Privacy Risk Models: Contextual Integrity, Calo's Harms Dimensions and FAIR

Privacy Risk Models: Contextual Integrity, Calo's Harms Dimensions and FAIR (CIPT Guide)

Overview
The IAPP CIPT (Certified Information Privacy Technologist) body of knowledge asks privacy technologists to identify, describe and assess privacy risk, not just apply security controls. To do that you need structured ways of thinking about what privacy risk is. The exam focuses on three models:
1. Contextual Integrity (Helen Nissenbaum), which explains when an information flow becomes a privacy violation.
2. Calo's Harms Dimensions (Ryan Calo), which explains what kind of harm results: subjective or objective.
3. FAIR (Factor Analysis of Information Risk), which explains how much risk exists, in quantifiable and often financial terms.
Together they let a technologist move from 'this feels creepy' to a defensible, measurable risk statement that engineers, lawyers and executives can act on.

Why Privacy Risk Models Are Important
- Privacy is more than security. A system can be perfectly secure and still violate privacy, for example through secondary use, profiling or surveillance. Risk models catch problems that confidentiality, integrity and availability (CIA) thinking misses.
- They support Privacy by Design. Using a model early in the development lifecycle lets teams find risk before code is written. That is far cheaper than fixing it later.
- They feed PIAs and DPIAs. Privacy impact assessments need a method for identifying harms and judging how serious they are. These models provide the vocabulary and the structure.
- They help prioritize. Organizations have limited budgets. Quantitative models like FAIR help decide which controls give the greatest risk reduction.
- They communicate risk. Each model fits a different audience. Contextual integrity suits ethics and design discussions. Calo's dimensions suit user-impact discussions. FAIR suits board-level and financial discussions.
- They separate the individual's view from the organization's view. A core CIPT theme is that privacy risk is primarily risk to individuals. Organizational risk (fines, reputation) is secondary but related. Knowing which model takes which perspective is heavily tested.

Model 1: Contextual Integrity (Helen Nissenbaum)
What it is: Nissenbaum introduced the framework in 'Privacy as Contextual Integrity' (2004) and expanded it in the book Privacy in Context (2010). It rejects the simple public/private split. Its central claim is that privacy means appropriate flows of information. Appropriateness is judged by the context-specific informational norms that govern a particular social setting.

How it works: Every information flow can be described with five parameters:
- Context: the social setting, such as healthcare, education, employment, family or commerce. Each has its own purposes, values and norms.
- Actors: the sender of the information, the recipient, and the information subject (the person the information is about).
- Information type (attributes): what the data is, such as a diagnosis, location, grades or purchase history.
- Transmission principles: the constraints under which the flow happens. Examples are confidentiality, with consent, reciprocity, required by law, sale or purchase, and need-to-know.
- Norms: the entrenched expectations that link all of the above. Earlier formulations split these into norms of appropriateness (what may be revealed in a context) and norms of distribution (how information may move onward).

A privacy violation happens when a flow breaches the entrenched norms of its context. Example: a patient tells a doctor about a condition. That is appropriate, because the transmission principle is confidentiality for treatment. If the doctor sells the same diagnosis to a marketing firm, the recipient and the transmission principle have changed. The flow violates contextual integrity, even though the data itself has not changed and the doctor already 'knew' it.

The decision heuristic (useful for scenario questions):
1. Describe the new practice in terms of information flows.
2. Identify the prevailing context.
3. Identify the actors: sender, recipient and subject.
4. Identify the information types or attributes.
5. Identify the transmission principles.
6. Locate the applicable entrenched norms and note where the new flow departs from them.
7. Reach a prima facie judgment. A departure from norms suggests a violation.
8. Evaluate further. Ask whether the new flow harms or supports the moral, political and context-specific values and goals. If it serves the context's purpose better, the norms themselves may legitimately evolve.

Key insights for technologists:
- 'Public' data can still be misused. Aggregating public posts into a profile, or moving data from a social context into an employment context, can violate norms.
- Consent is only one transmission principle among many. It is not the whole of privacy.
- The model is descriptive and normative but qualitative. It does not produce a number.
- It is especially useful for new technologies such as IoT, data brokers, AI training data and location tracking, where data moves into new contexts.

Model 2: Calo's Harms Dimensions (Ryan Calo)
What it is: In 'The Boundaries of Privacy Harm' (Indiana Law Journal, 2011), Ryan Calo argued that privacy harm falls into two distinct but related categories. Each has its own characteristics.

