Paulan Korenhof
email: p.e.i.korenhof@tilburguniversity.edu

An exploration of the "right to be forgotten" as implementation of "forgetting" in online memory processes

Keywords: Data protection, forgetting, Internet, memory, right to be forgotten

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

"The Web Means the End Of Forgetting" [START_REF] Rosen | The web means the end of forgetting[END_REF]: The title of this 2010 article by Rosen expresses the growing concern with personal data available on the World Wide Web (Web) 1 and the potential consequences of permanent availability of these data for individuals; people would be unable to "escape" from their online past. With the increasing number of people that make use of the Web to share and consult information [7, p. 382] such concerns seem justified. In only a relatively short time, the quality and quantity of digital data storage and online accessible information have grown explosively [START_REF] Mayer-Schönberger | Delete: The Virtue of Forgetting in the Digital Age[END_REF]. The dramatic increase and ease with which digital data can be stored have led from a situation that could be described as "forgetting-by-selection" due to limited storage space, to a "remembering-by-default" in our information systems. The technology of the Web is thus influencing what we remember and how we remember.

According to Dodge and Kitchin, stronger growing digital memory technologies mean that "memory should always be complemented by forgetting" [9, p. 441]. In the proposal for the European Union General Data Protection Regulation (GDPR) a "Right to Be Forgotten or Erasure" (R2BFE), article 17 (art. 17 GDPR) was developed in order to provide for such a counterbalance to digital memory. Ideally, the R2BFE aims to help individuals escape their past by targeting information that already exists in the public domain and that "with the passing of time becomes decontextualized, distorted, outdated, no longer truthful (but not necessarily false)" [3, p. 127].

Based on its title, the R2BFE seems to promise people a reinforcement of the forgetting of memories that concern them. However, "forgetting" is a concept that generally takes shape in the human 2 memory process of a singular agent 3 while the R2BFE is directed at information that is shared among agents. The information available on the Web is not only of interest to the agent that is the object of the information, but also to the people that share and consult that information. This makes the concept of human forgetting in such a context challenging to implement.

Taking into account the importance that is assigned to forgetting within the R2BFE, it is important to evaluate how successful the R2BFE could actually be in its implementation of forgetting. By analyzing the R2BFE in the light of human memory processes and the role that the Web plays in human memory, we can get a better idea of the possibilities of how to implement such a concept as human forgetting in relation to data on the Web and subsequently -and more importantly -where the R2BFE may lose out or may be at risk of affecting more than is necessary other interests that are at stake. So let us assume that art. 17 GDPR was written with the intention to actually provide a "right to be forgotten", then my fundamental question is: to what extent can we consider the R2BFE to be a successful proposal for implementing forgetting on the Web? To answer this question I will first describe the concept of "memory", the use of external memory sources and the manner in which agents use the Web as a shared memory. This is followed by a section on "forgetting". Next I will analyze how the R2BFE implements forgetting in the online shared memory and conclude to what extent the implementation of "forgetting" by the R2BFE does justice to the concept of human forgetting and on which fronts it misses out. 2 The focus on human memory and forgetting does not mean that humans are the only species that forget or have a memory process. However, because "biological memory" seemed too broad a topic for this paper and the R2BFE is aimed at human agents, the concepts of memory and forgetting are framed here in human terms. 3 The agent can be any gender type, including gender X (the third legal gender, for example, in Australia). Because truly gender neutral pronouns like "xe" are still regarded as uncommon, I will refer to an agent as "he/him/his", although this use of the masculine gender is meant to include all options.

Memory, external memory and transactive memory

If we want a Web that forgets, we need to get an idea of the semantic content of "forgetting", and for that, we need to know what memory entails. The manner in which we use "our" memory systems has changed and is still changing over time due to technological developments i.e. on the level of information management. Additionally, our memory depends not only on what a single agent can do, but also on what agents can do through social interaction.

To highlight the functioning of our memory in relation to the Web, this section consists of three parts: the concept of "memory", the manner in which we externalise our memory by the use of tools and the manner in which we use the Web in a socially interactive way as a form of external memory, the transactive memory.

Firstly, the concept of "memory". "Memory" is a complex concept that has given rise to much thought in various academic fields [START_REF] Sutton | Memory. In: The Stanford Encyclopedia of Philosophy[END_REF]. The term "memory" is commonly used for both biological (human) entities and computers (Cf. [6]). This does not mean that these types of memory systems are the same: on the contrary, they differ a lot. For example, the electronic memory system seems far more apt for storing information than the human system; if they would be the same, there would possibly not even be a desire for the R2BFE. However despite (big) differences in its application, the term "memory" is considered applicable for diverse systems because they have something in common that is inherent to memory systems: "Any memory system -whether physical, electronic, or human -requires three things, the capacity to encode, or enter information into the system, the capacity to store it, and -subsequently -the capacity to retrieve it." [2, p. 5] These three elements interact: the manner of encoding determines what and how something is stored, which will in turn determines what can be retrieved [2, p. 5]. The concrete functioning of these three elements can differ according to the type of memory system and entity, but all necessarily comprise the same three elements.

With regard to the human memory process, the brain has special strategies to enhance its memory process with the help of environmental factors. This brings us to the second topic: the use of external tools in the human memory process. Clark points out that " [o]urs are (by nature) unusually plastic and opportunistic brains whose biological proper functioning has always involved the recruitment and exploitation of nonbiological props and scaffolds" [8, p. 86]. The use of external tools to increase our cognitive abilities has long been related with the human species: writing is one way that many of us use to think and reflect upon our own thoughts or to remember [8, p. 5]. By using tools to store, alter, combine and transform information we can deal with complex problems and large amounts of information in ways that would be impossible for or require a lot of time and energy from our biological "naked" brains [8, p. 78]. The human brain is good at learning how to use environmental factors and instruments optimally so as to minimize weaknesses like its generally limited memory capacity [8, p. 74-75]. External memory sources can complement this limited capacity by diminishing the amount of information that the biological memory needs to process and store [8, p. 67].

One of these potential external memory sources is the Web. The Web as external memory source differs fundamentally from many other information resources, due its "ontological features" [12, p. 186]. Information on the Web is not bound to a specific physical information source. Digital information is aspatial [19, p. 412]. Because of this, it is easily transported [5, p. 1112]. It is also generally a nonrivalrous good: meaning that the consumption of a good by one person, does not diminish the possibility of its use by others [19, p. 411]. The ontological features of the Web determine the effort that we need to undertake to get access to the information that it contains [12, p. 186]. Together these features determine the degree of "ontological friction" [12, p. 186] of the Web as "infosphere": "the forces that oppose the information flow within (...) the infosphere, and hence (...) the amount of work required for a[n] (...) agent to obtain information" [12, p. 186]. The Web's ontological frictions are low compared to offline, and especially analogue, information sources. Only a device to access the Web is needed and then one can access it almost from anywhere at any time while, if we want for instance to access information in an analogue library, we needs to physically access the building.

Besides its easy accessibility, the digital information on the Web is also easy to store. The storage capacity of digital devices has grown exponentially over the past decade and the quality loss of the stored information is relatively minor [13, p. 67]. Moreover, digital information can be multiplied, and copied easily and flawlessly, without loss of quality and is therefore infinitely expansible [19, p. 411] which can lead to a certain persistence [5, p. 1112]. Additionally the Web provides for easy retrieval of information. By means of search engines and other functions we can scan the Web for certain topics in a great level of detail, and generally we are able to find the desired information even when using vague keywords and search terms [8, p. 153].

The Web is not just a useful tool for us with regard to our memory processes as a singular human being. This fact brings us to a third topic: the Web as a socially interactive memory tool. The Web has a peculiar informational character compared to "classic" resources like libraries and archives. It has a decentralized and anarchic nature [8, p. 149-150]; it is an information source that is created by the minds of many. Everyone with an appropriate device can add information to the Web and often websites are publicly accessible. This gives the Web a special status; it can function as a "transactive memory system" [START_REF] Sparrow | Google effects on memory: Cognitive consequences of having information at our fingertips[END_REF].

Wegner4 introduced the term "transactive memory" to describe the processing and structuring of information within a group of people [20, p. 185]. Transactive memory is "a set of individual memory systems in combination with the communication that takes place among individuals" [20, p. 186]. The notion of transactive memory is based on an analogy between informational group processes and the individual memory process [20, p. 185]. In this sense, the processes of encoding, storage and retrieval have "both internal and external manifestations" [20, p. 188]. People can encode and store information both in themselves and in external sources (including other agents) and they can retrieve the information they need from these sources andif made available -from other agents and their external sources [20, p. 188]. Access to a transactive memory allows agents to enhance their own (external) memory stores and to retrieve information that they themselves have never encoded and stored [20, p. 188]. The Web is used as such a transactive memory. Sparrow, Liu and Wegner, in recent research stated that the Internet -this includes the Web -"has become a primary form of external or transactive memory, where information is stored collectively outside ourselves" [16, p. 776]. The features of the Web enable people to easily reach and consult online memory stores, especially search engines and the like effectively facilitate the retrieval of online information [16, p. 776]. The advantage of search engines is that the user does not need to know the location of the information, but that knowledge of the general label is often sufficient. Sparrow at al. conclude that "[w]e are becoming symbiotic with our computer tools, growing into interconnected systems that remember less by knowing information than by knowing where the information can be found" [16, p. 778].

