Marc Van Lieshout

Marc Van Lieshout
email: marc.vanlieshout@tno.nl

The Value of Personal Data 1

Keywords: Behavioural economics, Data protection by design, Economic value of privacy, Personal Data Markets, Privacy

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Personal data are an important asset in today's data-driven society. A report by the Boston Consulting Group in 2012 stated that the value created through digital identities would amount to approximately 8% of GDP for the EU-27 countries [START_REF]BCG: The value of our digital identity[END_REF]. With regard to personal data, a privacy paradox seems to exist: individuals state that they consider privacy to be important, but they hardly are willing to undertake action to protect their personal data. The sharing of personal information on social networking sites, and the provision of personal data in exchange for apps and other web-based services seem to support this view. However, several arguments can be presented to explain this apparent contradiction. For instance, users do not have a choice but to accept that they hand over their personal data in exchange for the service to be delivered. Or, the distinction which users make between what they consider privacy relevant and what not, is different from the formal distinction between 'ordinary' personal data and sensitive data. Another explanation is that although users seem to reveal quite some personal data when using social media , accepting a new app or buying something on the internet, they use informal strategies to protect their privacy (for instance by supplying incorrect personal information) [START_REF] Acquisti | Nudging privacy: The behavioural economics of personal information[END_REF][START_REF] Rabin | Incorporating limited rationality into economics[END_REF]. Literature in the field of behavioral economics shows that there is a very limited willingness to pay for the protection of privacy [START_REF] Acquisti | Nudging privacy: The behavioural economics of personal information[END_REF][START_REF]ENISA: Study on monetizing privacy. An economic model for pricing online information[END_REF]. People are willing to accept privacy intrusions when it serves their interests. One should therefore wonder whether privacy plays a role at all when personal data can offer financial benefits to individuals. Still, the fundamental right to privacy is not an issue that can simply be put aside. 2 One needs a more thorough analysis, both of how these personal data markets are organized and of how individuals appreciate the economic or monetary value of their data. In this chapter I will start with an introduction to the rise of personal data markets (section 2). The largest part of this chapter will be dedicated to the presentation and the discussion of the various ways in which the monetary value of personal data can be measured.

2

The market for personal data

Over the years, a number of studies have investigated the rise of personal data markets [START_REF]BCG: The value of our digital identity[END_REF][START_REF] Deighton | The Value of Data: Consequences for insight, innovation and efficiency in the US economy[END_REF][START_REF]Personal Data: the emergence of a new asset class[END_REF][START_REF]Unlocking the value of personal data: from collection to usage[END_REF]. The studies differ in their focus; two of them look at the overall impact of changes in the use of personal data [START_REF]Personal Data: the emergence of a new asset class[END_REF][START_REF]Unlocking the value of personal data: from collection to usage[END_REF], one study is dedicated to the size and the features of the European markets on personal data [START_REF]BCG: The value of our digital identity[END_REF] and a fourth study investigates the economic value of Individual-Level Consumer Data (ILCD) [START_REF] Deighton | The Value of Data: Consequences for insight, innovation and efficiency in the US economy[END_REF]. The WEF 2010 study highlighted the relevance of personal data as an economic asset that could be perceived as the new 'oil' [START_REF]Personal Data: the emergence of a new asset class[END_REF]. The metaphor of personal data as oil is an interesting one. It covers both the use of personal data as a product in itself and as being a substance that is basic to a large number of economic activities. The WEF study was one of the first in capturing the phenomenon of 'big data' developments, and identified a number of interesting features of these developments. It introduced an -arguably contestabledistinction between types of personal data that enables a kind of classification of the data processing and collecting processes (based on either voluntary, observed or inferred data, see below). Due to the contested nature of the first category (data being provided 'voluntarily') the WEF changed its phrasing in followon reports in the more apt phrasing 'personally provided'. 3The Boston Consulting Group presented a study in which it estimated the economic value of personal data markets in Europe, introducing a new inventory of relevant economic sectors [START_REF]BCG: The value of our digital identity[END_REF]. The study arrives at an expected value of personal data markets of 8% of European GDP in 2020. It bases its forecast on a composite average of growth of some prominent economic sectors at present. The three most relevant ones are online communication and entertainment (Compound Average Growth Rate 22%), e-Commerce (CAGR 15%) and web-communities (100%). Given the present market size, a presumed CAGR of 22% over the next years would yield a market of €330 Billion in 2020 with consumer benefits of€670 Billion because of reduced prices, time savings (because of self-service transactions) and the valuation of free online services.

The US-based study on Data Driven Market Economies, published by the Data Driven Marketing Institute, on the role of Individual-Level Consumer Data (ILCD) in providing marketing services, estimated the size of the ILCD market to be about $156 Billion, offering work to approximately 676,000 people in 2012. With a total US marketing and advertising market of $298 Billion the contribution of ILCD-based marketing added up to slightly more than 50%. The largest contribution to the economic value of DDME is related to the direct (50%) and indirect (21%) exchange of ILCDs between firms, with only some 29% related to the collection of use of ILCD within a single firm [START_REF] Deighton | The Value of Data: Consequences for insight, innovation and efficiency in the US economy[END_REF] (p. [START_REF]Unlocking the value of personal data: from collection to usage[END_REF][16]. The role of personal data in marketing activities is manifold, and ranges from personalized targeting, to measuring benefits of marketing activities and lowering the entry costs for small firms (for which mass-advertising is too costly). The study indicates the relevance of DDME for stimulating technology development and realizing start-up entrepreneurship.

The relevance of personal data has a public element as well. Personal data are a prime asset for public services. Having access to (reliable) personal data may improve the efficiency of public services. The relevance of collecting, aggregating, analyzing and using personal data thus extends beyond monetary terms. An example is provided by Kaiser Permanente, a US-based health insurance firm, which has collected a database with over 3 million patient records. It offers patients fast access to their medical files, allowing them for instance to schedule an appointment and to receive text messages for prescription refills, leading to cost savings for Kaiser Permanente of many hundreds of thousands of dollars [START_REF] Katibloo | Personal Identity Management: Preparing for a World of Consumer -Managed Data[END_REF]. Meanwhile, the same data can be used to investigate correlations between incidences of diseases and use of medicines. By using data analytics, Kaiser Permanente discovered a correlation between use of anti-depressants by pregnant women and the incidence of a form of autism by newborns [START_REF]Personal Data: the emergence of a new asset class[END_REF]. These results enable adapting medical practices in anti-depressant prescriptions for pregnant women.

Massive personal data collection can thus serve multiple purposes. The area identified in the US study relating to advertisement networks in online environments can be seen as a growing and interesting part of personal data markets. The market is expanding with the growth of personal data that people leave, knowingly or unknowingly, when using one of the several digital platforms they have at their disposal. An estimation presented in the BGC study mentions a growth figure of 45% per year through 2015 to a volume of 7 zetabytes, being the equivalent of more than 1,000 gigabytes of data for each person on earth [START_REF]BCG: The value of our digital identity[END_REF]. The advertisement market has already matured to some respect, being based on a large number of 'Freemium' services; the business model of these Freemium services is quite simple: personal data in exchange for a free service. The personal data are, as indicated, the 'raw material' for added value services such as personalized and targeted advertisement. . A market of personal data brokers has emerged. Large service providers such as Google, AOL and Yahoo have taken over personal data brokers to secure their own position in this advertisement market. Google now owns a number of brokers such as AdMob and Double Click. Apple has its own ad-broker with iAd. The role of these ad-brokers is growing. The ad-broker MobClix for instance, matches 25 advertisement networks with 15,000 different apps that are looking for advertisers [START_REF]Personal Data: the emergence of a new asset class[END_REF]. An organization as BlueKai offers a data exchange platform that captures more than 30,000 attributes over 300 Million users. It handles over 75 Million auctions a day (an auction being a tool with which advertisement space is offered to potential advertisers; ad networks are the intermediaries between advertisers and those offering advertisement space) [START_REF]Personal Data: the emergence of a new asset class[END_REF].

