be re-identified : </li></ul>SOURCE: LATANYA SWEENEY Ethnicity Visit date Diagnosis Procedure Medication Total bill ZIP Birth date Sex Medical Data Name Address Date registered Party Date last voted Voter Lists ZIP Birth date Sex
    15. 15. Date of birth, gender + 5-digit ZIP uniquely identifies 87.1% of U.S. population SOURCE: LATANYA SWEENEY = one ZIP code ZIP 60623 has 112,167 people, 11%, not 0% uniquely identified. Insufficient # over 55 living there.
    16. 16. Privacy Act of 1974 5 U.S.C. §552a <ul><li>Deals with disclosure of Federal Government records on individuals </li></ul><ul><li>“ No agency shall disclose any record … to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [except … ]” </li></ul><ul><ul><li>… the record is to be transferred in a form that is not individually identifiable; </li></ul></ul><ul><ul><li>authorized law enforcement </li></ul></ul><ul><ul><li>heath or safety </li></ul></ul><ul><ul><li>Congress </li></ul></ul><ul><ul><li>court order </li></ul></ul>
    17. 17. Privacy Act of 1974 <ul><li>“ No agency shall disclose any record … to any person, or to another agency, except … with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be -- </li></ul><ul><ul><li>… used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable” (not a defined term) </li></ul></ul><ul><li>Restriction on “matching programs” </li></ul><ul><ul><li>any computerized comparison of -- (i) two or more automated systems of records … [certain exceptions] </li></ul></ul>
    18. 18. Privacy on the Web <ul><li>Posted privacy policies are legal representations </li></ul><ul><li>Violation of privacy policy by a website is deceptive advertising and an unfair trade practice </li></ul><ul><li>The Federal Trade Commission acts on behalf of consumers </li></ul><ul><li>Vigorous enforcement </li></ul><ul><ul><li>Example: In the Matter of Microsoft Corporation </li></ul></ul><ul><li>FTC is the leading U.S. government privacy watchdog </li></ul><ul><ul><li>Is this good? (It was never intended.) </li></ul></ul>
    19. 19. Electronic Communications Privacy Act 18 U.S.C. §§ 1367 , 2232 , 2510 , 2701 , 3117 , 3121 <ul><li>Defines “oral communication” as </li></ul><ul><li>“ any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation” </li></ul><ul><li>Prohibits </li></ul><ul><ul><li>interception of wire, oral, or electronic communication </li></ul></ul><ul><ul><li>use or disclosure of intercepted communication </li></ul></ul><ul><li>Complicated exceptions </li></ul><ul><ul><li>Inadvertently overhearing evidence of a crime </li></ul></ul><ul><li>Chat rooms? </li></ul>
    20. 20. Health Insurance Portability and Accountability Act of 1996 ( HIPAA ) <ul><li>A “covered entity” may not use or disclose protected health information, except as permitted or required … </li></ul><ul><ul><li>p ursuant to … a consent … to carry out treatment, payment, or health care operations </li></ul></ul><ul><ul><li>p ursuant to … an authorization </li></ul></ul><ul><ul><li>p ursuant to … an agreement (opt-in) </li></ul></ul><ul><ul><li>[other provisions] 45 CFR §164.502 </li></ul></ul><ul><li>Health information that meets … specifications for de-identification … is considered not to be individually identifiable health information 45 CFR §164.502(d) </li></ul>
    21. 21. What HIPAA Protects <ul><li>“ Individually identifiable health information” is information that is a subset of health information, including demographic information collected from an individual, and: … </li></ul><ul><ul><li>relates to … physical or mental health or condition of an individual; … provision of health care to an individual; or … payment for … health care to an individual; and </li></ul></ul><ul><ul><li>identifies the individual; or </li></ul></ul><ul><ul><li>w ith respect to which there is a reasonable basis to believe the information can be used to identify the individual 45 CFR §164.501 </li></ul></ul>