Reciprocal use by agents of each other's memory leads to a transactive memory system "that is larger and more complex than either of the individual's own memory systems" [20, p. 189]. Information from different sources can be linked together and lead to new insights [20, p. 197]. Transactive memory systems thus influence what a group of people remembers and what they individually believe to be true [20, p. 191]. Consequently the Web as transactive memory can influence how we remember and what we remember.

The Web is thus to be seen as a transactive memory system that has a lower degree of ontological friction than traditional libraries or archives. This difference is significant and may lie at the base of a desire to have a R2BFE. The Web's large storage capabilities, its easy access and the fact that everyone can add information to the Web make it into a massive external transactive memory source that memorizes by default. The chief question therefore is: how can the Web "forget"?

Forgetting

The R2BFE claims to be -as part of the title of this paper states -a right "to be forgotten". But what is "forgetting"? Generally forgetting is described in relation to human agents. Human agents can be considered "to forget" in both a literal and metaphorical manner. 5 For the purpose of this paper I will only focus on the literal form of forgetting where forgetting is the occurrence of a glitch6 in the memory process, a "fail[ure] to remember" [6]. Forgetting can occur as a result of failures in any of the three elements of the memory process. It can be the loss of acquired information (storage), the inability to retrieve stored information (retrieval) and the deterioration of correspondence between the acquired and the retrieved information (encoding) [10, p. 100]. Many nuances are possible, like only losing part of the stored information, being able to retrieve information only partially, a temporary inability to receive certain information or a combination of different failures [10, p. 101]. For the purpose of this paper, I will focus only on the three memory process elements (storage, retrieval and encoding) -although I duly note that reality is far more complex and nuanced than such a basic model.

As stated, forgetting is a glitch somewhere in the three process elements of memory. However not every piece of information is remembered and forgotten equally. The likelihood of a glitch in the encoding, storage and/or retrieval of a specific piece of information in the memory depends on three main factors: the passing of time, the meaning of the information and the regularity with which the information is used [10, p. 100/101]. On the one hand, meaningful and repeatedly used information generally has a longer endurance in the memory; on the other hand, the memory of a certain piece of information generally gets weaker over time [10, p. 100-101] 7 . These factors can strengthen or weaken each other. For example, meaningful information may be used more often and thereby remembered better. Additionally, information often loses its value for us over time [1, p. 390], which leads to the increasing chance that it is forgotten eventually. The factors "meaning", "use" and "time" together influence if and till what extent an agent will remember or forget a specific piece of information.

What forgetting entails in relation to human agents is relatively clear. But as described in the previous section of this paper, human agents can extend and share their external memory with others. With regard to the use of external personal memory and external transactive memory, the notion of forgetting becomes increasingly difficult.

Let us start with forgetting in relation to the use of an external memory source by a single human agent. When using an external memory source, the storing of information requires an action of the agent to actively select and encode the information that he wants to store. This extended-by-externalization memory process can show signs of glitches in the extended memory process when the agent interacts with his external memory source: for example, if the agent is unable to retrieve information from an external memory source (i.e. he loses a paper notebook) or if the information in it becomes intelligible (i.e. a cup of coffee is spilt over some of the notebook's pages). Such glitches can be viewed as metaphorical forgetting in the extended memory process. If an agent wants to "forget" information in his external memory store, he will need to actively effectuate the "forgetting" in some way. He could do this by, for instance, destroying the externally stored information or by making sure that it is irretrievable. With the use of most external memory stores (like notebooks), the stor-ing faculty changes from a human memory store that automatically forgets by default into an external memory store that automatically remembers by default. The "digital turn" of information even strengthened the remembering by default in external memory stores. The previously needed forgetting-by-selection processes due to limited storage space are becoming increasingly unnecessary due to technological developments that enable the increased storage space of digital information [18, p. 349].

Understanding "forgetting" in relation to an external transactive memory is even more challenging, because it does not concern a single agent but multiple agents that may all have different interests at stake. When the transactive memory is stored externally, and especially when in digital format, the transactive memory system will automatically remember by default. The social base of the transactive memory makes it increasingly difficult to see how "forgetting" could work in such a system. The system depends on both the input and output of all agents and is often not under the control of a single agent. All agents that consult the external transactive memory (and not only the ones that add information to it) and/or that are the object of these "memories" have an interest in what is encoded into the memory and what is not, or what is "forgotten". This means that the factors of "meaning", "time" and "use" in the transactive memory differ in their relative importance with regard to the "forgetting" of a specific piece of information depending on the agent in question.

The challenge for the R2BFE is thus to implement the concept of singular human forgetting into the external transactive memory that forms a memory source for multiple agents.

R2BFE and online transactive memory

The term "forgetting" in the R2BFE implies human memory, but clearly the R2BFE is not aimed at human memory as such or else it would imply that there is a right to meddle in other people's brains. Rather, the R2BFE is part of the GDPR-proposal and therefore has to be read in the context of personal data protection and information technology systems. The R2BFE, art. 17 GDPR, gives people the "right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data" (art. 17 (1) GDPR). The R2BFE thus provides individuals with a right to interfere with digital information that is controlled by others, called data controllers (art. 4 (5) GDPR), and is located on an external memory source. Simply put, the data controller's external memory sources need to "forget". As pointed out in section two of this paper, external memory sources play an important role in human memory processes because our brains use them as external tools to enhance our memory. Most external memory sources (like stored emails) will have a personal instead of a public nature. Such personal external memory stores cannot be targeted by the R2BFE; art. 2 (2)(d) GDPR states that the processing of personal data "by a natural person without any gainful interest in the course of its own exclusively personal or household activity" falls outside the scope of the GDPR. This is the "household exemption" [4, p. 5]. The target of the R2BFE is thus the external memory shared among people (transactive memory) that lies outside the household. A part of the transactive memory systems is thus safeguarded by the household exemption if it can be considered part of the "household" activity. The scope of what is intended by "household" is therefore very important. The current idea of what is to be considered "household" use includes for a major part the data made accessible by individuals to friends on social networking sites (SNS). The Article 29 Working Party states that many SNS users "operate within a purely personal sphere, contacting people as part of the management of their personal, family or household affairs" [4, p. 3]. However, some exceptions are mentioned: the processing of data on SNS is not considered to be household use when activities extend beyond purely personal or household activity (for instance when the user acts on behalf of a company), when the access to the profile information extends beyond self-selected contacts or when the information is subject to liability under general provisions of national law (such as defamation) [4, p. 5/6]. Due to the household exemption, a large part of the data on social networking sites fall outside the scope of the R2BFE.

With regard to personal websites, the European Court of Justice (ECJ) decided in the Lindqvist ruling that activities on a personal website are not covered by the household exemption when the information on a website could be viewed by an indefinite number of people [11, § 47]. Here we enter the realm of the online transactive memory.

Additionally, the R2BFE tries to account for some of the ontological features of online data -the fact that they can be easily copied, multiplied and transported -in art. 17 (2) GDPR. Art. 17 (2) GDPR deals with third parties who have copied and reproduced data that is challenged by the R2BFE: it compels data controllers to inform third parties that are processing data that were originally published under the responsibility of the data controller, that the subject of the data wants the data to be erased. When the data controller has authorised publication by third parties, the data controller is considered responsible for those publications (art. 17 (2) GDPR).

The household exemption and the Lindquist ruling show that the group of people that can get access to the data play a important role for the criteria whether a certain information source -an external memory source -falls within the scope of the GDPR. The main types of memory that can be targeted by the R2BFE are thus publicly accessible and/or business oriented external transactive memory systems; transactive memory systems that have a big reach and hence can have a substantial group of people that have a legitimate interest in the content of that transactive memory.

The challenge for the R2BFE is to implement "forgetting", a concept that relates to the singular human memory, into a shared transactive memory system that transcends the memory of a single human being. The interests at stake with regard to a specific piece of information expand from one agent to a group of agents with diverse interests. The human memory metaphor can provide guidance on how to implement "forgetting" in online transactive memory systems. It can give guidance on which aspects should play a role in the balancing of interests of the different agents that are stakeholders with regard to the content of an online transactive memory system. In order to evaluate to what extent the R2BFE relates to the concept of human forgetting and implements this notion, I shall review the manner in which the relevant paragraphs of the R2BFE deal with this particular challenge.

