Enhancing Transparency and Control when Drawing Data-Driven Inferences about Individuals

Enhancing T ranspar ency and Contr ol when Drawing Data-Drive n Infer ences about Individuals Daizhuo Chen D C H E N 1 6 @ G S B . C O L U M B I A . E D U Columbia Business School, 2960 Broadway , Ne w Y ork, NY 10029 USA Samuel P . Fraiberger S . F R A I B E R G E R @ N E U . E D U Network Science Institute at Northeastern Univ e rsity , 177 Huntington A venue, Boston, MA 02114 USA Robert Moakler R M OA K L E R @ S T E R N . N Y U . E D U Foster Pr ovost F P ROV O S T @ S T E R N . N Y U . E D U NYU Stern School of Business, 44 W est 4th Street, New Y ork, NY 10012 USA Abstract Recent studies have shown that information dis- closed on social network sites (such as Facebook) can be used to predic t personal characteristics with surprisingly high accuracy . In this pap er we e xamine a method to give online u s ers trans- parency into why certain inference s ar e made about them by statistical mod els , and control to inhibit those inferenc es by hiding ( “cloaking”) certain per sonal information from inference. W e use th is method to examine wheth er such tran s- parency and con trol w ould b e a reasona ble g oal by assessing how difficult it would be for u sers to actually inhibit infere nces. Applying the metho d to data from a large collection of real users on Facebo ok, we show that a user mu s t cloak only a small p ortion of her Facebook Likes in order to inh ibit inferences about their person al characteristics. Howe ver, we also show that in response a firm cou ld change its mod eling of users to make cloaking more difficult. 1. Intr oduction Successful pricing strategies as well as marketing an d p o- litical campaigns depend on t he ability to target co nsumers or voters accurately . This gene rates incentives to acquire and e x ploit info rmation about personal characteristics such as gender, marital status, religion, and sexual or political orientation . Personal characteristics are often hard to observe becau se of lack o f data or privac y restrictions. As 2016 ICML W orkshop on Human Interpr etability in Machine Learning (WHI 2016 ) , Ne w Y ork, NY , US A. Copyright by the author(s). a result, firms and governments in creasingly dep end on statistical inferences drawn from a vailable information . Online user targeting systems increasingly are trained using informa tion on users’ fin e-grained behaviors ( Perlich et al. , 2013 ). A growing tre nd is to base targeting on infor mation disclosed by users on social networks. For instance, Facebook has recently dep lo y ed a system that allo ws third party a pplications to display ads on th eir platfor m u sing their user’ s profile infor mation, su ch as the thing s th e y indicate that they “Like. ” 1 2 While som e in di vidu als may benefit fr om being targeted based on inferen ces of their per s onal characteristics, o thers may find such inf erences unsettling. These inferen ces may be incorrect due to a lack of data, inadeq uate models, or simply the p robabilistic nature of the infere nce. Moreover, some users may not wish to have certain perso nal char- acteristics inf erred at all. T o many , p ri vacy inv asions via statistical inferences a re at least as tr oublesome as priv acy in vasions based on revealing personal data ( Barocas , 201 4 ). Howe ver, social networks su ch as Facebook lack fea tures that allow for transparency and fine-g rained con trol over how users’ profiles and behavioral information are used to determine targeted content and advertisements. T ra nsparency is based on understan ding the reasons for data-driven infer ences. W e ask: what is the m inimal set of evidence such that, if it had not been presen t, an inference abou t a user would n ot have b een d ra wn? W e introdu ce th e idea of a “cloaking device” as a vehicle to offer users contro l over inferences, and we show that a user nee ds to on ly cloak a small portion o f her Likes in 1 https://de velope rs.faceboo k.com/blog/post/20 14/10/07/audience- network 2 W e will capitalize “Like” when referring to the action or its result on Faceboo k. 21 Enhancing T ranspare ncy and Control when Drawing Data-Dri ven Inferences about Individuals order to inhibit inference, based on the modeling presented by ( K osin s ki et al. , 2013 ). 