Trustmarks and Privacy
You are viewing an archival website from the original trustmark pilot in 2013-2016. If you are looking for more recent content about the trustmark framework, please visit the Trustmark Initiative website.
During the NSTIC program, one of the goals of the NSTIC NPO was to ensure that each NSTIC pilot project upheld and advanced the NSTIC guiding principles. Of particular importance to the NPO was the principle of Privacy Enhancement and Voluntary Participation. To address concerns related to end-user privacy, GTRI formed a dedicated Privacy Team, comprising individuals with deep privacy experience, to address questions related to trustmarks and privacy.
How Trustmarks Can Advance End-User Privacy
The fundamental purpose of trustmarks is to provide trusted, 3rd-party attestation that a Trustmark Recipient (TR) upholds a specific set of characteristics that are important to a Trustmark Relying Party (TRP). This makes the trustmark concept a very powerful tool for advancing end-user privacy. Here’s an example that shows how.
Suppose that a group of privacy advocates get together and decide to develop a new trustmark containing a set of requirements related to privacy, e.g., prohibition of activity tracking, limits on data retention, restrictions on dissemination of user data, etc. These advocates are acting in the role of a Trustmark Defining Organization (TDO). Suppose also that a Service Provider (SP) wants to attain the privacy trustmark and present it to end-users as proof that it respects its users’ privacy. In this context, the SP is a TR, and the end-users are the TRPs. The trustmark attests not only that the SP upholds the privacy requirements defined by the trustmark, but also that a trusted 3rd party – a Trustmark Provider (TP) – has performed an audit of the SP‘s privacy policies and, where possible, validated its privacy behaviors, in accordance with the trustmark’s assessment and issuance criteria.
In today’s online environment, users must trust the SP (“take my word for it”) with regards to privacy, but in a trustmark framework with privacy trustmarks, users have the added benefit of 3rd party verification of the SP’s policies and behaviors via a TP. Also, whereas users today must trust the SP not to make arbitrary changes to its privacy policy after users have reviewed it, a trustmark framework allows for a privacy trustmark that prohibits the SP from making arbitrary changes to its privacy policy, under the threat of having its privacy trustmark revoked by the Trustmark Provider.
White Paper on Trustmarks and Privacy
Our Privacy Team developed a white paper on the topic of trustmarks and end-user privacy, available for download here.