3

The value of personal data

The digitization of communication and information has given rise to an abundance of data-sharing practices. People share details about their whereabouts, their moods and their activities through a multitude of platforms. They leave traces that go unnoticed for themselves, such as their geo-location when carrying a mobile phone, or their click behaviour. The value of this information is well understood by marketers who try to collect as much data about personal conducts and preferences as possible, allowing them to learn about purchasing habits and strategies, and to make the best suited offers to their customers. As indicated above, it is not only the commercial value of personal data that is of interest. The public value of these data analytics can be substantial as well. An example is the provision of medical information by patients with rare diseases. 4 The network of patients with rare diseases started as a social interaction between these patients but resulted in an extremely interesting network with very interesting personal experiences in medical treatments and use of medicines for medical practitioners (and pharmaceutical agencies).

The monetary value of personal dataa firm perspective

To measure the monetary value of personal data, two main perspectives can be used. The first is by assessing the monetary value of the firm that collects, aggregates, processes, stores and/or disseminates the personal data. Various approaches are possible for this assessment [START_REF]OECD: Exploring the Economics of Personal Data -A survey of methodologies for measuring monetary value[END_REF]. The second perspective determines which monetary value persons attach to their data. This can be assessed in various manners as well and is covered in the next section.

To start with the monetary value of personal values from a firm's perspective, the OECD study mentioned before [START_REF]OECD: Exploring the Economics of Personal Data -A survey of methodologies for measuring monetary value[END_REF] distinguishes between three perspectives: one can look at the stock value of a firm, at the revenues of a firm or at the price of data records on the market. Alternatively, one can also look at the costs of a data breach and at the price of personal data on an illegal market. All of these approaches show some features of the value of personal data but all have specific drawbacks as well.

A general feature of data is that it can be sold over and over again without loss of its intrinsic value. The copy is just as good as the original, enabling multiple offers without loss of price or value. A single item of personal data thus will hardly have a commercial value. It is the composite of personal data that makes a commercial difference. Combining specific classes of personal data to profiles is another way to realise commercial value. Profiles can be created bottom up (using the available data to create meaningful subsets of data) or top down (using pre-configured profiles to check in what group specific people would belong). Both forms of profiles add to the monetary attractiveness of personal data, since the grouping of data add to the original value of the data.

The stock value of a firm is a measure of trust in the firm's capacity to produce valuable revenues. It expresses the expectation of shareholders in the growth potential of the firm. For firms trading in personal data as their primary source of revenues, the stock value can be used as a proxy for the value shareholders attach to the data collected and the processes that turn the data into profitable products. However, stock values will fluctuate because of contextual factors that do not bear a direct relationship with the primary process of the firm. Fluctuations of stock prices can induce further fluctuations, as was shown by the introduction of Facebook to the stock market. Only in relatively stable markets one might expect a relatively stable relation between the value of a firm's shares and the revenues it realizes on the basis of its business activities.

The revenues of a firm may serve as a better proxy since it indicates real cash flows on the market, due to the firm's ability to sell products to customers. It enables cross-comparisons between firms acting on a similar market, since one would expect these firms to encounter similar problems in selling their products. The revenues per record may be an indication of the ability of a firm to overcome the complexity of the market, yielding higher revenues against lower costs. Revenues should be compared to the total number of data records a firm owns in order to yield a comparative indicator (revenues per data record in a specific period of time). A drawback of this method is that external factors may influence the prices third parties are willing to pay for specific data on the market, and that there may be a dependency on the total number of records a firm possesses (synergistic effects due to the fact that a firm is able to offer a larger sample of personal data records) [START_REF]OECD: Exploring the Economics of Personal Data -A survey of methodologies for measuring monetary value[END_REF].

Costs can vary considerably between firms and between markets. This may influence the value of personal data as well.

An example that shows the variance between the indicators above is provided by Experian [START_REF]OECD: Exploring the Economics of Personal Data -A survey of methodologies for measuring monetary value[END_REF]. Experian is a data broker. Over 2011, Experian reported total revenues of USD 4.2 Billion realized over 600 Million individual records and 60 Million business data records. Its stock value fluctuated between USD 10 and 12 Billion. Market capitalization thus is about USD 19 per record, and annual revenues were about USD 6 per record. Profits were roughly USD 1 per record. By means of comparison, I compared the situation of Experian with the situation of Facebook (see table 1). The stock market prices of Facebook have seen huge fluctuations since its introduction (from an initial USD 38 to a low USD 20 low per stock two months later to a value of USD 55 in December 2013). 5 Market capitalization of Facebook developed from USD 90 Billion at the start of its presence at the stock market up to USD 140 Billion in December 2013. 6 Over the past four quarters (Q4-2012 up to Q3-2013), Facebook earned a total of USD 6.9 Billion (with USD 2.0 Billion in 2013 Q3) and had a profit of USD 1.04 Billion (with USD 0.43 Billion in 2013 Q3). 7 Over this year (Q4 2012 -Q3 2013), Facebook has a market capitalization of USD 116 per subscriber, revenues of USD 5.75 per subscriber and a profit of USD 0.87 per subscriber. Though not all revenues are due to selling ads, a large part is. The market capitalization of Facebook thus is considerably larger than the market capitalization of Experian while other indicators are in the same range (though positive revenues and profits for Facebook only started at Q4 2012). The prices of personal data as these are sold at the market place offer another indicator. This price reflects the value purchasers attach to these data, which in turn will depend on the profitability purchasers expect to realize. The Financial Times offers an interactive sheet that enables calculating market prices for specific sorts of data. 8 It distinguishes between demographic data, family and health data, property, sport and leisure activities and consumer data. Demographic data such as age, gender, ethnicity, zip-code and education level are worth USD 0.005 per piece. Job information is worth USD 0.1 if being an entrepreneur up to USD 0.72 if being a health professional, pilot or non-profit worker. Over the five data categories, a total of 24 data entries can be discerned, each worth a specific (usually very modest) price. For information on credit history, criminal records, bankruptcies, convictions etc. of persons one has to pay USD 30-40 per record. 9 Firms specialize in inquiries for this kind of background information. Apparently, one is willing to pay higher prices for specific records of particular persons. Information that is available on black market prices shows that data on credit card numbers, personal health records and the like may cost in the range of 1 -30 USD per record, depending on the sensitivity of the data but also on the occurrence of data breaches (which provide new data on the market but may also lead to a saturated market) [START_REF]Unlocking the value of personal data: from collection to usage[END_REF]. https://ioptconsulting.com/ft-on-how-much-is-your-personal-data-worth/, referring to http://backgroundreport360.com/ (visited March 6, 2015).

Data breaches themselves offer another inroad to measuring the value of personal data. A data breach as occurred to the Sony PlayStation Network between April 17 and April 19 2011 led to the theft of personal data of 77 Million subscribers. It led Sony to stop its services for 24 days. Together with the costs of recovering from the hack and the fines to be paid, the data breach cost Sony USD 171 Million, this being the directly attributable costs. Per subscriber this led to a cost figure of USD 2.20. The indirect costs (loss of subscribers, negative brand image which may lead to a decline of purchases of other equipment as well, impact on stock market prices) have been estimated at USD 1.25 Billion, being USD 16 per subscriber. 10 Stock market prices showed a dip of approximately 6% when Sony entered the stock market again, but it is hard to decide whether this is due to the data breach or to the overall fall of stock market prices that Sony experienced in the period February 2011 -November 2012 (steadily falling down from USD 37 to USD 9 over this period). 11Bringing the various perspectives together, we can conclude that calculating prices per data record helps in understanding the value of personal data. A calculation from general revenues or the stock value of a firm to a price per record offers some insight in the value that is represented by the personal records a firms owns. However, stock value is a measure that is very dependent on external influences that bear no relationship with the value of the personal data. Revenues and profit per data record seem to offer a better perspective on the value of these data records. From the illustration I presented it showed that, while Experian and Facebook are active on different markets, the value of the data records they own is more or less similar. Other methods to calculate the commercial value of personal data show that the direct commercial value of personal data is usually relatively low, except for sensitive data and very specific data. Data breaches represent a specific measure of the price of personal data as well. The Sony PlayStation data breach showed that the costs per subscriber of this breach surpassed the net profits that Facebook and Experian made in a year per subscriber. 12

3.2

The monetary value of personal datathe individual perspective I will now shift the perspective from the value firms attribute to personal data to the value individuals attribute to their personal data. This valuation could vary considerably between individuals. What one individual would consider to be highly private information (such as income or health data), another individual might not bother to share or sell. 13 The case of Shawn Buckles is an interesting illustration of this last position. 14 Shawn Buckles, set up an auction in 2014 to sell his personal data to the highest bidder. The firm that offered the highest price for his personal data would acquire a subscription of a year to data that were collected on Shawn Buckles. These data encompassed his personal profile, his location track records, his train track records, his personal calendar, his email conversations, his online conversations, his consumer preferences, his browsing history, and his thoughts. 15 The highest bidder for this data set was The Next Web. This firm offered €350,for the full data set. Shawn Buckles used the auction to raise awareness for the commercialization of personal data and the consequences for privacy. 16In dealing with how people value personal data I will present two perspectives. Firstly, people could attribute a specific monetary value to these data as exemplified by Shawn Buckles. This is the commercial value of personal data. It forms the counter part of the overview I presented in the preceding section. Secondly, one can investigate what people are willing to pay to keep personal data private. The reasons for keeping these data private could vary. Data could be seen as delicate or sensitive data which people want to keep for themselves. Besides that, people might not want to have data made public because they think the economic benefits do not outweigh the disadvantages (getting loads of advertisements for instance).