2. Privacy , Cloakability , and the Evidence Counterfactual Online priv acy is becom ing an incr easing c oncern for con- sumers, regulato rs and policy makers ( White House , 2012 ). The analy tics liter ature has traditio nally focused on the issue of p ri vacy of per sonal inform ation (see ( Smith et al. , 2011 ; Pavlou , 2011 ) fo r an overview). Howe ver, with th e rapid increase in th e amo unt of social m edia da ta av ail- able, statistical inferen ce about personal ch aracteristics is a growing concern ( Barocas , 2014 ; Gayo -A vello et al. , 2013 ). A series of paper s h a ve shown the predictive power of inform ation disclosed on Facebook to infer users’ per- sonal ch aracteristics ( K osin s ki et al. , 20 13 ; Bachrach et al. , 2012 ; Schwartz et al. , 2013 ). A recent stud y based o n a su r - vey of Facebook user s found that users do not feel that they have the approp riate tools to mitiga te their priv acy concerns when it comes to social network d ata ( Johnson et al. , 2012 ). The meth od we propose to provide transparency over inference s is based on the idea of explainin g ind i vidua l model pr edictions by examining the “evidence” in the input feature vectors that, if r emov e d, would lead the m odel not to make the pre diction (introd uced in the co nte xt o f data-driven do cument classification s ( Martens & Prov ost , 2014 )). As a shorthand, we refer to this counterfactual notion o f “what would the m odel hav e done if this evidence hadn’t been present” as an “evidence counterfactual. ” The prior work can be g eneralized d irectly to any dom ain where the featur es taken as inp ut can be seen as interpretab le pieces of e vidence for or against a particular non-de f au lt inference . 3 Figure 1 illustrates the case of two users, their probabilities of being gay as predicted by the in fer - ence p rocedure of ( K osin s ki et al. , 2013 ), and the effect of removin g evidence f rom their data. As evidence is removed b y cloaking Likes, we see th at r emoving fewer than ten L ik e s for one u ser results in a dram atic drop in the p redicted probab ility of being gay , wh ereas for the other user , removing the same numb er of Likes reduces th e probab ility h ardly at all. Th is moti vating example leads us to propose a genera l meth od of cloak ing. 2.1. A Model for Cloaking W e will n o w formally describe cloaking in the con te x t of a linear mo del (for extensio n to n on-linear models, follow ( Martens & Provost , 20 14 ) ). Consider prediction s 3 The explan ation for a default prediction—namely , that there is no eviden ce for any alternative—o ften will be viewed as either triv i al or unsatisfying. S ee ( Martens & Prov ost , 2014 ) for further discussion and other nuan ces of ex plaining model-based inferences. 0 2 4 6 8 1 0 Nu mb e r o f L i k e s r e mo v e d 0 .9 2 0 .9 3 0 .9 4 0 .9 5 0 .9 6 0 . 9 7 0 .9 8 0 . 9 9 1 .0 0 P ( Y = 1) L a d y Ga g a Gl e e T r u e Bl o o d T h e E l l e n De Ge n e r e s S h o w Hu m a n Ri g h ts C a mp a i g n K a ty P e r r y Ba r a c k O b a ma S ki ttl e s De sp e r a te Ho u se w i v e s Je f f Du n h a m L a d y Ga g a Da n c i n g T h e E l l e n De Ge n e r e s S h o w Ha r r y P o t te r Ha r ry P o tte r S i n g i n g Hu ma n R i g h ts C a m p a i g n K a ty P e r r y Figure 1. The predicted probability of being gay as a function of Like cloaking for two users. For each line, the leftmost point is the estimated probability of being gay for the user before cloaking. Mov ing l eft to right, for each user , Likes are remov ed one-by- one from consideration by the inference procedure in order of greatest ef f ec t on the estimated score. One user’ s probability drops dramatically after clo aking fe wer th an ten Lik es; the other’ s is hardly af fected at all. of person al traits based on bin ary Likes as features. Let β j be the coefficient associated with Like