Ebenezer Paintsil
email: paintsil@nr.no

Lothar Fritsch
email: lothar.fritsch@nr.no

A Taxonomy of Privacy and Security Risks Contributing Factors

Identity management system(s) (IDMS) do rely on tokens in order to function. Tokens can contribute to privacy or security risk in IDMS. Specifically, the characteristics of tokens contribute greatly to security and privacy risks in IDMS. Our understanding of how the characteristics of token contribute to privacy and security risks will help us manage the privacy and security risks in IDMS. In this article, we introduce a taxonomy of privacy and security risks contributing factors to improve our understanding of how tokens affect privacy and security in IDMS. The taxonomy is based on a survey of IDMS articles. We observed that our taxonomy can form the basis for a risk assessment model.

Introduction

A token is a technical artifact providing assurance about an identity. Tokens help authenticate and establish the identity of the end-users. They also help the end-user to remember their identifiers and facilitate information flow in identity management system(s) (IDMS). Figure 1 depicts an example of a simple identity management system. The identity provider (IdP) is an organization that collects the personal information of the end-user and creates a digital identity or identities for it. An IdP issues or helps the end-user to choose an identifier representing the digital identity. The end-user can then use the identifier(s) to identify or authenticate herself to a service provider (SP) in order to access an online service or resource. Each SP may require a different identifier or has a peculiar identification or authentication scheme. The number of identifiers may grow depending on the number of SPs the end-user interacts with and the kind of services or resources the end-user subscribes. The growth may reach a point where the end-user could no long remember all the numerous identifiers and their corresponding SPs. To solve this identifier management challenge, we either employ a software agent to store and select the correct identifier for a SP as in [START_REF] Corporation | The identity metasystem: Towards a privacy-compliant solution to the challenges of digital identity[END_REF] or a hardware device such as a smart card to store and facilitate the selection of the correct identifier for a SP.

In the physical world, identity tokens consist of identifying information or identifiers stored in a physical device such as credit card, passports, a silicon Fig. 1. A Simple Identity Management System, SP1 means service provider 1, SP2 means service provider 2 and IdP means identity provider chip and a magnetic stripe [START_REF] Clarke | A sufficiently rich model of (id)entity, authentication and authorisation[END_REF]. We also have virtual or software identity tokens such as the Microsoft information card (InfoCard or CardSpace) technology. The InfoCard technology consists of identity metadata stored in a visual icon. The identity metadata point to or associate with a digital identity. The digital identity in this case represents the identity of the end-user. We can also find other kinds of tokens such as user name tokens, binary tokens, nonce, XML based tokens and custom tokens 1 such as Keynote [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF], [START_REF] Ibm | Overview of token types[END_REF]. A token can consist of a piece of data, a mechanism, an algorithm, an assertion or a credential. The construction and different uses of tokens contribute to privacy and security risks in IDMS [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF]. Camenisch and others have suggested anonymous credential systems as a means of enhancing privacy in IDMS. In such systems, different uses of identity tokens by the same user are unlinkable. However, apart from unlinkability, tokens contribute to security and privacy risks in diverse ways. For example, function creep is as a result of using a token for unintended purpose. Anonymous credential systems also lack practical use and may not be compatible with already deployed IDMS [START_REF] Camenisch | An efficient system for non-transferable anonymous credentials with optional anonymity revocation[END_REF], [START_REF]Structured overview on prototypes and concepts of identity management systems[END_REF]. They may rely on a master secret to protect all the tokens, however accidental disclosure of the master secret could lead to identity theft, linkability and eventual privacy or security risk. Thus, the characteristics of tokens can contribute to privacy and security risks even in anonymous credential systems.

In this article, we introduce a taxonomy of privacy and security risks contributing factors in order to understand the impact of the characteristics of tokens on privacy and security in IDMS. In addition, we introduce the applications of our taxonomy.

We organize this article as follows. In Section 2, we introduce existing works on the effect of tokens on IDMS. Section 3 describes our taxonomy of privacy and security risks contributing factors in detail. We introduce the applications of our taxonomy in section 4. Section 5 states the conclusion and future work.

Related Work

There is a large body of literature on identity tokens and how they may contribute to security and privacy risks. However, our work organizes tokens according to their contribution to privacy and security risks.

In [START_REF] Lutz | bridging the gap between privacy and security in multi-domain federations with identity tokens[END_REF] D.J. Lutz and R. del Campo used a custom identity token to bridge the gap between privacy and security by providing a high level of privacy without anonymity. They designed a scheme to prevent replay attack and ensure that personal data is not sent to a foreign domain. They did not focus on the effect of the characteristics of tokens on privacy and security risks within a domain.

Furthermore, tokens are used to facilitate single sign-on authentication in federated IDMS [START_REF]Structured overview on prototypes and concepts of identity management systems[END_REF]. However, this work focuses on a better way of constructing a token but not on the effect of the characteristics of tokens on privacy and security risks.

The identity mix (idemix) scheme proposed in [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF], employs anonymous tokens to enhance privacy. The idemix scheme has three main parties. The end-user obtains a pseudonym in a form of an anonymous token from the identity issuer. The verifier verifies the credentials. The end-users can authenticate with a verifier without revealing their pseudonyms. The characteristics of tokens such as token secrecy, can affect this scheme, as one can misuse a pseudonym if the token's secret is inferred or revealed.

Peterson introduces factors for asset value computation and stresses the importance of asset in risk calculation [START_REF] Peterson | Introduction to Identity Management Risk Metrics[END_REF]. We can use such factors to quantify the contributions of tokens to privacy and security risks. Peterson derived the asset value of tokens from their loss, misuse, disclosure, disruption, replacement value, or theft. However, this is just an aspect of the risk contributing factors.

Solove introduces a taxonomy of privacy [START_REF] Solove | A taxonomy of privacy -GWU Law School Public Law Research Paper No.129[END_REF]. He introduces a high-level privacy risk contributing factors. They include data processing, data collection, data transfer and invasion. Nevertheless, the taxonomy is a high-level explanation of privacy principles without paying particular attention to the contributions of tokens to privacy risk.

Privacy Impact Assessment (PIA), a framework for assessing the impact of personal data processing on privacy before an information system is implemented, is introduced in [START_REF] Office | Privacy impact assessment handbook -version 2[END_REF]. The PIA is a compliance check of personal data processing to privacy laws, policies, or regulations. It specifies the requirement for privacy risk assessment without any explicit assessment technique or method. Our work differs from PIA in our introduction of an explicit privacy and security risks assessment technique.