The role of personal data in today's society is undisputed. In a Eurobarometer Survey, stemming from 2011, 74% of respondents indicated that they accept that personal data need to be disclosed when participating in today's society [START_REF]TNS-NIPO: Attitudes on Data Protection and Electronic Identity in the European Union[END_REF]. The same number of people consider financial information, medical information and identity card numbers to be personal information. The survey showed that higher educated people and people living in West and North European countries are more sensitive to what they consider personal data [START_REF]TNS-NIPO: Attitudes on Data Protection and Electronic Identity in the European Union[END_REF].

In understanding what people value in privacy, the traditional economic models have been supplemented with models that look at behavioural features. These models study the impact of attitudes and preferences on choices people make. A number of mechanisms that influence behaviour have been identified [START_REF] Acquisti | What can behavioral economics teach us about privacy?[END_REF][START_REF] Hoogveld | De nieuwe privacyverordening en keuzemogelijkheden voor consumenten[END_REF][START_REF] Rabin | Incorporating limited rationality into economics[END_REF][START_REF] Thaler | Towards a positive theory of consumer choice[END_REF]. People perceive losses differently than gains, and are more willing to prevent a loss than achieving a similar gain (prospect theory) [START_REF] Acquisti | What can behavioral economics teach us about privacy?[END_REF]. People tend to value situations nearby differently from situations further away (hyperbolic discounting [START_REF] Rabin | Incorporating limited rationality into economics[END_REF]. People tend to value what they own higher than what they do not own (endowment effect) [START_REF] Thaler | Towards a positive theory of consumer choice[END_REF]. People are risk averse and People tend to overvalue immediate rewards and undervalue long term rewards (instant gratification) [START_REF] Hoogveld | De nieuwe privacyverordening en keuzemogelijkheden voor consumenten[END_REF]. People tend to mimic behaviour shown by predecessors: if many people already entered a specific site or social medium, it seem to be OK (informational cascading). [START_REF] Hoogveld | De nieuwe privacyverordening en keuzemogelijkheden voor consumenten[END_REF] The absence of real choices may impact upon how people will behave. When one can only chose between accepting specific conditions and getting access to a service or rejecting the conditions and thus having no access to that service, one may be tempted to accept unfavourable or unclear conditions. This practice is well-known in the internet-economy. Many services are offered as a 'take it or leave it' option. For many youngsters it is absolutely prerequisite to have a subscription to Facebook, if one wants to keep in close contact with one's friends, and thus one has to accept the conditions Facebook poses, whether one likes this or not.

Empirical research that tries to identify the relevant parameters of behaviour in order to understand how people assess the value of their personal data, is relatively scarce. An ENISA study mentions four papers dealing with an empirical field-or labrelated study of privacy behaviour [START_REF]ENISA: Study on monetizing privacy. An economic model for pricing online information[END_REF]. ENISA itself performed a case study in which it investigated whether people are willing to pay for additional data protection [START_REF]ENISA: Study on monetizing privacy. An economic model for pricing online information[END_REF]. When buying a ticket for the cinema, participants could choose between a number of varyingoffers. The minimum set of data asked was name, e-mail address and date of birth. Variations existed in the usage of the data (indicating that the e-mail address provided would be used for advertisement options) and a request for additional information (phone number). On top of this, in some experiments the price was kept the same for different options while in other options the price was different between the privacy-friendly and the privacy-unfriendly firm. The experiment was conducted as a lab experiment (with 443 participants), in which different options were offered in sequence, and as a hybrid field experiment (with more than 2,300 participants). The study showed that the privacy-unfriendly option was chosen by the majority of the participants when this ticket was 50 cent cheaper than the privacy-friendly offer. A minor part of 13% chose to pay the additional 50 cents. Without price difference, the majority of participants chose the privacy-friendly option. The experiment also showed that participants, when buying two tickets consecutively, remained to a large extent (142 of 152 participants) loyal to their first choice, even when they could swap from the more expensive to the cheaper ticket [START_REF]ENISA: Study on monetizing privacy. An economic model for pricing online information[END_REF]. 17In an experiment performed in 2011 Acquisti checked how people evaluated the willingness of people to pay for protection of their data vis-à-vis the willingness of people to accept the use of these data. The experiment was focused on revealing whether the gap between 'Willingness-to-Pay' and 'Willingness-to-Accept' as identified in several studies, exists as well when dealing with privacy and data protection issues. 18 The Willingness-to-Pay for the protection of personal data was relabeled as Willingness-to-Protect. This was juxtaposed against the Willingness-to-Accept: users were offered a financial reward in return for release of specific personal data. The experiment was performed with 349 (female) participants in a shopping mall. The participants first filled in a quiz and then answered some sensitive questions, such as the number of sex partners the participants had had. After filling in the questionnaire, participants could either protect information (at a specific cost) or sell it. The bonus they received was a gift card which price was 10 USD if no sensitive information was provided and 12 USD when they were willing to provide the sensitive information. Different scenarios were tested. In one scenario first the cheaper gift card was presented and participants were then asked to provide more sensitive information in exchange for the more expensive gift card (Willingness to Accept). Another scenario started with participants having revealed sensitive information in exchange for the gift card of 12 USD and were then enabled to change to the cheaper gift card in exchange for protection of their sensitive data (Willingness to Protect). Other, more complex scenarios were added. The gift cards were real, and the participants were not informed that this was an experiment directed at testing the difference between WtP and WtA. The experiments validated the different attitudes with respect to WtP and WtA. When first offered the 10 USD card, 52% of the participants kept the card and decided not to go for the more valuable card at the expense of revealing additional information. The other way around, only 10% of the participants decided to exchange the 12 USD gift card for the 10 USD gift card in order to protect their data. When the two cards were offered consecutively, 42% chose the 10 USD card when this was offered first, while 27% chose the 10 USD card when this was offered second.

A final study worth mentioning is a study performed by Spiekermann in which she investigated the willingness of participants to pay for their own data which they had left on Facebook before [START_REF] Spiekermann | Privacy property and personal information markets[END_REF]. Thehypotheticalsituation Spiekermann sketched is the announcement by Mark Zuckerberg that he pulls the plug out of Facebook. Facebook participants could either buy their information back or have it destroyed. In a second scenario a third party took over Facebook. Participants had the choice to leave their data at the platform or to buy their data back. A third scenario offered participants a share in the revenues of the third party that took over Facebook. The experiment was performed with over 1,500 Facebook participants. The results of the experiment showed that the Willingness to Pay/Protect was lowest in the first option (money one was willing to pay in order to have data saved): €16,-(median). In the second option Willingness to Pay/Protect was higher: €54,-(median) for preventing the data were sold to a third party. In the option of sharing in the revenues, people assessed the value of their data considerably higher: €507,-(median). The study supported the existence of the endowment effect: when people feel they own their data (shown by the possibility to share in the revenues) they consider the value of their personal data higher than in the other two scenarios. Spiekermann concludes that psychology of ownership is more relevant than privacy concerns in explaining attitudes of people vis-à-vis their personal data.

