I am looking for case studies of actual privacy risks. At the core of privacy and data protection impact assessments, we find the concept of 'risk' meaning - in this case - the probability of a threat to personal data and the possible harm or damage caused by this threat. E.g. I fall victim to a phishing attack and the attacker gains access to my bank account, the actual harm being that my account is emptied. Another example would be that my account at a social media platform is hacked and my identity is used to "go shopping".
Now, one finds a lot of literature on privacy (PIA) and data protection impact assessments (e.g. the edited volume by Wright and De Hert (2012) on PIA), on the potential risks of low levels of data security (e.g. Rosner, Kenneally (2018): Clearly Opaque: Privacy Risks of the Internet of Things), on technological and organization standards (e.g. ISO 27001 on Information security management), or on the regulatory frameworks of privacy and data protection (e.g. everything on the details of the GDPR in the EU). But I have a hard time to find research results evaluating actual risks similar to your risk to fall victim to a traffic accident, have your home being broken into, or get cancer.
I would welcome any hint to empirical publications on actual privacy risk analysis be it from medical, social, internet-based or any other research that you consider as most important. I am *not* looking for literature on how to conduct privacy and data protection impact assessments or standards for this purpose. Thank you.
This is a great question, and inspired to me to look for some quantification of the risk and probability of data breaches and harm. Found the following reports which may be of interest. They are largely from security companies and insurance companies, which would have access to this kind of data and might need data like that to set insurance policies.
- "Follow the Data:Dissecting Data Breaches and Debunking Myths - Trend Micro Analysis of Privacy Rights Clearinghouse 2005–2015 Data Breach Records" (https://www.trendmicro.co.uk/media/wp/dissecting-data-breaches-wp-en.pdf): This analysis draws out the frequencies of breaches and provides the numbers on how particular kinds of data are exploited. If you trust the data and the analysis, you could extrapolate probabilities of breaches and damages.
- "Privacy Rights Clearinghouse Data Breaches database" (https://privacyrights.org/data-breaches): The above report is based on this data which you can analysis yourself.
- "Data Breach Risk assessment calculator" (https://breachlevelindex.com/data-breach-risk-assessment-calculator): Uses a Data breaches database and make privacy risk assessments. Not sure where they got the data from.
- "Insurance Information Institute - Facts + Statistics: Identity theft and cybercrime" (https://www.iii.org/fact-statistic/facts-statistics-identity-theft-and-cybercrime): Some data from an insurance institute/research center. Can be used to get some idea of breach and consequences probabilities.
Hi Jeff.
Thank for these valuable hints. Especially the report by Huq (2015: Follow the Data) on the basis of the Privacy Rights Clearinghouse looks great.
Best,
Oliver
- Badges
- Science topic
- Similar topics
- Social Science
- Media
- Journalism