The characteristics of tokens affect privacy and security in IDMS. A token characteristic include but not limited to its usages, how it is built, designed or constructed and how it is chosen. Security protocols are often concerned with how to build or construct a security token that can enhance privacy and security in IDMS [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF], [START_REF] Lutz | bridging the gap between privacy and security in multi-domain federations with identity tokens[END_REF] , [START_REF] Lutz | Secure aaa by means of identity tokens in next generation mobile environments[END_REF], [START_REF]Structured overview on prototypes and concepts of identity management systems[END_REF]. The emphasis may be placed on formal verification of privacy and security risks caused by how tokens are built, designed or constructed. Moreover, tokens contribute in many different ways to security and privacy risks in IDMS. For instance in analogy to [START_REF] Peterson | Introduction to Identity Management Risk Metrics[END_REF] tokens can be a good source of security and privacy risk metrics since they can consist of metadata about identity definitions.

The Taxonomy

This section introduces our taxonomy of privacy and security risks contributing factors. We based our factors on a literature survey of scientific articles in IDMS such as [START_REF] Peterson | Introduction to Identity Management Risk Metrics[END_REF], [START_REF] Ardagna | Pedrini: PrimeLife Policy Language[END_REF], [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF], [START_REF] Hansen | Concepts of Privacy-Enhancing Identity Management for Privacy-Enhancing Security Technologies[END_REF], [START_REF] Iwaihara | Risk Evaluation for Personal Identity Management Based on Privacy Attribute Ontology[END_REF], [START_REF]2.1: Inventory of topics and clusters[END_REF] and many more. Our taxonomy, for the time being, avoids the Pfitzmann-Hansen terminology [START_REF] Pfitzmann | Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management A Consolidated Proposal for Terminology -v0[END_REF] with its definitions of e.g. linkability and observability, as the terms therein are defined on the background of anonymous communication and information sparsity. We feel that these terms need to be analyzed from our perspective on handling electronic identifiers and their risks. Our future work aims at aligning or re-defining the Pfitzmann-Hansen terminology to be meaningful in our context. Following this, we depict our taxonomy in Table 1. The taxonomy is non-exhaustive list of the characterization of tokens according to the manner in which they contribute to privacy and security risks. We explain the meaning of each contributing factor as listed in Table 1.

Token Mobility: This factor indicates the degree of mobility of a token. The degree of mobility refers to how easy to copy the token or its content, the physical constraints regarding the movement of the token, among others. For example the content of a low cost RFID tag with no additional security could easily be read as compared to the high cost RFID tags that come with additional security. The risks created by various forms of mobility directly relate to identity theft, linkability and the risk impacts. We assess the contributions of token mobility to privacy and security risks according to the following:

1. Copyable: the token can be copied with limited effort. 2. Remotely usable: the token can be used for remote identity management.

3. Concurrently usable: the token can be used concurrently in many parallel sessions, transactions, or applications. 4. Immobile: the token is not mobile, as it either must be physically present in a form of a user, or even presented to the system that is supposed to accept it.

Token Value at Risk: Finding assets and the value of the asset at risk is an important part of risk assessment ( see [START_REF]ISACA: The Risk IT Practitioner Guide[END_REF]). Similarly, tokens are assets of IDMS and their value at risk can contribute to privacy and security risks. Thus we can quantify the risk of using tokens by assessing the significance of the token or the value of the token to the operation and security of the IDMS and the privacy of the end-users. In [START_REF] Peterson | Introduction to Identity Management Risk Metrics[END_REF], six risk factors for IDMS have been found in analogy to classic risk assessment focusing on asset value at risk. We classify token's value at risk in a similar manner as follows:

1. Loss: value at risk when token is lost. 2. Misuse: value at risk when token is used in wrongful ways. 3. Disclosure: value at risk when token or token-related information gets known to someone else. 4. Disruption: value at risk when token doesn't function. 5. Theft: value at risk when token gets into someone else's possession without authorization. 6. Replacement value: cost (effort, resources, time) to replace a token.

Token Provisioning: We create a token from personal attributes. The amount of personal information collected during the creation phase could contribute to privacy risk. Data minimality principle prohibits excessive data collection of personal information [START_REF] Bygrave | Data Protection Law Approaching Its Rationale, Logic and Limits[END_REF]. In addition, tokens that store excessive personal information may be used for other unintended purposes (function creep) or enable profiling and linkability. There should be a means of updating the token in order to ensure data integrity. Further, there should be a means of deleting or destroying the token when the purpose for its creation is longer in the interest of the end-user or when the end-user decides to do so. This would ensure the privacy of the end-user. Therefore, we distinguish the following phases of the token provisioning life cycle: creation, editing and deletion. Each phase can be assumed to have different privacy or security risk impacts.

Token Frequency & Duration of Use: The underlining IDMS information flow protocol could determine if multiple use of the same token is susceptible to privacy and security risks [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF]. Different uses of even specifically constructed tokens remain linkable if the underlining IDMS information flow protocol is not designed to prevent such privacy risk. Token's frequency and duration of use are decisive for risks concerning exposure or long-time risk. IDMS that allow a SP and an IdP to share information, a token used often allows for detailed profiling. A token used in association with life-time identification or multiple times causes high risks of secondary use and profiling of the person's life [START_REF] Fritsch | Profiling and Location-Based Services[END_REF]. We classify a token chosen or assigned for life as lifetime token, a token that can be used multiple times but not for life as a multiple times token and a token that can be used once is a one-time token.

Token Use & Purpose: Purpose specification is an important privacy principle. It requires that personal information be collected for a specific purpose and use in an open and transparent manner [START_REF] Hansen | Privacy and identity management[END_REF]. Personal information should not be used for purposes other than the original purpose for which it was collected without informed consent. Since tokens may carry personal information or contain identifiers that link to personal information, any form of function creep or misuse could contribute to privacy and security risks. Function creep occurs when a token is used for unintended purpose. For example, in the United States (US), driver licenses have become the de facto general-purpose identity tokens [START_REF] Gregor | An Ontology of Identity Credentials -Part 1: Background and Formulation[END_REF], however, in some cases the driver licenses disclose more personal information than actually needed. For example, using a driver license to prove one's age will result in disclosing additional personal information meant for secondary purpose to the SP [START_REF] Camenisch | Privacy and identity management for everyone[END_REF]. Such function creep and lack of selective disclosure pose privacy and security risks. We classify the purpose of a token as original and unintended. In general the intended purpose of a token is identification, authentication or authorization. The abuse of the purpose of a token or how the purpose of a token is achieved may contribute to privacy and security risks.

Token Assignment & Relationship: The need for user-centric IDMS clearly emphasizes the importance of how tokens are assigned or chosen. Usercentric IDMS offer the end-users the ability to control their personal information and enforce their consent by determining the choice of their identity tokens [START_REF] Bramhall | User-centric identity management: New trends in standardization and regulation[END_REF].

We can determine the amount of personal information to disclose or attach to our identity token with user-centric IDMS ( see [START_REF] Bar-Or | Openid explained[END_REF], [START_REF] Kruk | D-foaf: Distributed identity management with access rights delegation[END_REF]).

