Okay, thank you very much Mauro for the introduction so we're in the field of data privacy and
like in the subtopic, let's say of privacy communication meaning
organizations and companies talking to us and telling us what what they about to do and and I'm gonna
like show you or introduce you to our very let's say an
exploratory paper in this area. So we wanted to know
what kind of difference those contexts make in the relevance of
privacy information and therefore we asked some users
Okay, so you're all
probably aware or maybe even unaware of privacy notices that we all let's say
see on a daily basis and we don't read and and they are still pretty common
in the field
because of like compliance reasons and other reasons
so this is still the main let's say tool to talk about privacy practices
They're often long, they are very seldom read
so a recent proposal
Suggests to make them more relevant and there have been many approaches to make privacy notices more relevant
for example icons, but this recent proposal focuses on
putting short
Just-in-time
notices in the transaction context of the user. So
let's imagine you have some kind of app
and you have to enter your name or your email address and then a very short tiny notice a piece of information will pop up
telling you that your email address is not shared with third parties
So that would be an example and of this kind of short and relevant just-in-time
notices which are complementary in a way to these long legally required privacy notices.
And nowadays
many companies start to make use of this kind of just-in-time notices or short notices, for example
You probably have seen in Whatsapp when you start a new chat with somebody and that your communication is encrypted
If you have installed Apple Pay on your device, there's a short notice saying where your credit data is transferred to.
You're all aware of these cookie banners and we can discuss whether these are make sense in a way
but let's say it's an attempt of
making privacy communication more contextual.
And that's basically the area that we did our research in.
We let's say took a pretty naive approach.
We said okay in order to find out what is contextually relevant for the user from all these let's say
broad privacy policies, we thought okay, let's ask them first.
Let's really do the naive approach of asking users what they consider relevant and
we used
basically two main research questions. One is:
How concerned are the consumers regarding the privacy and what are privacy information
preferences in a particular context. So concerns on the one hand and privacy information preferences on the other hand.
And is there a contextual difference. So does it make any difference?
when I'm confronted with different contexts.
That are our two main questions.
So what we did was basically
selecting two contexts and we selected one context which is
loyalty cards that you for example use when you go to a store and show in order to collect bonus points and the
second context is fitness tracking.
And we basically recruited people from a panel. We display to one set
the loyalty card context and explained them:
just imagine you are using loyalty cards. And we introduced to the second set of people this fitness tracking context and
told them, okay
imagine you're using fitness trackers and afterwards we simply asked them: What are your privacy concerns in this context?
And what are your privacy information
preferences? So what kind of privacy information would you consider as relevant?
Okay, the first is privacy concerns.
We use a standardized scale.
The concern for information privacy instrument. And on the left hand side you can see the outcomes of
the loyalty card to concern on the right the fitness tracking concern
Let's say
Four is more or less some neutral on concern level.
Everything above means your concern somehow.
In a way and what you can see is that on this like let's say high abstraction level, the concern pattern is very much
the same. You can see significant differences with small effect sizes for example for
error concerns and collection concern but for example when it comes to
secondary use which means like using your data for like other topics or giving your data to a third party
it's pretty much the same concern level in both contexts.
Okay, we then ask the users for their privacy information
preferences, so what kind of privacy information would you consider relevant?
We used categories
based on the GDPR of the EU
and they are guidelines and they distinguish between different kinds of information categories like for example personal rights information
"You have the right to opt out",
information on processing purposes,
information on for example, how long is your data stored like storage period and we also
translated these kind of categories
in a more simple language so that people were able to
understand what kind of information
these were and then we asked them what do you consider relevant here. And what you can see here is basically
that the effects are like very small again
So neutral is somehow in the middle, to the right
you see I consider this kind of information relevant. And I had to add some some like small bars so that you can see
where significant differences actually are.
Meaning that for example people would consider information on their personal rights in this context more relevant than for example
the contact name of the data privacy officer that is like just at the bottom. Just
a side note: if you look at many privacy notices today
the name of the contact data privacy officer sometimes at the top. So
in the field, it's currently considered like being important.
Again, these are only like minor differences, very small effects
between these two contexts.
Okay, let's conclude
regarding the
privacy concerns we found something called a hierarchy of concerns,
which has been discussed in the literature before.
And we also found something like let's say small hierarchy of information
preferences.
The significance the differences are like just of a minor type, we generally have very small effect sizes.
And that also brings us to the main limitations of our study.
So this was a let's say first approach to ask the user for the privacy communication preferences.
And we started on a very high abstraction level. So we said like "Imagine
using the card" we had like very abstract
let's say
concern categories and very abstract information categories. And so we were on a very high and abstract level.
Regarding these two contexts you can say
You should probably address secondary use an improper access concerns over areas on collection.
And regarding the privacy information
preferences you should probably focus on the person's right and less for example of the contact information of your data privacy officer.
Further research, well a
next idea would be to look at a
context in much more detail. Let's say an example an app
with specific screens and asking people again: What information is relevant now? And also taking a very concrete
privacy policy of a company. My students did this already with the privacy policy of Twint and
asked the users for example is data sharing with Google Analytics ok for you or not. How relevant is this information? And the second
topic for research in this area is
testing their actual relevance with an experimental design.
Thank you very much for your attention.
I'm going to clap
For everybody. Thank you very much Nico for this great presentation and
while we wait like a few questions to populate
I like to start with a question from Alessio from the same session
He is asking how where the data are collected.
Was it the same user sample?
And so it was like two different groups of users. So we
recruited about 650 and when I imagine, we split them into two groups
and one group got one context and the other group got the second context.
Great, so I like to ask you like another question
I was particularly
interested in the
reasons why you involved non users into the study and
I was wondering if you could expand a little bit on the rationale for
involving non users into into the sampling.
So our idea was that probably non users might have different concerns
meaning that the reason for not using
like a loyalty card or fitness tracker
could be because of a specific concern so we hoped or that was basic idea to see a different pattern.
But in the ends also the pattern was very similar between users and non-users
Okay, so you didn't see any difference between these two groups of users?
If I have time I can just go to the backup slide and show.
Of course you have like around like 10 seconds 15 seconds late. I think it's a lot.
Ok, just have a look
There is a different for example when it comes to collection concerns between users and non-users and a loyalty card context.
But again, it's like not a totally different pattern. I see
Ok, thank you very much nico for this presentation. Thanks. Thanks a lot. I like to
Move to the second presenter of the session