Privacy theory in practice: designing a user interface for managing location privacy on mobile devices

Ataei, Mehrnaz; Degbelo, Auriol; Kray, Christian

doi:10.1080/17489725.2018.1511839

Cited by 17 publications

(12 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most problem with compliance are found in SMEs (with the exception of companies with an existing security focus), since they have more limited resources (Lindqvist 2018;Sirur et al 2018). Some researchers focus on a specific article in GDPR, for instance data portability, certification and privacy (Ataei et al 2018b;Bu-pasha 2017;De Hert et al 2017;Graef et al 2018;Lindqvist 2018;Rodrigues et al 2016;Urquhart et al 2018;Vanberg and Ünver 2017) or a specific sector/business (Erdos 2016;Grundstrom et al 2019;Lopes and Oliveira 2018;Stanciu and Rîndașu 2018).…”

Section: Research State Of the Artmentioning

confidence: 99%

A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises

Brodin

2019

Eur J Secur Res

View full text Add to dashboard Cite

The EU's General Data Protection (GDPR) is an EU regulation that affects everyone in the EU and all organisations outside the EU that wants to do business with the EU. GDPR introduces tougher requirements for processing personal data, which may be difficult for many small-and medium-sized enterprises (SMEs) to follow without major adjustments. This work uses design science to develop a framework for SMEs to adapt to GDPR. The framework was empirically evaluated in three different types of organisations, resulting of GDPR compliance according to their Data Protection Officers. It was also theoretical evaluated against scientific literature including the identified implications of GDPR. In this paper the framework is presented, from initial analysis and design to implementation and future work, with advice on how to work with each part to achieve compliance. The paper also highlights some of the most important changes in GDPR compared to its predecessor, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (DIR95).

show abstract

Section: Research State Of the Artmentioning

confidence: 99%

A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises

Brodin

2019

Eur J Secur Res

View full text Add to dashboard Cite

show abstract

“…A similar issue particularly relevant in geographic information science (GIScience) is location privacy. For example, mobile apps might collect location data during a long term study (Ataei et al, 2018). Again, publishing this data could reveal the identity of a participant.…”

Section: The Status Quo Of Orr In the Computational Geosciencesmentioning

confidence: 99%

“…In-depth examination of spatiotemporal figures in open reproducible researchThis chapter was published as: Konkol, Markus and ChristianKray (2018). "Indepth examination of spatiotemporal figures in open reproducible research".…”

mentioning

confidence: 99%

Publishing Reproducible Geoscientific Papers: Status quo, benefits, and opportunities

Konkol¹

2019

Preprint

View full text Add to dashboard Cite

Open reproducible research (ORR) is the practice of publishing the source code andthe datasets that are needed to produce the computational results reported in a paper.Since geoscientific articles often include geostatistical analyses and spatiotemporaldata, reproducibility should be a cornerstone of the computational geosciences butis rarely realized. In addition, the current way of publishing scientific outcomes, i.e.as static PDFs, does not adequately report on computational aspects. Thus, readerscannot fully understand how the authors came to the conclusions and how robustthese are to changes in the analysis. Consequently, it is difficult for reviewers tofollow the analysis steps, and for other researchers to reuse existing materials. Thisdissertation has two overarching goals to tackle these issues: First, it aims at assistingauthors in adhering to ORR principles to ensure high scientific standards. The secondgoal is to reap the benefits that come with papers supplemented by code and data. Toachieve these objectives, this thesis reports on five complementary studies to collectand analyze qualitative (i.e. through interviews and a focus group) and quantitativedata (i.e. through surveys and reproducibility studies). Based on these studies, thiswork provides four key contributions: First, it identifies obstacles that preventedgeoscientists from publishing ORR. To overcome these barriers, this dissertationsuggests concrete and directly applicable strategies. One of these strategies is theexecutable research compendium (ERC) which encapsulates the paper, code, data,and the entire software environment needed to produce the computational results.Based on that, this work presents the design and implementation of an ERC-basedworkflow. It allows authors to convey their computational methods and results byalso providing interactive access to code and data, and readers to deeply investigatethe computational analysis while reading the actual article, e.g. by changing theparameters of the analysis. Finally, this work describes the concept of a binding; abinding connects those code lines and data subsets that produce a specific result, e.g.a figure or number. By also considering user interface widgets (e.g. a slider), thisapproach allows readers to interactively manipulate the parameters of the analysisto see how these changes affect the result. To conclude, the contributions include (i)a set of obstacles which prevent geoscientists from publishing ORR, (ii) conceptsand tools to overcome the identified barriers, (iii) incentives and opportunities thatcome with attached code and data, and (iv) solutions to realize the incentives whicheventually result in a higher number of open and reproducible research.