The origin of and control over tokens contribute to privacy or security risk. A token can be chosen by a person, jointly established or forced upon by an authority. They can relate to a role rather than a person, and they could relate to a pseudonym [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF]. A role is some sort of authorization, while a pseudonym is a mask with properties and usage patterns that might only occur for a particular purpose.

The token assignment and relationship risk-contributing factor assesses the risk impact if a token is forced on an end-user, chosen by an end-user as in the user-centric IDMS, jointly-established with the end-user or chosen according to the end-user's role. It also assesses the risk impact if a token is chosen under a pseudonym (pseudonymous tokens). Choosing a token under a pseudonym can enhance privacy especially if we cannot profile it various usages [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF].

Token Obligation & Policy: We may protect a token with data minimization technique such as idemix [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF] or attach a policy expressing the end-user's consent to the token in an IDMS. For policy-based protection, a major factor for the introduction of risks is the question of privacy policy enforcement, the possibilities for auditing and investigation of suspicious system behavior. Recent work suggests combine services' privacy policies [START_REF] Ardagna | Pedrini: PrimeLife Policy Language[END_REF] with an obligation [START_REF] Mont | On parametric obligation policies: Enabling privacy-aware information lifecycle management in enterprises[END_REF]-a policy expressing the data processing consent that was given by a person. In addition, to ensure audit of processing, an audit trail [START_REF] Hansen | Concepts of Privacy-Enhancing Identity Management for Privacy-Enhancing Security Technologies[END_REF] is suggested. The absence or the presence of privacy policy and a particular functionality (or enforcement mechanism) of the policy based concepts express a potential privacy risk. In the absence of policy or for non-policy based IDMS a particular data minimization technique or functionality can also enhance privacy or contribute to privacy risk (see [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF]).

Token Claim Type: We can enforce the security of identifiers stored in a token or protect the misuse of identifiers by attaching a secret or a claim to the tokens. The type of claims are generally classify as "something we know" (a secret e.g. password), "something we are" ( something we cannot share with others, e.g. finger print, iris etc) and "something we have" (e.g. possessing a smart card, key card or a token etc) [START_REF] Gregor | An Ontology of Identity Credentials -Part 1: Background and Formulation[END_REF]. Each claim type is a factor. Token claim type considers the impact of the number of factors used to secure a token in IDMS. Some tokens may require no additional secret in order to protect it content. We refer to such tokens as single claim tokens since the possession of the token itself is a factor. A token that requires a factor such as a personal identification number (PIN) in order to access its content is referred to as a twofactor or multiple claim token. We refer to a token requiring multiple factors such as PIN and finger print as multiple claim tokens or a three-factor token.

For example, an X509 token may require the possession of a physical smart card and a PIN [START_REF] Corporation | The identity metasystem: Towards a privacy-compliant solution to the challenges of digital identity[END_REF]. The smart card is inserted into a card reader and a PIN is used to access the certificate's private key. The possession of the card is a factor representing what the end-user has or possesses and the PIN is a second factor representing what the end-user knows. This is an example of a two-factor authentication token.

The number of authentication factors or factors may determine the complexity and security of the token. For example, current master cards may require no additional secret PIN when used for online transactions. We regard such token as a single factor authentication token. A single factor authentication token would be less secure and easy to use than a three-factor authentication token such as an X509 token that requires a PIN and a biometric factor. We therefore classify tokens into single claim and multiple claim tokens.

Token Secrecy: Tokens have claim type as discussed above. The secrecy or the constraints of authentication factors such as physical presence can contribute to security or privacy risk in IDMS. If a token's additional authentication factor is public then the claim type of such a token is always single. The secrecy of the additional authentication factor and the constraint attach to the additional authentication factor may determine the claim type.

Furthermore, secrecy is essential for maintaining unique mapping between identifiers and persons [START_REF] Peterson | Introduction to Identity Management Risk Metrics[END_REF]. We can facilitate identification by how much secrecy a token possesses. A token with additional authentication factor such as "mothers' maiden name" used in the past for telephone authentication with credit cards [START_REF] Anderson | Security Engineering: A Guide to Building Dependable Distributed Systems[END_REF] is easy to guess or infer. We classify such tokens secrecy as inferable. We consider the secrecy of a token as public if the additional authentication factors or claims are known by a number of people, group and organization or exist in many databases, at the disposal of an unknown number of persons and organizations.

We classify the secrecy of a token as "secret" or an additional authentication factor of a token as "secret" if it is private or not shared with others because it is link to a valuable resource such as our bank account (see [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF] ). A possible example of private "secret" is a private cryptographic key and a PIN.

Token Security: The security of token can contribute to the security of the IDMS. If a token used in an IDMS is a credential then the system should have a mechanism for checking the authority who issued the token. If the token is a mere assertion then the IDMS should provide a different mechanism to ensure the authenticity of the assertion. In order to ensure token security, there should be a means of ensuring the validity, identity and legitimacy of the token. Similar to [START_REF] Gregor | An Ontology of Identity Credentials -Part 1: Background and Formulation[END_REF] we describe token security as follows:

1. origination: the token is issued by the indicated legitimate authority 2. Identification: token identifies the subject-the entity possessing the token. 3. Validation: token has not expired, its lifespan is within the validity period or has passed the validity test. 4. Authentication: token belongs to the entity presenting it to the IDMS. 5. Authorization: token grants relevant permissions to the entity possessing it.

The IDMS should provide functionality for checking the above security properties of the token.

We can fairly estimate the privacy and security risks of an IDMS based on the characteristics of token as explained in our taxonomy. This section explains the possible application of our taxonomy for privacy and security risks assessment. We state the possibilities of conducting privacy and security risks assessment based on the characteristics of tokens used in the IDMS. We follow the following steps:

Known Security Risks in IDMS: We examine the IDMS in order to determine all the possible system tokens. We assess how the characteristics of the system tokens may affect the achievement of the information security objectives of the IDMS. Thus, which of the characteristics of tokens listed in table 1 contribute to the breach of information security such as unavailability, loss of confidentiality, repudiation and lack of integrity [START_REF] Siponen | A review of information security issues and respective research contributions[END_REF] and in what way do they contribute to security risk. For example we may assess the impact of multi-factor authentication scheme on the security of the IDMS. We may assess if the IDMS employs a two-factor authentication tokens or a three-factor authentication tokens. A two-factor authentication token is simpler but may provide less secure authentication [START_REF] Gregor | An Ontology of Identity Credentials -Part 1: Background and Formulation[END_REF].

We also assess how the security of the token contributes to security risk of the IDMS. In other words, we examine if the IDMS has a method for checking the security of the tokens. That is, we assess if the IDMS has a mechanism to check the legitimacy of the token, validity of the token, identity of the holder of the token, authenticity of the token and level of authorization the token has.

