Making GDPR Usable: A Model to Support Usability Evaluations of Privacy

Johansen, Johanna; Fischer‐Hübner, Simone

doi:10.1007/978-3-030-42504-3_18

Cited by 9 publications

(10 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…informational selfdetermination) considerably influence behavior. If employees have false or significantly limited perceptions, simply providing privacy controls would reduce the principles of the GDPR to absurdity [24]. To shed light on this matter, we explored the boundaries of the perceptions of informational self-determination by conducting a mental model study with 27 office workers in Germany.…”

Section: Introductionmentioning

confidence: 99%

Exploring mental models of the right to informational self-determination of office workers in Germany

Tolsdorf

Dehling

Reinhardt

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Applied privacy research has so far focused mainly on consumer relations in private life. Privacy in the context of employment relationships is less well studied, although it is subject to the same legal privacy framework in Europe. The European General Data Protection Regulation (GDPR) has strengthened employees’ right to privacy by obliging that employers provide transparency and intervention mechanisms. For such mechanisms to be effective, employees must have a sound understanding of their functions and value. We explored possible boundaries by conducting a semi-structured interview study with 27 office workers in Germany and elicited mental models of the right to informational self-determination, which is the European proxy for the right to privacy. We provide insights into (1) perceptions of different categories of data, (2) familiarity with the legal framework regarding expectations for privacy controls, and (3) awareness of data processing, data flow, safeguards, and threat models. We found that legal terms often used in privacy policies used to describe categories of data are misleading. We further identified three groups of mental models that differ in their privacy control requirements and willingness to accept restrictions on their privacy rights. We also found ignorance about actual data flow, processing, and safeguard implementation. Participants’ mindsets were shaped by their faith in organizational and technical measures to protect privacy. Employers and developers may benefit from our contributions by understanding the types of privacy controls desired by office workers and the challenges to be considered when conceptualizing and designing usable privacy protections in the workplace.

show abstract

Section: Introductionmentioning

confidence: 99%

Exploring mental models of the right to informational self-determination of office workers in Germany

Tolsdorf

Dehling

Reinhardt

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…presented to). One set of measuring scales can come from criteria regarding the usability of privacy as defined in Johansen and Fischer-Hübner (2020). G.8: The goal with “layered PL” is to give the user a bird’s-eye view about what privacy aspects are included in the privacy policy.…”

Section: Visual Appearance Of Privacy Labelsmentioning

confidence: 99%

“…aiming for goal G.1, is by measuring the usability of privacy using HCI methods, thus covering also G.2. (Johansen and Fischer-Hübner, 2020) works in this direction by proposing a set of criteria thought to produce measurable evaluations of the effectiveness, efficiency and satisfaction with which privacy goals of GDPR are reached.…”

Section: Diagrammatic Summary Of Contributionsmentioning

confidence: 99%

A multidisciplinary definition of privacy labels

Johansen¹,

Pedersen²,

Fischer‐Hübner³

et al. 2022

ICS

Self Cite

View full text Add to dashboard Cite

Purpose This paper aims to present arguments about how a complex concept of privacy labeling can be a solution to the current state of privacy. Design/methodology/approach The authors give a precise definition of Privacy Labeling (PL), painting a panoptic portrait from seven different perspectives: Business, Legal, Regulatory, Usability and Human Factors, Educative, Technological and Multidisciplinary. They describe a common vision, proposing several important “traits of character” of PL as well as identifying “undeveloped potentialities”, i.e. open problems on which the community can focus. Findings This position paper identifies the stakeholders of the PL and their needs with regard to privacy, describing how PL should be and look like to address these needs. Main aspects considered are the PL’s educational power to change people’s knowledge of privacy, tools useful for constructing PL and the possible visual appearances of PL. They also identify how the present landscape of privacy certifications could be improved by PL. Originality/value The authors adopt a multidisciplinary approach to defining PL as well as give guidelines in the form of goals, characteristics, open problems, starting points and a roadmap for creating the ideal PL.

show abstract

“…Thus, the EuroPriSe certification assures that the GDPR legal ground is covered, including data protection principles and data subject rights, while the usable privacy criteria come on top, fine-graining the EuroPriSe evaluation with usability measurements showing how well the legislation is respected. This work has identified from the GDPR text 30 usability goals, which have been used as guidelines to define 23 usability criteria, each composed of several subcriteria designed to measure usability aspects [JFH19]. In ergonomics and HCI, the context of use is an important component of a usability evaluation.…”

Section: G4: Pl Would Facilitate the Inclusion Of People In The New D...mentioning

confidence: 99%

“…One starting point for evolving certification schemes from seals and trust marks towards privacy labels of the energy efficiency type, i.e., aiming for goal G.1, is by measuring the usability of privacy using HCI methods, thus covering also G.2. [JFH20] works in this direction by proposing a set of criteria thought to produce measurable evaluations of the effectiveness, efficiency, and satisfaction with which privacy goals of GDPR are reached. This work extends the methodology of EuroPriSe certification scheme by adding, what is called, usable privacy criteria.…”

Section: G4: Pl Would Facilitate the Inclusion Of People In The New D...mentioning

confidence: 99%

A Multidisciplinary Definition of Privacy Labels: The Story of Princess Privacy and the Seven Helpers

Johansen,

Pedersen,

Fischer-Hübner

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

Privacy is currently in 'distress' and in need of 'rescue', much like princesses in the all-familiar fairytales. We employ storytelling and metaphors from fairytales to argue how a new and all-encompassing concept of Privacy Labelling (the 'knight in shining armour') can come to the rescue of Privacy (the 'princess in distress'). We paint a detailed portrait of Privacy Labelling (PL) that emerges from discussions carried out from seven different perspectives (the 'seven helpers'): Business, Legal, Regulatory, Usability and Human Factors, Educative, Technological, and Multidisciplinary. We describe a common vision, proposing several important 'traits of character' of PL as well as identifying 'places of improvement', i.e., open problems on which the community can focus their efforts. More specifically, this position paper identifies the stakeholders of the PL and their needs with regard to privacy, describing how the PL should be and look like in order to respond to these needs. Throughout the paper, we highlight goals, characteristics, open problems, and starting points for how one could approach what we define as the ideal PL. In the end we present three approaches to finding PL through, self-evaluations, certifications, or community endeavours, and sketch a roadmap for future developments aiming for an Individualised PL.

show abstract

Making GDPR Usable: A Model to Support Usability Evaluations of Privacy

Cited by 9 publications

References 18 publications

Exploring mental models of the right to informational self-determination of office workers in Germany

Exploring mental models of the right to informational self-determination of office workers in Germany

A multidisciplinary definition of privacy labels

A Multidisciplinary Definition of Privacy Labels: The Story of Princess Privacy and the Seven Helpers

Contact Info

Product

Resources

About