    22. 22. De-Identification <ul><li>A covered entity may determine that health information is not individually identifiable only if: … the following identifiers of the individual or of relatives, employers, or household members of the individual are removed: </li></ul><ul><li>Names; </li></ul><ul><li>All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, …, except for the initial three digits of a zip code if … </li></ul><ul><li>All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89… </li></ul><ul><li>Telephone numbers; Fax numbers; email addresses; URLs; IP addresses </li></ul><ul><li>Social security numbers; Medical record numbers; Health plan beneficiary numbers; Account numbers; </li></ul><ul><li>Certificate/license numbers; vehicle identifiers, serial numbers, plate numbers; </li></ul><ul><li>Device identifiers and serial numbers; </li></ul><ul><li>Biometric identifiers, including finger and voice prints; </li></ul><ul><li>Full face photographic images and any comparable images; and </li></ul><ul><li>Any other unique identifying number, characteristic, or code; and </li></ul><ul><li>The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information. </li></ul><ul><li> 45 CFR §164.514 </li></ul>
    23. 23. Employer Surveillance <ul><li>In general, surveillance by the employer is legal if </li></ul><ul><ul><li>the computer being monitored belongs to the employer; or </li></ul></ul><ul><ul><li>the computer is connected to the employer’s network; and </li></ul></ul><ul><ul><li>even if communications are encrypted </li></ul></ul><ul><li>McLaren v. Microsoft Corp ., No. 05-97-00824 (Tex. Ct. App. May 28, 1999). </li></ul><ul><ul><li>Employee used private password to encrypt email messages stored on office computer. </li></ul></ul><ul><ul><li>Company decrypted and viewed files. </li></ul></ul><ul><ul><li>Email account and workstation were provided for business use, so Microsoft could legitimately access data stored there. </li></ul></ul><ul><li>Notice of Electronic Monitoring Act (CT) </li></ul><ul><ul><li>Versions introduced in other states and Congress </li></ul></ul>
    24. 24. Platform for Privacy Preferences <ul><li>P3P </li></ul><ul><li>Developed by World Wide Web Consortium </li></ul><ul><li>Protocol allowing users to interrogate websites about privacy </li></ul><ul><li>P3P-enabled site posts machine-readable privacy policy summary ( IBM P3P editor , PrivacyBot ) </li></ul><ul><li>User sets up his privacy preferences in his browser </li></ul><ul><li>User’s browser examines the summary; does not allow access to non-compliant sites </li></ul><ul><li>Compliance is voluntary . Validator available. </li></ul>
    25. 25. Anonymity (U.S.) <ul><li>Freedom to publish anonymously is guaranteed by the First Amendment. McIntyre v. Ohio Elections Comm’n , 514 U.S. 334 (1995). Basis: Federalist Papers (1787-1788) </li></ul><ul><li>Are you anonymous if your ISP can be forced to identify you? </li></ul><ul><li>Currenty a VERY HOT topic because of efforts of the recording industry to identify file swappers </li></ul><ul><ul><li>Not strictly a privacy rights matter because the Digital Millennium Copyright Act specifically authorizes such subpoenas </li></ul></ul>
    26. 26. Subpoenas to Identify <ul><li>No privilege between a user and and ISP. But ISP may have standing to assert user’s rights, especially First Amendment rights </li></ul><ul><li>In re Subpoena Duces Tecum to America Online, Inc. (Anonymous Publicly Traded Co. v. Doe), Va. Cir. Ct., Fairfax Cty., Misc. Law No. 40570 , 2/7/00 </li></ul><ul><li>Company alleged it was defamed by an anonymous AOL subscriber </li></ul><ul><li>Company did not want to identify itself, but demanded in a subpoena that AOL identify the subscriber </li></ul><ul><li>(Underlying case was in Ohio; AOL is in Virginia) </li></ul>
    27. 27. Subpoenas to Identify <ul><li>Lower court allowed the subpoena </li></ul><ul><li>Gave a test for subpoenas to identify a user: </li></ul><ul><ul><li>are pleadings and evidence supplied to the court satisfactory? </li></ul></ul><ul><ul><li>does the party requesting the subpoena have a legitimate, good faith basis that it may be the victim of actionable conduct? </li></ul></ul><ul><ul><li>is identifying the subscribers central to advancing the claim? </li></ul></ul>