Finally we assign or compute the risk impact of token security, token secrecy etc of the IDMS.

Known Privacy Risks in IDMS: Similar to security risk assessment, we examine the IDMS in order to understand the information flow of the system. We examine how the IDMS tokens are designed and used. We assess if the information flow in the IDMS can contribute to the misuse of personal data, accidental disclosure of personal data etc. We determine if these privacy risks are caused by the construction of the IDMS tokens using the risk contributing factors listed in table 1. We then determine the impact and the possibility of the known risk occurring. For example, how will the token mobility contribute to accidental disclosure of personal data and what will be the impact of accidental disclosure on the IDMS?

Stakeholders Risk in IDMS: Usually tokens are created to reflect the needs of the system stakeholders. However, lack of extensive taxonomy of token characteristics to guide this process may contribute to future privacy and security risks of the IDMS. This taxonomy will aid the stakeholders of the IDMS to ask the necessary questions before designing or consenting to use any identity token. Furthermore, the stakeholders can now, before they take an IDMS that was designed for a different purpose into a new application context, thoroughly analyze its properties and the possible risks and consequences. For example, the stakeholders can now assess how an IDMS with high token mobility contribute to function creep. How does function creep affect their interest such as the reputation? Furthermore, how does multiple claim authentication token inconvenience the end-user and how does it protect against identity theft in IDMS? We can also examine how token assignment contributes to privacy and security risks from the stakeholders' point of views. For example, user-centric IDMS may allow the end-users to exercise selective disclosure by choosing tokens on their own. This enhances the privacy of the end-user but the other stakeholders may be deprived of information for auditing and accounting [START_REF] Bar-Or | Openid explained[END_REF], [START_REF] Corporation | The identity metasystem: Towards a privacy-compliant solution to the challenges of digital identity[END_REF].

Conclusion

Identity tokens are constructed without extensive assessment of their affect on privacy and security risks in identity management system (IDMS). The understanding of the contribution of tokens to privacy and security risks can aid in managing privacy and security risks in IDMS. This article defines a token and how tokens affect privacy and security in IDMS. We introduced a taxonomy of risk contributing factors for IDMS based on the characteristics of tokens and the application of the taxonomy for privacy and security risks assessment. We explained how the taxonomy contributes to privacy, security, and the stakeholders' risk in IDMS. Finally, we showed that tokens are rich sources of privacy and security risks metric for IDMS and can serve as a basis for privacy and security risks assessment model.

We intend to investigate the development of a privacy and security risks assessment model based on our taxonomy in our future work.

Table 1 .

 1 Taxonomy

	Risk Contributing Factors	Parameters
	Token Mobility	copyable, remotely usable,
		concurrently usable, immobile
	Token Value at Risk	loss, misuse, disclosure, disruption,
		theft, replacement value
	Token Provisioning	creation, editing, deletion
	Token Frequency &	Uses per year, life-time,
	Duration of Use	multiple times, one-time
	Token Use & Purpose	original, unintended
	Token Assignment & Relationship forced, chosen, jointly-established,
		role, pseudonymity
	Token Obligation & Policy	absence, present, functionality
	Token Claim Type	single, multiple
	Token Secrecy	public, inferable, secret
	Token Security	origination, identification, validation,
		authentication, authorization

Acknowledgment

The work reported in this paper is part of the PETweb II project sponsored by The Research Council of Norway under grant 193030/S10.


Philip Schütz
email: philip.schuetz@isi.fraunhofer.de

Michael Friedewald
email: michael.friedewald@isi.fraunhofer.de

Privacy: What are we actually talking about? A multidisciplinary approach

This paper presents a multidisciplinary approach to privacy. The subject is examined from an ethical, social, and economic perspective reflecting the preliminary findings of the EU-funded research project PRESCIENT. The analysis will give a comprehensive illustration of the dimensions' unique and characteristic features. This will build the basis for identifying overlaps and developing synergetic effects, which should ideally contribute to a better understanding of privacy.

Introduction

Privacy is an essential fundamental human right, which preserves individuals from arbitrary intrusion into their personal sphere by the state, corporations or other individuals. In a globalised world with ever new emerging technologies privacy issues have evolved into one of the most salient, ubiquitous and pressing topics of our society today. The information age with its new forms of communication, data storage and processing contests the current concept of privacy to an extent and in ways never seen before. The imperative to deal with these new challenges becomes an increasingly prominent feature not only in media coverage but also in private and public policy-making.

However, the current media attention to privacy-related topics poses the risk of a shallow and non-scientific debate. Being a moving target, the concept of privacy is above all elusive. It is evolving over time and people define and value it differently [START_REF] Nissenbaum | Privacy as contextual integrity[END_REF]. That is exactly why it remains tremendously important to work at the theoretical base of the concept and to keep on asking: What are we actually talking about?

Recognising that privacy is a multifaceted concept, this paper proposes to examine the subject from different scientific perspectives. Reflecting the preliminary findings of the EU-funded research project PRESCIENT [START_REF] Friedewald | Privacy, data protection and emerging sciences and technologies: Towards a common framework[END_REF], the multidisciplinary approach embraces the dimensions of ethical, social, and economic aspects. 1 The following sections are intended to give a comprehensive illustration of the perspectives' unique and characteristic features. This will form the basis for identifying overlaps and developing synergetic effects, which should ideally contribute to a better understanding of privacy.

The different perspectives 2.1 Ethical perspective

Ethics is often falsely understood as moral rules providing individuals and society with a guidance. Yet ethics is not etiquette, it is not a manual to be followed, rather it is a philosophical enquiry about concepts involved in practical reasoning. Ethics as a part of philosophy deals with moral principles such as good and evil, virtues or justice.

This section will to explore the ethical value of privacy. Why do we consider privacy as something worthy to protect? Where does the desire for privacy derive from? Assuming that privacy is part of two constitutive human polarities, mainly the desire to be independent and the need to be part of a community, we will trace the biological, anthropological, psychological and religious antecedents of this polarity.

Research on territoriality and overcrowding shows that virtually all animals seek periods of individual seclusion. Although being social animals, humans have shown throughout their evolution behaviour of defending their territories and avoiding overcrowding the latter often functioning as an intensifier of stressful condition [START_REF] Ford | The analysis of space use patterns[END_REF]. In frequently seeking small-group intimacy, individuals search for relieve of stress dropping the role they are assigned to play in community. At the same time, however, particularly humans have developed to the highest degree the ability of empathy, a capacity to reproduce the emotional and mental patterns of others, which makes them not only in their rationale to survive but also in their very neurological structure dependent on other human beings. 2 That is why isolation can be much more pathological than overcrowding [START_REF] Haney | Mental health issues in long term solitary and supermax confinement[END_REF]. 3 Supported by various anthropological studies, aspects of privacy can be found in modern but also preliterate societies throughout history all over the world [START_REF] Moore Jr | Privacy: Studies in social and cultural history[END_REF]. Hence, the individual's need for a certain degree of social distance at some point in time seems to occur in every culture and time period, although social obligations as a must of any gregariousness imply some limitations to the choice of seeking this distance. As Westin puts it, the concept of privacy seems to be a "cultural universal", which would militate in favour of an intrinsic value of privacy [START_REF] Westin | Privacy and freedom[END_REF].