Subjective privacy harm:
- Defined as the perception of unwanted observation.
- It is internal and psychological. Examples are anxiety, embarrassment, fear, discomfort and a feeling of being watched.
- It includes chilling effects, where people change their behavior because they believe they are being observed.
- It can occur even if no one is actually watching. A dummy security camera or the mere belief in monitoring is enough.
- Examples include workplace keystroke monitoring, being followed by targeted ads that feel 'creepy', and a person unsure whether their smart speaker is recording.

Objective privacy harm:
- Defined as the unanticipated or coerced use of information concerning a person against that person.
- It is external and has actual adverse consequences. Examples are identity theft, financial fraud, discrimination, loss of a job or insurance, price discrimination, stalking or physical violence, and wrongful arrest based on bad data.
- It can occur even if the person never knows it happened, for example a hidden credit-scoring decision based on scraped data.
- 'Unanticipated' means the use falls outside what the person expected. 'Coerced' means the person had no meaningful choice to provide the data.

How the two relate: Calo describes them as two sides of the same coin. Subjective harm is often the anticipation or fear of objective harm. Objective harm is the realization of that fear. Either can exist without the other. Calo also distinguished privacy harm from privacy violation. Not every violation of a norm produces measurable harm, and treating the categories clearly helps avoid both over- and under-claiming harm.

How technologists use it:
- Subjective harm mitigations target perception and transparency. Examples are clear notices, recording indicators such as camera LEDs, just-in-time notices, user dashboards, and avoiding 'creepy' personalization.
- Objective harm mitigations target the data and its uses. Examples are data minimization, purpose limitation, access controls, encryption, de-identification, fairness testing for algorithms, and retention limits.
- It reminds designers that user perception itself is a harm to be managed. It is not merely a PR issue.

Model 3: FAIR (Factor Analysis of Information Risk)
What it is: FAIR was developed by Jack Jones and is maintained as an Open Group standard (the Open Risk Taxonomy O-RT and Open Risk Analysis O-RA). It is a quantitative model for information and operational risk. It defines risk as the probable frequency and probable magnitude of future loss.

How it works (the FAIR taxonomy):
- Risk = Loss Event Frequency (LEF) x Loss Magnitude (LM)
- Loss Event Frequency = Threat Event Frequency (TEF) x Vulnerability
  - Threat Event Frequency depends on Contact Frequency (how often a threat agent comes into contact with the asset) and Probability of Action (how likely the agent is to act once in contact).
  - Vulnerability is the probability that a threat event becomes a loss event. It depends on Threat Capability compared with Resistance Strength (control strength, also called difficulty).
- Loss Magnitude = Primary Loss + Secondary Loss
  - Primary loss falls directly on the organization from the event itself, such as response costs and lost productivity.
  - Secondary loss comes from reactions by secondary stakeholders, such as regulators, customers, media and courts. It has its own Secondary Loss Event Frequency and Secondary Loss Magnitude.
- Six forms of loss: productivity, response, replacement, fines and judgments, competitive advantage, and reputation.

Key features:
- It uses ranges and calibrated estimates (minimum, most likely, maximum) rather than single guesses. It often runs Monte Carlo simulations to produce loss distributions expressed in currency.
- It enables cost-benefit analysis of controls. For example: does a 200k encryption project reduce annualized loss exposure by more than 200k?
- It replaces vague 'high/medium/low' heat maps with defensible numbers.

FAIR and privacy:
- FAIR is built from the organization's perspective. Its losses are losses to the organization. This is its main limitation for privacy, because harm to individuals (Calo's subjective harms, contextual violations) is not natively captured.
- It can be adapted for privacy. Privacy events (breach, unauthorized secondary use, over-collection) can be treated as loss events. Individual harms can be modeled through their secondary-loss effects (regulatory fines, class actions, reputational damage). Separate privacy-harm estimates for individuals can also be added.
- It works best for breach-type or security-adjacent privacy risk. It is less natural for ethical or normative questions such as 'is this flow appropriate?'

Comparing the Three Models
- Core question: Contextual integrity asks 'Is this information flow appropriate?' Calo asks 'What harm does the individual experience?' FAIR asks 'How much loss, and how often?'
- Perspective: Contextual integrity takes the societal and normative view. Calo takes the individual's view. FAIR takes the organization's view, though it can be adapted.
- Output: Contextual integrity gives a qualitative judgment of a norm violation. Calo gives a qualitative classification of harm. FAIR gives a quantitative, usually financial, estimate.
- Best use: Contextual integrity suits design reviews of new data uses and secondary uses. Calo suits user-impact analysis and choosing transparency or use controls. FAIR suits prioritizing controls, budgeting and executive reporting.
- Complementary use: Use contextual integrity to spot the problematic flow, Calo to characterize the harm, and FAIR to size the risk and justify the fix.

