Data Protection and Consenting Communication Mechanisms: Current Proposals and Challenges

in IEEE eXplore (2022, June 06)

Data Protection and Consenting Communication Mechanisms (DPCCMs) have the potential of becoming one of the most fundamental means of protecting humans’ privacy and agency. However, they are yet to be ... [more ▼]

Data Protection and Consenting Communication Mechanisms (DPCCMs) have the potential of becoming one of the most fundamental means of protecting humans’ privacy and agency. However, they are yet to be improved, adopted and enforced. In this paper, based on the results of a technical document analysis and an expert study, we we identify some of the main technical factors that can be comparison factors between some of the main interdisciplinary challenges of a Human-centric, Accountable, Lawful, and Ethical practice of personal data processing on the Internet and discuss whether the current DPCCMs proposal can contribute towards their resolution. In particular, we discuss the two current open specifications, i.e. the Advanced Data Protection Control (ADPC) and the Global Privacy Control (GPC) based on the identified challenges. [less ▲]

Context, Prioritization, and Unexpectedness: Factors Influencing User Attitudes About Infographic and Comic Consent

in Web Conference Companion Volume (ACM) (2022, April 26)

Being asked to consent to data sharing is a ubiquitous experience in digital services - yet it is very rare to encounter a well designed consent experience. Considering the momentum and importance of a ... [more ▼]

Being asked to consent to data sharing is a ubiquitous experience in digital services - yet it is very rare to encounter a well designed consent experience. Considering the momentum and importance of a European data space where personal information freely and easily flows across organizations, sectors and Member States, solving the long-discussed thorny issue of "how to get consent right" cannot be postponed any further. In this paper, we describe the first findings from a study based on 24 semi-structured interviews investigating participants’ expectations and opinions toward consent in a data sharing scenario with a data trustee. We analyzed various dimensions of a consent form redesigned as a comic and an infographic, including language, information design, content and the writer-reader relationship. The results provide insights into the complexity of elements that should be considered when asking individuals to freely and mindfully disclose their data, especially sensitive information. [less ▲]

What if data protection embraced foresight and speculative design?

in DRS2022: Bilbao (2022)

Due to rapid technological advancements and the growing “datafication” of our societies, individuals’ privacy constitutes an increasingly explored speculative space for regulators, researchers ... [more ▼]

Due to rapid technological advancements and the growing “datafication” of our societies, individuals’ privacy constitutes an increasingly explored speculative space for regulators, researchers, practitioners, designers and artists. This article reports two experiences at a national and an international data protection authority (i.e., the Commission Nationale de l'Informatique et des Libertés - CNIL - and the European Data Protection Supervisor - EDPS - respectively), where foresight methods and speculative design are employed in policy-making with the goal of anticipating technological trends, their implications for society and their impact on regulations, as well as the effects of existing and upcoming laws on emerging technologies. Such initiatives can enhance strategic proactive abilities, raise public awareness of privacy issues and engender a participatory approach to the design of policies. They can also inspire the research, education and practice of legal design. [less ▲]

All in one stroke? Intervention Spaces for Dark Patterns

E-print/Working paper (2021)

This position paper draws from the complexity of dark patterns to develop arguments for differentiated interventions. We propose a matrix of interventions with a \textit{measure axis} (from user-directed ... [more ▼]

This position paper draws from the complexity of dark patterns to develop arguments for differentiated interventions. We propose a matrix of interventions with a \textit{measure axis} (from user-directed to environment-directed) and a \textit{scope axis} (from general to specific). We furthermore discuss a set of interventions situated in different fields of the intervention spaces. The discussions at the 2021 CHI workshop "What can CHI do about dark patterns?" should help hone the matrix structure and fill its fields with specific intervention proposals. [less ▲]

Which Properties has an Icon? A Critical Discussion on Evaluation Methods for Standardised Data Protection Iconography

in Proceedings of the 8th Workshop on Socio-Technical Aspects in Security and Trust (STAST) (2021)

Following GDPR's Article12.7's proposal to use standardized icons to inform data subject in "an easily visible, intelligible and clearly legible manner," several icon sets have been developed. In this ... [more ▼]

Following GDPR's Article12.7's proposal to use standardized icons to inform data subject in "an easily visible, intelligible and clearly legible manner," several icon sets have been developed. In this paper, we firstly critically review some of those proposals. We then examine the properties that icons and icon sets should arguably fulfill according to Art.12's transparency provisions. Lastly, we discuss metrics and evaluation procedures to measure compliance with the Article. [less ▲]

Proactive Legal Design for Health Data Sharing based on Smart Contracts

in Corrales Compagnucci, Marcelo; Fenwick, Mark; Wrbka, Stefan (Eds.) Smart Contracts. Technological, Business and Legal Perspectives (2021)

Transparency by Design in Data-Informed Research: a Collection of Information Design Patterns

in Computer Law & Security Review (2020), 37(105402),

Oftentimes information disclosures describing personal data-gathering research activities are so poorly designed that participants fail to be informed and blindly agree to the terms, without grasping the ... [more ▼]