j ∈ { 1; ... ; J } . W ithou t loss of generality , ass ume that these are ranked by decreasing value of β . Each such coefficient correspo nds to th e marginal increase in a user’ s score if he chooses to Like j . For a target trait s , let s i be the mo del output score for user i , calculated as P J j =1 β j x ij where x ij is set to 1 if u ser i has L ik e d j an d zero otherwise. W e consider “targeted” users to be those in the top δ -qua ntile of the score d istrib ution . Define the cutoff score s δ to be the scor e of the h ighest-ranked user in the quan tile dir ectly below the targeted user s . T hus the set o f targeted users T s for classification task s is T s = { i | s i > s δ } . T o analyze the difficulty or ease o f clo aking f or each user in the targeted group, we iteratively r emov e Likes from his profile in or der of the largest effect on the outpu t score. A user is co nsidered to be successfully cloa k e d when his score falls be lo w s δ (and thus he no lo nger would b e targeted). Given a linear mo del, th e Like with the largest effect on th e o utput scor e is the Like pr esen t in the user’ s data instanc e that has the largest coefficient in the model. For each user a nd trait the mo del is static; mo dels are not retrained after each Like is r emov ed. Figu re 1 shows two examples. The ab solute effort to cloak a par ticular classification target s for user i , η s i,δ , is giv en b y c ounting the number of Likes th at must be removed for that user to drop below the threshold sco re. T he (average) a bsolute effort to cloak ch aracteristic s is given by a verag ing across users in T s , 22 Enhancing T ranspare ncy and Control when Drawing Data-Dri ven Inferences about Individuals η s δ = P i ∈ T s η s i,δ | T s | . (1) For th e re s t of this paper we use δ = 0 . 9 0 to indicate that the top 10% o f user s are being targeted. For other values of δ the results hold qualitatively . 3. Results Let us now examin e th e effort requ ired to cloak the infer- ences of a variety of personal character is tics based on data on Faceboo k users. W e first descr ibe the data, an d then assess the effort required to cloak user character is tics. 3.1. Data Our data wer e collected thro ugh a Faceboo k application called myPer s onality . 4 Users of the a pplication ha ve op ted in and given the ir co nsent to h a ve their data recorded for analysis. The data co mprise 164 , 883 individuals from the United States, includ ing th eir responses to survey questions and a subset of their Facebook pr ofiles, including Likes. Subsets of users are characterized b y their sexual orientation , gende r , political affiliation, religiou s views , IQ, alcoh ol and drug use, personality dimen sions, and lifestyle choices. Th e persona l ch aracteristics are the tar get variables for th e various modelin g and inferen ce problems and the Likes are the features. Th e f eature data are very sparse: a user display s less than 0 . 5% o f the set of Likes on av e rage. T able 1 presents summary statistics. W e replicated the predictive mo deling and infere nce pr o- cedure reported by ( K osin s ki et al. , 2013 ). Specifically , we build th e pred icti ve mode ls on the top 100 SVD com po- nents using lo gistic regression as implemente d in the scikit- learn pack age in Pytho n (LRSVD). For each mod el, we choose the re gularization parameter by 5 -fold nested cross- validation ( Provost & Fawcett , 2013 ). 3.2. Cloaking Difficulty T able 2 r eports the effort necessary to cloak users in the top 10% of users as ranked by m odel scor e. Column 1 shows that althou gh u s ers display hundred s of Likes, on a verag e they need to cloak less th an 10 o f them to successfully inhibit inf erence. This c orresponds to cloaking on ly about 2 − 3 % o f a user’ s Likes, on average. The averages give a fair pictu re: with only a cou ple excep tions the prop ortion of info rmation neede d to inhib it inference is ar ound 2 − 4 %. T o put these r esults in context it would be usef ul to know how stro ngly the cloak ability of a trait is related to 4 Thanks to t h e authors of ( K osinski et al. , 2013 ) for sharing the data. T ask # Users % Positiv e A vg. Likes age ≥ 37 145,400 0.127 216 agreeableness ≥ 5 136,974 0.014 218 conscientiousn ess ≥ 5 136,974 0.018 218 extra version ≥ 5 136,974 0.033 218 iq ≥ 130 4,540 0.130 186 iq < 90 4,540 0.073 186 is democrat 7,301 0.596 262 is drinking 3,351 0.485 262 is female 164,285 0.616 209 is gay 22,383 0.046 192 is homose xual 51,703 0.035 257 is lesbian 29,320 0.027 307 is muslim 11,600 0.050 238 is single 124,863 0.535 226 is smoking 3,376 0.237 261 life satisfaction ≥ 6 5,958 0.125 252 network density ≥ 65 32,704 0.012 214 neuroticism ≥ 5 136,974 0.004 218 num friends ≥ 585 32,704 0.140 214 openness ≥ 5 136,974 0.043 218 ss belief = 1 13,900 0.178 229 ss belief = 5 13,900 0.079 229 uses drugs 2,490 0.172 264 T able 1. Summary statistics of the dataset. Number of Users indicates ho w many unique users are associated with the giv en task. Percent positi ve shows the percentage of users w ith true labels for each task. A v erage Likes indicates t h e average number of Likes a user associated with the gi ven task has. the statistical d ependency stru cture of the data-gen erating process. On e might think that pe ople wh o indeed hold a particular trait would exh ibit it throug hout their behavior , and in p articular th roughout the things that they Like. How do these clo akability results c ompare to what one would expect if L ik es and the trait wer e not actually interr elated? Figure 3 shows th e d if feren ce between η 0 . 9 in the no- depend ency population a nd th e true η 0 . 9 . Additional details on this test c an be fo und in the exten ded work ing pa per ( Chen et al. , 2015 ). Although it is indee d r elati vely easy to inhibit inf erence by cloaking Likes, the statistical dep endencies among th e i s mu sl i m i q < 9 0 i s g a y i s si n g l e a g e ≥ 3 7 i s d e m o c r a t n e tw o r k d e n si ty ≥ 6 5 i s fe m a l e i s sm o ki n g i s h o m o se x u a l i s d rin ki n g ss b e l i e f = 5 i s l e sb i a n l i fe sa ti sfa c ti o n ≥ 6 n u m fr i e n d s ≥ 5 8 5 c o n sc i e n ti o u sn e ss ≥ 5 ss b e l i e f = 1 e x tra v e r si o n ≥ 5 a g r e e a b l e n e ss ≥ 5 o p e n n e ss ≥ 5 u se s d r u g s n e u ro ti c i sm ≥ 5 i q ≥ 1 3 0 −1 0 0 1 0 2 0 3 0 η tp 0 . 9 − η f p 0 . 9 Figure 2. Differenc e i n cloaking , η 0 . 9 , for true positiv e and false positi ve users using the L RSVD model. Err o r bars depict the 95% confidence interv al. 23 Enhancing T ranspare ncy and Control when Drawing Data-Dri ven Inferences about Individuals c o n sc i e n t i o u sn e ss ≥ 5 ss b e l i e f = 5 a g r e e a b l e n e ss ≥ 5 ss b e l i e f = 1 i s h o m o se x u a l i s g a y o p e n n e ss ≥ 5 i s d e m o c r a t i s d r i n k i n g i s l e sb i a n n e t w o r k d e n si t y ≥ 6 5 i s sm o k i n g i q ≥ 1 3 0 u se s d r u g s e x t r a v e r si o n ≥ 5 n e u r o t i c i sm ≥ 5 l i fe sa t i sfa c t i o n ≥ 6 i s fe m a l e n u m fr i e n d s ≥ 5 8 5 i q < 9 0 a g e ≥ 3 7 i s m u sl i m i s si n g l e 0 2 4 6 8 1 0 1 2 1 4 η 0 . 90 T r u e η 0 . 9 0 R a n d o m η 0 . 9 0 Figure 3. Comparison between absolute effo rt ( η 0 . 9 ) to cloak in the LRSVD model. Results from the normal cloaking procedure are compa red to tho se of a randomization test for each task. Error bars depict the 95% confidence interv al. Likes and the p redicted trait m ak es it mor e dif ficu lt than it would be without such dependenc ies . 3.3. Cloaking T rue Positives vs. False P ositives There a re multiple settings whe re o ne might want to in- hibit infe rence. Possibly th e most impo rtant distinctio n is between inhibiting an inference that is in fact true (a true positive inference) a nd inhibiting an in ference that is false (a false po s iti ve inference). Based on th e prior results, o ne might e x pect that a false p ositi ve inference would be easier to cloak becau se the s tatistical dependency to the (p ositi ve) trait is by defin ition missing. T he false positive user was “accidentally” classified as positiv e, similarly to how th e top-decile random ized users “accidentally ” were class ified. In neither case was the presence of the trait reflected in the behavior o f the user . For a more detailed discussion see the working paper ( Chen et al. , 2015 ). In table 2 , we show that cloaking is ind eed generally more difficult for tru e-positi ve users than f or false-positiv e ( p < 0 . 