Related Models You May See as Distractors or Companions
- Solove's Taxonomy of Privacy: 16 harmful activities in four groups: information collection, information processing, information dissemination, and invasion.
- NIST Privacy Risk Assessment Methodology (PRAM): focuses on problematic data actions and the problems they cause individuals. It scores likelihood x impact.
- NIST Privacy Framework and privacy engineering objectives: predictability, manageability, and disassociability.
- FIPPs / OECD principles: these are principles, not risk models.
Know these well enough to rule them out when the question names a specific concept such as 'transmission principles' or 'threat event frequency'.

Exam Tips: Answering Questions on Privacy Risk Models: Contextual Integrity, Calo's Harms Dimensions and FAIR
1. Map keywords to models instantly.
- 'Context', 'norms', 'information flow', 'transmission principles', 'sender/recipient/subject', 'appropriate flow', 'Nissenbaum' point to Contextual Integrity.
- 'Perception of observation', 'feeling watched', 'chilling effect', 'anxiety', 'used against the person', 'unanticipated or coerced use', 'Calo' point to Calo's subjective or objective harm.
- 'Loss event frequency', 'threat event frequency', 'vulnerability', 'loss magnitude', 'primary/secondary loss', 'quantitative', 'financial', 'Monte Carlo', 'Open Group' point to FAIR.

2. Memorize Calo's two definitions word for word.
- Subjective harm is the perception of unwanted observation.
- Objective harm is the unanticipated or coerced use of information against the person.
Typical trap: a scenario where cameras are fake but employees change their behavior. That is still subjective harm, because actual observation is not required. A person denied a loan due to secret data use, with no awareness of it, is objective harm, because awareness is not required.

3. Remember the FAIR formula structure.
Risk = LEF x LM. LEF = TEF x Vulnerability. Vulnerability compares Threat Capability with Resistance Strength. If a question asks which factor a stronger control affects, the answer is Vulnerability (through resistance strength), which lowers LEF. Regulatory fines and reputational damage are usually secondary loss.

4. Know each model's limitations. These are frequently tested as 'which is a weakness of...'
- FAIR is organization-centric. It does not directly capture harm to individuals, and it depends on the quality of estimates.
- Contextual integrity is qualitative. Norms can be hard to identify and vary across cultures, and it gives no numeric prioritization.
- Calo's model classifies harm but does not measure likelihood or organizational cost.

5. In contextual integrity scenarios, look for what changed. The data is often the same. What changed is the recipient, the context, or the transmission principle. The correct answer usually identifies that change as the source of the violation. Be wary of answers claiming that 'public data cannot raise privacy issues'. Contextual integrity explicitly rejects that view.

6. Pick the model that fits the stated goal.
- If the goal is to justify a budget, compare control costs, or report to the board in dollars, choose FAIR.
- If the goal is to decide whether a new secondary use is appropriate, choose contextual integrity.
- If the goal is to understand the impact on users or why users feel uncomfortable, choose Calo.

7. Match mitigations to harm types. Transparency and notice mainly address subjective harm. Use restrictions, minimization, security and fairness controls mainly address objective harm. Questions may ask which control best reduces a given harm.

8. Watch for 'best' or 'most' wording. Several answers may be partially true. Choose the one that uses the model's own terminology precisely. For example, prefer 'violates the norms of the context' over 'violates the privacy policy' for a contextual integrity question.

9. Eliminate cross-model distractors. An option such as 'contextual integrity calculates annualized loss exposure' or 'FAIR evaluates the appropriateness of information flows' is mixing models. Discard it.

Practice Scenarios
- Scenario A: A fitness app shares users' workout locations with their insurer to adjust premiums.
  - Contextual integrity: the recipient and transmission principle changed, from personal tracking to commercial underwriting. This violates the norms of the fitness context.
  - Calo: premium increases are objective harm. Users' worry about being tracked is subjective harm.
  - FAIR: the organization models the likelihood of regulatory action and churn as secondary loss.
- Scenario B: A CISO must show the board how much a DLP tool reduces exposure from customer data leakage. The best model is FAIR.
- Scenario C: Students stop searching sensitive health topics after the school announces web monitoring. This is subjective harm (chilling effect) under Calo.

Quick Recap
- Contextual integrity is about appropriate flows according to context-specific norms. It uses five parameters: context, actors, information type, transmission principles and norms. It is qualitative.
- Calo divides harm into subjective harm (perception of unwanted observation) and objective harm (unanticipated or coerced use against the person). The two are related but independent.
- FAIR is quantitative: Risk = LEF x LM. LEF = TEF x Vulnerability. Loss = primary + secondary, across six forms of loss. It is organization-centric but adaptable to privacy.
- Use them together: spot the flow, characterize the harm, then quantify and prioritize.