Complying with Privacy Legislation: From Legal Text to Implementation of Privacy-Aware Location-Based Services

Abstract

An individual's location data is very sensitive geoinformation. While its disclosure is necessary, e.g., to provide location-based services (LBS), it also facilitates deep insights into the lives of LBS users as well as various attacks on these users. Location privacy threats can be mitigated through privacy regulations such as the General Data Protection Regulation (GDPR), which was introduced recently and harmonises data privacy laws across Europe. While the GDPR is meant to protect users' privacy, the main problem is that it does not provide explicit guidelines for designers and developers about how to build systems that comply with it. In order to bridge this gap, we systematically analysed the legal text, carried out expert interviews, and ran a nine-week-long take-home study with four developers. We particularly focused on user-facing issues, as these have received little attention compared to technical issues. Our main contributions are a list of aspects from the legal text of the GDPR that can be tackled at the user interface level and a set of guidelines on how to realise this. Our results can help service providers, designers and developers of applications dealing with location information from human users to comply with the GDPR.using location data of their users, i.e., location-based services (LBS). Given that in the digital age "privacy goes global" [6], the impacts of the GDPR will be felt far beyond the boundaries of Europe.While this new law promises to strengthen the rights of individuals, it also poses challenges to the designers and developers of systems that process personal data (e.g., location data). On the legal level, there are questions as to how compliance can be demonstrated. On a technical level, the law introduces new requirements regarding how data is stored, processed and deleted. While these two perspectives already introduce many challenges, it is also not clear how to realise various requirements that the GDPR formulates with respect to what users should be able to control and regarding how and when certain types of information should be presented to them. Providing material to support developers implementing GDPR is critical, as non-compliant companies could be fined with up to (the greater of) 20 million Euro or 4% of their global annual turnover.Location-based services (LBS) are increasingly ubiquitous systems that deal with geo-information and process the location data of their users. In this paper, we aim to address challenges resulting from the introduction of the GDPR that relate to user interfaces of LBS. Our main contributions are as follows: (1) We systematically analysed the legal text to identify a list of aspects that can be tackled at the user interface level (UI) (Section 3); (2) In addition, we carried out interviews with experts to gain further insights into challenges arising from having to comply with the GDPR as well as into ways of addressing them (Section 4); (3) Based on the outcome of both activities, we compiled a set of guidelines for developers and desi...

Location Data and COVID-19 Contact Tracing: How Data Privacy Regulations and Cell Service Providers Work In Tandem

“…Ataei et al examine the GDPR legislation in depth to understand how certain aspects can be implemented using user interfaces(UI), and analyze how best to comply with GDPR regulation [59]. Consequently, Ataei et al defined a set of guidelines for Location Based Service(LBS) design and development, with the goal of making it easier for developers to create systems that are GDPR compliant.…”

“…Both Georgiadou et al [55] Ataei et al [59] and studies provide a thorough analysis of GDPR policy as it affects location. Georgiadou et al [55] uses this analysis to encourage privacy legislation developments in the African Union while Ataei et al [59] uses the analysis of the GDPR to help produce usable UI.…”

A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises

“…There are some studies that deal with challenges that come with GDPR. Ataei et al (2018a) identified three challenges with GDPR, after interviewing six GDPR experts. The first is user-friendliness-implementing GDPR in a way that does not place unmanageable burdens on users.…”

“…As mentioned in the introduction, there have been some theoretical evaluations in the literature where GDPR has been compared to its predecessor, DIR95 (Ataei et al 2018a;Grundstrom et al 2019;Tikkinen-Piri et al 2017). Ataei et al (2018a) has their focus on the user interface level for Location-Based Services rather than issues that SMEs face. Grundstrom et al (2019) focuses on challenges for the organisation in a specific sector, insurance.…”

Heterogeneous deniable authenticated encryption for location-based services

“…Users utilize LBSs to find points of interests, navigate the destination, and inquire public transportation etc. [1][2][3][4][5][6]. In all of these requested services, users need to disclose their location information to the location-based service provider (LBSP).…”