Can you test with this preference set and see if it behaves correctly?
<pre>
SOGoCalendarEventsDefaultClassification Parameter used to defined the default classification for new events. Possible values are :

• PUBLIC
• CONFIDENTIAL
• PRIVATE

Defaults to PUBLIC when unset.
</pre>

You will have to set it for your existing users, either via the preference dialog, or via sogo-tool.

In our configuration we have:
SOGoCalendarEventsDefaultClassification = CONFIDENTIAL;
SOGoCalendarTasksDefaultClassification = CONFIDENTIAL;

So each user have in his preferences in SOGo Web interface under Calendar Options:
Default events classification: Confidential
Default tasks classification: Confidential

and when creating a new event in SOGo Web interface or in Thunderbird with SOGO-Connector/Integrator the button "Privacy" is set to Confidential (or in Thunderbird to "Show Time and Date only' due to a lightning bug: 649944)

But the problem is with other clients, connecting to SOGo through Caldav, which didn't set the CLASS of the event. For example:

BEGIN:VCALENDAR
PRODID:-//Apple Inc.//iCal 4.0.4//EN
VERSION:2.0
CALSCALE:GREGORIAN
BEGIN:VTIMEZONE
TZID:Europe/Paris
BEGIN:DAYLIGHT
TZOFFSETFROM:+0100
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
DTSTART:19810329T020000
TZNAME:GMT+02:00
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:+0200
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
DTSTART:19961027T030000
TZNAME:GMT+01:00
TZOFFSETTO:+0100
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
CREATED:20130516T124634Z
UID:1E1DB0A9-FFE6-4B9A-9ED3-66FF23E88527
DTEND;TZID=Europe/Paris:20130426T070000
TRANSP:OPAQUE
SUMMARY:test ical
DTSTART;TZID=Europe/Paris:20130425T150000
DTSTAMP:20130516T124746Z
LOCATION:ici et la
SEQUENCE:6
END:VEVENT
END:VCALENDAR
(extract from the url /SOGo/so/login/Calendar/calid/eventid.ics/raw)

in the VEVENT CLASS:CONFIDENTIAL (or PUBLIC/PRIVATE) is missing.

As a result for this event the corresponding line in the database have c_classification set to 0 (not 1 2 or 3), it is like not set.
For the final users who have access to the shared calendar they see the event as if it was public, as it has no privacy level set.
The new feature is about having a default privacy level for new event created through caldav, it is at backend level.

As I understand SOGoCalendarEventsDefaultClassification only affect frontend (SOGo web + connector/integrator) but not the backend.

Regards

https://github.com/inverse-inc/sogo/commit/02b3de6465c85e254f265cedb28a0e96aeef6f31