However, feminist anthropologists view privacy mainly as a "trap of domesticity" to women [START_REF] Friedan | Feminist Mystique[END_REF]. This "trap" would develop through the division between domestic affairs as essentially private and predominantly female, and the exclusively male and public realm of war and politics. 4 Picking up the same train of thought, Pateman argues that the private and public spheres are two sides of a social contract, which includes primarily a 2 According to the most accredited theories, empathy is generated by "automatically and unconsciously activated neural representations of states in the subject similar to those perceived in the object" [4, p. 282]. 3 Research on overcrowding and isolation suggests that the degree of control concerning the ability to choose between solitude and gregariousness is decisive in affecting the physical and psychological state of the individual. 4 Post-modern and feminist scholars have devoted influential studies on the sexual origins of privacy in the early Greek civilization. Sophocles' Antigone was used as an example for the introduction of the distinction between the private, familial and womanly (oikia) and the public, political, and masculine (koinos) realm [START_REF] Elshtain | Public Man, Private Woman[END_REF].

"sexual contract" that distributes social roles and defines "areas of influences" between men and women [START_REF] Pateman | The Sexual Contract[END_REF].

Arguing furthermore from a psychoanalytic point of view, Freud understood privacy as involving a dichotomy between "civilized society, which demands a good conduct" of its citizens, and instinctual behaviour of the individual [START_REF] Freud | Zeitgemässes über Krieg und Tod[END_REF]. Since society has allowed itself to be misled into tightening the moral standards to the greatest possible degree, the creation of the private realm serves above all as a safety valve for all of the instinctual constraints weighing heavily upon the individual [START_REF] Freud | Zeitgemässes über Krieg und Tod[END_REF][START_REF] Westin | Privacy and freedom[END_REF].

Even more revealing is his seminal essay on "Das Unheimliche" (The Uncanny) [START_REF] Freud | Das Unheimliche[END_REF]. The German term "Unheimlich" derives from the meaning of "not homey" ("unfamiliar" or "outside of the family"), which is "the name for everything that ought to have remained secret and hidden but has come to light", says Schelling's definition, from which Freud starts. He eventually defines the uncanny as "anything we experience that reminds us of earlier psychic stages, of aspects of our unconscious life, or of the primitive experience of the human species". The id as part of Freud's structural model of the human psyche (id, ego and superego) contains most of these uncanny elements. There is in other words a literally dark side to privacy which implies a dimension the individual will never be able to master or understand completely.

Freud then notices that also the antonym "heimlich" ("homely" or "familiar"), which nowadays actually means "secret", conveys the meaning of private in the sense of "within in the family". Surprisingly, he discovers that familiarity represents an integral part of uncanniness. It consequently seems that the uncanny as well as the familiar (homely) are two sides of the same coin which both constitute the core sphere of inner personal privacy.

The concepts of modesty, intimacy and shame reflect furthermore emotions, behaviour patterns and externalised decisions which are based on the interplay within one's psyche between the id and the superego. The private realm therefore depends on a process of negotiating the boundary between the inner part of the self and the external world of the other selves. This negotiation is influenced both by personal attitudes (subjectivity) and by social and cultural norms.

In a religious context the inner part of the self represents a sacred place where the individual can seek intimacy with God. 5 Even beyond the Christian or other monotheistic religions the attempt to establish a bond or a contact with God(s) consists commonly of a meditation phase of an individual or an exclusive group, in which privacy is sought.

Eventually, political philosophy has had another major influence on today's conception of privacy. Especially in the Western hemisphere liberalism was shaping the idea of a state that ensures its citizens the protection of life, liberty and property, an idea originated by Locke in Two Treatises of Government. The legal notion of privacy as a fundamental right but also as an instrument to achieve other basic rights is based on these liberal conceptions in which privacy is mainly seen as a protective sphere that shields the individual from intrusions of the state. 6 Complementary to this negative defensive right, Westin suggests a rather positive right conception of privacy which enables the individual to exercise control over his/her information.

Social perspective

Privacy is often seen in contrast to the public, although there is a social value to privacy. The perceived duality between private and public value frequently results in a supposed need of balancing the two against each other, which is explored in this section.

Humans are individualistic and herd animals at once. They represent Hobbes' homo homini lupus and Aristotle's zoon politicon at the same time. This inner dualism can be best described by Schopenhauer's hedgehog's dilemma, which comprises the idea to identify the optimal distance between being "alone" and "together". 7So Moore is right when he argues that "the need for privacy is a socially created need. Without society there would be no need for privacy" [6, p. 73]. However, this only reflects the personal dilemma, with which individuals are regularly confronted. The tension between individual and community remains even if the hedgehog's dilemma is solved, because the optimal distance would differ from situation to situation and would be due to various personal preferences not applicable to everyone.

That is why balancing the individual well-being against the common good runs frequently into severe difficulties. One is that the notion of balancing or making tradeoffs suggests literally a zero-sum game where an increase in security, for example, automatically results in a reduction of privacy. However, these kinds of trade-offs, often presented in public as axiomatic, seem not to take the complexity of social values into their account. "The value of privacy should be understood in terms of its contributions to society. [...] When privacy protects the individual, it does so because it is in society's interest.", argues Solove [15, p. 173].

Theoretically, privacy as well as other values such as national security, transparency, free speech or other human rights generate a complex net of interwoven and consequently interdependent values of society which can flexibly shift into one or another direction. The network structure could function as a model for the interaction of these social values.

In legislative, judicial and administrative practice, there is the inevitable need of balancing different and overlapping values against each other. Therefore it becomes crucial to consider how such balancing processes can be effectively designed and implemented. One of the main features of balancing processes should be the testing of necessity and proportionality. Aharon Barak advocates "the adoption of a principled balancing approach that translates the basic balancing rule into a series of principled balancing tests, taking into account the importance of the rights and the type of restriction. This approach provides better guidance to the balancer (legislator, administrator, judge), restricts wide discretion in balancing, and makes the act of balancing more transparent, more structured, and more foreseeable." [16, p. 2] So in the case of balancing national security against privacy, for instance, there are at least four minimum core principles to be considered: 1) The principle of the rule of law, 2) the principle of proportionality, 3) the principle of favouring moderate intrusiveness as well as 4) the principle of the lesser technological privacy intrusiveness and the principle of directly proportional incremental authority to the privacy intrusiveness of the technology used [17, p. 142].

