Contextual integrity

Contextual integrity is a theory of privacy developed by Helen Nissenbaum and presented in her book Privacy In Context: Technology, Policy, and the Integrity of Social Life. It comprises four essential descriptive claims:

• Privacy has to do with appropriate flows of information.
• Appropriate information flows are those that conform with contextual information norms.
• Contextual informational norms involve five independent parameters: data subject, sender, recipient, information type, and transmission principle.
• Conceptions of privacy are based on ethical concerns that evolve over time.

The theory of contextual integrity seeks to define, clarify, and organize conceptions of privacy in a manner that is relevant even in evolving information environments. When applied, contextual integrity serves to illuminate a range of concerns to consider when designing systems, making decisions, or establishing policy that implicate flows of information and information privacy. It provides a framework for distinguishing between appropriate and inappropriate information flows, and thus for making ethical decisions and avoiding privacy violations as the development of new technologies enables novel flows of information.

Overview

A contextual integrity framework holds that privacy norms and data practices in digital environments should derive from the norms and expectations associated with preexisting social institutions to which these environments correspond (for example, the ethical norms and expectations of healthcare providers regarding user privacy should also apply in their online environments). When rules and policies are derived in this manner, there exists a continuity, or integrity, of privacy practices, norms, and expectations spanning the physical, digital, and online dimensions of a given social context. When social or institutional precedents are not readily identifiable due to the novelty of certain online environments, a contextual integrity approach to privacy encourages examination of the ends, purposes, and values of users of those environments and deriving appropriate privacy rules and policies from these considerations. Contextual integrity asserts that the collection and use of individuals' information should not by default be coextensive with technical capabilities, but rather adhere to rules and norms socially constructed according to broader shared values.

Contextual integrity defines privacy in terms of appropriate flows of information. This contrasts with theories that define privacy as control over information about oneself, as secrecy, or as regulation of personal information that is private or sensitive. This places contextual integrity at odds with privacy regulation based on Fair Information Practice Principles; it also does not line up with the 1990s Cypherpunk view that newly discovered cryptographic techniques would assure privacy in the digital age because preserving privacy is not a matter of stopping any data collection, or blocking all flows of information, minimizing data flow, or by stopping information leakage.

The fourth essential claim comprising contextual integrity gives privacy its ethical standing and allows for the evolution and alteration of informational norms, often due to novel sociotechnical systems. It holds that practices and norms can be evaluated in terms of:

• Effects on the interests and preferences of affected parties
• How well they sustain ethical and political (societal) principles and values
• How well they promote contextual functions, purposes, and values

The most distinctive of these considerations is the third. As such, contextual integrity highlights the importance of privacy not only for individuals, but for society and respective social domains.

Parameters

The "contexts" of contextual integrity are social domains, such as healthcare, finance, commercial marketplace, family, education, civil and political, etc. The five critical parameters for data transfer operations are:

1. The data subject (examples: patient, shopper, investor, reader)
2. The sender of the data (examples: doctor, bank, website)
3. The recipient of the data (examples: police, advertising network, family member)
4. The information type (examples: contents of an email message; user activity on a website; the data subject's demographic, biographical, medical, or financial information)
5. The transmission principle (examples: consent, notice, coerced, legally mandated, purchased, confidentiality, stewardship, national security)

The first three parameters consist in context-dependent social roles. The fourth parameter, information type, refers to the nature of the information that is shared. The fifth parameter, transmission principle, describes conditions and constraints that determine what information is shared in given circumstances.

A key thesis of contextual integrity is that assessing the privacy impact of information flows requires the values of all five parameters to be specified. Nissenbaum has found that access control rules not specifying the five parameters are incomplete and can lead to problematic ambiguities.

Nissenbaum also notes that the certain kinds of language can misrepresent the real dynamics of information flows. For example, when the passive voice is used to describe the movement of data, it allows the speaker to gloss over the fact that there is an active agent performing the data transfer.

Some illustrative examples of contextual informational norms in western societies include:

• In a job interview, an interviewer is forbidden from asking a candidate's religious affiliation
• A priest may not share congregants' confessions with anyone
• A U.S. citizen is obliged to reveal gross income to the IRS, under conditions of confidentiality except as required by law
• One may not share a friend's confidences with others, except, perhaps, with one's spouse
• Parents should monitor their children's academic performance

Example

Consider the norm: "US residents are required by law to file tax returns with the US Internal Revenue Service containing information, such as, name, address, SSN, gross earnings, etc. under conditions of strict confidentiality."

