Data Protection Certification in the EU: Possibilities, Actors and Building Blocks in a Reformed Landscape

Kamara, Irene; Hert, Paul De

doi:10.1007/978-94-6265-228-6_2

Cited by 8 publications

(4 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The primary choice is a PL that would also involve a certification by an independent certification body, e.g. if the client is established in the EEA (European Economic Area), then it will have to adhere to data protection legislation such as the GDPR and also local data protection requirements (Kamara and De Hert, 2018). However, PL could also be relevant for establishments outside the EEA, for example, if they want to compete with businesses in the EEA.…”

Section: Lawyersmentioning

confidence: 99%

A multidisciplinary definition of privacy labels

Johansen¹,

Pedersen²,

Fischer‐Hübner³

et al. 2022

ICS

View full text Add to dashboard Cite

Purpose This paper aims to present arguments about how a complex concept of privacy labeling can be a solution to the current state of privacy. Design/methodology/approach The authors give a precise definition of Privacy Labeling (PL), painting a panoptic portrait from seven different perspectives: Business, Legal, Regulatory, Usability and Human Factors, Educative, Technological and Multidisciplinary. They describe a common vision, proposing several important “traits of character” of PL as well as identifying “undeveloped potentialities”, i.e. open problems on which the community can focus. Findings This position paper identifies the stakeholders of the PL and their needs with regard to privacy, describing how PL should be and look like to address these needs. Main aspects considered are the PL’s educational power to change people’s knowledge of privacy, tools useful for constructing PL and the possible visual appearances of PL. They also identify how the present landscape of privacy certifications could be improved by PL. Originality/value The authors adopt a multidisciplinary approach to defining PL as well as give guidelines in the form of goals, characteristics, open problems, starting points and a roadmap for creating the ideal PL.

show abstract

Section: Lawyersmentioning

confidence: 99%

A multidisciplinary definition of privacy labels

Johansen¹,

Pedersen²,

Fischer‐Hübner³

et al. 2022

ICS

View full text Add to dashboard Cite

show abstract

“…Though the certification is still voluntary, GDPR endorses and facilitates a certification mechanism as a means to demonstrate compliance with data protection provisions. In addition, the existence of a certificate makes the process of choosing processors easier for the controllers too, especially so since GDPR establishes responsibility and liability for any processing carried out on the controller's behalf [19].…”

Section: Usable Privacy Criteriamentioning

confidence: 99%

“…[UPG. 19 In what degree does the provided information [ UPC.7.3 affect the choices and actions and UPC.7.4 improve the understanding] of the data subject in respect to the logic involved, as well as the significance and the envisaged consequences of automated decision-making, including profiling to which s/he is object to? [Es:Accuracy] resp.…”

Section: Upc3 Is the Information About The Intended Processing Provimentioning

confidence: 99%

“…As such, the motivation for usability evaluations of privacy is that usability goals of GDPR, s.a. "... any information ... and communication ... relating to processing [to be provided] to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, ..." (Article 12 (1) of GDPR), are left open to the subjective interpretation of both evaluators and controllers. The provisions of GDPR regarding usability are too general and high-level to be suitable for a certification process [19]. To remedy this we propose a set of criteria thought to produce measurable evaluations of the effectiveness, efficiency, and satisfaction -as usability outcomes -with which privacy goals of data protection are reached.…”

Section: Our Approach To Making Privacy Usablementioning

confidence: 99%

See 1 more Smart Citation

Making GDPR Usable: A Model to Support Usability Evaluations of Privacy

Johansen

Fischer‐Hübner

2020

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

We introduce a new model for evaluating privacy that builds on the criteria proposed by the EuroPriSe certification scheme by adding usability criteria. Our model is visually represented through a cube, called Usable Privacy Cube (or UP Cube), where each of its three axes of variability captures, respectively: rights of the data subjects, privacy principles, and usable privacy criteria. We slightly reorganize the criteria of EuroPriSe to fit with the UP Cube model, i.e., we show how the EuroPriSe can be viewed as a combination of only rights and principles, forming the two axes at the basis of our UP Cube. In this way we also want to bring out two perspectives on privacy: that of the data subjects and, respectively, that of the controllers/processors. We define usable privacy criteria based on usability goals that we have extracted from the whole text of the data protection regulations. The criteria are designed to produce measurements of the level of usability with which the goals are reached. Precisely, we measure effectiveness, efficiency, and satisfaction, considering both the objective and the perceived usability outcomes, producing measures of accuracy and completeness, of resource utilization (e.g., time, effort, financial), and measures resulting from satisfaction scales. In the long run, the UP Cube is meant to be the model behind a new certification methodology capable of evaluating the usability of privacy, to the benefit of common users. For industries, considering also the usability of privacy would allow for greater business differentiation, beyond GDPR compliance.

show abstract

Privacy Through Certification?: The New Certification Scheme of the General Data Protection Regulation

Hornung

Bauer

2019

Studies in European Economic Law and Regulation

View full text Add to dashboard Cite

Data Protection Certification in the EU: Possibilities, Actors and Building Blocks in a Reformed Landscape

Cited by 8 publications

References 5 publications

A multidisciplinary definition of privacy labels

A multidisciplinary definition of privacy labels

Making GDPR Usable: A Model to Support Usability Evaluations of Privacy

Privacy Through Certification?: The New Certification Scheme of the General Data Protection Regulation

Contact Info

Product

Resources

About