The R2BFE targets personal data that relate to a certain individual. Art. 17 (1) GDPR states the grounds on which people have a R2BFE in sub-paragraphs (a) through (d): sub-paragraph (a) grants agents a R2BFE when it concerns data that "are no longer necessary in relation to the purposes for which they were collected or otherwise processed", (b) determines that agents can invoke their R2BFE when the processing of data is based on consent and the agent withdraws this consent or when the period for which the consent is given is expired, (c) entitles agents to a R2BFE if the agent objects to the processing of personal data in accordance with art. 19 GDPR. The data has to be erased, unless the data controller can show compelling legitimate grounds that override the agent's interests (art. [START_REF] Vafopoulos | Being, space, and time on the Web[END_REF](1) GDPR), and (d) requires the erasure of data when the processing of the data is not conform the GDPR.

These subparagraphs show the balance of interests between an agent that wants information "forgotten" and the data controller that wants to retain the information. In determining this balance of interests the elements of "meaning" and "time" play a role; the data need to have meaning in order for the data controller to keep it in his external memory source. Art. 17 (1)(a) GDPR contains a temporal and meaning reference that suggests that, with the passing of time, information may lose its relevance for a data controller, in which case the individual's R2BFE prevails. This subparagraph restricts a processor's data collection to data that serves the specified purpose for data processing.

The exceptions to what may be forgotten by the enforcement of the R2BFE are also important. These are listed in art. 17 (3) GDPR. Data can be retained (a) when the data is necessary for exercising the right of freedom of expression, (b) for reasons of public interest in the area of public health, (c) historical, statistical and scientific research purposes, and (d) for compliance with legal obligation to retain data and in specific cases described in art. 17(4) GDPR. As these exceptions show, if information has public value the data can be retained. What is important to underline here, is that these exceptions acknowledge the meaning of the data for third parties that consult or make use of the external transactive memory and thus acknowledge their interest with regard to a certain set of topics (the data need to be important for the freedom of expression, public health, historical and/or scientific value).

Additionally the formulation of art. 17 (4)(a) GDPR is interesting: "for exercising the right of freedom of expression". The use of the verb and its conjugation "exercising" suggests that data can be retained if they are part of an ongoing activity of freedom of expression. The question then is: when does this action end? The temporal scope of a freedom of speech activity is an interesting issue, and it is worthwhile debating if the R2BFE is implemented and retains this formulation. Such a discussion however exceeds the scope of this paper.

The R2BFE has some elements that correspond with important factors in the human forgetting process. The most prominent one is the meaning of the information: it is included in terms of whether the data are necessary (meaningful) for the data controller, if the data should be retained due to its public importance (art. 17 (3) GDPR; freedom of expression, public interest in the area of public health, historical, statistical and scientific research purposes) and the meaning of the information for the individual that wants the data to be forgotten. The time-factor of forgetting is less prominent, it is only a factor in art. 17 (1)(a) GDPR. It is notable that any element that acknowledges the importance of the "use" of data in relation to forgetting, the frequency with which the data are used, is missing altogether.

The "forgetting" that is implemented by the R2BFE is initiated by the individual who wants certain data to be forgotten. The R2BFE is thus an externally initiated and enforced form of "forgetting". As the name of the article already indicates, it is a right to be forgotten and to erasure. The first paragraph shows that "erasure" is the dominant feature of the article, because the R2BFE gives individuals the "right to obtain from the controller the erasure of personal data". By erasing information the R2BFE operates on the storage level of the transactive memory process and thereby applies a black-and-white notion of forgetting: data are either erased or not. This is in contrast with the concept of human forgetting which can also play a role at the process levels of encoding and retrieval, and may vary in gradations of forgetting: in human terms, information can be partially or temporally forgotten.

However, there is (minor) potential in the in the second and fourth paragraph of the article of the R2BFE for it to be applied to the two levels of retrieval and/or encoding. Art. 17 (2) GDPR compels data controllers "to inform third parties which are processing such data, that an individual requests them to erase any links to (...) that personal data". An erasure of hyperlinks would be an interference with the transactive memory process on the level of retrieval. The question, however, is whether a controller can request third parties to remove the links while retaining the information on his own website due to one of the exceptions of art. 17 (3) GDPR. In this situation, the information would be more difficult to retrieve, but not impossible to retrieve for people who know what they are looking for and where to look. Also, it is unclear whether an individual could use the R2BFE only to have links removed, and not the content itself: for instance, if the agent wants to retain the content for sentimental reasons, but not draw attention to it because it is outdated. 8Art. 17 (4) GDPR mentions several cases where data controllers can refrain from erasing data, but have to restrict its processing. Sub-paragraph (b) and (c) are interesting in the light of "forgetting". A controller is allowed to restrict the processing of data instead of erasing them, when (b) the data controller needs to maintain the data for the purposes of proof, (c) the processing of the data is unlawful, but the individual requests the restriction of the use of the data instead of erasure. In the case of (b) the interference of the R2BFE works on the levels of retrieval and encoding in the transactive memory process: the data may only be retrieved for the purpose of providing proof and no additional information may be encoded, nor may the already encoded information be altered. Roughly the same goes for (c), with the difference that the request for the retention of the data is initiated by the individual. However, paragraph four of the article seems to be focused on internal company processes and not aimed at online publicly accessible content.

In sum, the R2BFE is largely concentrated on erasure on the storage level and only minimally allows for other -more fine-grained -applications of "forgetting" that may deal with the same issue at hand. Possibilities to use implementations of "forgetting" on the process levels of encoding and retrieval are the exception rather than the rule.

5

Learning from forgetting by the human memory

As stated earlier, the human memory metaphor can provide valuable guidance on how to implement "forgetting" in online transactive memory systems. Its rich mechanisms of forgetting provide for a better understanding of which aspects can and should play a role in the balancing of the interests of different stakeholders in online transactive memory systems and give guidance for implementations of more gradual and balanced forms of "forgetting". A straightforward erasure of data is a too narrow understanding of "forgetting".

The "forgetting" implemented by the R2BFE needs to take place somewhere in the transactive memory process of encoding, storage and retrieval. The element of retrieval seems to be a very significant part in the use of the Web as transactive memory; people can get access to information they did not even know existed through the use of search engines [START_REF] Sparrow | Google effects on memory: Cognitive consequences of having information at our fingertips[END_REF]. Cues in search engines can lead to search results that individuals were not originally looking for and search results can provide for new insights by showing information that can be combined serendipitously. The R2BFE would obtain means to more nuanced implementations of "forgetting" if it were to be able to impede for instance, the retrieval of information by search engines. Links could be erased or moved to a harder-to-access area (e.g., an area that requires a user login or an area that can be found only with the use of very specified retrieval cues in a search engine), or certain results in search engines could be downranked. 9On the level of encoding, there may be possibilities to anonymize, pseudonymize or encrypt information or certain -identifying -parts of the data (this in return will influence the extent of retrieval of the information). Additionally, one can think of encoding more contextual and actual information with memory items, so that people who consult the transactive memory view updated instead of possibly outdated information. Such forms of forgetting or updating of the memory could be a less heavy and more goal-effective means of forgetting than erasure of data on the storage level.

Hold-ups in the retrieval process or obscuration in the encoding process would obviously interfere with the interests of individuals who try to consult the transactive memory. However, they will have a greater chance of retrieving the "forgotten" information or at least part of it -with some effort -than would be the case if the information were to have been erased altogether. An implementation of forgetting on the level of encoding and/or retrieval would be therefore a less extensive integration of forgetting in the online transactive memory than the erasure of the content itself. Using less far-reaching measures than the plain erasure of data could be beneficial for the interests of others. It could include access to: the historical and scientific value of information, the freedom of speech, or personal interests of others. Also an individual self can have a need for different "grades" of forgetting rather than plain erasure. With an eye on the balancing of interests between the individual who wishes certain personal information to be forgotten and the users of the transactive memory, it will be worthwhile to pay attention to factors that influence the memory process -of which "meaning", "time" and "use" are the most important ones.

In its current form, the R2BFE neglects the frequency with which information is used as a factor that affects the forgetting process. Allocating a role to the "use" of information as a factor that either enforces or prevents "forgetting" can be a helpful element in weighing up the balance of various interests. "Forgetting" information on a website that is hardly viewed makes more sense than "forgetting" information that is consulted several hundreds of times a day. Integrating "use" as a factor could benefit the interests of third parties, which as consulting parties are now only taken into account by means of the exceptions to the R2BFE. "Use" as a factor that could oppose "forgetting" provides a possibility for concrete evaluation: measuring how often something is viewed is technically easy on the Web. Additionally giving more attention to the factors "time" and "meaning" -not just for the data controller, but also for the third parties who consult the transactive memory -could help in providing the R2BFE with the right tools to oversee a good balance of interests.

Additional and especially technical research is needed to obtain better understanding of the possibilities of how to implement more sophisticated forms of "forgetting" in the online transactive memory. This will enable us to shape and implement a R2BFE that is more fine-tuned and based on a more nuanced process of forgetting that will be better equipped to balance between an individual's need to be forgotten and the other interests at stake.

