Privacy Notices Research Articles

Talar head fractures: An observational study of 33 talar head fractures derived from the Swedish Fracture Register

BackgroundReports in the literature on talar head fractures are rare and limited to case reports and small case series. Questions/PurposesThis study aimed to describe a national cohort of talar head fractures for fracture characteristics, associated injuries, treatment, and reoperations. MethodsWe reviewed all radiographs of patients enrolled in the SFR between 2011 and 2021 showing talar head fractures (AO/OTA 81-A3). We excluded those with talar head avulsion fractures, misclassified, multiple registrations, or with a privacy notice in their medical records. The cohort was reviewed using medical records and radiographs at a minimum 2-year follow-up. ResultsThe study included 32 patients (33 fractures) ≥18 years of age. The median age was 32 (range 18–65) years, 84 % were men, and the main trauma mechanisms were motor vehicle accidents (28 %) and falls from heights (28 %) and graded as high-energy injuries in 50 % of the cases. 18 (55 %) were displaced and 15 (45 %) had comminuted fractures. 14 talar head fractures (42 %) had multiple injuries to the same foot. 21 patients (66 %) underwent surgical treatment, most commonly with screw fixation. Surgery was performed in 15 of 18 patients with displaced fractures. Four patients were reoperated, one with arthrodesis of the talonavicular joint and three for implant removal. No cases of avascular necrosis were identified. ConclusionsTalar head fractures are rare and occur mainly in men. They are associated with other foot injuries. Most talar head fractures are treated operatively. In this case series, we did not identify any case of avascular necrosis. Levels of EvidenceIV, retrospective observational cohort study

Matcha

Apple and Google introduced their versions of privacy nutrition labels to the mobile app stores to better inform users of the apps' data practices. However, these labels are self-reported by developers and have been found to contain many inaccuracies due to misunderstandings of the label taxonomy. In this work, we present Matcha, an IDE plugin that uses automated code analysis to help developers create accurate Google Play data safety labels. Developers can benefit from Matcha's ability to detect user data accesses and transmissions while staying in control of the generated label by adding custom Java annotations and modifying an auto-generated XML specification. Our evaluation with 12 developers showed that Matcha helped our participants improved the accuracy of a label they created with Google's official tool for a real-world app they developed. We found that participants preferred Matcha for its accuracy benefits. Drawing on Matcha, we discuss general design recommendations for developer tools used to create accurate standardized privacy notices.

Designing Effective Privacy Notices and Controls

Privacy notice and choice are essential aspects of privacy and data protection regulation worldwide. Yet, today's privacy notices and controls are surprisingly ineffective at informing users or allowing them to express choice. We analyze why existing privacy notices fail to inform users and tend to leave them helpless, and discuss principles for designing more effective privacy notices and controls.

Aligned with the Blueprint for an AI Bill of Rights? An AI Transparency Evaluation of Company Privacy Notices and Explanations

Aligned with the Blueprint for an AI Bill of Rights? An AI Transparency Evaluation of Company Privacy Notices and Explanations

A Design Theory for Transparency of Information Privacy Practices

Public policy initiatives demand transparency of information privacy practices (TIPP) since the 1970s, at least, when a first version of the fair information practice principles (FIPP) was published. Decades later, information system (IS) providers are still struggling to meet this demand. Apparently, there is a tension between socially desirable guardrails for privacy practices (e.g., allowing for anonymity) and economic value creation (e.g., exploiting personalization surplus). To inform IS designs that can change such avaricious states to the benefit of consumers, we present a theoretical foundation (TIPP theory) explaining and prescribing what needs to be built to establish TIPP in the real world. On the one hand, TIPP theory explains why IS providers, who have privacy practices to hide, should not go beyond IS designs that meet legal demands. More importantly, TIPP theory explains and prescribes what IS providers need to build to actually establish TIPP and be able to differentiate from competitors by doing so. TIPP theory will be useful for all involved parties: IS providers are enabled to avoid privacy notice fallacies, public policy makers can give more details in their related guidance and laws published, and consumers can, ultimately, interact with IS that actually establish TIPP.

Comparing Large-Scale Privacy and Security Notifications

Over the last decade, web security research has used notification campaigns as a tool to help web operators fix security problems or stop infrastructure abuse. First attempts at applying this approach to privacy issues focused on single services or vendors. Hence, little is known if notifications can also raise awareness and encourage remediation of more complex, vendor-independent violations of privacy legislation at scale, such as informed consent to cookie usage under the EU's ePrivacy Directive or the General Data Protection Regulation's requirement for a privacy policy. It is also unclear how privacy notifications perform and are perceived compared to those about security vulnerabilities. To fill this research gap, we conduct a large-scale, automated email notification study with more than 115K websites we notify about lack of a privacy policy, use of third-party cookies without or before informed consent, and input forms for personal data that do not use HTTPS. We investigate the impact of warnings about fines and compare the results with security notifications to more than 40K domains about openly accessible Git repositories. Based on our measurements and interactions with operators through email and a survey, we find that notifications about privacy issues are not as well received as security notifications. They result in lower fix rates, less incentive to take immediate action, and more negative feedback. Specific reasons include a lack of awareness and knowledge of privacy laws' applicability, difficulties to pinpoint the problem, and limited intrinsic motivation.