    28. 28. America OnLine , Inc. v. Record No. 000974 Anonymous Publicly Traded Company <ul><li>Appeals court REVERSED the decision to allow the anonymous subpoena (2001 Va. LEXIS 38; 29 Media L. Rep. 1442) HTML version </li></ul><ul><li>HELD, anonymous plaintiff could be given subpoena power only if it would suffer exceptional harm, such as social stigma, or extraordinary economic retaliation, as a result of exposing its identity </li></ul><ul><li>Company subsequently dropped the lawsuit </li></ul>
    29. 29. Korean Privacy Law <ul><li>Constitution of the Republic of Korea </li></ul><ul><ul><li>Article 17 [Privacy] The privacy of no citizen may be infringed. </li></ul></ul><ul><ul><li>Article 18 [Secrecy of Correspondence] The secrecy of correspondence of no citizen may be infringed. </li></ul></ul><ul><li>Act on the Protection of Personal Information Maintained by Public Agencies (1995) </li></ul><ul><li>Act on Promotion of Information and Communication Network Utilization and Data Protection (“DP Act,” 2001) </li></ul><ul><li>Korea Personal Data Protection Center </li></ul>
    30. 30. European Union Privacy Approach <ul><li>Total contrast to U.S. </li></ul><ul><li>Europeans fear their neighbors, not the government </li></ul><ul><li>Americans fear the government, not their neighbors </li></ul><ul><li>“ Public” information highly restricted </li></ul><ul><li>No notion of personal data as a commodity to be bought and sold </li></ul><ul><li>Concept: </li></ul><ul><ul><li>prior notice and consent by individual </li></ul></ul><ul><ul><li>use restricted to disclosed use </li></ul></ul><ul><ul><li>right of access and correction </li></ul></ul><ul><ul><li>onward transfer restricted </li></ul></ul>
    31. 31. EU Privacy Structure European Parliament UK Government Information Commissioner Registered DataControllers , e.g. Shell French Government German Government Privacy Commissioner Privacy Commissioner Individuals
    32. 32. European Union Privacy Directive <ul><li>Member States shall provide that personal data may be processed only if: (a) the data subject has given his consent unambiguously; or (b) processing is necessary for </li></ul><ul><ul><li>performance of a contact to which the data subject is party; </li></ul></ul><ul><ul><li>compliance with a legal obligation to which the controller is subject; </li></ul></ul><ul><ul><li>protecting the vital interests of the data subject; or </li></ul></ul><ul><ul><li>legitimate interests of parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject </li></ul></ul><ul><li>EU claims this also applies to U.S. companies who use cookies </li></ul>
    33. 33. Remote Data Collection <ul><li>Where the data have not been obtained from the data subject … the controller must at the time of undertaking the recording of personal data provide the data subject with at least: </li></ul><ul><ul><li>identity of the controller and his representative, </li></ul></ul><ul><ul><li>purposes of the processing </li></ul></ul><ul><ul><li>categories of data concerned </li></ul></ul><ul><ul><li>recipients or categories of recipients; </li></ul></ul><ul><ul><li>existence of the right of access and rectification </li></ul></ul><ul><li>Subject may object, but not refuse </li></ul>
    34. 34. European Union Privacy Directive <ul><li>Member States shall grant the right to every person not to be subject to a decision which produces legal effects concerning him … based solely on automated processing of data … such as </li></ul><ul><ul><li>performance at work </li></ul></ul><ul><ul><li>creditworthiness </li></ul></ul><ul><ul><li>reliability </li></ul></ul><ul><ul><li>conduct, etc. </li></ul></ul><ul><li>Member States shall provide that the transfer to a third country of personal data ... may take place only if ... the third country in question ensures an adequate level of protection. </li></ul><ul><ul><li>big problem with respect to U.S. </li></ul></ul>