Conclusion

Technology has changed and is still changing our internal and external memory processes. The Web -as discussed in this paper -is one of those technological developments that affects the way we remember and what we remember in fundamental ways. We have moved from external memory stores with limited storage space that therefore had to "forget"-by-selection to memory stores with ever-growing storage space that "memorize"-by-default. The R2BFE aims to deal with the possible negative consequences of the shared online memory by providing people with a means to have some of their data in the online transactive memory "forgotten". Implementing "forgetting" into such systems is difficult, because the concept of forgetting originates from a single agent's internal memory process. Instead of functioning as forgetting within a singular agent, the R2BFE has to implement forgetting in an external transactive memory that affects the interests of multiple agents. The current wording of the R2BFE does this with limited success.

The manner in which the R2BFE implements "forgetting" is mainly a "right to erasure" of content and operates thereby mainly on the storage level of the external transactive memory process. The present possibilities for the R2BFE to operate on the level of encoding and retrieval are very limited. The R2BFE thus uses a narrow interpretation of "forgetting". While "erasure" is black-and-white (information is either erased or it is not), "forgetting" provides for a big greyscale. Additionally, of the factors that influence the occurrence of forgetting, only the "meaning" of the information for diverse agents plays a significant role. "Time" as a relevant factor to either enforce or avert forgetting is only marginally acknowledged in the R2BFE and "use" is not acknowledged at all. The R2BFE could be transformed into a more successful implementation of "forgetting" in the external transactive memory if it were to draw more heavily on the mechanisms of human forgetting. Despite the fact that the human memory is based on a single agent, the human concept of memory shows us that there are more levels in information processes in which we could interfere to achieve "forgetting". Instead of the plain erasure of information we could interfere on the level of encoding or retrieval, which can also lead to successful "forgetting".

Furthermore, the factors "meaning", "time", and "use" provide for a better understanding of which aspects play a role in every agent's relation to (memorized) information and thereby to information in the external transactive memory. These factors give guidance as to which aspects can and should play a role in the balancing of the interests of the different stakeholders in online transactive memory systems: not just the agents that are the object of the memory or the data controller, but also, very important, the third parties that use the external transactive memory as memory and may rely on it.

The Web is an application of the Internet. The content of this paper may also be applicable to other applications of the Internet, but to ensure clarity in this paper I have restricted my focus to the Web.

Daniel M. Wegner, the founding father of the notion of transactive memory, sadly died in July 2013 while I was writing this paper.

Making a strict distinction between these two elements of forgetting is not always possible, because they can relate to each other in a reciprocal manner. Metaphorical forgetting relates to instances that are generally described as "forgive and forget": certain information is not literally forgotten by the agent, but the agent will not actively use the information for current decisions. An agent makes a conscious choice to neglect specific memories in certain cases. However, if by this behaviour the information is used less and less and eventually loses its meaningfulness for the agent, there is a fair chance that the information will also literally be forgotten.

"Forgetting" may also be seen as a feature of the memory process that generates storage space.

Again, this is a basic model of a more complex and nuanced reality.

What plays an important role here is whether a search engine can be considered to be a data controller. This is one of the central legal questions in the Google versus Spain case (case number C-131/12) that is currently still under discussion by the ECJ. Advocate General Jääskinen stated in his advice to the court that search engines cannot be considered data controllers. The question is: will the court hold the same interpretation of the law? Opinion of Advocate General Jääskinen, 25 June 2013, Case C-131/12.

The search engine Google uses ranking algorithms to deal with certain issues, see for example http://googleblog.blogspot.nl/2010/12/being-bad-to-your-customers-is-bad-for.html (last accessed 8 November 2013).

Acknowledgments. This research is conducted within the Privacy and Identity Lab (PI.lab) and funded by SIDN.nl (http://www.sidn.nl). Additionally I would like to acknowledge the help of the IFIP Summer School participants, my anonymous reviewers, and Bert-Jaap Koops, Ronald Leenes and Diane Whitehouse by providing me with very helpful and much appreciated comments and suggestions.


Jens Köhler
email: jens.koehler@kit.edu

Konrad Jünemann
email: konrad.juenemann@kit.edu

Securus: From Confidentiality and Access Requirements to Data Outsourcing Solutions

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Preserving the privacy of individuals in today's service landscape is an ongoing research topic that gains even more importance with the trend of service outsourcing. Besides the protection of personal information that is necessary to make access control decisions [START_REF] Camenisch | Concepts and languages for privacy-preserving attribute-based authentication[END_REF], enforcing the confidentiality of personal data that is processed by third parties constitutes a challenge [START_REF] Armbrust | Above the clouds: A Berkeley view of cloud computing[END_REF][START_REF] Harauz | Data Security in the World of Cloud Computing[END_REF]. Ensuring confidentiality when outsourcing databases is both necessary to protect sensitive information and to adhere to privacy laws in many cases. One approach to tackle this problem is to establish a trust relationship with the external provider using Service Level Agreements (SLAs) [START_REF] Jaatun | Security SLAs -an idea whose time has come?[END_REF] or by relying on laws for being able to hold the external provider accountable [START_REF] Pearson | Toward accountability in the cloud[END_REF]. However, in many cases either no trust relationship can be established or (regional) laws forbid relying on trust alone. In these cases, technical means have to be used to preserve confidentiality [START_REF] Jünemann | Data outsourcing simplified: Generating data connectors from confidentiality and access policies[END_REF].

A naive solution that technically preserves data confidentiality is to completely encrypt the whole database prior to outsourcing. However, queries on entirely encrypted data cannot be efficiently executed. It is thus better to selectively apply encryption techniques and partitioning the database on multiple, non-colluding external providers, as this way a tradeoff between data confidentiality and efficient query execution can be achieved [START_REF] Ceselli | Modeling and assessing inference exposure in encrypted databases[END_REF][START_REF] Damiani | Balancing confidentiality and efficiency in untrusted relational DBMSs[END_REF][START_REF] Hacıgümüş | Executing SQL over Encrypted Data in the Database-Service-Provider Model[END_REF][START_REF] Hacıgümüş | Efficient execution of aggregation queries over encrypted relational databases[END_REF][START_REF] Mykletun | Aggregation queries in the database-as-a-service model[END_REF]. However, it requires expert knowledge to choose a suitable set of existing techniques for a given scenario that protect confidential information while maximizing query efficiency. Furthermore, the choice highly depends on which parts of the data are considered sensitive and how the data will be queried.

User Securus Storage Providers

Database architect

Client

Defines

Mediator Policy Profile

Query Query

Transformed to

Result Result Fig. 1. Overview of the general Securus concept [START_REF] Jünemann | Data outsourcing simplified: Generating data connectors from confidentiality and access policies[END_REF] In this paper, we describe the Securus (Secure and Efficient Cloud Utilization Relying Upon Schemes) framework [START_REF] Jünemann | Data outsourcing simplified: Generating data connectors from confidentiality and access policies[END_REF] that enables users to define which information of the outsourced data requires protection and which queries are executed on the data in a policy profile (see Figure 1). Furthermore, a set of available storage providers (SPs) to which the data will be outsourced can be specified.

Attacker model: The worst case Securus protects against is that each SP constitutes an honest-but-curious attacker or is compromised by one. We assume that the attackers a) do not collude and b) do not have background knowledge on data inserts/deletions/updates or incoming queries that can be used to infer information on data records. For instance, knowing that SELECT...WHERE name='john' is the most frequently executed query can be used to reveal encrypted names of the result records of the most frequently executed queries.

Based on the policy profile, Securus chooses a matching set of confidentiality enhancing techniques and generates a mediator software component that automatically applies them before outsourcing the data. Users can utilize mediators to transparently execute queries on the outsourced data, i.e., without taking the applied confidentiality enhancing techniques into account. Securus provides strong performance guarantees in terms of induced overhead during query executions, regardless of the outsourced dataset's composition.

The paper is structured as follows: We summarize related work and existing approaches Securus builds on in Section 2. In Section 3, we introduce the components of policy profiles and show how we adapted the building blocks of the policy profile (and thus the policy transformation process) to reflect the assumed attacker's knowledge more precisely compared to the already published [START_REF] Damiani | Balancing confidentiality and efficiency in untrusted relational DBMSs[END_REF][START_REF] Ceselli | Modeling and assessing inference exposure in encrypted databases[END_REF] Range Selection Bucket Hash Indices [START_REF] Hacıgümüş | Executing SQL over Encrypted Data in the Database-Service-Provider Model[END_REF] Aggregation Homomorphic Homomorphic Encryption [START_REF] Hacıgümüş | Efficient execution of aggregation queries over encrypted relational databases[END_REF][START_REF] Mykletun | Aggregation queries in the database-as-a-service model[END_REF] Encryption [START_REF] Hacıgümüş | Efficient execution of aggregation queries over encrypted relational databases[END_REF][START_REF] Mykletun | Aggregation queries in the database-as-a-service model[END_REF] Table 1. Catalog of security mechanisms for different queries and substitution categories. The symbol indicates that no security mechanisms need to be applied, indicates that no security mechanisms are known that have the required properties.

version of Securus [START_REF] Jünemann | Data outsourcing simplified: Generating data connectors from confidentiality and access policies[END_REF]. In Section 4 we show how to transform policy profiles into an outsourcing solution. As addition to our previous work [START_REF] Jünemann | Data outsourcing simplified: Generating data connectors from confidentiality and access policies[END_REF] we highlight the differences between Securus and other existing approaches and provide an extended evaluation of our approach in Section 5. Finally, the paper is concluded in Section 6.