show abstract

“…One of the concerns in this regard is related to mobile operating systems that "lack fine-grained control mechanisms for location services, thus severely limiting the degree of control users have over their location information" [11]. Ataei et al [29] recently proposed user interface elements for fine-grained management of location privacy settings, which help to specify who to share location information with, when to share it, and where to share it. A common sentiment among critics of LBS is that "the ethical ramifications of progresses in location-enabled technology are often viewed as an afterthought, and legal concerns over privacy aspects oftentimes lag behind technological advances" [11].…”

Section: Location Data Privacy Issues In Lbs and The Role Of The Genementioning

confidence: 99%

Complying with Privacy Legislation: From Legal Text to Implementation of Privacy-Aware Location-Based Services

Ataei

Degbelo

Kray

et al. 2018

IJGI

Self Cite

View full text Add to dashboard Cite

An individual's location data is very sensitive geoinformation. While its disclosure is necessary, e.g., to provide location-based services (LBS), it also facilitates deep insights into the lives of LBS users as well as various attacks on these users. Location privacy threats can be mitigated through privacy regulations such as the General Data Protection Regulation (GDPR), which was introduced recently and harmonises data privacy laws across Europe. While the GDPR is meant to protect users' privacy, the main problem is that it does not provide explicit guidelines for designers and developers about how to build systems that comply with it. In order to bridge this gap, we systematically analysed the legal text, carried out expert interviews, and ran a nine-week-long take-home study with four developers. We particularly focused on user-facing issues, as these have received little attention compared to technical issues. Our main contributions are a list of aspects from the legal text of the GDPR that can be tackled at the user interface level and a set of guidelines on how to realise this. Our results can help service providers, designers and developers of applications dealing with location information from human users to comply with the GDPR.using location data of their users, i.e., location-based services (LBS). Given that in the digital age "privacy goes global" [6], the impacts of the GDPR will be felt far beyond the boundaries of Europe.While this new law promises to strengthen the rights of individuals, it also poses challenges to the designers and developers of systems that process personal data (e.g., location data). On the legal level, there are questions as to how compliance can be demonstrated. On a technical level, the law introduces new requirements regarding how data is stored, processed and deleted. While these two perspectives already introduce many challenges, it is also not clear how to realise various requirements that the GDPR formulates with respect to what users should be able to control and regarding how and when certain types of information should be presented to them. Providing material to support developers implementing GDPR is critical, as non-compliant companies could be fined with up to (the greater of) 20 million Euro or 4% of their global annual turnover.Location-based services (LBS) are increasingly ubiquitous systems that deal with geo-information and process the location data of their users. In this paper, we aim to address challenges resulting from the introduction of the GDPR that relate to user interfaces of LBS. Our main contributions are as follows: (1) We systematically analysed the legal text to identify a list of aspects that can be tackled at the user interface level (UI) (Section 3); (2) In addition, we carried out interviews with experts to gain further insights into challenges arising from having to comply with the GDPR as well as into ways of addressing them (Section 4); (3) Based on the outcome of both activities, we compiled a set of guidelines for developers and desi...

show abstract

Privacy theory in practice: designing a user interface for managing location privacy on mobile devices

Cited by 17 publications

References 32 publications

A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises

A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises

Publishing Reproducible Geoscientific Papers: Status quo, benefits, and opportunities

Complying with Privacy Legislation: From Legal Text to Implementation of Privacy-Aware Location-Based Services

Contact Info

Product

Resources

About