Chi Barnett - The Ethical Spy

### Overview In this presentation, Chi Barnett, a data scientist working in home automation (with previous experience at Tinder), discusses the critical balance between building useful data-driven services and preserving user privacy. Modern applications like recommendation engines and crowdsourced traffic tools (such as Waze) require extensive user data to function effectively, but accidental or intentional disclosures can introduce severe real-world physical and safety risks. Barnett argues that existing privacy policies fail because they are written in opaque legalese aimed at protecting service providers rather than empowering users. To address this, Barnett proposes establishing a formal voluntary standard—currently being developed as an IETF draft—modeled on medical informed consent to govern data collection, disclosure, and lifecycle management.

### Key Topics - **The Medical Informed Consent Model**: Borrowing from medical law, Barnett outlines the three fundamental pillars required for legitimate consent: 1. *Disclosure*: Users must clearly understand what data is collected and how it will be used. 2. *Capacity*: The user must be capable of understanding risk and exercising autonomy (referencing age standards such as 13 under COPPA, or legal incapacitation). 3. *Voluntariness*: Consent cannot be coerced through force or undue pressure where the user cannot practically say no. - **Utilities vs. Non-Utilities**: The standard distinguishes standard services from entities that function as utilities (services like the electric company or potential future mandatory transit platforms). When opting out would cause severe negative life consequences, mandatory data collection is inherently coercive. Therefore, utilities should only be permitted to require essential billing details (such as a billing address, which can be bypassed via electronic payment), making all other data collection optional. - **Mandatory vs. Optional Metrics**: Services can define metrics as mandatory only if they are strictly required for core functionality (e.g., location pings for real-time routing in Waze or Lyft). Value-added features (e.g., long-term search history) and data collection for future unannounced innovations must be treated as optional with explicit opt-out mechanisms that clearly state what functionality degrades if declined. - **Lifecycle Disclosures and Third-Party Sharing**: Disclosures must cover the entire data lifecycle: collection, usage, retention duration, security/encryption models, destruction plans, and breach response policies. If data is shared with third parties, the receiving party's retention, security, and privacy terms must also be disclosed. - **Capacity Loss and Retroactive Opt-Outs**: If a user becomes incapacitated or dies, a designated proxy should manage consent; otherwise, consent is treated as withdrawn. When minors or incapacitated users are found to have consented invalidly, data must be purged immediately. Furthermore, user opt-outs should be retroactive by default, purging previously collected data.

### Technical Details - **Draft Format**: Barnett authored the initial IETF draft using XML intended for conversion to standard RFC text format using the IETF XML conversion tool. - **Data Categorization**: The framework distinguishes *content* (data meant for human consumption) from *metrics* (machine-readable data used by the service, such as clickstreams or demographic tags), as well as differentiating non-sensitive data, sensitive data, and legally defined Personally Identifiable Information (PII). - **Alarm Fatigue & Default Opt-Outs**: To combat user notification fatigue from constant disclosure updates, providers may opt to treat features as opt-out by default from inception while providing minimal core functionality.

### Takeaways Barnett emphasizes that establishing trust requires enforceable accountability, standardized templated disclosure language, and clear risk communication (such as reminding users that retained data is subject to government subpoenas). The speaker invites community collaboration from attendees to refine the draft into an actionable standard.