Related Work

In the Database-as-a-Service community, several contributions that share the goal of confidential data outsourcing exist. These can be categorized into approaches that encrypt data in a way that allows for the execution of specific queries [START_REF] Ceselli | Modeling and assessing inference exposure in encrypted databases[END_REF][START_REF] Damiani | Balancing confidentiality and efficiency in untrusted relational DBMSs[END_REF][START_REF] Hacıgümüş | Executing SQL over Encrypted Data in the Database-Service-Provider Model[END_REF][START_REF] Hacıgümüş | Efficient execution of aggregation queries over encrypted relational databases[END_REF][START_REF] Mykletun | Aggregation queries in the database-as-a-service model[END_REF], approaches that only encrypt parts of the data [START_REF] Popa | Cryptdb: protecting confidentiality with encrypted query processing[END_REF] and approaches that protect sensitive information by fragmenting the data on several non colluding providers [START_REF] Ciriani | Combining fragmentation and encryption to protect privacy in data storage[END_REF][START_REF] Aggarwal | Two can keep a secret: A distributed architecture for secure database services[END_REF].

Various security mechanisms have been proposed that encrypt attribute values while still allowing the efficient execution of queries containing equality selections (e.g. ...WHERE name='Doe') [START_REF] Ceselli | Modeling and assessing inference exposure in encrypted databases[END_REF][START_REF] Damiani | Balancing confidentiality and efficiency in untrusted relational DBMSs[END_REF], range selections (e.g. ...WHERE age<30) [START_REF] Hacıgümüş | Executing SQL over Encrypted Data in the Database-Service-Provider Model[END_REF] and aggregations (e.g. SELECT SUM(salary)...) [START_REF] Hacıgümüş | Efficient execution of aggregation queries over encrypted relational databases[END_REF][START_REF] Mykletun | Aggregation queries in the database-as-a-service model[END_REF]. These security mechanisms can be categorized as shown in Table 1. We distinguish between mechanisms that map equal plaintext values on the same encrypted values (deterministic substitute) and mechanisms that map equal plaintext values on different encrypted values that cannot be distinguished (probabilistic substitute). While an attacker with background knowledge like the frequency distribution of an attribute can infer information from deterministic substitutes [START_REF] Ceselli | Modeling and assessing inference exposure in encrypted databases[END_REF][START_REF] Capitani Di Vimercati | On information leakage by indexes over data fragments[END_REF], no information can be inferred from probabilistic substitutes. However, in our model it is also impossible to evaluate equality or range selections on them. While cryptographic methods to search probabilistically encrypted data exist [START_REF] Song | Practical techniques for searches on encrypted data[END_REF][START_REF] Curtmola | Searchable symmetric encryption: improved definitions and efficient constructions[END_REF], the proposed methods require to "touch" every data record instead of using indexing structures or reveal information upon processing queries that can be used to distinguish records in a similar way deterministic ciphertexts do. Homomorphic encryption schemes enable the storage provider to aggregate encrypted values before returning the query result to the client.

Additionally to these security mechanisms, the approach to protect sensitive attribute combinations by fragmenting the critical attributes across multiple SPs has been proposed [START_REF] Aggarwal | Two can keep a secret: A distributed architecture for secure database services[END_REF]. For instance, while the attribute name and the attribute salary of a dataset may be viewed in plaintext by the attacker, the combination of them might be considered sensitive. Therefore, plaintext attribute values of name have to be stored by another SP than plaintext attribute values of salary.

CryptDB [START_REF] Popa | Cryptdb: protecting confidentiality with encrypted query processing[END_REF] is an approach that initially encrypts all attributes of the database that is outsourced to an external SP. Once a query needs to be executed, the key for the relevant attributes is passed to the SP. Thus, the SP incrementally unveils attributes and is able to execute queries efficiently. While providing performance guarantees regarding query execution, the protection of sensitive attributes cannot be guaranteed and depends on the query workload.

Securus makes use of both security mechanisms and attribute fragmentation to fulfill the user's requirements. Previous approaches [START_REF] Ciriani | Combining fragmentation and encryption to protect privacy in data storage[END_REF][START_REF] Foresti | Preserving Privacy in Data Outsourcing[END_REF] also propose to let the user specify which information contained in the data is sensitive and the query workload that will be executed on the data. They provide heuristics to find the best-effort attribute fragmentation that protects confidential relationships between attributes and produces as little overhead as possible for the given workload. Securus goes beyond true fragmentation and considers storing particular attributes at multiple SPs to allow for a more efficient query execution. Furthermore, Securus allows the user to specify hard performance requirements that must not be violated (cf. Section 5.1).

Policy Profiles

Before Securus can generate a mediator, the user has to specify his particular requirements in a policy profile. Besides the attributes that are contained in the dataset that is outsourced, the user defines the following three types of policies:

-Access Policies (APs) describe the queries that have to be efficiently executable. For instance, the AP [Name,Salary] expresses, that queries like SELECT * FROM db WHERE Name=''xy'' AND Salary=10000 have to be efficiently executable. Besides equality selections, Securus also supports range selections and aggregation. For the sake of simplicity and space constraints we do not introduce them in this paper. -A Confidentiality Constraint (CC) [START_REF] Aggarwal | Two can keep a secret: A distributed architecture for secure database services[END_REF][START_REF] Ciriani | Combining fragmentation and encryption to protect privacy in data storage[END_REF][START_REF] Foresti | Preserving Privacy in Data Outsourcing[END_REF][START_REF] Xiong | Adaptive, secure, and scalable distributed data outsourcing: a vision paper[END_REF] constitutes a set of attributes that are considered sensitive if they are combined. For instance, the CC [Name,Salary] expresses that no name should be mapable on a salary value and vice versa. However, revealing the names or the salaries to an SP is tolerable. A special case are CCs containing a single attribute: [Salary] expresses that the salaries are sensitive and must not be revealed to any SP. -Inference Constraints (ICs) specify a set of attributes. By including an attribute in the ICs it can be expressed that the assumed attacker is not able to infer any information from deterministically encrypted values of the attribute 1 . In particular, this assumption holds for attributes that are guaranteed to be unique [START_REF] Capitani Di Vimercati | On information leakage by indexes over data fragments[END_REF]. We are aware of the fact that ICs constitute very crude assumptions that users cannot confidently make in many scenarios. However, they provide an "interface" that enables us to explore a more fine-grained modeling of the attacker's capabilities in our future research.

For instance, ICs could be derived from a more fine-grained attacker model specified by users.

4 Policy Transformation

Solving the puzzle

Finding an appropriate distribution of the index tables on the SPs that minimizes the required application of security mechanisms and satisfies the defined APs, CCs and ICs is not a trivial task and can be shown to be NP-hard. Securus reduces the problem of finding a suitable solution on an Integer Linear Programming (ILP) problem. ILP is a well understood mathematical model to specify optimization problems. ILP problems consist of constraints that define feasible solutions and an optimization criterion that characterizes the optimal solution. While the exact formulation of the ILP problem is out of scope of this paper, we introduce the basic ideas. We utilize the constraints of the ILP to model the policies defined in the policy profile:

-Access Policies: To satisfy an AP, every attribute of the AP has to be stored in plaintext or as deterministic substitute by at least one SP to allow for an efficient execution of equality and range selections (cf. Table 1). The SP that stores all attributes of an AP may also store the AP's index table. -Confidentiality Constraints: A CC is satisfied if at each SP at least one contained attribute is not revealable. To guarantee that, for each SP it must hold that at least one of the attributes contained in the CC is not stored at all, stored as probabilistic substitute or stored deterministically encrypted and contained in the specified ICs.

In order to apply security mechanisms only when necessary, we define the optimization criterion of the ILP as follows:

min j∈SP s i∈Attributes (d i,j + p i,j ) (1)
where d i,j = 1, if SP j stores deterministic substitutes of attribute i 0, else p i,j = 1, if SP j stores probabilistic substitutes of attribute i 0, else

The versatile nature of the ILP optimization criterion allows us to consider fine-grained performance differences of security mechanisms and database systems of the SPs in future work.

