Towards Effective Differential Privacy Communication for Users’ Data Sharing Decision and Comprehension

Abstract

Differential privacy protects an individual's privacy by perturbing data on an aggregated level (DP) or individual level (LDP). We report four online human-subject experiments investigating the effects of using different approaches to communicate differential privacy techniques to laypersons in a health app data collection setting. Experiments 1 and 2 investigated participants' data disclosure decisions for low-sensitive and high-sensitive personal information when given different DP or LDP descriptions. Experiments 3 and 4 uncovered reasons behind participants' data sharing decisions, and examined participants' subjective and objective comprehensions of these DP or LDP descriptions. When shown descriptions that explain the implications instead of the definition/processes of DP or LDP technique, participants demonstrated better comprehension and showed more willingness to share information with LDP than with DP, indicating their understanding of LDP's stronger privacy guarantee compared with DP.

Exploring Design and Governance Challenges in the Development of Privacy-Preserving Computation

“…While our experts generally acknowledged the individuals whose personal data is being privately computed on as an important stakeholder group, few seemed to prioritise seeking their understanding and acceptance. This is in contrast to the small number of existing HCI studies that investigate 'user acceptability' of particular privacy-preserving computation techniques such as differential privacy [19,117] and MPC [92]. User acceptability could and should be further examined in particular contexts; for instance, Colnago et al suggest further work is needed to explore whether such techniques embedded in Internet-of-Things privacy assistants might 'help mitigate people's reservations about data collection practices and reduce the chance they opt out' [24].…”

“…Some participants explained this was because adding more noise felt like lying. Xiong et al [117] also studied participants' willingness to share data with a hypothetical differentially private system. They examined the effect of different descriptions of differential privacy (including real descriptions provided by technology companies and the U.S. Census bureau) on willingness to share, and their findings suggest that certain descriptions (in particular, implication descriptions) are more understandable and increase willingness to share data as a result.…”

Vision: A Noisy Picture or a Picker Wheel to Spin? Exploring Suitable Metaphors for Differentially Private Data Analyses

“…There are a few studies in which researchers took first steps forward to achieve usable differential privacy [2,10]. For instance, Bullek et al used the randomized response technique (RRT) to describe a variant of differentially private mechanism using a spinner, i.e.…”

“…They examined whether users trust the RRT mechanism which proposes to ensure their privacy and if they adjust their privacy decisions when they see more details of the privacy promises made by RRT. Xiong et al [10] analysed the effects of using different approaches to verbally communicate differentially private techniques to laypersons in a health app data collection setting. Across different approaches of short textual descriptions, their results show that descriptions explaining implications, i.e.…”

“…Across different approaches of short textual descriptions, their results show that descriptions explaining implications, i.e. what happens if the aggregator's database is compromised can facilitate people's data-sharing decisions and their comprehension of the local and centralized techniques [10]. To the best of our knowledge, no attempts have yet been made to generate, test, and compare metaphors for conveying the underlying differentially private data analysis to lay users.…”