Conclusions

The market for personal data is growing explosively. Expectations are of double digit growths in the coming years. New services will be developed on the basis of the collection, aggregation and dissemination of personal data. The value of new businesses is hidden in the stock of personal data that can be collected. Personalised and targeted advertising enables offering services for free. Personal data are the new 'oil': they fuel new services and they can be used to deliver additional services, based for instance on profiles constructed of the aggregation of personal data. In estimating the value of personal data from a firm's perspective, I used a number of proxies (such as stock market valuation, revenues or profits per data record). This yields some comparative indicators. They highlight different aspects of the valuation of personal data.

Revenues and profits per data record are more reliable indicators than stock market value. Comparing the situation of Experian and Facebook, it showed that the revenues and profits per data record were almost similar. The impact of data breaches is high, as the Sony PlayStation data breach shows. Costs per subscriber were twice as high as the annual revenues per subscriber of Experian and Facebook. Empirical studies on how people value their personal data and what they are willing to pay to protect personal data to be used are scarce The few studies available indicate a sensitivity of individuals for ownership of data, and the relevance of concepts such as instant gratification (evaluating immediate returns higher than returns on the longer term), hyperbolic discounting (difficulty of evaluating costs at the longer term against benefits at the shorter terms), and endowment effects (the relevance of a sense of ownership). The privacy paradox (people indicate they care about privacy but do not act accordingly) is at least partly situated in these behavioural features. The direct valuation of personal data is shown to be modest in the case of Facebook. When some kind of ownership is introduced, people start to bother more about their data and want a fairer share of the revenues that can be realized with the data. The experiments done in this respect showed that people prefer a privacy friendly approach when it is for free but that they are hardly willing to pay for additional privacy protection. . These mechanisms may help to understand how people deal with their privacy and may help to develop systems that meet these expectations. One issue that springs to mind is the interpretation of privacy by default (or, to be more precise: data protection by default) as this is mentioned in the General Data Protection Regulation (article 23).

Behavioural economics shows that it is very relevant to have a high level of data protection as starting point (by default). People appreciate what they have. Any privacy feature already built in into a system will likely be appreciated as OK and 'nice to have'. When this feature is offered as a choice it is likely that people will only accept it when it comes for free and does not impose any mental or financial effort. Designing data protection by default such that it makes initial decisions for individuals in protecting their privacy is one approach towards 'nudging' individuals into privacy protection, as Acquisti proclaims [START_REF] Acquisti | Nudging privacy: The behavioural economics of personal information[END_REF].

Another issue is whether the fundamental right to privacy can be traded away by making good offers for personal data. The right to privacy is a fundamental right and will always have to be balanced against other fundamental rights. The very moment privacy becomes a tradable good, other fundamental rights, such as nondiscrimination, will be put under pressure. The emergence of personal data markets and the increasing importance of profiles encompass opportunities for various forms of discrimination, both on commercial markets (people who are excluded from specific services or people who are offered specific services at a higher price) and in the public domain (health insurers who will use profiles to discriminate in health services and insurance packages offered).

A prominent issue that needs to be tackled in this discussion is the proximity of the right to data protection and the right to privacy. Both rights are safeguarded in the European Charter of Fundamental Rights. This is an interesting observation since the European directive on data protection (which is expected to be replaced by the General Data Protection Regulation within the coming two to three years) is based upon economic and not fundamental principles, namely the free flow of such data (as expressed in the full title of the directive). By uplifting the principle of data protection to the level of a fundamental right the European Parliament seems to lend more moral support to safeguarding this principle against market forces. In that sense, a preliminary conclusion can befor the European situationthat sheer market forces are not sufficient to determine the price against which privacy and/or data protection can be traded away. This requires further study, especially with the advent of the era of big data and data analytics.

Table 1 .

 1 Comparison between Experian and Facebook[START_REF]OECD: Exploring the Economics of Personal Data -A survey of methodologies for measuring monetary value[END_REF][START_REF]Unlocking the value of personal data: from collection to usage[END_REF]

		Experian		Facebook
		660 M users		1,1 B users
		Total value	Per record	Total value	Per record
	Market Capitalisation	$10-12	$19	$90-140	$110
		billion	(2011)	billion	(Q4-2012; Q3-2013)
	Revenues	$4 billion	$6	$6.9 billion	$6.25
	Profit	$660 mil-	$1	$1.04	$0.92
		lion		billion

This chapter is largely a reproduction of Chapter

of the TNO-report: Roosendaal A. Lieshout, M van, Veenstra AF van (2014). Personal Data Markets. TNO report R11390.[START_REF] Roosendaal | Personal Data Markets[END_REF] The original chapter has been written by the author. It has been adapted for this publication.

See the change in phrasing between[START_REF]Personal Data: the emergence of a new asset class[END_REF] and[START_REF]Unlocking the value of personal data: from collection to usage[END_REF] on this subject.

See www.patientslikeme.org

http://en.wikipedia.org/wiki/Initial_public_offering_of_Facebook (accessed March 1717 , 2015)

http://en.wikipedia.org/wiki/Initial_public_offering_of_Facebook (accessedMarch 6, 2015)

http://techcrunch.com/2013/10/30/facebooks-q3-13-beats-with-2-02b-revenue-0-25-epswith-49-of-ad-revenue-now-mobile/ (accessedMarch 6, 2015)

http://www.ft.com/intl/cms/s/2/927ca86e-d29b-11e2-88ed-00144feab7de.html (accessedMarch 6, 2015). BTW: in order to access these pages one has to register oneself, thus adding to the value FT derives from its subscribers!

Juro Osawa, May 9 2011. 'As Sony counts hacking costs, analysts see billion-dollar repair bill.' Wall Street Journal. http://online.wsj.com/news/articles/SB10001424052748703859304576307664174667924 (accessed March 6, 2015).

http://quotes.wsj.com/SNE/interactive-chart (accessed March 6, 2015).

Having only a few illustrations in which the price of personal data was calculated, the findings are only illustrative. More research is needed to turn the findings in more robust conclusions. However, this is outside the scope of this

article.[START_REF]TNS-NIPO: Attitudes on Data Protection and Electronic Identity in the European Union[END_REF] The webforum 'Patients like me' offers an example that shows that patients are willing to share sensitive and personal data, hoping it will help in improving treatments for the rare diseases which they suffer. See http://www.patientslikeme.com/ (visited March 7, 2015).

See http://shawnbuckles.nl/dataforsale/ (visitedMarch 7, 2015)

http://shawnbuckles.nl/dataforsale/. While some of these data categories seem to be rather straightforward, some pose problems. Email conversations, for instance, do not only contain information on Shawn Buckles but could reveal information on those with whom he communicates as well. And what precisely Shawn Buckles considered to be his thoughts is not identified at his website.

 16 Shawn Buckles published a Privacy Pamphlet on his website. The Pamphlet intends to raise awareness for the way how personal data are used for marketing purposes, and how the market of personal data 'lures' people in the trap to sacrifice privacy for 'free' services.

This could identify those people who really care about their privacy. The study did not conclude on this matter since it could not be asked (being a purely observational study that was constructed such that no direct link to privacy was made in the design of the field study).

 18 This gap is identified in many studies. People tend to value what they own above what they do not own and are thus willing to pay a higher price for keeping what they have than for achieving the same when not having it. See[START_REF] Acquisti | Nudging privacy: The behavioural economics of personal information[END_REF][START_REF] Acquisti | What can behavioral economics teach us about privacy?[END_REF].


Christine M O'keefe
email: christine.okeefe@csiro.au

Privacy and Confidentiality in Service Science and Big Data Analytics

Keywords: Privacy, Statistical Disclosure Control, De-identification

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The future internet in the age of globalisation is turning the so-called information super-highway into an information super-mountain of data. The Internet of Things continues to grow and touch every aspect of our lives, and every interaction generates a digital record, leading to vast data archives accumulating in repositories everywhere. Put together, these data repositories reveal more and more details about ourselves, our behaviours, and our preferences. On the one hand, these detailed data hold a wealth of information vital to informed decision making, research, services personalisation, and debate within governments and the community. On the other hand, there is a risk that personal privacy will not be protected, where privacy is understood as the interest an individual has in controlling the dissemination of information about themselves.