Once the ILP problem is solved by existing ILP solvers the solution of the ILP problem can be used to derive an optimal distribution of the index tables across the SPs and to determine which security mechanisms need to be applied on the attributes of the index tables. For instance, from Table 1 it can be deduced that if SP1 may store attribute age as deterministic substitute, hash indices can be used in an index table that should enable efficient queries that contain an equality selection on age (cf. Figure 2).

Evaluation

Benefit of redundantly storing attributes

One feature that distinguishes Securus from previous approaches is that while encryption and fragmentation is used to protect data confidentiality, we do not enforce true fragmentation of the attributes on the SPs. In many scenarios, true fragmentation is an unnecessarily strict way of fulfilling confidentiality constraints. For instance, consider the example depicted in Figure 3 The example shown in Figure 3 also illustrates the advantages of storing attributes redundantly at multiple SPs. Consider the query SELECT ID FROM index table 1 WHERE gender=f AND age=50. This query would return zero records as no record matches the query. However, if the attributes were truly fragmented and age would not be part of index table 1 but of index table 2, the query would have to be reformulated to SELECT ID FROM index table 1 WHERE gender=f. Consequently, records 3-6 would be transmitted to the mediator and would then all be discarded when evaluating the second part of the query: SELECT * FROM results WHERE age=50. Thus, for this example, three records would have been transmitted unnecessarily due to true fragmentation.

Furthermore, the example illustrates why Securus can provide hard performance guarantees for specified APs. Securus enforces that for each specified AP, an index table that holds all attributes of the AP exists. Thus, instead of having to evaluate parts of the query in the mediator, queries can be entirely executed by the SPs. As shown in the example above, true fragmentation can not guarantee that all returned records are part of the query's result. In fact, the number of unnecessarily transmitted records depends on the datasets structure. As the example shows, it is possible that, to answer a query that would not return any results at all, half of the dataset needs to be transmitted to the mediator first. Thus, client-side validation whether a record is really contained in the result or not can lead to a massive and potentially unpredictable performance overhead.

Policy Transformation Performance

To evaluate the policy transformation performance, we randomly generated policy profiles of different sizes and measured the time needed to transform the policy profiles into mediators. For each policy profile size, we generated 5000 policy profiles. We ran the Gurobi solver2 on a commodity computer with 4GB RAM and a 2.93GhZ Dual Core CPU to conduct the measurements shown in Table 2. The results show that Securus scales well for reasonably sized scenarios. The maximum transformation time was less than 693 seconds even for datasets with 80 attributes, 80 APs and 100 CCs. This is feasible, as mediator generation only has to be performed once, initially.

Discussion

Securus allows the definition of APs that guarantee an efficient query execution of the according queries and CC that prevents SPs from viewing attribute combinations or even from inspecting single attribute values. Policy profiles that are inherently unsolvable exist. As a trivial example, consider a policy profile with a CC [a 1 ,a 2 ] and an AP [a 1 ,a 2 ]. The CC and the AP contradict each other: both attributes have to be present at an SP in plaintext or as deterministic substitutes to satisfy the AP, however, at least one attribute must not be stored as plaintext or as deterministic substitute to satisfy the CC. In future work, we will investigate how to support the user in resolving policy conflicts. In particular, the solution will tell the user why his policy profile is infeasible.

In terms of query constructs, Securus supports equality and range selections as well as aggregation. It can be easily extended to support further query con-structs such as LIKE or GROUP operators. Just like the range and equality selections, these would have to be bound to a required representation (e.g., plaintext or deterministic substitute) at the SP.

We assume that the CCs, APs and ICs are known by the user before generating the mediator and are not subject to changes. However, CCs might change in reality, for instance, due to shifting legal requirements concerning privacy. APs might change due to the arising demand to efficiently execute queries that have not been addressed by existing APs. To account for changing policies, a new mediator has to be generated and the dataset has to be re-outsourced.

The proposed concept considers each SP as an honest-but-curious attacker. Unlike other approaches [START_REF] Popa | Cryptdb: protecting confidentiality with encrypted query processing[END_REF][START_REF] Foresti | Preserving Privacy in Data Outsourcing[END_REF], we do not assume that the attacker is not capable of monitoring operations on the data or queries. We only assume that the attacker lacks applicable background knowledge on the executed operations and queries such as the frequency distribution of executed queries. In particular, using Securus an SP without background knowledge can not violate CCs by monitoring the effects of an insert operation on the data tables. In future work we plan to extend Securus to also address attackers with background knowledge on incoming queries.

Conclusion

We presented an outline of Securus, a framework that simplifies data outsourcing by allowing users to specify their requirements in terms of data confidentiality and queries that have to be efficiently executable. Based on this information a software adapter is generated that can be used to outsource the data compliantly to the specified requirements and that can execute the specified queries efficiently. We extended our previous publication of Securus [START_REF] Jünemann | Data outsourcing simplified: Generating data connectors from confidentiality and access policies[END_REF] by highlighting the differences to other data outsourcing frameworks in this paper. One major difference constitutes that Securus makes use of both fragmentation and encryption techniques, but also stores attributes redundantly at multiple SPs for a more efficient query execution if this does not undermine the required data confidentiality. Furthermore, it was shown that Securus can provide hard performance and confidentiality guarantees. We altered the policy model of the originally published version of Securus by specifying ICs that make assertions on the assumed attacker's knowledge. In future work, we can utilize the strict semantics of ICs to pursuit one of our future research directions: enabling users to model the attacker's capabilities in a fine-grained manner. Furthermore, we aim to explore methods to resolve conflicting requirements and to adapt the approach to consider fine-grained performance differences of both security mechanisms and database backends. Although Securus abstracts from confidentiality enhancing techniques, users are still required to specify which information needs protection. Enabling users to accurately define their company's individual confidentiality needs constitutes an interdisciplinary challenge that needs to be addressed not only in computer science but also in law and social sciences.

  The workflow of an example mediator that was automatically generated by Securus is shown in Figure2. To outsource a dataset (e.g. Employees), the attribute values of each record are encrypted probabilistically and put in the main table that can be stored by an arbitrary SP. As the probabilistic ciphertexts are indistinguishable for the SPs, no CC is violated. However, while it is possible to request specific records, no other queries can be executed based on the main table. Therefore, for each AP an index table that allows for efficient query execution is stored by at least one SP. Index tables contain attribute values in plaintext or protected by a security mechanism that does not prohibit the efficient execution of queries that comply to the AP (cf. Section 2). Thus, queries can be executed efficiently based on the according index table.However, index tables might violate CCs. For instance, consider two index tables that store the attributes {address} and {disease} in plaintext, respectively.If those two index tables are stored by the same SP, this would violate the CC [address,disease]. The violation of CCs might be prevented by distributing the index tables on multiple, non colluding SPs and/or selectively applying security mechanisms on the attributes of the index table. For instance, in Figure 2, the CC [name,salary] is not violated as neither SP1 nor SP2 store both name and salary in plaintext or as deterministic ciphertexts that an attacker with -for instance -knowledge about the frequency of attribute values might infer plaintext values from. The CC [name,age] can be satisfied even though both attributes have to appear together in one index table to satisfy the AP [name,age]. This is due to the defined IC {age} that specifies, that it is assumed that the attacker cannot infer information from deterministically encrypted attribute values. Therefore, it suffices to encrypt age in index table 1 deterministically to comply with CC [name,age].

	4.1 General Concept

  . While gender and ZIP must not be stored by the same SP to satisfy the CC [gender,ZIP], it is legitimate to store age at both SPs. True fragmentation would dictate that age may only be present at a single SP in plaintext.

	ID gender age	ID ZIP age
	1	m	30	1 76131 30
	2	m	50	2 51362 50
	3	m	40	3 76131 40
	4	f	20	4 51362 20
	5	f	40	5 76131 40
	6	f	40	6 51362 40
	Exemplary index table at SP1	Exemplary index table at SP2
	(AP: [gender, age])	(AP: [ZIP, age])

Fig. 3. Exemplary index tables at two SPs. APs: [ gender, age ], [ ZIP, age ], CC: [ gender, ZIP ]

Table 2 .