    35. 35. US/EU Agreement on Data Privacy and Safe Harbor <ul><li>7 Principles to which a US company may voluntarily agree </li></ul><ul><li>Safe harbor companies deemed to protect data adequately and data flows to them from the EU may occur </li></ul><ul><li>Member State requirements for prior approval of data transfers either will be waived or approval will be automatically granted; and </li></ul><ul><li>Claims brought by European citizens against U.S. companies will be heard in the U.S. subject to limited exceptions </li></ul><ul><li>Enforcement in the US by the Federal Trade Commission and Department of Transportation, 49 U.S.C. § 41712 </li></ul><ul><li>Does not include financial institutions </li></ul>
    36. 36. Seven US/EU Safe Harbor Principles <ul><li>Notice </li></ul><ul><ul><li>“ clear and conspicuous” first time data is collected </li></ul></ul><ul><ul><li>purpose of collection </li></ul></ul><ul><ul><li>how to complain </li></ul></ul><ul><ul><li>types of third parties with whom data will be shared </li></ul></ul><ul><li>Choice (opt-out always, opt-in for “sensitive” information) </li></ul><ul><li>Onward Transfer (ascertain status of transferee) </li></ul><ul><li>Security </li></ul><ul><li>Data Integrity (reliability + use consistent with purpose) </li></ul><ul><li>Access (+ right to correct) </li></ul><ul><li>Enforcement (recourse + obligation to remedy) </li></ul>
    37. 37. Major Ideas <ul><li>Privacy is important </li></ul><ul><li>No accepted definition of privacy </li></ul><ul><li>Federal legislation in medical, financial, educational </li></ul><ul><li>Many state laws, few dealing with data </li></ul><ul><li>Anonymizing databases is difficult </li></ul><ul><li>Privacy policies are contracts </li></ul><ul><li>FTC is the main U.S. privacy enforcement body </li></ul><ul><li>Complying with privacy policies and laws is not easy </li></ul>
    38. 38. Q A &
    39. 39. A simple HTTP transaction Web Server SOURCE: LORRIE CRANOR GET /index.html HTTP/1.1 Host: . . . Request web page HTTP/1.1 200 OK Content-Type: text/html . . . Send web page
    40. 40. … with P3P 1.0 added Web Server SOURCE: LORRIE CRANOR GET /w3c/p3p.xml HTTP/1.1 Host: Request Policy Reference File Send Policy Reference File GET /index.html HTTP/1.1 Host: . . . Request web page HTTP/1.1 200 OK Content-Type: text/html . . . Send web page Request P3P Policy Send P3P Policy
    41. 41. P3P increases transparency <ul><li>P3P clients can check a privacy policy each time it changes </li></ul><ul><li>P3P clients can check privacy policies on all objects in a web page, including ads and invisible images </li></ul>|2|68523|1|146|ADFORCE SOURCE: LORRIE CRANOR
    42. 42. P3P in IE6 Privacy icon on status bar indicates that a cookie has been blocked – pop-up appears the first time the privacy icon appears Automatic processing of compact policies only; third-party cookies without compact policies blocked by default SOURCE: LORRIE CRANOR
    43. 43. Users can click on privacy icon for list of cookies; privacy summaries are available at sites that are P3P-enabled SOURCE: LORRIE CRANOR
    44. 44. Privacy summary report is generated automatically from full P3P policy SOURCE: LORRIE CRANOR
    45. 45. P3P/XML encoding <POLICIES xmlns=&quot;;> <POLICY discuri=&quot;; name=&quot;policy&quot;> <ENTITY> <DATA-GROUP> <DATA ref=&quot;;> </DATA> <DATA ref=&quot;;> </DATA> <DATA ref=&quot;;>Web Privacy With P3P</DATA> </DATA-GROUP> </ENTITY> <ACCESS><nonident/></ACCESS> <STATEMENT> <CONSEQUENCE>We keep standard web server logs.</CONSEQUENCE> <PURPOSE><admin/><current/><develop/></PURPOSE> <RECIPIENT><ours/></RECIPIENT> <RETENTION><indefinitely/></RETENTION> <DATA-GROUP> <DATA ref=&quot;#dynamic.clickstream&quot;/> <DATA ref=&quot;#dynamic.http&quot;/> </DATA-GROUP> </STATEMENT> </POLICY> </POLICIES> SOURCE: LORRIE CRANOR P3P version Location of human-readable privacy policy P3P policy name Site’s name and contact info Access disclosure Statement Human-readable explanation How data may be used Data recipients Data retention policy Types of data collected