Oftentimes information disclosures describing personal data-gathering research activities are so poorly designed that participants fail to be informed and blindly agree to the terms, without grasping the rights they can exercise and the risks derived from their cooperation. To respond to the challenge, this article presents a series of operational strategies for transparent communication in line with legal-ethical requirements. These "transparency-enhancing design patterns" can be implemented by data controllers/researchers to maximize the clarity, navigability, and noticeability of the information provided and ultimately empower data subjects/research subjects to appreciate and determine the permissible use of their data. [less ▲]

Making the Case for Evidence-based Standardization of Data Privacy and Data Protection Visual Indicators

in Journal of Open Access to Law (2020), 8(1),

Lately, icons have witnessed a growing wave of interest in the view of enhancing transparency and clarity of data processing practices in mandated disclosures. Although benefits in terms of ... [more ▼]

Lately, icons have witnessed a growing wave of interest in the view of enhancing transparency and clarity of data processing practices in mandated disclosures. Although benefits in terms of comprehensibility, noticeability, navigability of the information and user’s attention and memorization can be expected, they should also be supported by decisive empirical evidence about the efficacy of the icons in specific contexts. Misrepresentation, oversimplification, and improper salience of certain aspects over others are omnipresent risks that can drive data subjects to wrong conclusions. Cross-domain and international standardization of visual means also poses a serious challenge: if on the one hand developing standards is necessary to ensure widespread recognition and comprehension, each domain and application presents unique features that can be hardly established, and imposed, in a top-down manner. This article critically discusses the above issues and identifies relevant open questions for scientific research. It also provides concrete examples and practical suggestions for researchers and practitioners that aim to implement transparency-enhancing icons in the spirit of the General Data Protection Regulation (GDPR). [less ▲]

Legal Design for the General Data Protection Regulation. A Methodology for the Visualization and Communication of Legal Concepts

Doctoral thesis (2019)

Privacy policies are known to be impenetrable, lengthy, tedious texts that are hardly read and poorly understood. Therefore, the General Data Protection Regulation (GDPR) introduces provisions to enhance ... [more ▼]

Privacy policies are known to be impenetrable, lengthy, tedious texts that are hardly read and poorly understood. Therefore, the General Data Protection Regulation (GDPR) introduces provisions to enhance the transparency of such documents and suggests icons as visual elements to provide “in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing.” The present dissertation discusses how design, and in particular legal design, can support the concrete implementation of the GDPR’s transparency obligation. Notwithstanding the many benefits that visual communication demonstrably provides, graphical elements do not improve comprehension per se. Research on graphical symbols for legal concepts is still scarce, while both the creation and consequent evaluation of icons depicting abstract or unfamiliar concepts represent a challenge. More- over, precision of representation can support the individuals’ sense-making of the meaning of graphical symbols, but at the expense of simplicity and us- ability. Hence, this research proposed a methodology that combines semantic web technologies with principles of semiotics and ergonomics, and empirical methods drawn from the emerging discipline of legal design, that was used to create and evaluate DaPIS, the Data Protection Icon Set meant to support the data subjects’ navigation of privacy policies. The icon set is modeled on PrOnto, an ontological representation of the GDPR, and is organized around its core modules: personal data, roles and agents, processing operations, processing purposes, legal bases, and data subjects’ rights. In combination with the description of a privacy policy in the legal standard XML Akoma Ntoso, such an approach makes the icons machine-readable and semi-automatically retrievable. Icons can thus serve as information markers in lengthy privacy statements and support the navigation of the text by the data subject. [less ▲]

DaPIS: an Ontology-Based Data Protection Icon Set

in Peruginelli, Ginevra; Faro, Sebastiano (Eds.) Knowledge of the Law in the Big Data Age (2019)

Privacy policies are known to be impenetrable and lengthy texts that are hardly read and poorly understood. This is why the General Data Protection Regulation (GDPR) introduces provisions to enhance ... [more ▼]

Privacy policies are known to be impenetrable and lengthy texts that are hardly read and poorly understood. This is why the General Data Protection Regulation (GDPR) introduces provisions to enhance information transparency including icons as visual means to clarify data practices. However, the research on the creation and evaluation of graphical symbols for the communication of legal concepts, which are generally abstract and unfamiliar to laypeople, is still in its infancy. Moreover, detailed visual representations can support users’ comprehension of the underlying concepts, but at the expense of simplicity and usability. This Chapter describes a methodology for the creation and evaluation of DaPIS, a machine-readable Data Protection Icon Set that was designed following human-centered methods drawn from the emerging discipline of Legal Design. Participatory design methods have ensured that the perspectives of legal experts, designers and other relevant stake- holders are combined in a fruitful dialogue, while user studies have empirically determined strengths and weaknesses of the icon set as communicative means for the legal sphere. Inputs from other disciplines were also fundamental: canonical principles drawn from aesthetics, ergonomics and semiotics were included in the methodology. Moreover, DaPIS is modeled on PrOnto, an ontology of the GDPR, thus offering a comprehensive solution for the Semantic Web. In combination with the description of a privacy policy in the legal standard XML Akoma Ntoso, such an approach makes the icons machine-readable and automatically retrievable. Icons can thus serve as information markers in lengthy privacy statements and support an efficient navigation of the document. In this way, different representations of legal information can be mapped and connected to enhance its comprehensibility: the lawyer-readable, the machine-readable, and the human-readable layers. [less ▲]