The pursuit of the greater good has often led to tremendous affliction throughout world's history. That is why inalienable rights protect the individual from intrusions of the state. These fundamental rights and their core principles must not be subject to negotiation and should include an adequate protection of minorities in order to avoid Tocqueville's tyranny of the majority.

However, privacy has also a "dark side" to it. Not only could terrorists take advantage of a constitutionally guaranteed private sphere to organise their attacks, but also is transparency and accountability in general challenged in cases like bank secrecy or discretionary earnings of politicians. From a feminist perspective, as already pointed out, the socially constructed realm of privacy threatens to continue to serve as a shield against the public, covering domestic violence and abusiveness of men against women.

Though seemingly in conflict, social values such as privacy and transparency are all equally important. The Gordian challenge, with which society is continuously confronted, consists of striking the right balance between these social values.

Economic perspective

This section examines privacy from an economic point of view. Although the notion of privacy in the economic discourse is mainly understood as informational privacy dealing with data protection issues, this paper tries to consider the costs and benefits beyond the mere perfect/imperfect information topos of economic theory.

In order to be able to effectively analyse the economic value of privacy, we have to initially shed light on the main actors protecting and intruding upon privacy. The actor-centred approach hypothesises that the decisions of the data subject (DS) as well as those of the data controller (DC) are based on the rationale of the homo economicus carefully balancing the costs and benefits and aiming for the maximal profit. 8The decisions of the DS include a dual choice model in which the DS can opt for "disclosing" or "retaining" personal information. The DC's options of actions involve the collecting, aggregating, storing and processing of personal information as well as the reactions to privacy breaches. 9The data subject: Costs created by disclosing personal data are scientifically extremely hard to grasp, because they are at the core of exactly that essence and complex value of privacy, which is a fundamental part of the essentially contested concept of privacy itself. Frequently, individuals value these types of costs differently and in addition privacy incidents often do have indirect and long-term effects on the DS. 10 Consequences are therefore hard to anticipate and it seems that individuals perceive long-term impacts as a rather indirect, controllable and less perilous harm to themselves. That's why the DS often underestimates or does not consider the long-term risks in giving away personal information [20, p. 11].

However, more and more individuals are confronted with privacy problems frequently resulting from their lax attitude towards sharing private information or being forced to disclose personal data. This can result in social sorting or other discriminatory practices by DCs. There is furthermore an increasing risk of being the victim of online and offline crime such as burglary, 11 identity theft, cyber stalking and bullying, character assassination as well as other forms of harassment.

Another cost factor of sharing voluntarily personal and private data involves that peers, colleagues or prospective employers may form an opinion about the data subject based on a one-time superficial and maybe misleading impression. The consequences can go from mere embarrassment to the failure of a job interview. Feeling annoyed by unsolicited advertisement, but also being uncomfortable with advertisements that reflect too much knowledge about themselves, Internet users suffer more often than expected the aftermath of continuously disclosing personal and private information.

In many instances, however, they are actually able to choose between disclosing or retaining personal data. Nonetheless, individuals tend to decide in favour of shortterm and tangible benefits although being aware that there is a value to privacy. The research of Acquisti and Berendt deals with exactly this gap of stated preferences, i.e. the (partial) awareness of the consequences of giving away personal information, and actual behaviour [START_REF] Acquisti | Privacy attitudes and privacy behavior: Losses, gains, and hyperbolic discounting[END_REF][START_REF] Berendt | Privacy in e-commerce: Stated preferences vs. actual behavior[END_REF]. Lack of information and transparency about the commercial or governmental usage of personal data often eases the individual's decision to disclose personal data [START_REF] Grimmelmann | Privacy as product safety[END_REF].

Convenience aspects are one of the most important drivers for disclosing personal data [24, p. 4]. DCs offer a plethora of supposed advantages and seemingly free services to the DS in order to get hold of personal data.

Acquisti characterizes the benefits of disclosing personal information as relatively small and short-term rewards [START_REF] Acquisti | Privacy attitudes and privacy behavior: Losses, gains, and hyperbolic discounting[END_REF]. These include direct and indirect monetary incentives such as little gifts or discounts on products in exchange of the customer's personal data. All of these price deductions such as student, senior citizen and even volume discounts are part of a positive price discrimination strategy. But there are also immaterial rewards which can involve social benefits, e.g. when the DS tries to avoid peer-group pressure (particularly in social networks) by willingly sharing private information [START_REF] Grimmelmann | Privacy as product safety[END_REF].

Furthermore, Lenard and Rubin argue that the very existence of the Internet as we know it today with a myriad of seemingly free services such as search engines, e-mail accounts, social networks, news, etc. heavily depends on consumers' willingness to disclose personal information [25, p. 163]. Taking these offers for granted, users underestimate the cost-benefit rationality that underlies the business models of many providers.

The trade-off between exchanging personal data and services mostly free of charge is based on an asymmetric allocation of information. Not knowing that their personal data is collected and processed, users are often deluded concerning their reasonable expectation. Since knowledge and education about the economic value of personal data plays a decisive role, a new form of digital divide, perhaps a "privacy divide", threatens to develop in society and the long-term need of a Privacy-E-inclusion of citizens could come into existence [26, p. 16].

Nevertheless from an economic point of view the increasing demand for goods like privacy or data protection would foster the supply and development of new technologies, laws and entrepreneurial codes of conduct as well as new business models which will offer new strategies to deal with privacy issues. It must be admitted, however, that there is little empirical evidence for a strong demand response.

In retaining personal information, the DS bears, of course, the costs of not-receiving the benefits for disclosing his/her personal data. In this case he/she is also part of a negative price discrimination not belonging to the group of preferred customers that enjoys discounts.

Since data protection implies to hold back certain information, individuals who are reluctant to disclose personal data could furthermore be suspected of being loners, freaks or weirdoes who have something to hide. In fact, the question why people would need privacy if they do not have anything (bizarre or illegal) to hide belongs to one of the classical arguments of DCs trying to camouflage their gain in power and profit by collecting information. 12 Here the classical but wrong statement "If you have nothing to hide. . . " becomes relevant [START_REF] Solove | I've got nothing to hide" and other misunderstandings of privacy[END_REF].

However, communicating, exchanging opinions or sharing information represents an essential part of human behaviour and an important strategy to succeed in society. If you want to pursue a successful career in any field of work, networking belongs to one of the most relevant activities. That is why holding back information at a certain point of time could be disadvantageous. In the online world most of all social networks try to meet this demand of being easily, all the time and everywhere connected. Although most of the social interactions still take place in the off-line world, a trend towards more and more virtual interactions seems to be visible, especially if looking at the younger 12 In an interview on the CNBC documentary "Inside the Mind of Google" in December 2009

Eric Schmidt, CEO of Google, was asked: "People are treating Google like their most trusted friend. Should they be?" Hitting the nail on the head, he responded: "I think judgment matters.

