Administrative agencies increasingly rely on technology to achieve substantive goals. Often this technology is employed to collect, exchange, manipulate and store personally identifiable information, raising serious concerns about the erosion of personal privacy.

Congress has recognized this problem. In the E-Government Act of 2002, it required administrative agencies to conduct privacy impact assessments (PIAs) when developing or procuring technology systems that handle personal information. Despite this new requirement, however, agency adherence to privacy mandates is highly inconsistent.

In this paper, we ask why. We first explore why both process requirements and traditional means of political oversight are often weak tools for ensuring that policy reflects privacy commitments. We then consider what factors might, by contrast, promote agency consideration of privacy concerns.

Specifically, we compare decisions by two federal agencies - the Department of State and the Department of Homeland Security - to use RFID technology, which allows a wireless-access data chip to be attached to or inserted into a product, animal, or person. These two cases suggest the importance of internal agency structure, culture, and personnel, as well as alternative forms of external oversight, interest group engagement, and professional expertise, as important mechanisms for ensuring bureaucratic accountability to the secondary privacy mandate imposed by Congress.

The analysis speaks to debates in both public administration and privacy protection. It implicates disputes over the efficacy of external controls on bureaucracy, and the less-developed literature on opening the black box of administrative decisionmaking. It further offers insight into pre-conditions necessary to advance privacy commitments in the face of social and bureaucratic pressure to manage risk by collecting information about individuals. Finally, it offers specific proposals for policy reform intended to promote agency accountability to privacy goals.

Public and private organizations alike compute statistics from personal data. These statistics are used for a wide array of purposes, such as informing federal, state, and local policymaking, distributing humanitarian aid during crisis situations, and informing the public about social, economic, and health trends in the population. However, statistical uses of personal data can harm individual privacy. Modern privacy research has demonstrated that personal data can be reconstructed from statistics, and that statistical summaries can be analyzed to identify the presence of specific individuals in the underlying data. To attenuate these informational privacy concerns, robust privacy protections are required.

Differential privacy is a mathematical definition of privacy that enables statistical learning while protecting the privacy of individuals in the underlying data. However, in real world applications, other conceptions of privacy, and values beyond privacy, are also at stake.

In this dissertation, we examine how differentially private algorithms can be used to compute statistics while attending to context specific social and political commitments. This inquiry is informed by two studies, both of which examine this question in distinct ways. In our first study, we consider ways to configure differentially private algorithms based on the privacy and accuracy concerns of data subjects and other stakeholders, all the while attending to the values of privacy, fairness, and strategyproofness. Our second study considers the ways in which differentially private algorithms can be configured to attend to context-specific values in public health. We do so through a case study amidst the backdrop of the COVID-19 pandemic, where mobility statistics derived from mobile phone metadata are used to inform decisions on lockdown mandates and other non-pharmaceutical interventions.

Throughout these studies, we develop theory and tools to effectively leverage differential privacy in practice. In addition to the mathematical results in this dissertation, we provide strategies and guidelines to effectively aid in the development and deployment of differentially private algorithms. This work serves as a guide for researchers, analysts, developers, and policymakers on how to use mathematical approaches to attend to context specific social and political commitments, including privacy, in areas where statistical knowledge is essential to advancing the public good.

Maintaining the privacy of one’s personal information—one’s choice of when to disclose it and to whom, how one maintains control over it, and the risks of disclosure—is one of the most important social issues of the internet era. For the past decade, privacy researchers have focused on several domains, including: documenting public opinion about privacy attitudes and expectations; understanding how user interfaces affect disclosure; and focusing on understanding interpersonal privacy dynamics within social media settings, to name a few. All of this work shares the goal of furthering our collective understanding of how people think about information privacy in online settings, what they expect when disclosing their personal information, and why they make the disclosure choices they make. A common element missing from the extant privacy research is an accounting of social structures. More specifically, as researchers consider the various factors that affect personal disclosure, they often do not consider the relationship between the discloser and the recipient, and how aspects of that relationship may directly or indirectly affect one’s decision to disclose. A specific form of relationship I examine here is that between individuals and the companies to whom they disclose their personal information.

This dissertation explores how the structure of relationships between individuals and companies influences individuals’ decisions to disclose personal information. I accomplish this though a mixed-methods approach; first, I conducted twenty exploratory qualitative interviews with ten users of the 23andMe genetic testing service and ten women who used mobile apps to track their pregnancies. I interviewed all twenty participants about their experiences using online search engines. I then conducted three online survey experiments, using a hypothetical wearable fitness device that collects personal information as the premise of the study. The experiments tested a set of hypotheses and further explored themes that emerged from the qualitative research. These studies examine the ways in which the relationship between individuals and the companies they disclose to, and in particular the distribution of power within the relationship, affects the individuals’ decisions to disclose. I use social exchange theory (SET) as the theoretical framework for this inquiry because the transfer of personal information in exchange for a service is an exchange between social actors. Thus, SET provides an empirically tested scaffolding for exploring key features of these relationships and their impact on the normative aspects of exchange that affectdisclosure choices, specifically: individuals’ perceptions of trust, fairness, power, and privacy.