In this paper, we focus on the use of data archives, irrespective of how they have been established, populated and maintained, and on methods for assuring confidentiality of the people or organisations represented in the data. Such methods are called statistical disclosure control methods, since they seek to reduce or control the risk of disclosure from statistical analysis. To provide a full solution, they must be implemented with an appropriate governance framework and with appropriate information security processes. The methods we will present and discuss were developed in the context of a national statistical agency making census and survey data available for research. Confidentiality remains a major concern for national statistical agencies [START_REF] Duncan | Statistical Confidentiality[END_REF][START_REF] Hundepool | Statistical Disclosure Control. Wiley Series in Survey Methodology[END_REF], as well as for a broader range of agencies and organisations which now find themselves holding significant data archives and receiving access requests from researchers.

Thus, this paper aims to contribute to the investigation of what technologies, frameworks, and tools we might need to gain, regain and maintain informational self-determination and lifelong privacy while still extracting useful information from our growing data archives. This would be in addition to the minimum standard required by applicable privacy, data protection, and related legislation.

Preliminaries

In this section we describe preliminary notions regarding confidentiality and privacy, where confidentiality is a status accorded to information about a person [11, Section 1.1], and: A disclosure occurs when a person or organisation recognises or learns something that they did not know already about another person or organisation, via released data [START_REF] Hundepool | Statistical Disclosure Control. Wiley Series in Survey Methodology[END_REF].

Types of data

Microdata refers to datasets in which each record is contributed by an individual in the population, so that the record typically comprises values of a number of variables for that individual. A variable can be either continuous or categorical, where a continuous variable value is numeric and a categorical variable value is a category label.

Tabular data result when microdata are summarised and presented as a table with axes corresponding to explanatory variables and cells corresponding to a response variable. Table cells can contain counts, where each data record contributes 1 to its tabulation cells and 0 to all other cells, in which case the data is called tabular count data and the table is called a contingency table. Table cells can also contain aggregates of one response variable, for example the total or average value of that variable for individuals contributing to that cell, in which case the data is called magnitude data.

Types of disclosure

There are two basic types of disclosure, namely identity and attribute disclosure [START_REF] Duncan | Disclosure risk vs data utility: The R-U confidentiality map[END_REF], resulting from a data release. An Identity Disclosure occurs if an individual is identifiable from the data release. An Attribute Disclosure occurs when the released data make it possible to infer the characteristics of an individual more accurately than would have otherwise been possible.

The main ways that an identity disclosure can occur are:

-Release of identifying information -Spontaneous recognition -where an individual is sufficiently unusual in a data collection, or the data user knows sufficiently many attributes of an individual, so that individual can be recognised from normally non-identifying attributes. This may occur if the attributes have extreme values such as extreme old age or an unusual combination of attributes. For example, it is generally accepted that households have distinctive patterns of inhabitants and other features that make them vulnerable to spontaneous recognition. -Matching to another data base -where combinations of so-called key variables in the data occur in other databases sufficiently rarely that data matching reveals identity.

Attribute disclosure is usually achieved through identity disclosure; an individual is first identified through some combination of variables and then disclosure of values of other variables included in the released data follows.

Balancing disclosure risk with data utility

The balance between protecting confidentiality and allowing the use of data for research has been represented as a trade off between disclosure risk and data utility [START_REF] Duncan | Disclosure risk vs data utility: The R-U confidentiality map[END_REF], where disclosure risk attempts to capture the probability of a disclosure of sensitive information, while data utility attempts to capture some measure of the usefulness of the released data. Confidentiality methods are technical approaches designed to reduce disclosure risk, and are applied in addition to governance and information security measures. Unfortunately, any confidentiality method will also reduce data utility.

The idea of balancing risk and utility advanced by Duncan et al. [START_REF] Duncan | Disclosure risk vs data utility: The R-U confidentiality map[END_REF] is that in a specific situation, the data custodian creates a Risk-Utility (or R-U) Map as a two-dimensional plot of disclosure risk versus data utility for various parameter instances of a range of confidentiality methods, and chooses the method and parameter instance with the maximum utility given a maximum tolerable risk.

Approaches for protecting confidentiality in data

In this section we provide a structured overview of a broad range of approaches for protecting confidentiality in data archives. Many of these appear in the literature, and are described in [START_REF] Duncan | Statistical Confidentiality[END_REF][START_REF] Hundepool | Statistical Disclosure Control. Wiley Series in Survey Methodology[END_REF]. The structure of our overview depends at a high level on the system design, the type of method, and the type of data [START_REF] O'keefe | Balancing the research use of health and medical data with confidentiality protection[END_REF].

Types of methods

In the remainder of this Section we provide a structured overview of approaches to reducing disclosure risk when making data available for research. Importantly, each approach only addresses the disclosure risk inherent in the data, and so each must be implemented within an appropriate legislative and policy environment and governance structure, and with user community management and IT security, including user authentication, access control, system audit and follow-up. The approaches have different strengths and weaknesses, and so none dominates the others in all data access scenarios. In fact, because there is a range of scenarios, it is desirable to have a range of disclosure risk reduction approaches, so the most appropriate one can be chosen to meet the requirements of a particular situation involving a particular dataset, data custodian, analyst and so on.

Traditionally, there have been two different general approaches with regard to enabling the use of data while protecting confidentiality [START_REF] Duncan | Enhancing access to microdata while protecting confidentiality: prospects for the future[END_REF]:

restricted or limited access, wherein the access to the information is restricted; and restricted or limited information, wherein the amount or format of the information released is restricted.

Often these two approaches are used in combination, such as when access to data is restricted to approved analysts and the data themselves have had identifying information removed and/or dates aggregated to months or years. The relationship between the degree of access restriction and the degree of information restriction required is perhaps best represented in the framework of Marsh et al [START_REF] Marsh | The case for samples of anonymized records from the 1991 census[END_REF], who noted that a successful disclosure involves first an attempt at disclosure, then success of that attempt. In probabilistic terms, this is Pr(disclosure) = Pr(attempt) • Pr(disclosure | attempt). Restricted access seeks to reduce Pr(attempt) while restricted data seeks to reduce Pr(success | attempt).

Restricted access methods

In this Section we discuss various data access strategies used to restrict access to information, noting that they are predominantly implemented as system designs.

We present these in generally increasing order of restriction, so that the degree of requirement for information restriction generally decreases correspondingly. At opposite ends of this spectrum are the familiar data access strategies of providing no information to non-authorised users, and full information to fully authorised users.

User agreements for offsite use Under this approach, sometimes called Licensing, users are required to register with a custodian agency, and sign a user agreement, before receiving data to be analysed offsite. Typically such agreements specify restrictions on the user, such as, restrictions on the manner of storage and further dissemination of the data, as well as prohibiting attempts to re-identify data records. Such agreements also typically specify sanctions for breaches, and are legally binding. The user community is managed by the custodian, including, possibly, the use of external audits to verify compliance with the restrictions in the agreement.

Examples of this approach include the many Public Use Files disseminated by organisations and agencies, including national statistical and health agencies, see [START_REF]About CURF Microdata[END_REF][START_REF]Public-use data files and documentation[END_REF]27].

Remote analysis systems

In remote analysis, the analyst submits statistical queries through an interface, analyses are carried out on the original data in a secure environment, and the user then receives the (confidentialised) results of the analyses [START_REF] Gomatam | Data dissemination and disclosure limitation in a world without microdata: A risk-utility framework for remote access systems[END_REF][START_REF] Sparks | Remote access methods for exploratory data analysis and statistical modelling: Privacy-Preserving Analytics TM[END_REF]. In particular, the analyst does not receive any data at all, but only analysis results. Since analysis results can reveal information about the underlying data, the output needs to be confidentialised.

The Australian Bureau of Statistics Remote Access Data Laboratory (RADL) is a secure online data query service that clients can access via the Australian Bureau of Statistics web site [START_REF]Remote Access Data Laboratory (RADL)[END_REF]. The Australian Bureau of Statistics has recently developed the TableBuilder and DataAnalyser remote analysis systems with automated confidentiality routines that allow uses to build their own custom tables or undertake regression analyses on secured ABS microdata [START_REF] Thompson | Methodology for automatic confidentialisation of statistical outputs from remote servers at the Australian Bureau of Statistics[END_REF]. The Microdata Analysis System under development by the U.S. Census Bureau will allow users to receive certain statistical analyses of Census Bureau data, including regression analyses, without ever having access to the data themselves [START_REF] Lucero | The Current Stage of the Microdata Analysis System at the U.S. Census Bureau[END_REF].