05 , sign test). The differences in cloakab ilit y b etween true-po s iti ve an d false-po siti ve users are shown i n figure 2 . 3.4. Modeling Behavior T able 3 presen ts the values for our cloakin g me asure across different mo dels. 5 As expected, the cloak ing effort required f or the L R and LRSVD mo dels are similar . In contrast, clo aking is indeed sub stantially more difficult for NB. Rather than need ing to cloak only a h alf-dozen o r so Likes in the L R and LRSVD models, the NB model’ s users on av erage hav e to cloak 50 Likes. Mechanically , we can explain th is difference thro ugh the 5 The generalization performanc e f o r the NB model is slightly lo wer than that for the logistic regression mode ls. T able 2. The ef fort necessary to cloak different users’ character- istics using t h e logistic regres sion with the 100-SVD-componen t logistic regression (LRSVD) model. The fi rst column shows the full set of users; the second column shows only the true positiv e users, and the third column sho ws only the false po sitiv e users. η 0 . 9 T ask All TP FP is lesbian 3.075 5.437 2.829 is homose xual 3.493 6.572 2.888 extra version ≥ 5 4.428 5.944 4.300 conscientiousn ess ≥ 5 4.746 6.746 4.670 agreeableness ≥ 5 4.985 6.508 4.957 num friends ≥ 585 5.043 6.556 4.197 life satisfaction ≥ 6 5.128 7.214 4.642 is gay 5.653 10.944 3.161 ss belief = 1 5.738 6.880 4.946 iq ≥ 130 6.566 3.429 7.283 openness ≥ 5 6.674 7.677 6.571 is drinking 6.771 7.463 3.875 iq < 90 6.867 16.318 4.582 ss belief = 5 8.251 11.098 7.760 is smoking 8.357 9.800 5.621 is democrat 8.462 8.533 2.000 neuroticism ≥ 5 9.140 5.667 9.173 is female 9.971 10.015 5.475 age ≥ 37 10.259 13.011 5.847 network density ≥ 65 10.545 15.308 10.388 is muslim 11.706 27.804 2.930 uses drugs 12.161 12.143 12.176 is single 13.665 15.514 7.888 Mean 7.465 9.851 5.572 assumptions made by each of th e predictive models. The main different between the LR/LRSVD models and the NB mo del is t hat the NB algorithm tr eats L ik es as if they are con ditionally indepen dent of each other given the target (the trait). When the Likes in fact are highly correlated, this cre ates a patho logy in pred icti ve be ha vio r: the resulting inference mode l will tend to “double count” when u s ers presen t cor related Likes. This r esult in dicates that a targeter could cho ose to make cloaking more d if ficult without imp osing any restriction s on their users simply by changin g its p redicti ve mo del choice (possibly incurrin g a small loss in predictive per formance.) 4. Conclusion The results show that the amount of ef fo rt users must exert in o rder to successfu lly hide themselves is quite small. Although it is hig her than if ther e were no statistical de - penden c y amo ng the Likes and th e personal traits, the users still ne ed on ly to cloak abou t a half-do zen of th eir hundr eds of Likes o n av erage to in hibit inferen ce of a persona l trait. Users for wh om the infe rence made is actu ally wrong have an even easier time cloaking th e inference. Howe ver, organizations engagin g in such modeling could alter their modeling choices to make cloaking much more difficult. 24 Enhancing T ranspare ncy and Control when Drawing Data-Dri ven Inferences about Individuals T able 3. The ef fort to cloak different users’ characteristics using logistic regression with 100 SVD components (LRSVD), logistic regression on the ra w Likes (LR), and nai ve Bayes (NB). η 0 . 