 2 Time required to generate a mediator from policy profiles of various sizes.

	Number of policies/elements Duration (s)
	Attr. APs ICs CCs SPs	mean	max
	10	5	1 10	3	0.004 0.056
	20 10 2 40	4	0.015 0.217
	20 15 2 10	4	0.016 0.330
	40 40 3 50	4	0.555 8.169
	40 40 3 60	4	0.658 6.714
	80 40 3 40	4	0.036 0.812
	80 60 3 80	4	0.887 16.602
	80 80 3 100	4	5.474 692.235

For instance, if an attacker would know the most frequently occurring attribute value, he could reveal the most frequently occurring deterministic ciphertext.

http://www.gurobi.com


Rob Heyman
email: rob.heyman@vub.ac.be

Jo Pierson

An Explorative Mapping of the Belgian Social Media Marketing Value Network and Its Usage of Personal Identifiable Information

Keywords: Social media, value network, privacy, targeted advertising

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Previous research has shown an increase in both disclosure of personal data [START_REF] Stutzman | Silent Listeners: The evolution of privacy and disclosure on Facebook[END_REF] and means to gather this data [START_REF] Wang | Third-party apps on Facebook: privacy and the illusion of control[END_REF] on social media such as Facebook. On the other hand data gathering and profiling have been conceptualized as black boxes for users in a legal way [START_REF] Gutwirth | Some Caveats on Profiling[END_REF] but also in users' understanding of targeted advertising [START_REF] Ur | Smart, useful, scary, creepy: perceptions of online behavioral advertising[END_REF] or their manipulation of privacy settings [START_REF] Heyman | Not all privacy settings are created equal -evaluating social media privacy settings for personal and advertising purposes[END_REF][START_REF] Liu | Analyzing Facebook Privacy Settings: User Expectations vs. Reality[END_REF] and authorization dialogs [START_REF] Wang | An online experiment of privacy authorization dialogues for social applications[END_REF].

The aim of this research is to map how a subset of Belgian social media marketing companies are organized as a value network and secondly how they use social media users' data for marketing campaigns. This is motivated by the current opaqueness of these processes illustrated in previous research. But it is also necessary to inform current policy and legislation, which aims to regulate these practices. Lastly, this knowledge should also be used to illuminate how commercial entities influence algorithms, which are our gatekeepers in online and social communication [START_REF] Beer | Power through the algorithm? Participatory web cultures and the technological unconscious[END_REF][START_REF] Pariser | The filter bubble : what the Internet is hiding from you[END_REF].

The answer to this research question was obtained through expert interviews with experts from sector organizations and social media marketing companies. The consulted experts affirmed the fact that it is possible to use a myriad of personal information although the actual use was limited to age, gender, location and language. The main reasons are the unreliability of the data, legal insecurity and fear of repelling potential customers with privacy invasive questions.

The structure of this research paper is as follows. It first elaborates on the needed key concepts, which are social media, Personal Identifiable Information and value networks. After that the Belgian marketing sector is contextualized. The research outline of our expert interviews is described next. This is followed by the results, the conclusion and limitations of this research.

Concepts

The scope of companies that we research is limited to companies that market on behalf of advertisers in Belgium. Social media must therefore be an integrated part of their marketing products. For this we need to define the two ways social media can be used for marketing purposes. The most obvious way to use social media is to create an advertisement and use the provided targeting options, which are based on profile information submitted by the user. The targetable criteria for Facebook as example are country, town or city, age, gender, interests and connections (with other users or pages on Facebook) [START_REF] Korolova | Privacy violations using microtargeted ads: A case study[END_REF]. LinkedIn uses similar data, also derived from profile information and activities on the service [START_REF] Heyman | Social media use and corporate dataveillance: exploring and assessing digital Personal Identifiable Information (PII) collection tools[END_REF].

Fig. 1. Facebook's advertising interface

The second mode to use social media for marketing purposes is by obtaining data from users by connecting to their API [START_REF] Wang | Third-party apps on Facebook: privacy and the illusion of control[END_REF]. Facebook, LinkedIn and Twitter offer this possibility through applications and websites. The owner of a website or application can ask basic credentials for the registration or more elaborate information through extra permissions. The protocol used to authenticate these applications and websites is called OAuth1 .

Social Media

We define social media as 'a group of Internet-based applications that build on the ideological and technological foundations of Web 2.0, and that allow the creation and exchange of User Generated Content.' [START_REF] Kaplan | Users of the world, unite! The challenges and opportunities of Social Media[END_REF] Social network sites (SNS) [START_REF] Boyd | Social network sites: Definition, history, and scholarship[END_REF] or online social network services (OSN) are a special instance of social media that focus on the creation of a network and a user profile. Social media is broader and therefore incorporates the micro blogging service, Twitter, which does not require these networks.

Personal Identifiable Information

Personal information is here defined as Personal Identifiable Information (PII), which originated in the K-anonymity approach [START_REF] Ciriani | k-anonymity[END_REF][START_REF] Sweeney | k-anonymity: A model for protecting privacy[END_REF]. Sweeney [START_REF] Sweeney | k-anonymity: A model for protecting privacy[END_REF] introduced Kanonymity to prove that anonymized databases are not anonymous if they contain unique records that may be linked to other databases with names and overlapping information. An IP-address is unique although this is not considered nonymous it may identify people when combined with other data. Sweeney proved this by combining an anonymized medical database with the voter registration of Massachusetts. We need this concept to show that the dichotomy of anonymous and its counterpart, identifiable information will not be made when looking at data in our research. This is motivated by the fact that anonymous information may still uniquely identify a user. In this case K, representing the smallest number of records sharing the same characteristics, is one. If K = 1, each user is uniquely identifiable. If K > 1, the data are aggregated in such a way that users are no longer uniquely identifiable.

Value Networks

Value network analysis [START_REF] Ballon | Business modelling revisited: the configuration of control and value[END_REF][START_REF] Bouwman | Designing Business Models: a practical and holistic approach[END_REF][START_REF] Allee | Value-creating networks: organizational issues and challenges[END_REF] is an approach to evaluate business models within an environment of other businesses. It is used in a normative way to evaluate, which configuration of companies and underlying relations begets a perfect fit. A perfect fit is a situation where the configuration of roles, actors and relations is fair and viable on the long term. This research uses the value network perspective in a descriptive way to map the use of data within the social media marketing sector.

"A role is a distinct value-adding activity within the value network, which potentially can exist as a commercial entity in the marketplace, with its own cost and revenue balance" [START_REF] Ballon | Business modelling revisited: the configuration of control and value[END_REF]. Actors are the commercial entities that function within a market by integrating one or more roles. Relationships are the interactions between roles or actors and are usually shown as arrows in diagrams which depict a monetary transac-tion, service or a tradable good [START_REF] Ballon | Business modelling revisited: the configuration of control and value[END_REF]. In this paper, these arrows will represent the flow of PII.

Situating the Belgian Value Network of Social Media Marketing

To situate the Belgian value network within the other advertising venues, the Belgian Union of Advertisers2 annual report [START_REF]UBA: Jaarverslag 2011[END_REF] was consulted. IAB 3 Europe's Adex Benchmark 2011 [START_REF] Knapp | Adex Benchmark 2011, European online advertising expenditure[END_REF] presents a backdrop to compare the Belgian situation within Europe. UBA reported on online display advertising, which incorporates social media spending. Online spending normally also includes classifieds and search. Online spending was 183 million € for 2011, which is 5,1 % of the total measured advertising expenditure for Belgium in 2011. The global Belgian advertising expenditure rose with 2,9 % while online increased with 8,9 % when compared with the previous year. According to IAB classifieds and search were responsible for two thirds of total online advertising expenditure, which implied that online would represent 17,1 % of the total media spend in Belgium. Belgian online ad expenditure is on the lower end with the UK and the Netherlands leading with respectively 35,9 % and 27,9 % and Austria as the lowest with 13,0 % within Western Europe.

Research Outline

The results were obtained through expert interviews [START_REF] Pfadenhauer | At eye level: The expert interview -a talk between expert and quasiexpert[END_REF], which were conducted in two waves. The first wave consisted of interviews with directors of sector organizations that represented firms which are part of the social media marketing value chain. These organizations are BDMA, IAB, UBA and ACC 4 . All interviews were performed in the summer of 2012 5 . The second wave consisted of interviews with actors within the value network.

We have found two distinct definitions of experts in two disciplines: international business studies [START_REF] Bandara | Major issues in business process management: an expert perspective[END_REF][START_REF] Welch | Corporate elites as informants in qualitative international business research[END_REF] refer to 'elites' while Pfadenhauer [START_REF] Pfadenhauer | At eye level: The expert interview -a talk between expert and quasiexpert[END_REF] situates 'experts' in the qualitative interview methodology. Both terms were kept as they point out different aspects important to our sampling strategy.

'Elites' are defined as: "an informant {…} who occupies a senior or middle management position; has functional responsibility in an area which enjoys high status in accordance with corporate values; has considerable industry experience and frequently also long tenure with the company; possesses a broad network of personal relationships; and has considerable international exposure." [START_REF] Welch | Corporate elites as informants in qualitative international business research[END_REF] As they use their knowledge, they reshape their environment: "By becoming practically relevant, the experts' knowledge structures the practical conditions of other actors in their professional field in a substantial way." [START_REF] Bandara | Major issues in business process management: an expert perspective[END_REF] Although elite and expert were used, they both referred to a professional who does not only have expert knowledge but is also participating within his field of expert knowledge. We will refer to this kind of expert as participating expert.

Pfadenhauer on the other hand conceptualizes the 'expert' as a meta-specialist, who "knows what the (respective) specialists know in their fields of knowledge -and how what they know relates to each other" [START_REF] Pfadenhauer | At eye level: The expert interview -a talk between expert and quasiexpert[END_REF]. The expert is here defined as an observer or even an outsider who does not partake as an actor within the value network. These experts will be referred to as observing experts.