If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place, but if you really need that kind of privacy, the reality is that search engines including Google do retain this information for some time, and it's important, for example, that we are all subject in the United States to the Patriot Act. It is possible that that information could be made available to the authorities." http://www.youtube.com/watch? v=A6e7wfDHzew, last accessed on 17 January 2011.

generation. Not sharing digital information could therefore lead to an isolation problem these days and even more probable in the future. As already pointed out, the relevant literature does not specifically identify the economic advantages of maintaining informational privacy for the individual, because the concept of privacy does not generate easily quantifiable factors. Hence, difficult-toquantify, privacy aspects are often excluded from the analysis [START_REF] Swire | Efficient confidentiality for privacy, security, and confidential business information[END_REF].

Nonetheless, what can be seen as a benefit is that privacy serves as a defensive right against intrusions by others as well as a positive right enabling the DS to exercise control over his/her information. Westin names four functions of privacy: [7, pp. 32] -First of all, there is personal autonomy, providing the individual with a core sphere where he/she is able to retreat not being controlled, manipulated or dominated by others, e.g. huge relevance concerning the secrecy of the ballot. -Secondly, privacy serves as a safety valve which allows the individual to let his/her instinctual needs run more freely without having to fear embarrassment. -Thirdly, self-evaluation and reflection can be carried out undisturbed in the private realm in order to develop one's personality and initiate learning processes. Additionally, innovative and creative thinking is spawned so that societies can continue to advance allowing their citizens to explore beyond the mainstream. -Finally, limited and protected communication leads to an unstrained exchange of information supporting the right to free speech.

Again, it is obvious that these highly immaterial and long-term benefits for the individual are difficult to operationalise and quantify. However, they represent a crucial element in our analysis of the costs and benefits of privacy.

The data controller: DCs face a complex cost-benefit ratio in gathering, storing and exploiting the collected data as well. Although the boundaries are blurred, we should generally distinguish between sensitive (confidential) data of the corporation and collected personal information of individuals. This paper mainly deals with the latter.

Material and personnel costs of aggregating, storing and processing data represent first of all the most important direct expense factors. Although the software and hardware costs of aggregating, storing and processing data are constantly decreasing due to technological progress, the amount of data that needs to be stored and processed is skyrocketing at the same time so that data collecting companies face rapidly rising operating costs (e.g. for electric power supply). For this reason data centres are even built close to power plants or in cooler climates [START_REF] Harizopoulos | Energy efficiency: The new holy grail of data management systems research[END_REF]. The energy issue becomes a more and more relevant topic, also because there is an apparent tendency towards retention of data, i.e., to collect more data than actually needed. This increases additionally the risk of overinvestment [30, p. 474].

Especially when you consider private data as a commodity that can be exploited by its owner, property rights should be furthermore taken into account as an indirect cost factor [START_REF] Volkman | Privacy as life, liberty, property[END_REF]. Confronted, moreover, with a complex body of rules and regulations concerning the collection, storage and usage of personal data, DCs will try to comply (at least to a certain degree) with these rules to avoid lawsuits and payments of compensations. Extra administrative and infrastructural expenses should therefore be considered.

Information security would represent one of these additional infrastructural cost factors. When storing personal data, most companies are obliged by law to protect the data through technical means (e.g. encryption) and access control measures. Moreover, back-ups and log files which show who accessed which data serve as another safeguard. Staff at all levels have to be trained how to use and manage data in a lawful way. If a company wishes to transfer data to a country outside the EU, there are serious regulatory hurdles to cross, not least of which is ensuring that the data will be adequately protected and respected to the same extent as in the European Union.

Besides, a company may need to respond to requests for access to their data by customers arguing that the data is not correct. The company will need to verify whether the data is correct or not. And when the data is compromised in some way, either through data breaches caused by a hacker attack, or when data is lost, then the DC faces a plethora of material and immaterial costs.

Data and privacy breaches can have devastating consequences for DCs. Immediate costs would include first of all the repair or replacement of the broken system while slowing down or even stopping whole business processes [32, p. 106]. If mandatory, data subjects have to be notified of the data breach, there is negative publicity, which in a long-term perspective can seriously damage the image and reputation of the data controller. Data protection authorities may require an inspection or audits, and eventually legal actions such as fines, compensations, torts or other liabilities could account for severe financial consequences for the DC.

Acquisti, Friedman and Telang have shown in their study that companies that experienced a privacy breach not only have to fear the loss of existing customers, but also suffer a statistically significant negative impact on the firm's stock exchange value [33, p. 1573]. However, stock prices tend to recover in a rather short period of time. Ultimately, privacy and data breaches can result in long-term damages for enterprises such as higher insurance premiums, severance of contractual relations, and, most importantly, an eventual harm to trust relationships with customers and/or suppliers.

Thus, DCs need to assess their security investment in relation to the probability of a privacy incident multiplied by the impact the problem will cause. Such a risk assessment is necessary in order to keep the right balance between an adequate level of data protection and an efficient and effective processing of the data [START_REF] Sonnenreich | Return on security investment (rosi) -a practical quantitative model[END_REF][START_REF] Anderson | The economics of information security[END_REF]. When sanctions are unlikely or the costs of compensations do not surpass the financial benefits resulting from the collection and usage of personal data, DCs will tacitly accept these incidents and prefer to neglect privacy and data protections measures as frequently the case in these days.

Trying to exploit personal data commercially, companies aim to understand the mechanisms behind individual purchase behaviour in order to increase their profits from better market opportunities. To sell products and services, suppliers need to comprehend what their customers want or need, to stimulate the buyer's interest in their products or services and to be reasonably sure what a consumer (or different groups of customers) is willing to pay for the product or service. For this purpose many market players have been aggregating data, regardless of whether personal or non-personal, for a long time. Moreover, enterprises have collected even more data in the field of production and logistics succeeding in making the supply chain more efficient. This general aim prevails in an age where the collection of more and more data becomes feasible and affordable due to the ever-decreasing costs for sensors, storage and computing power. The data comes from traditional sources such as loyalty cards and data trails in the Internet [START_REF] Graeff | Collecting and using personal data: consumers' awareness and concerns[END_REF], but increasingly also from other sources such as RFID-tagged products or deep-packet inspection.

In selling personal data to third parties, companies run, of course, the risk of losing money if the added sales revenue is smaller than the benefits of providing services based on processing the personal data on their own.

There are numerous companies which found their business model on the processing of personal data creating consumer profiles and exploiting the results of their data analyses in order to make a huge profit [START_REF] Hildebrandt | Profiling the European Citizen: Cross-Disciplinary Perspectives[END_REF]. Offering seemingly free services such as Internet searches, emails, news, games or social interaction, many Internet enterprises are part of an already huge and still rapidly growing online advertising industry [START_REF] Evans | The online advertising industry: Economics, evolution, and privacy[END_REF].

