Civilization is the progress toward a society of privacy.
(Ayn Rand, American writer)

In this thesis, we analyzed the privacy trade-off between data holders and service users that occurs in various web-based service constructs. An increase in privacy protection for the data holders often implies a decrease in data utility to the service users in terms of extent and precision of the provided data. Our main contributions are as follows.

• A classification of privacy conflicts based on the number of involved parties and the nature of the data provision

• A software-based model for a two-party service architecture where the data holder's privacy is protected at the expense of a restriction in the offered services

• A mediator-based model for a three-party service architecture with a particular focus on the inference of tight bounds for confidential numerical data

• An analysis of different frameworks to quantify the privacy trade-off and an overview on the implications for electronic commerce and public policy.

We classified privacy issues based on two dimensions. The number of involved parties (two vs. three) indicates how many parties have potential insight into the confidential data. In the two-party case, the data holder is the service user at the same time and does not necessarily trust the service provider. A prominent example is the use of financial portfolio services on the web. In the three-party case, the data holder is not necessarily the service user at the same time. A well-known example for this are Census Records where the service result is made available to the public. A second dimension is the nature of the data provision. Personal financial data have to be explicitly specified, whereas personal interests and hobbies can be tracked automatically by web sites who analyze clicking behavior with the help of tools such as cookies.

For the two-party case, we introduced the example of an ASP who offers wage accounting services to its customers. We presented a service architecture that allows the service user to use a limited number of services without submitting plain data to the (potentially untrusted) service provider. A sample implementation suggested that the service performance does not suffer significantly due to the new service infrastructure. The trade-off in this case consists of the fact that the service user receives a high level of privacy protection at the expense of a reduced service offering.

Future research in the two-party case should include a more explicit determination of the extent of services that can be carried out in a privacy-preserving framework. This is particularly true for the database services part. A theoretical proof showing which part of the SQL algebra can be performed on encrypted data is still missing. One approach to investigate is whether the complete set of logical operations is sufficient to build the SQL algebra [Maurer, 2004]. Moreover, the practicality of the proposed service architecture should be analyzed in more complex settings and systems.

For the three-party case, we introduced the running example of a regional healthcare initiative that collects, analyzes and disseminates information about chronic disease treatment. We showed that a data snooper who uses mathematical programming techniques can derive tight bounds on confidential numerical values that were not included in the disseminated information. We proposed an iterative "audit & aggregate" methodology to detect and limit the privacy compromise called interval inference. A sample implementation showed that the data quality of the information that was finally disseminated with our methodology is higher than with comparable privacy protection methods such as random data perturbation. This accounts particularly for settings with a limited number of data holders like in the running healthcare example. We also gave experimental evidence of the fact that interval inference is more likely to occur in circumstances where "audit and aggregate" delivers better results and still has controllable complexity.

Future research in the three-party case embarks in four major directions. First, the complexity of the audit inhibits the use of "audit and aggregate" in large-size database systems. Some approaches exist with regard to linear programming problems, but further research would be beneficial for nonlinear programming problems that are induced e.g. by standard deviations in the disseminated marginal information. Second, disseminated information is not necessarily restricted to measures of centrality and dispersion, but can also extend to other measures such as partial or total order that might help patients to rank for instance the performance of HMOs. The integration of such information is theoretically possible, but experimental evidence about characteristics and sensitivities can only be obtained via a specific implementation. We also assume that our approach is suited for higher-dimensional data than in the analyzed two-dimensional setting, but a specific implementation would yield evidence about practical particularities. The third research direction is the design of a service provider or, more specifically, a mediator that does not necessarily have to be trusted. Cryptography yields some promising approaches [Goldreich, 1998] that need further research regarding their applicability in mediator-based information systems. The fourth research direction is the integration of "audit and aggregate" into practical systems that are concerned with all kinds of privacy compromises. In healthcare for example, such a system would include the anonymization of individual patient records and the removal of sensitive attributes in queries of unauthorized users. It should be investigated how "audit and aggregate" can be integrated into complex systems where interval inference plays an important role.

The missing awareness of privacy issues and the lack of technical opportunities to balance privacy still inhibit electronic commerce. Many major web sites such as online book stores still do not offer even the most obvious options (e.g. to simply turn personalization services off). We think that the integration of trade-off techniques, independent from their sophistication, can help promote the continuous development of electronic commerce. With regard to public policy, a conflict often exists between each citizen's privacy and higher societal aims such as national security. Legislation has to trade off these competing interests and has to ensure that neither the citizens' privacy is compromised nor the activities of the authorities are hampered completely.

To summarize, this thesis shows that it is technically possible to trade off data privacy and data utility in web-based services. For many services, the quality of the service result increases with an extension of the provided personal input data. We show for the specific service of health data dissemination that for a given a level of privacy protection by the data holders, we can automatically generate a service result, i.e. the health report, with a high data utility. Going beyond the technical methods proposed in this thesis, we think it is worth analyzing the correlation between the technical trade-off opportunities and the actual behavior of the data holders. The question is whether the techniques suggested in this thesis can contribute to the reduction of extreme usage behavior that [Ackerman,et al., 1999] call "privacy fundamentalism" and "marginal concern".