We have identified the following sector organizations as observing experts who were contacted to situate the value network but also to refer us to participating experts: BDMA, IAB, UBA and ACC. We have omitted sector organizations that did not have a direct link with online advertising 6 .

The selected organizations share more or less the same goals: they wish to defend their profession from overregulation and they achieve this by lobbying and selfregulation on a national and international level. They wish to promote their profession through education, networking and research [START_REF]UBA: Jaarverslag 2011[END_REF][START_REF]ACC: Mission statement[END_REF][START_REF] Decocker | Bdma in het kort[END_REF][26]]. 4 Belgian Direct Mail Association (BDMA) for more information visit http://www.bdma.be/ and the Association of Communication Companies. 5 The exact dates can be found in the annex of this paper. 6 Belgian Union of Daily Publishers (BVDU), the Federation of Belgian Magazines, Union of Publishers of Periodical Print (UPP), Association of Billboard Owners (AEA), Belgian Union of Audiovisual Media (BVAM). BVDU www.fleetproject.be, the Federation of Belgian Magazines www.theppress.be, UPP www.upp.be, AEA (has no online presence), BVAM www.abma-bvam.be.

These sector organizations were chosen because of their general expert knowledge about the sector, but also because they were able to introduce us to the other experts we were interested in. These are the CEOs or employees responsible for social media marketing. The introduction or referral from known authorities increases the likelihood of a positive reply [START_REF] Welch | Corporate elites as informants in qualitative international business research[END_REF]. Below is a representation of the actual course of interviews. The second wave experts were also asked to refer to experts, which sometimes created a longer chain of interviews.

- The interviews were semi-structured. Questions were prepared according to the expert the researcher was facing. All guides were grounded on the same research questions to guarantee uniformity. The questions mapped the value network, how they used PII in general and on social media, how they used social media and lastly how they incorporated privacy in their products. A topic guide can be found in the annex of this paper.

The interviews took at least one hour or to one hour and a half depending on the expert's need to ask for more clarification or elaborate further on the main research questions. All interviewees agreed to be recorded. The interviews were summarized and grouped per distinct role and research question.

Results

Before discussing the results figure 3 should be explained because it represents the results in a value network diagram. Light grey boxes were used to identify actors. These actors have white boxes, which contain the roles they perform. Dark grey boxes were used to refer to companies that were important to the interviewed actors either as a starting point or endpoint of the service. We will discuss the most important roles within this value network. These roles are strategy, concept, coaching, build & launch, operate and evaluation. Afterwards we elaborate on the consulted experts' practices with regard to PII, which are targeting, evaluation and CRM 7 .

The arrows between actors and roles symbolize the flow of PII. The arrows drawn on figure 3 are dotted if the transaction of PII is aggregated (K > 1). The full lines refer tot transactions involving PII that can uniquely identify a user (K = 1).

Fig. 3. Belgian Social Media Marketing Value Network

Four out of the six consulted actors plan the strategy of a company that wishes to advertise. They assess the advertiser's position and then evaluate whether a social media marketing approach is adequate. Wijs and LBi provide other online channels as well. In the concept phase and role, the strategy is further operationalized in concrete measurable steps, which are evaluated during the evaluation role.

The following roles contain the actual building and execution of the proposed concept: coach, build, launch and operation. This is when websites are built, advertisements are made and other social media actions such as creating and maintaining social media presence are executed.

Social media is not only used for its advertising purposes, it is also used to talk with consumers or to provide the content related to their brand. When advertising is used, it is always targeted as we will explain in section 5.1. The consulted experts were reluctant to try more than the basic advertising format shown on the right hand pane. Sponsored stories, updates that contain advertorial content, which are shown in the News Feed were used sparingly. Participating experts were unsure about these advertising products due to their obtrusiveness but also because they were shown too often 8 .

Roles Requiring PII

When a medium is chosen or when an advertisement for a social media platform is made, an audience is targeted. The criteria for this audience are defined during the strategy and concept phase of the campaign. Broad categories that fit the advertiser's goal were preferred and they contained the following criteria: gender, age, location and education. The experts refrained from using categories such as likes or interests because these were less reliable. For example many different product pages of the same product exist and users may also like objects like a Ferrari without ever having the intention to buy one. Another reason to refrain from using more specific targeting criteria is Belgium's small market. Too much segmentation would exclude too many users.

A campaign's performance is evaluated through a funnel. A funnel is a technical and strategic way to evaluate performance. Measuring points are implemented on each step of the marketing process. Each number of users per step is compared to the number of the previous step in order to see how many users exited the funnel before they completed the marketing goal. Darwin offers this role as its only value proposition; to measure and report on the various social ads or social media platforms. This feedback information is required to increase the budget of high-performing actions and remedy the low-performing actions. The data required for evaluation purposes is aggregated (K > 1) and there is no need to uniquely identify a person.

This aggregated data of the evaluation process is very important because it is used to evaluate the efficiency of the marketing campaign. This is not only used to convince advertisers, the same data is reused in the operation phase to target the most efficient audience. The data are also important for attribution. Each publisher needs to report how many visitors saw the ad (this is called reach) and how many people interacted with the advertisement (this is called performance). Without these metrics it is impossible to bill advertisers because payments are based on reach or performance per number of users.

Lastly, WDM Belgium, LBi and Wijs gathered uniquely identifiable PII such as name and address for CRM purposes. This is the only instance where PII is gathered and kept identifiable. Otherwise the data is stripped from directly identifiable categories in order to render it anonymous (according to the consulted experts). In the case of CRM all interviewed experts were reluctant to ask for too much information because this could repel users from taking the next step in the marketing funnel. As little uniquely identifiable data as possible is gathered for three other reasons as well: to remain within legal boundaries. Because it is hard to foresee what information would be useful in future occasions 9 and lastly advertisers lack the necessary infrastructure to store data.

PII is either gathered on Facebook through a dialog box, which authenticates third parties' access to social media APIs. WDM Belgium, LBi and Wijs preferred to ask data through forms on an external website. This happens for two reasons, Facebook does not allow application owners to store this data permanently. Secondly, these companies prefer to display their privacy statement on their own websites where a clear opt-in is guaranteed. Data most often required for CRM oriented campaigns, are preferences directly related to the advertiser's product categories and contact information 10 .

It was already mentioned that most advertisers were lacking the proper means or knowhow to store PII for CRM purposes 11 . This is the main reason why companies such as WDM Belgium exist. Next to the previously stated roles, this company also implements data management systems for CRM. It also provides data cleaning and segmentation services. This is the only company we interviewed that sold data mining services. Social media was being tested to deduce extra information but it was deemed unreliable compared to other CRM data because users are less prone to use their real identity. This in turn illustrates why Facebook and Google implement a real name policy.

Conclusion

This research leads us to conclude that what is technologically possible in social media marketing is not necessary implemented by this subset of Belgian actors. Targeted advertising was limited to very broad target audiences and data gathering was also limited. The motivation to limit the use of these privacy intrusive tools was economic. None of the interviewed companies could afford to lose users (or clients) due 9 Jo Caudron, interviewed by Rob Heyman 2012, July 11. 10 to legal problems or being too intrusive towards users. Privacy was thus seen as a means to obtain something else and not a value an sich. PII had to be uniquely identifying in two cases. First PII are used to count individual actions of users, but these are saved aggregated because they only need to be reported in total number of users for billing, evaluation and efficiency purposes. Secondly, PII is kept as K = 1 if and only if an advertiser specifically requests to keep this data for further CRM campaigns.

Limitations

The examples in this research and during the interviews were biased towards Facebook. This is due to its popularity but also the fact that Twitter for example cannot be contacted for advertising purposes in Belgium.

The researcher's focus was biased towards advertising instead of marketing before the advent of the interviews. The experts have pointed out that social media can also be used to create content and attract users without paying social media.

Lastly, more Belgian actors need to be interviewed within two categories that were under represented in this sampling; app developers and cross-media agencies.

Fig. 2 .

 2 Fig. 2. Belgian Advertising Spending overview 2011. Source Adex Benchmark 2011 and UBA Jaarverslag

  Rob van Alphen, interviewed by Rob Heyman 2012, July 4. 11 Erik Tamboryn, interviewed by Rob Heyman 2012, July 6. Greet Dekocker, interviewed by Rob Heyman 2012, July 10. Philippe Arnauts, interviewed by Rob Heyman 2012, September 5.

For further reading visit http://oauth.net/about/.

Unie der Belgische Adverteerders (UBA), for more information visit http://www.ubabelgium.be/.

Interactive Advertising Bureau (IAB) for more information visit http://www.iab-belgium.be/.

Customer Relationship Management (CRM) is the model companies use to build and maintain a relation with their current and future customers.

Rob van Alphen, interviewed by Rob Heyman 2012, July 4.