We remark that remote analysis systems need to be protected against attacks including massively repeated queries, subsetting to create very small datasets and never-ending loops. Recently-developed systems do not allow user-submitted code but rather implement a menu-driven interface to prevent these and other types of attack.

Virtual data centres Virtual data centres are similar to remote analysis systems, except that the user has full access to the data [START_REF] O'keefe | Protecting confidentiality in statistical analysis outputs from a virtual data centre[END_REF], and are similar to on-site data centres except that access is over a secure link on the internet from the researcher's institution.

An example of a virtual data centre is the US NORC Data Enclave, that provides a confidential, protected environment within which authorised social science researchers can access sensitive microdata remotely [49]. Another interesting example is the Australian Population Health Research Network Secure Unified Research Environment [START_REF]Secure Unified Research Environment (SURE)[END_REF], see [START_REF] Okeefe | Comparison of two remote access systems recently developed and implemented in australia[END_REF]. Similar systems include the United Kingdom Office For National Statistics (ONS) Virtual Microdata Laboratory [28], and the UK Secure Data Service, that provides secure remote access to data operated by the Economic and Social Data Service [START_REF]UK Data Archive: Secure data service (website)[END_REF].

Secure on-site data centres Many national statistical agencies allow researchers access to confidential data in secure, on-site research data centres. Usually the data have undergone a confidentialisation process such as de-identification and some light statistical disclosure control, but have more detail than datasets confidentialised for release to researchers. Analysts are generally not restricted in the analyses they can perform and the intermediate results they can generate and view. However, only results which have been checked to ensure low disclosure risk, or which have been confidentialised if necessary to reduce disclosure risk, can be removed from the laboratory. Currently this output checking is done manually, as in the guidelines in [START_REF] Hundepool | Statistical Disclosure Control. Wiley Series in Survey Methodology[END_REF].

Examples of on-site data centres include the U.S. Census Bureau Research Data Centers (RDC) [48] and the Australian Bureau of Statistics (ABS) On-site Data Laboratory [5].

Restricted information methods -microdata

Restricted information methods normally comprise the application of some statistical disclosure limitation techniques, see [START_REF] Duncan | Statistical Confidentiality[END_REF][START_REF] Hundepool | Statistical Disclosure Control. Wiley Series in Survey Methodology[END_REF]. Statistical disclosure control techniques can be perturbative or non-perturbative. Perturbative methods operate by modifying the data values, whereas non-perturbative methods do not modify the data values. Perhaps the most well-known perturbative method is the addition of random "noise" to a dataset, and perhaps the most well-known non-perturbative method is suppression of sensitive values.

In this section we describe the main techniques developed for microdata. The methods are presented in the order of generally increasing restriction on released information, so decreasing disclosure risk, from removal of identifying information to synthetic data. The amount of trust in the analyst therefore generally decreases across the methods, and so access restrictions may also be able to be relaxed across the methods.

Removal of identifying information

Probably the most common method of reducing disclosure risk in data sets is to remove identifying information such as name, address, date of birth, and unique identifiers such as social security number or healthcare identifier. This is often called de-identification.

As examples, the Population Health Research Network [33] will enable existing Australian health data to be brought together and made available for health and health related research purposes under protocols that use linkage keys to replace personal information in health records. Similarly, the University of British Columbia Centre for Health Services and Policy Research [START_REF]British Columbia Linked Health Database[END_REF] is the central access point for researchers wishing to obtain and use health data in de-identified format for research in the public interest.

Non-perturbative methods for microdata

Suppression of variables or variable values Entire sensitive variables, such as name of surgeon in clinical data, can be suppressed. It is also possible to suppress certain values of categorical individual variables, where such a value is sufficiently unusual that it leads to unacceptable risk of disclosure via matching.

Variable Recoding A widely-used method for reducing disclosure risk is variable recoding, or coarsening, that can be either part of the data collection design phase or applied to the resulting dataset. The method can be applied to either tabular data or microdata, and can be applied to any number of the variables.

Variable recoding usually involves reporting the values of the variable with less than full detail. For example, geographic information such as address can be recoded to suburb or postal code area, age can be recoded to 5-year or 10-year intervals, and age over a certain threshold can be recoded to simply being over that threshold.

Sampling Disclosure risk can depend on the existence of microdata records that are both unique in the sample and in the population on a set of potentially identifying cross-classified key variables, since such records can be matched to external datasets with high confidence [42].

Perturbative methods for microdata

Rounding Original variable values are replaced by rounded values rounded to multiples of a given number such as 3 or 5.

Data swapping Data swapping transforms a database by interchanging values of sensitive variables between records in a microdata file.

Additive or multiplicative noise addition Randomly-distributed noise values can be added to the data, or the data can be multiplied by randomlydistributed values. Additive noise can be uncorrelated or correlated, and can be augmented with a linear or non-linear transformation.

Micro-aggregation Micro-aggregation is applied by clustering records into small groups of similar records and replacing individual record values by the cluster average values.

Post-randomisation method (PRAM) The Post-Randomisation Method technique is applied to categorical data and involves a form of intended misclassification using a known and pre-set probabilistic mechanism. Under PRAM, for each record in a microdata file, the value of one or more categorical variables is changed with a certain probability.

Synthetic data Rubin [START_REF] Rubin | Discussion: Statistical disclosure limitation[END_REF] suggested the approach of generating and releasing (fully) synthetic data, see also [START_REF] Little | Statistical analysis of masked data[END_REF] and [START_REF] Reiter | Using CART to generate partially synthetic public use microdata[END_REF]. In the generalisation to partially synthetic data, the data custodian releases a dataset comprising the original records with some observed values replaced with multiple imputations drawn from distributions designed to preserve important relationships in the confidential data, or from models generated by amachine learning technique.

Examples of restricted information approaches on microdata

Internationally, IPUMS-International is a project dedicated to collecting and distributing census data from around the world [27]. IPUMS-International works with each country's statistical office to minimise the risk of disclosure of respondent information. The details of the confidentiality protections vary across countries, but in all cases, names and detailed geographic information are suppressed and top-codes are imposed on variables such as income that might identify specific persons. In addition, IPUMS-International uses a variety of technical procedures to enhance confidentiality protection, including:

-Swapping an undisclosed fraction of records from one administrative district to another to make positive identification of individuals impossible. -Randomizing the placement of households within districts to disguise the order in which individuals were enumerated or the data processed. -Aggregating codes of sensitive characteristics (e.g., grouping together very small ethnic categories) -Top-and bottom-coding continuous variables to prevent identification of extreme cases.

There are several examples of partially synthetic datasets already released for research. For example, the US Bureau of the Census has released a partially synthetic, public use file for the Survey of Income and Program Participation including imputed value of Social Security benefits information and dozens of other highly sensitive variables [START_REF] Abowd | Final report to the social security administration on the sipp/ssa/irs public use file project[END_REF]. More recently, a synthetic public use file for the U.S. Longitudinal Business Database, an annual economic census of U.S. establishments, has been approved for release by the U.S. Bureau of the Census and the Internal Revenue Service [START_REF] Kinney | Towards unrestricted public use business microdata: The synthetic longitudinal business database[END_REF].

Restricted information methods -tabular data

Although tabular data are aggregated, there still may be unacceptable disclosure risk. Perhaps the most common disclosure risk is associated with a cell of a table that relates to only one individual, where an identity disclosure may occur by data matching from the characteristics in the table.

Restricted information methods normally comprise the application of some statistical disclosure limitation techniques for tabular data, see [START_REF] Duncan | Statistical Confidentiality[END_REF][START_REF] Hundepool | Statistical Disclosure Control. Wiley Series in Survey Methodology[END_REF]. As in the case of microdata, tabular statistical disclosure control techniques can be perturbative or non-perturbative. There are two main classes of confidentiality methods for tabular data, namely, pre-tabular and post-tabular. Pre-tabular methods modify microdata before aggregation into a table, while post-tabular methods modify a table directly.