• Data subject: a US resident
• Sender: the same US resident
• Recipient: the US Internal Revenue Service
• Information type: tax information
• Transmission principle: the recipient will hold the information in strict confidentiality.

Given this norm, we can evaluate a hypothetical scenario and see if it violates the contextual integrity norm: "The US Internal Revenue Service agrees to supply Alice's tax returns to the city newspaper as requested by a journalist at the paper." This hypothetical clearly violates contextual integrity because providing the tax information to the local newspaper would violate the transmission principle under which the information was obtained.

Applications

As a conceptual framework, contextual integrity has been used to analyze and understand the privacy implications of socio-technical systems on a wide array of platforms (e.g. Web, smartphone, IoT systems), and has led to many tools, frameworks, and system designs that help study and address these privacy issues.

Privacy in the public

In her book Privacy In Context: Technology, Policy, and the Integrity of Social Life, Nissenbaum discusses the privacy issues related to public data, discussing examples like Google Street View privacy concerns and problems caused by converting previously paper-based public records into digital forms stored online. In recent years, similar issues happening in the context of social media have revived the discussion.

The concept of contextual integrity have also influenced the norms of ethics for research work using social media data. Fiesler et al. studied Twitter users' awareness and perception of research work that analyzed Twitter data, reported results in a paper, or even quoted the actual tweets. It turned out that users' concerns were largely dependent on contextual factors, i.e. who is conducting the research, what the study is for, etc., which is in line with the contextual integrity theory.

Mobile privacy

The privacy concerns induced by the collection, dissemination and use of personal data via smartphones have received a large amount of attention from different stakeholders. A large body of computer science research aims to efficiently and accurately analyze how sensitive personal data (e.g. geolocation, user accounts) flows across the app and when it flows out of the phone.

Contextual integrity has been widely referred to when trying to understand the privacy concerns of the objective data flow traces. For example, Primal et al. argued that smartphone permissions would be more efficient if it only prompts the user "when an application's access to sensitive data is likely to defy expectations", and they examined how applications were accessing personal data and the gap between the current practice and users' expectations. Lin et al. demonstrated multiple problematic personal data use cases due to the violation of users' expectations. Among them, using personal data for mobile advertising purposes became the most problematic one. Most users were unaware of the implicit data collection behavior and found it unpleasantly surprising when researchers informed them of this behavior.

Contextual integrity has also influenced the design of mobile operating systems. Both iOS and Android are using a permission system to help developers manage their access to sensitive resources (e.g. geolocation, contact list, user data, etc.) and to provide users with control over which app can access what data. In their official guidelines for developers, both iOS and Android recommend developers to limit the use of permission-protected data to situations only when necessary, and recommend developers to provide a short description of why the permission is requested. Since Android 6.0, users are prompted at runtime, in the context of the app, which is referred to as "Increased situational context" in their documentation.

Other applications

In 2006 Barth, Datta, Mitchell and Nissenbaum presented a formal language that could be used to reason about the privacy rules in privacy law. They analyzed the privacy provisions of the Gramm-Leach-Bliley act and showed how to translate some of its principles into the formal language.

See also

• H. Nissenbaum, Privacy in Context: Technology, Policy and the Integrity of Social Life (Palo Alto: Stanford University Press, 2010), Spanish Translation Privacidad Amenazada: Tecnología, Política y la Integridad de la Vida Social (Mexico City: Océano, 2011)
• K. Martin and H. Nissenbaum (2017) "Measuring Privacy: An Empirical Examination of Common Privacy Measures in Context", Columbia Science and Technology Law Review (forthcoming).
• H. Nissenbaum (2015) "Respecting Context to Protect Privacy: Why Meaning Matters", Science and Engineering Ethics, published online on July 12.
• A. Conley, A. Datta, H. Nissenbaum, D. Sharma (Summer 2012) "Sustaining both Privacy and Open Justice in the Transition from Local to Online Access to Court Records: A Multidisciplinary Inquiry", Maryland Law Review, 71:3, 772–847.
• H. Nissenbaum (Fall 2011) "A Contextual Approach to Privacy Online", Daedalus 140:4, 32–48.
• A. Barth, A. Datta, J. Mitchell, and H. Nissenbaum (May 2006) "Privacy and Contextual Integrity: Framework and Applications", In Proceedings of the IEEE Symposium on Security and Privacy, n.p. (Showcased in "The Logic of Privacy", The Economist, January 4, 2007)