Exploring Understandability in Socio-technical Models for Data Protection Analysis: Results from a Focus Group

The understandability of conceptual models depends not only on the model’s inner complexity and representation but also on the personal factors of the model’s audience. This is critical when conceptual models are used for achieving common ground during the early stages of requirements engineering for information systems and, moreover, for complex domains such as data protection. In this article, we present the results of an exploratory study consisting of eight focus groups with 21 experts on software development, business analysis and data protection, examining socio-technical models of an information system to identify privacy risks. We surveyed participants on their backgrounds to characterize the personal factors of understandability and performed an initial understandability assessment on a socio-technical model. We compared these values with the outcome of the focus group, i.e., the effectiveness of the participants in identifying privacy risks, annotating whether the risks are identified individually by a participant or collaboratively by two or more participants. The results suggest that most of the privacy risks were identified collaboratively, regardless of the previous understandability scores and personal factors such as experience and background.