Pre-tabular methods Perhaps the most widely-used pre-tabular method is table redesign, including collapsing of categories along any axis. In fact, any of the methods presented in Section 3.3 could be used as a pre-tabular confidentiality method.

Post-tabular methods In post-tabular Statistical Disclosure Control for tabular data, the first task is to determine whether any of the cells are sensitive, where a sensitive cell is one for which the release of the data in the cell could lead to a disclosure. The most commonly-used cell sensitivity tests are:

-Threshold rule -a cell is sensitive if less than n individuals contribute to its value (frequency and magnitude tables) -(n, k) -rule -a cell is sensitive if less than n individuals contribute at least k% of its value (magnitude tables) [START_REF] Cox | Linear sensitivity measures in statistical disclosure control[END_REF] For a discussion of the shortcomings of these techniques, see [START_REF] Robertston | Cell suppression: Experience and theory[END_REF].

After the sensitive cells in a table have been identified, the second task is to take steps to address the disclosure risk. The most commonly-used techniques are:

-Deletion of variables -removing table axes corresponding to sensitive variables and/or variables that lead to sensitive cells. -Variable recoding -adjusting the level of aggregation of variables to reduce the number of sensitive cells. This method aggregates all cells involving the recoded variable, whether sensitive or not. -Cell collapsing -merging pairs of cells until no sensitive cell remains. This method only aggregates the sensitive cells, but can make analysis more difficult. -Cell suppression -suppression of the entry in each sensitive cell, then suppression of entries in non-sensitive cells sufficient to prevent reconstruction of any sensitive value. -Rounding -rounding all cells to a multiple of a chosen positive integer, for example, 3 or 5. -Addition of noise -altering sensitive cell values (and usually also non-sensitive cell values) by the addition of noise sampled from some distribution. Examples of this method include the Post-Randomization Method [START_REF] Gouweleeuw | Post randomisation for statistical disclosure control: Theory and implementation[END_REF] and the key-based method in [START_REF] Marley | A Method for Confidentialising User-Defined Tables: Statistical Properties and a Risk-Utility Analysis[END_REF].

The Australian Bureau of Statistics Census TableBuilder [START_REF][END_REF] is an online tool that allows users to create confidentialised, custom tables of Census data from variables including age, education, housing, income, transport, religion, ethnicity, occupation, family composition and more for all ABS geographic areas [START_REF] Thompson | Methodology for automatic confidentialisation of statistical outputs from remote servers at the Australian Bureau of Statistics[END_REF].

Analysis output confidentialisation methods

Currently virtual data centres rely on manual checking for confidentiality protection, such as those outlined in [START_REF] Hundepool | Statistical Disclosure Control. Wiley Series in Survey Methodology[END_REF]. This solution may not be feasible in the long term given the trend of rising user demands for data access. Although it is acknowledged that developing valid output checking processes that are automated is an open research question [START_REF] Duncan | Statistical Confidentiality[END_REF], there have been some recent advances in such methods for remote analysis systems, see [START_REF] Gomatam | Data dissemination and disclosure limitation in a world without microdata: A risk-utility framework for remote access systems[END_REF][START_REF] Lucero | The Current Stage of the Microdata Analysis System at the U.S. Census Bureau[END_REF][START_REF] Reiter | Model diagnostics for remote-access regression systems[END_REF][START_REF] Reiter | Categorical data regression diagnostics for remote systems[END_REF][START_REF] Sparks | A framework for performing statistical analyses of unit record health data without violating either privacy or confidentiality of individuals[END_REF][START_REF] Sparks | Remote access methods for exploratory data analysis and statistical modelling: Privacy-Preserving Analytics TM[END_REF][START_REF] Thompson | Methodology for automatic confidentialisation of statistical outputs from remote servers at the Australian Bureau of Statistics[END_REF].

Remote analysis systems now in development in the US Census Bureau and the Australian Bureau of Statistics do not rely on restricted output methods alone, but also make use of a combination of protective measures from the restricted access, restricted data, restricted analysis and restricted output groups of methods.

Confidentiality in Service Science and Big Data Analytics

In this paper, our aim is to contribute to the investigation of what technologies, frameworks, and tools we might need to gain, regain and maintain informational self-determination and lifelong privacy while still extracting useful information from our growing data archives. We do this by means of two examples of growing importance due to the rise of the future internet in the age of globalisation, namely, service science and big data.

Confidentiality in Service Science

The world is dominated by service-based economies. In developed countries, the sector accounts for over 70% of economic activity, and in a significant number of developing countries it accounts for over 50% [START_REF] Gećzy | Service science, quo vadis?[END_REF]. A service can be defined as: the application of competencies for the benefit of another [START_REF]The Service-Dominant Logic of Marketing: Dialog, Debate, and Directions[END_REF], see [START_REF] Spohrer | Steps toward a science of service systems[END_REF]. Further, "Service is performed in close contact with a client; the more knowledge-intensive and customized the service, the more the service process depends critically on client participation and input, whether by providing labor, property or information" [START_REF] Sampson | Foundations and implications of a proposed unified services theory[END_REF] see [START_REF] Spohrer | Steps toward a science of service systems[END_REF]. According to the Journal Service Science, "Leading and competitive services enabled by service systems are all remarkably delineated with information-driven, people-centric, e-oriented, and satisfaction/success focussed characteristics". Market and consumer trends in the service economy include: demand for personalisation, customisation of services, and improvement of the customer service experience.

It is clear that a successful service economy relies fundamentally on customers providing information to service providers. This information is needed in the service provision, for example, a delivery address is needed for goods delivery, and service requests often include choice of options. The service provider may need to share the information internally or externally, for example with a courier service.

It is highly likely that service providers also store client information, for future use in service improvement and innovation, including personalisation, customisation and customer experience improvement. Issues of privacy and commercial sensitivity arise, since client information can be complex, personal and sensitive. For example, the information may include direct data such as health status, employment status, or financial status, or may include indirect information revealing behaviours, movements, and preferences. In some cases, such as government services, the client may not have a choice whether to interact or not, so must accept that the information needs to be provided. In addition, given the trends of the future internet in the age of globalisation, service providers would be increasingly collecting as much transactional and auxiliary information as possible. The service provider may be motivated to address these issues, since assurances of confidentiality protection during service provision may increase the information the client is willing to give, so improving the service and the level of personalisation possible, and hence improving the overall service experience for the client. Interestingly, we have been unable to locate any articles in the academic press relating primarily to privacy or confidentiality technologies in service science (via a title search on a popular publications database). There has been some discussion of policy aspects, see for example [START_REF] Pitkänen | Legal research topics in user-centric services[END_REF], who note that "technology has the potential to regulate behaviour by enabling or disabling it, in contrast with law, which regulates mainly be imposing sanctions. ... Therefore, it is necessary to consider these approaches simultaneously ..."

It is therefore worthwhile to analyse the similarity between the confidentiality protection scenario in service science and that in the research use of data scenario as discussed in this paper. We consider the applicability of the approaches described in Section 3, in order to better understand the need for new methods of protecting confidentiality in service science. This is consistent with the approach advocated by service science experts, including: "Services science is an emerging field that seeks to tap into these and other relevant bodies of knowledge, integrate them, and advance three goals -aiming ultimately to understand service systems, how they improve and how they scale", "The study of service systems is an integrative, multidisciplinary undertaking and many disciplines have knowledge and methods to contribute" [START_REF] Spohrer | Steps toward a science of service systems[END_REF], and "Synthesis of partial knowledge from individual disciplines is vital for future of service science" [START_REF] Gećzy | Service science, quo vadis?[END_REF].

The table in Figure 1 gives a summary of the main similarities and differences between the scenarios of service science and research use of data archives.

We see from Figure 1 that the data providers and data custodians in the two scenarios are broadly similar. The differences in motivation for providing information are probably not sufficient to impact on the data providers' expectations of confidentiality of their data. For the implications of big data on confidentiality protection, see Section 4.2.