9 T ask LRSVD LR NB is lesbian 3.075 2.507 15.518 is homose xual 3.493 3.396 17.046 extra version ≥ 5 4.428 3.617 58.048 conscientiousn ess ≥ 5 4.746 3.357 24.471 agreeableness ≥ 5 4.985 2.871 8.727 num friends ≥ 585 5.043 4.748 57.596 life satisfaction ≥ 6 5.128 4.061 11.959 is gay 5.653 9.073 17.796 ss belief = 1 5.738 4.550 19.908 iq ≥ 130 6.566 2.920 21.947 openness ≥ 5 6.674 3.700 37.433 is drinking 6.771 5.398 17.687 iq < 90 6.867 3.681 7.664 ss belief = 5 8.251 4.692 25.450 is smoking 8.357 7.012 44.821 is democrat 8.462 9.396 65.363 neuroticism ≥ 5 9.140 2.292 125.232 is female 9.971 11.619 320.665 age ≥ 37 10.259 7.263 37.746 network density ≥ 65 10.545 2.569 75.717 is muslim 11.706 8.934 31.131 uses drugs 12.161 8.161 20.532 is single 13.665 10.233 101.658 Mean 7.465 5.48 50.614 These results raise the question of wheth er organization s would want to give users such transpare nc y an d control. One argument is that a firm should b ecause, in line with other “fair inform ation practices” it simply is the righ t thing to do. As certain firms beco me indispensable, individuals would pay a heavy soc ial cost simply to op t out. An alternati ve argument is that doing so w ould increase cu s tomer satisfaction, and f e w pe ople would ac- tually exercise their optio n for con trol. In 2 014, Facebook introdu ced a feature called “Why am I seeing this ad?” which g i ves users pa rtial tr ansparency into why they are being targeted. Users can also selecti vely cloak p articular categories of ad s o r ad v ertisers; they can also m odify their “ad preferen ces” to hide categories of inform ation from b eing used for ta r g eting. T ranspare nc y w ould be greatly enhance d by revealing which data actua lly led to the provision o f p articular content or ads, a s well as tools to help users to cloak just the right data. Refer ences Bachrach, Y oram, K osinski, Michal, Graepel, Thor e, K oh li, Pushmeet, and Stillwell, David. Personality and patterns of facebook usage. In Pr oceed ings of the 4th Annua l AC M W eb Science Confer en ce , pp. 24 –32. AC M , 2012. Barocas, S. P an ic Inducin g: Data Mining, F airness, and Privacy . PhD thesis, Ne w Y ork Uni versity , 2014. Chen, Daizhuo, Fraiberger, Samu el P ., Moakler, Robert, and Provost, Foster . Enhancin g Transparency and Control When Drawing Data-Dri ven Inferences About Indi viduals. S ocial Scien ce Resear ch Network W orking P aper Series , May 2015. URL http://ssrn. com/abstract=2611542 . Gayo-A vello, Panagiotis T ak is Metaxas, Eni Mustafaraj Markus Strohm aier Harald Schoen , P eter Gloor, Daniel, Schoen, Harald , Gayo-A vello, Daniel, T akis Metaxas, Panagiotis, Mustafaraj, E ni, Stro hmaier , Mar kus, and Gloor, Peter . The po wer of prediction with social m edia. Internet Resear ch , 23(5):528– 543, 2 013. Johnson, Maritza, Ege lman, Serge, and Bello vin, Ste ven M. Facebook and priv acy: it’ s complicated. In Pr oceedin gs of the eighth symposium o n usable privacy and security , pp. 9. A CM, 201 2. K osin s ki, Michal, Stillwell, David, and Graepel, Thore . Priv ate traits and attributes are predictab le from dig it al records of human behavior . Pr ocee dings of the National Academy of Sciences , 2013 . Martens, D and Provost, F . Explainin g data-driven docume nt classification s. MIS Quarterly , 38(1):73 –99, 2014. Pa vlo u, P au l A. State of the info rmation priv acy literature: where are we now and wher e shou ld we go? MIS quarterly , 35(4 ):977–988, 20 11. Perlich, C, Dalessandro, B, Raeder , T , an d Stitelman , O. Machine learning for targeted display a dvertising: T ra nsfer learning in action. Machine Learning , 2013. Provost, Foster and Fawcett, T om. Data Scien ce for Business: Wh at you need to know about d ata mining and data-a nalytic thin king . O’ Reil ly Media, Inc, 2013 . Schwartz, H Andrew , E ichstaedt, Johannes C, K er n, Mar- garet L, Dziurzynsk i, Lu kasz, Ramone s , Stephan ie M, Agrawal, Megha, Shah, Achal, K osinski, Michal, Stillwell, Da vid, Seligman, Martin EP , et al. Person ality , gender, and age in the lang uage o f social media: The open-vocabulary approach. PloS o ne , 8(9):e73 791, 2013. Smith, H Jeff, Dinev , T ama ra, and Xu, Hen g. Information priv acy research: an interdisciplinar y review . MIS quarterly , 35(4 ):989–1016 , 2011. White H ouse. Consume r data priv acy in a networked world: A framework for p rotecting pr i vacy and promo ting innov ation in the global eco nomy . T echnical report, 2012 . 25