Lessons in VCR Repair: Compliance of Android App Developers with the California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) provides California residents with a range of enhanced privacy protections and rights. Our research investigated the extent to which Android app developers comply with the provisions of the CCPA that require them to provide consumers with accurate privacy notices and respond to "verifiable consumer requests" (VCRs) by disclosing personal information that they have collected, used, or shared about consumers for a business or commercial purpose. We compared the actual network traffic of 109 apps that we believe must comply with the CCPA to the data that apps state they collect in their privacy policies and the data contained in responses to "right to know" requests that we submitted to the app's developers. Of the 69 app developers who substantively replied to our requests, all but one provided specific pieces of personal data (as opposed to only categorical information). However, a significant percentage of apps collected information that was not disclosed, including identifiers (55 apps, 80%), geolocation data (21 apps, 30%), and sensory data (18 apps, 26%) among other categories. We discuss improvements to the CCPA that could help app developers comply with "right to know" requests and other related regulations.

Introducing Privacy Receipts into DLT and eIDAS

The introduction of digital identification (e.g., eIDAS) and wallet standards (e.g., EUDI wallet) require compliance with privacy principles and clear communication of the principles through privacy notice and record of consent in the form of a privacy receipt. Regulation needs standards to help set the bar for reducing the privacy infringement risk. Without a standard-based implementation, solutions will be proprietary and siloed with no concern for interoperability, like privacy labels in Google and Apple app stores. Do existing standards address the gap, or do new ones need to be introduced? This article looks at the standards and regulations in three areas to answer this question: privacy protection standards, blockchain and DLT standards, and digital identification and wallet standards.

Privacy nutrition labels, App Store and the GDPR: Unintended consequences?

In an effort to increase the transparency of personal data processing carried out via applications listed on their mobile store, Apple recently announced the launch of privacy nutrition labels (PNLs). Aimed at informing users about an application's use of data, these card-like labels are prominently visible on each application's App Store page. This paper explores whether such disclosures made via PNLs can help data controllers fulfil their duty of transparency under the EU General Data Protection Regulation (GDPR). It establishes that the PNLs, in their current, highly standardised fashion, cannot convey the mandatory obligations required by the GDPR. Added to this, they cannot adequately supplement existing privacy policies, either — as they neither serve an adequate role as a ‘first layer’ of a privacy notice, nor help communicate information more efficiently. However, the paper finds that the PNLs might serve another purpose: enhancing data controllers' internal compliance routines. PNLs, even with their current limitations, can bring tangible improvements to cross-functional communication, third-party sharing awareness, records of processing accuracy, adherence to the data protection principles and adequate resource assignment. The overall conclusion of the paper, counterintuitive as it might appear, is that PNLs should be viewed as an organisational measure-enhancing mechanism rather than a transparency tool.

A Value-centered Exploration of Data Privacy and Personalized Privacy Assistants

In the current post-GDPR landscape, privacy notices have become ever more prevalent on our phones and online. However, these notices are not well suited to their purpose of helping users make informed decisions. I suggest that instead of utilizing notice to elicit informed consent, we could repurpose privacy notices to create the space for more meaningful, value-centered user decisions. Value-centered privacy decisions, or those that accurately reflect who we are and what we value, encapsulate the intuitive role of personal values in data privacy decisions. To explore how we could design for such decisions, I utilize Suzy Killmister’s Four-Dimensional Theory of Autonomy (4DT) to operationalize value-centered privacy decisions. I then utilize 4DT to help design a system—called a value-centered privacy assistant (VcPA)—that could help create the space for value-centered data privacy decisions using privacy notices. Using this 4DT lens, I further assess the degree that an existing technology, personalized privacy assistants (PPAs), use notices in a manner that allows for value-centered decision-making. I lastly utilize insights from the PPA assessment to inform the design of a VcPA, concluding that a VcPA could utilize notices to assist users in value-centered app selection and in other data privacy decisions.