One of the main differences between the two scenarios is in the area of data sharing -specifically, whether the dataset is held by the collecting agency or is held in trust for a different collecting agency. In the research use of data, this issue arises in data linkage centres which bring together data from various sources, see the Manitoba Centre for Health Policy and Evaluation, Canada [START_REF] Roos | Record linkage strategies: Part 1: Estimating information and evaluating approaches[END_REF], the Oxford Medical Record Linkage System [START_REF] Gill | OX-LINK: The Oxford Medical Record Linkage System[END_REF], the Scottish Medical Record Linkage System [START_REF] Kendrick | The Scottish Medical Record Linkage System[END_REF], Western Australian Data Linkage Branch [START_REF] Holman | Population-based linkage of health records in Western Australia: development of a health services research linked database[END_REF] and the Welsh Secure Anonymised Information Linkage (SAIL) system [START_REF] Ford | The SAIL Databank: building a national architecture for e-health research and evaluation[END_REF]. In this situation the issue is best addressed in the governance layer, supported by technological implementations and information security measures.

Finally, two areas of broad similarity between the two scenarios are the range of authorised users and the cohort against which confidentiality protection is

Service Science Research Use Data providers

Clients Census and survey participants

Motivation for providing information

In exchange for a service, but may be compulsory

Voluntary or compulsory

Data custodians

Service provider agencies and companies National statistical agencies and other service provider agencies

Dataset size

Moderate trending to big data Moderate trending to big data Data sharing Shared amongst a community of service provider agencies and companies

Usually held by custodian agency, some initiatives in data linkage

Authorised data users

Staff in service provider agencies and companies; increasingly outsourced to contractors Staff in service provider agencies. Researchers, policy analysts, increasingly the general public Confidentiality protection needed against:

Unauthorised users -most privacy policies include use for service provision, improvement and personalisation Unauthorised users and some classes of authorised users Fig. 1. Main and differences between the scenarios of service science and research use of data archives needed, if we accept that there is broad analogy between contractors and researchers, policy analysts, and the general public.

Given the similarities between the two scenarios of service science and research use of data, we believe that the approaches for protecting confidentiality outlined in Section 3 are broadly applicable in service science. We note that within the broad service science context, there is still likely to be a range of more detailed scenarios involving a particular dataset, data custodian, analyst and so on. We reiterate that it is important to choose the appropriate confidentiality protection method to address the particular scenario in question.

Confidentiality in Big Data

As mentioned in the introduction, technological advances and the increasing connectivity of a growing number of computers, devices, and sensors are resulting in massive amounts of data being generated and stored. The term "Big Data" was coined in response to the realisation that traditional methods of storing, processing, and analysing data were breaking down in the face of the so-called "3 V's of big data", namely, volume (amount of data), variety (range of data sources and data types), and velocity (speed of collection and dissemination).

In the big data scenario, it is worthwhile to think about whether the 3 V's of big data pose additional privacy or commercial sensitivity risks. Again, we analyse the similarity between the confidentiality protection scenario in big data and that in the research use of data scenario as discussed in this paper. We further consider the applicability of the approaches described in 3, in order to understand the need for new methods of protecting confidentiality in big data.

Big data involves massively increasing volumes of data, often leading to a situation in which values for more and more characteristics of an individual are being stored. This in turn increases disclosure risk, since the more information we have about an individual, the more likely it is to be able to identify an individual in the data and learn something that we did not know already about that individual. Massively increasing volume of data also places stress on storage and computational infrastructure. These challenges are being addressed through new infrastructure and computational approaches. A important additional privacy or commercial sensitivity risks would therefore arise in the context of information security -the question is whether the new infrastructure and computational approaches for big data are still adequately protecting data from unauthorised access and use.

Massively increasing variety of data has the potential to increase again the likelihood that an individual is identified, with subsequent increased disclosure risk.

Massively increasing velocity of data bring challenges in terms of ensuring that data processing is fast enough to keep up with the rate of data arriving. For example, if it is necessary to remove direct identifiers from data in order to reduce disclosure risk, then how fast does this need to be done in order to ensure that only de-identified data are stored or accessed? Again, these challenges seem to be best addressed through the integration of confidentiality protection routines with the new infrastructure and computational approaches under development to cope with big data velocity.

There have been a number of books and articles published in the academic press relating primarily to privacy or confidentiality technologies in big data. Many of these address the socio-legal or information security perspectives. We believe it is still worthwhile to analyse the similarity between the confidentiality protection scenario in big data and that in the research use of data scenario as discussed in this paper. We consider the applicability of the approaches described in Section 3, in order to better understand the need for new methods of protecting confidentiality in big data.

The table in Figure 2 gives a summary of the main similarities and differences between the scenarios of big data and research use of data archives.

We see from Figure 2 that there are significant differences between the nature of data providers and the motivation for providing information between the two scenarios of big data and the research use of data. In the situation of big data, data providers may not even know they are providing data, or may have little or no choice in the data provision. Given these observations, there is a higher moral/ethical responsibility on data custodians to protect confidentiality in big data, which would be addressed in the design of information management systems, see [START_REF] Cavoukian | Privacy by design in the age of big data[END_REF].

There are also significant differences between the nature of data custodians in the two scenarios. While in research use, the relatively few data custodians are subject to enabling legislation containing specific confidentiality protection requirements, in big data almost any entity can be a data custodian subject to Unauthorised users and some classes of authorised users Unauthorised users and some classes of authorised users Fig. 2. Main similarities and differences between the scenarios of big data and research use of data archives more general privacy or data protection laws. Similarly, while data sharing is quite controlled in research use, in big data it could be trending to uncontrolled. The degree of community awareness of data collection would also impact community expectations of confidentiality protection from data custodians during collection, storage, sharing and use. There would appear to be an imperative to ensure that legislative frameworks are robust and widely applicable enough to cover the activities of all data custodians, not just the traditionally-recognised ones.

There is broad similarity between the two scenarios with respect to the range of authorised users and the cohort against which confidentiality protection is needed, though these populations may be vastly different sizes. The main difference is in the size of the datasets, though this may disappear in time as research data sets also become larger and larger. In the big data scenario, it will be generally infeasible to transfer datasets to users, implying that there will be a preference for remote analysis systems, virtual data centres and secure on-site data centres. These are likely to rely on a combination of microdata confidentialisation methods with techniques to confidentialise analysis outputs. The growing user numbers are likely to cause a greater reliance on automated methods.

We note that within the broad big data scenario, there is still likely to be a range of more detailed scenarios involving a particular dataset, data custodian, analyst and so on. We reiterate that it is important to choose the appropriate confidentiality protection method to address the particular scenario in question.

Conclusion

In this paper our aim was to contribute to a discussion of some of the issues regarding confidentiality in the service science and big data analytics contexts. We believe that these two areas are growing in importance as the future internet in the age of globalisation is transforming our economy into a service economy and is turning the so-called information super-highway into an information supermountain of data.

We provided an introduction to a consideration of what technologies, frameworks, and tools we might need to gain, regain and maintain informational selfdetermination and lifelong privacy while still extracting useful information from our growing data archives. In particular, we gave an overview of methods for protecting confidentiality in the use of data for research, as developed in the context of a national statistical agency making census and survey data available for research and policy analysis. We then discussed the general applicability of these methods to the new scenarios, in order to help pinpoint where existing methods might be applicable and where new methods might be in demand.

In the service science scenario, we found that the approaches for protecting confidentiality in the research use of data are broadly applicable, with adaptations as needed to particular situations. In the case of big data on the other hand, we found that only certain of the approaches were applicable, namely, remote analysis servers, virtual data centres, and secure on-site data centres with automated output confidentialisation routines. We remark that this is a trend underway for enabling the research use of data, and we echo the following: ... recent events in the development of remote analysis servers herald the dawn of a new era in automated confidentiality protection for analysis and we look forward to invigorated research collaborations among NST's and academic institutions to further this research ... [START_REF] Thompson | Methodology for automatic confidentialisation of statistical outputs from remote servers at the Australian Bureau of Statistics[END_REF].

Acknowledgments. I warmly thank the organisers of the International Federation for Information Processing (IFIP) 9th Summer School on Privacy and Identity Management for the Future Internet in the Age of Globalisation, for their invitation to participate. I acknowledge the financial support of the Authentication and Authorization for Entrusted Unions (AU2EU) project funded by the European Commission Seventh Framework Programme for Research and Technological Development.