This dissertation forges new ground in the analysis of information privacy and personal disclosure. Namely, the results of my mixed-method studies demonstrate the utility of the relational analytic approach for identifying social structural factors that affect personal disclosure. Further, it demonstrates the influence of power on personal disclosure—the extent to which individuals can control the terms under which personal information is exchanged, the options available to them to obtain similar resources elsewhere, how fair the exchange is, and the extent to which individuals benefit from it. This approach yields a different set of insights into the dynamic of personal disclosure and information privacy. It reveals the impact of power differentials on personal disclosure, demonstrating that imbalances in power between individuals and companies can affect individual decisions to disclose.

Late in 2005, Sony BMG released millions of Compact Discs containing digital rights management technologies that threatened the security of its customers' computers and the integrity of the information infrastructure more broadly. This Article aims to identify the market, technological, and legal factors that appear to have led a presumably rational actor toward a strategy that in retrospect appears obviously and fundamentally misguided.

The Article first addresses the market-based rationales that likely influenced Sony BMG's deployment of these DRM systems and reveals that even the most charitable interpretation of Sony BMG's internal strategizing demonstrates a failure to adequately value security and privacy. After taking stock of the then-existing technological environment that both encouraged and enabled the distribution of these protection measures, the Article examines law, the third vector of influence on Sony BMG's decision to release flawed protection measures into the wild, and argues that existing doctrine in the fields of contract, intellectual property, and consumer protection law fails to adequately counter the technological and market forces that allowed a self-interested actor to inflict these harms on the public.

The Article concludes with two recommendations aimed at reducing the likelihood of companies deploying protection measures with known security vulnerabilities in the consumer marketplace. First, Congress should alter the Digital Millennium Copyright Act (DMCA) by creating permanent exemptions from its anti-circumvention and antitrafficking provisions that enable security research and the dissemination of tools to remove harmful protection measures. Second, the Federal Trade Commission should leverage insights from the field of human computer interaction security (HCI-Sec) to develop a stronger framework for user control over the security and privacy aspects of computers.

The functionality of the Internet and the Web are determined in large part by the design of technical standards that allow for interoperable implementations. Those design decisions are important both in terms of functionality and in maintaining basic public policy values including accessibility, freedom of expression, privacy and security. This is one instance of a phenomenon variously referred to as values-in-design or from another angle technological delegation: fundamental matters of public policy importance can be determined or regulated by software architecture, in much the way that urban architecture has.

Technical standard-setting bodies, like the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C), are multistakeholder organizations that host groups that define Internet standards. In contrast to multilateral bodies (like the United Nations) or state bureaucracies or firms, participants are drawn from competing companies across different industry sectors, as well as governments and civil society groups, and make decisions based on rough consensus and working implementations. This represents a distinct form of new governance where collaborative development of technical and policy solutions can be enacted outside traditional legislative or administrative bodies.

Standard-setting participants are most often engineers; their discussions are technical and wide-ranging, distributed between in-person meetings, email lists, online chat and version-controlled text and software. Web standards include HTML, the foundational markup language that defines Web pages, and Do Not Track, a syntax and system for communicating user privacy preferences about online behavioral tracking. Some standards, like HTML, have been widely adopted and support some of the world's most used software, while others, like DNT, have seen limited adoption and little direct effect.

This work seeks to understand how privacy and other values get enacted in the technical standards and running software that make up the Internet we use. At the highest level, it considers these two related research questions:

1. What are the impacts of multistakeholder techno-policy standard-setting processes on resolving public policy disputes for the Internet?2. How do the views of the designers of the Internet’s underlying protocols affect the privacy of Internet and Web users?

To start to answer these questions, I have explored the community of standard-setting participants and their beliefs about privacy and security in their lives and work. And I have investigated the unusual consensus decision-making process used in technical standard-setting and perspectives, from newcomers and long-time participants, on its fairness and efficacy and how it applies to values such as privacy.

Private interviews with participants working on Do Not Track and other standards provided candid and diverse perspectives on the concept of privacy, multistakeholder processes and the role of technical standards for interoperability and for public policy. And the extensive documentation and technologically-mediated communication methods of these Internet standard-setting venues enabled some supplementary quantitative analysis of the patterns of participation.

Multistakeholder standard-setting processes bring together diverse participants from a wide variety of organizations with a wide variety of backgrounds and goals. Individuals navigate a tricky balance of being both experts collaborating and representatives negotiating. While this novel cross-boundary process provides real opportunity, it also provides real difficulties of bad faith behavior, entrenchment and conflict. And while access and transparency of processes may improve upon some alternatives, technical standard-setting continues to be Western-oriented, male-dominated and intensely time-consuming.

Participants hold competing views of privacy and recognize that the priorities and concerns of Internet users may vary widely. While privileged community members may not have as much to risk when it comes to their own online privacy, the distinct wants and needs of their own children provide a compelling touchstone. Sometimes the work of privacy has been reduced to compliance with laws or best practices, but it remains an area where professionals actively pursue debate and development of policy.

The social, legal and technical architecture of the Internet and the Web determine so much about the lives of people around the world and deserve the attention of research on their impacts. Using consensus-based multistakeholder processes focused on interoperability for the Internet presents real, new opportunities to enact privacy by intentionally taking advantage of handoffs between social, technical and organizational factors. At the same time, this work highlights some of the challenges to convening for, equitably designing, agreeing on and implementing these techno-policy standards. Training people in intersecting disciplines, developing systematic processes and building technical and decisional tools can all contribute to better support for privacy, security and the other fundamental but still contested values we want to see in the Internet.