Deontic Modality in the GDPR Based Finnish Privacy Notices in the Light of the Transparency Principle

Since its inception the General Data Protection Regulation has introduced a number of rights and obligations that relate to the personal data processing. As the Regulation requires that all information about data subjects’ rights be conveyed in a clear and plain language (transparency principle), this study focuses on the linguistic means of expressing rights and obligations in the GDPR based privacy notices. The article aims at scrutinising the features and context of deontic expressions which may influence the clear message. The research corpus consists of fourteen privacy notices of Finnish design companies which were analysed in order to identify deontic expressions. They were juxtaposed with the GDPR text and some discrepancies were found in their frequency and modal patterns. The qualitative analysis of the expressions with the help of Easy Language Meter criteria for Finnish revealed that privacy notices show simplifying tendencies like choice of modal expressions, the use of certain subjects and the way of addressing the reader. These comply with the Plain Language principles and thus the transparency principle highlighted in the GDPR.

How Usable Are iOS App Privacy Labels?

Standardized privacy labels that succinctly summarize those data practices that people are most commonly concerned about offer the promise of providing users with more effective privacy notices than full-length privacy policies. With their introduction by Apple in iOS 14 and Google’s recent adoption in its Play Store, mobile app privacy labels are for the first time available at scale to users. We report the first indepth interview study with 24 lay iPhone users to investigate their experiences, understanding, and perceptions of Apple’s privacy labels. We uncovered misunderstandings of and dissatisfaction with the iOS privacy labels that hinder their effectiveness, including confusing structure, unfamiliar terms, and disconnection from permission settings and controls. We identify areas where app privacy labels might be improved and propose suggestions to address shortcomings to make them more understandable, usable, and useful.

Transparency of privacy notices and contextualisation: effectively conveying information without words

ABSTRACT Data protection regulations require that website visitors provide their informed consent before their personal data are collected. However, privacy notices are often misunderstood. We claim that the context of the notice, i.e. the visitor’s action preceding their appearance, can affect its comprehension. In two studies with an ad hoc website (N = 132, 128), we either preserved the sequential connection between the notice and the action triggering it or broke it with a delay. We also manipulated the reference to the triggering action in the notice's title. The participants’ comprehension, perceived comprehension, and response were measured. In a third study (N = 91), we investigated how different contexts (i.e. generic vs. specific) affect the participants’ interpretation of the notice. Overall, the results suggest that the action preceding the notice affects the identification of its cause (studies 1, 2, and 3) and the interpretation of its content (study 3), whereas the explicit content of the notice does not. The acceptance of the notice does not seem to directly follow an improvement in comprehension, as would be foreseen by the transparency paradox. Considering the sequential context in which the notice appears seems then a good design practice to achieve genuine comprehension.

Data protection record of processing activities and privacy notice generator toolkit by EMBL’s European Bioinformatics Institute

EMBL-EBI, Europe's biomolecular data hub, is a world leader in managing and analysing big data in biology and making it freely available to scientists worldwide. Researchers can access the open data resources and related services of EMBL-EBI by submitting minimal personal data. In May 2018, following the enforcement of the European Data Protection Regulation (GDPR), EMBL adopted the EMBL Internal Policy no. 68 on General Data Protection. It reflects European data protection principles while remaining within the bounds of EMBL's international legal status. As a result of GDPR and EMBL's Internal Policy No. 68 coming into force, 190 EMBL-EBI user-facing services that processed personal data in 2018 were required to have Records of Processing Activities (RoPA) and Privacy Notices (PN). EMBL-EBI's solution was to develop a Data Protection Engine (DPE) that automatically generates RoPA and PN when a service owner answers a series of questions. In addition to maintaining a centrally located database for RoPAs and PNs, the DPE tracks changes to the documents, as well as providing versioning and time-stamped updates. It is the aim of this article to share the EMBL-EBI IT department’s experience with designing and implementing the DPE and providing a toolkit to let others develop a similar solution and benefit from our experience. Implementation steps, benefits, challenges, opportunities, and practices are discussed and critically analysed.

The Bulletproof Glass Effect: Unintended Consequences of Privacy Notices

Drawing from a content analysis of publicly traded companies’ privacy notices, a survey of managers, a field study, and five online experiments, this research investigates how consumers respond to privacy notices. A privacy notice, by placing legally enforceable limits on a firm's data practices, communicating safeguards, and signaling transparency, might be expected to promote confidence that personal data will not be misused. Indeed, most managers expected a privacy notice to make customers feel more secure (Study 1). Yet, consistent with the analogy that bulletproof glass can increase feelings of vulnerability despite the protection offered, formal privacy notices undermined consumer trust and decreased purchase interest even when they emphasized objective protection (Studies 2, 3, and 5) or omitted any mention of potentially concerning data practices (Study 6). These unintended consequences did not occur, however, when consumers had an a priori reason to be distrustful (Study 4) or when benevolence cues were added to privacy notices (Studies 5 and 6). Finally, Study 7 showed that both the presence and conspicuous absence of privacy information are sufficient to trigger decreased purchase intent. Together, these results provide actionable guidance to managers on how to effectively convey privacy information (without hurting purchase interest).

