| Abstract | The rapid growth of the Internet has been accompanied by a proliferation of e-services targeting consumers. E-services are available for banking, shopping, learning, government online, and healthcare. However, each of these services requires a consumer's personally identifiable information (PII) in one form or another. This leads to concerns over privacy. In order for e-services to be successful, privacy must be protected (Ackerman, Cranor, and Reagle, 1999). An effective and flexible way of handling privacy is management via privacy policies. In this approach, a consumer of an e-service has a personal privacy policy that describes what private information the consumer is willing to give up to the e-service, with which parties the provider of the e-service may share the private information, and how long the private information may be kept by the provider. The provider likewise has a provider privacy policy describing similar privacy constraints as in the consumer's policy, but from the viewpoint of the provider, i.e. the nature of the private information and the disclosure/retention requirements that are needed by the e-service. Before the consumer engages the e-service, the provider's privacy policy must match with the consumer's privacy policy. In this way, the consumer's privacy is protected, assuming that the provider complies with the consumer's privacy policy. Note that policy compliance is outside the scope of this work but see Yee and Korba (July 2004). |
|---|