Conclusion

This paper has presented three different approaches to privacy attempting to answer central questions such as: Why do we consider privacy as something worthy to protect? Is there a social value to privacy? Cui bono from privacy?

Although privacy is extremely context-dependent and often valued differently, the ethical perspective suggests that privacy represents an essential component of human identity. Trying to figure out, where the supposed human desire for privacy comes from, this section analyses a variety of antecedents tracing biological, anthropological, psychological and religious origins.

Territoriality and noxious reactions to overcrowding, for example, can be seen as biological factors causing sometimes a need for a certain degree of social distance. However, research on empathy and isolation also shows that human-beings are above all social creatures. Furthermore, notions of privacy can be found in most preliterate and modern societies, which indicates a universal value of privacy.

However, feminist anthropologists assume that privacy constitutes primarily a realm created by man in order to exert power over women. From a psychoanalytic point of view Freud helps us to realise that there is an unconscious dimension to privacy which lies beyond one's awareness.

Eventually, the influence of the early liberal movement on the notion of privacy has to be considered paving the way of today's negative and positive privacy right conception.

The social perspective aims to depict the tension between private and public. Being Hobbes' homo homini lupus and Aristotle's zoon politicon at once, humans face the hedgehog's dilemma, craving solitude and gregariousness at the time. However, privacy is not only challenged by the personal dilemma but also by conflicting social values such as national security, transparency or free speech. That is why a transparent and effectively designed balancing process must be followed in cases of curtailing privacy; otherwise, as for example Thomas Jefferson stated, there is a risk that "he who trades liberty for security [...] loses both."

The economic perspective resort to an actor-centred approach distinguishing between data subject (DS) and data controller (DC). In the case of the first a dual choice model of "disclosing" or "retaining" personal information presents the options of action, whereas the latter has to consider the costs and benefits of collecting, aggregating, storing and processing data as well as of potential privacy breaches.

In disclosing personal information, the DS is often confronted with costs that are neither easy to identify nor simple to operationalise and quantify. Nonetheless, more and more individuals are facing privacy problems resulting from their lax attitude towards sharing private information or being forced to disclose personal data. These problems include the risk of being a subject to social sorting or other discriminatory practices. Giving away personal information increases the threat for the DS of becoming a victim of online and offline crime. Other cost factors involve embarrassment, discomfort, annoyance, etc. But there are also a variety of benefits for the DS resulting from the disclosure of personal data. One of the most important advantages is an increased level of convenience meaning relatively small rewards such as discounts, free Internet services, etc. In retaining personal information, the DS bears, of course, the costs of not-receiving the benefits for disclosing his/her personal data. Since data protection implies to hold back certain information, individuals who are reluctant to disclose personal data could furthermore be suspected of being loners who want to hide something from the public. In today's digital society the refusal of sharing personal information could therefore easily lead to an isolation problem. Nonetheless, there are important benefits of retaining informational privacy. First of all, privacy serves in general as a defensive right against intrusions of others creating a protective sphere around the individual. Privacy as a positive right enables ideally the DS to exercise control over his/her information. Westin's four functions of privacy include personal autonomy, emotional release, self-evaluation and limited as well as protected communication. [7, pp. 32] Though mostly immaterial, these benefits are much more relevant, profound and complex than economic theory is being able to grasp.

The DC on the other hand faces various material and personnel expenses of aggregating, storing and processing personal data such as costs for property rights (if considered), compliance with state regulations and information security.

But in fact, the lucrative benefits outweigh the costs by far. The maxim scientia potentia est ("for also knowledge itself is power") could not be more appropriate explaining the strategy behind the DC's rampant collection behaviour of personal data. In the information society data itself has become one of the most valuable commodities. In analysing data of (potential) customers, companies, for instance, are far better off calculating and minimising risks. Aiming to understand the mechanisms behind individual purchase behaviour, commercial DCs are able to reduce transaction costs immensely. The rapidly growing online advertising industry is just one example of business that profits in a remarkable way from collecting digitally consumer information.

There is, however, a major downside to collecting personal data. Privacy and data breaches can have devastating consequences for DCs such as legal actions, slowing down or even stopping whole business processes, but also in a long-term perspective damaging the DC's image and trust relationships with customers as well as suppliers.

In conclusion, providing a comprehensive overview of three different perspectives, this paper attempts to contribute to a better understanding of privacy. The multidisciplinary analysis of privacy represents a difficult task since the different approaches have huge overlaps and are at least in parts difficult to distinguish from each other. Nonetheless, the interacting scientific points of view uncover neglected aspects and give revealing insights into the multifaceted concept of privacy. Summing up the most important findings of the different approaches, it seems that privacy has an intrinsic universal value that does not, however, stand for itself. Privacy is part of a complex social value system which components need to be kept in balance. Since economic theory reaches surprisingly fast its limits, ethical and social aspects needs to be integrated into the analysis. The economic discourse shows as well that privacy implies control and therefore power which the data subjects such as citizens but also consumers should be made aware of.

Although being considered in PRESCIENT, the legal perspective as a section of itself has been left aside in this paper in order to avoid redundancies with an already extensive literature on legal aspects of privacy.

The biblical allegory of Adam and Eve, being happily nude while sharing with God the holy space of paradise, tries to show that perfect intimacy with God. When they taste from the forbidden fruit and consequently break the alliance with God, shame and distrust represented by the need to hide themselves in clothes begin to appear.

Warren and Brandeis later extend this idea defining privacy as "the right to be left alone"[START_REF] Warren | The right to privacy[END_REF].

Though the hedgehog needs the warmth and affection of his fellow hedgehogs in his surrounding, he will expect to inevitably get hurt by their spiny backs[14, p. 396].

The EU data protection directive defines the DS as "an identified or identifiable natural person", whereas the DC is referred to as "the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data."[18]

[START_REF] Elshtain | Public Man, Private Woman[END_REF] Due to the growing quantity of possible DC actors, the analysis limits itself to private business entities, although public authorities represent one of the most important bodies collecting and controlling personal data. This must be, however, subject to further research.

The data subject's perception of these effects heavily depends on the information he/she receives and on previous experiences with privacy intrusions, the latter being called the "life cycle element"[19, pp. 31].

[START_REF] Freud | Zeitgemässes über Krieg und Tod[END_REF] The Dutch website PleaseRobMe.com highlights the dangers of sharing too much information on the Internet about your locations[START_REF] Harvey | PleaseRobMe website highlights dangers of telling world your location[END_REF].

Acknowledgements

This work was carried out in the EU-funded FP7 project PRESCIENT: Privacy and Emerging Sciences and Technologies (SIS-CT-2009-244779). Important input came from David Wright (Trilateral Research & Consulting), Emilio Mordini and Silvia Venier (Centre for Science, Society and Citizenship). For more information see: http: //www.prescient-project.eu