Regulators and lawmakers can only do so much to hold tech companies accountable. Enforcement agencies and the people they protect need help. One problem is that the inner workings of large organizations and complex algorithmically-driven systems remain obscure and opaque while their privacy representations are voluminous and vague. As described in a recent journal article, we argue that bringing together technologists and policy experts can help improve accountability, where academic researchers can play a larger role in privacy enforcement and policymaking. Examples of relevant opportunities include automatically surfacing a company's privacy representations and statements, measuring the actual behavior of their systems with respect to algorithms, user interfaces, and data processing, and identifying risks and harms for newly deployed technologies. To make progress toward closing the gap between academic research and policy, we need to focus on building an interdisciplinary community that incorporates myriad stakeholders in each domain, instead of one-off and unilateral efforts by each domain. This workshop is an initial effort trying to build this community to address this gap.
In this workshop, we will bring together a multi-disciplinary group of researchers trained in computer science, engineering, and law to explore how researchers can support the movement for tech accountability. We expect the discussions at the workshop to improve knowledge transfer and collaboration both from academic researchers to policy experts (e.g., via explorations of recent papers relevant to privacy research in an interactive environment) and from policy experts to academic researchers (e.g., by covering how to most effectively go public with findings, how to work with regulators, how to contribute to Unfair, Deceptive, or Abusive Acts or Practice (“UDAAP”) complaints and lawsuits, and how to take advantage of data subject rights). Through a combinations of keynote presentations, panels, and multiple interactive breakout sessions, we intend to build a community around this opportunity for interdisciplinary collaboration—one that we hope will have impact not only through more policy-relevant research being published in the PETS community, but also through more effective outcomes such as enforcement actions and law/rulemaking.
The workshop is organized as an in-person, one-day event focusing on discussing opportunities for collaborations between policymakers and academic researchers in the PETS community. In this initial workshop, we will focus on privacy work that is relevant to policy, e.g., work that focuses on identifying privacy risks and harms related to laws that include (but are not limited to): UDAAP, GPDR, CP(P|R)A, COPPA/HIPPA/VPPA/BIPA, FISA, FISAA, RIPA, and other legislation and rules relevant to privacy.
We will produce a workshop report that outlines initial steps to realize such a community for policy-inspired privacy research. It will include highlights of presentations, panel discus- sions, and readouts of each breakout session. It will also outline recommended next steps for continuing to grow, coordinate, and integrate this emerging interdisciplinary community.
The tentative schedule is below, and is of course subject to change.
| Time | Activity |
|---|---|
| 9-9:30 | Overview and Logistics |
| 9:30-10:30 | Keynote |
| 10:30-11:00 | Break |
| 11:00-12:00 | Lightning Talks |
| 12:00-1:00 | Lunch breakouts |
| 1:00-2:30 | Panel: Policy/Technology collaboration |
| 2:30-3:00 | Break |
| 3-4:30 | Breakout discussions |
| 4:30-5:00 | Readout from breakouts and wrap up |
We welcome all community members who identify either as technologists working on privacy research or policy-focused individuals. To register for the event, please use the PETS registration page. We strongly encourage anyone interested in attending to please also fill out the form below to help us plan accordingly.
Examples of relevant areas include:
For any questions about the workshop, contact David Choffnes (choffnes at ccs dot neu dot edu).