Pulse Oximeter App Privacy Policies During COVID-19: Scoping Assessment

BackgroundPulse oximeter apps became of interest to consumers during the COVID-19 pandemic, particularly when traditional over-the-counter pulse oximeter devices were in short supply. Yet, no study to date has examined or scoped the state of privacy policies and notices for the top-rated and most downloaded pulse oximeter apps during COVID-19.ObjectiveThe aim of this study was to examine, through a high-level qualitative assessment, the state and nature of privacy policies for the downloaded and top-rated pulse oximeter apps during the COVID-19 pandemic to (1) compare findings against comparable research involving other mobile health (mHealth) apps and (2) begin discussions on opportunities for future research or investigation.MethodsDuring August-October 2020, privacy policies were reviewed for pulse oximeter apps that had either at least 500 downloads (Google Play Store apps only) or a three out of five-star rating (Apple Store apps only). In addition to determining if the apps had an accessible privacy policy, other key privacy policy–related details that were extracted included, but were not limited to, app developer location (country); whether the app was free or required paid use/subscription; whether an ads disclosure was provided on the app’s site; the scope of personal data collected; proportionality, fundamental rights, and data protection and privacy issues; and privacy safeguards.ResultsSix pulse oximeter apps met the inclusion criteria and only 33% (n=2) of the six apps had an accessible privacy policy that was specific to the pulse oximeter app feature (vs the app developer’s website or at all). Variation was found in both the regulatory nature and data privacy protections offered by pulse oximeter apps, with notable privacy protection limitations and gaps, although each app provided at least some information about the scope of personal data collected upon installing the app.ConclusionsPulse oximeter app developers should invest in offering stronger privacy protections for their app users, and should provide more accessible and transparent privacy policies. This is a necessary first step to ensure that the data privacy of mHealth consumers is not exploited during public health emergency situations such as the COVID-19 pandemic, where over-the-counter personal health monitoring devices could be in short supply and patients and consumers may, as a result, turn to mHealth apps to fill such supply gaps. Future research considerations and recommendations are also suggested for mHealth technology and privacy researchers who are interested in examining privacy implications associated with the use of pulse oximeter apps during and after the COVID-19 pandemic.

MHealth wearables and smartphone health tracking apps: A changing privacy landscape

The use of digital health technologies is changing the ways people monitor and manage their health and well-being. There is increasing interest in using wearables and smartphone health apps to collect health-related data, a domain within digital health referred to as mHealth. Wearables and health apps can continuously monitor metrics such as physical activity, sleep, and heart rate, to name a few. These mHealth data can supplement the measures taken by healthcare professionals during regular doctor’s visits, with mHealth having the advantage of a much greater frequency of collection. But what are the privacy considerations with mHealth? This paper explores global data privacy protections, enumerates principles to guide regulations, discusses the tension between anonymity and data utility, and proposes ways to improve how we as a society talk about and safeguard data privacy. We include brief discussions about inadvertent or unintended consequences of digital data collection and the trade-off between privacy and public health interests, such as is illustrated by COVID-19 contract tracing apps. This paper concludes by offering suggestions for consideration about improving privacy and confidentiality notices.

GDPR Glasnost: Spain’s AEPD raises the transparency bar and sanctions two banks

This paper is a commentary on two recent decisions issued by the Spanish data protection authority (DPA): the AEPD (Agencia Española de Protección de Datos). Both decisions — issued one month apart — developed similar motives and grievances primarily arising from the alleged lack of clarity in the two banks’ privacy notifications to their clients as well as in the consent-collection process and in the formulation of their legitimate interest in processing personal data. These two decisions combined with one issued just a couple of months earlier by the French DPA (CNIL [Commission Nationale de l’Informatique et des Libertés]) appear to draw a new trend: one towards a heightened scrutiny on the details of the data protection documentation set forth by data controllers. Sanctions issued over General Data Protection Regulation’s (GDPR) first two years of implementation had largely focused on penalising manifest disregard for GDPR (primarily in the form of a lack of appropriate technical and organisational measures or the absence of a lawful basis for personal data processing). In each of the three decisions, the data controller was a bank (Banco Bilbao Vizcaya Argentaria, SA [BBVA] and CaixaBank in the two AEPD decisions under review, Carrefour Banque in the CNIL decision previously commented by the co-authors). In the two Spanish decisions, the fines issued were, respectively, for €5m and €6m against BBVA and CaixaBank. Privacy professionals in the banking sector will need to factor in these regulatory developments and reassess the formulation of their privacy notifications. The industry has thus been invited to reassess its duty of privacy information from a new, more rigorous perspective. What degree of detail regarding the specifics of the data processing do regulators expect in a privacy notice? How should data controllers structure the collection of data subject consent to ensure it may constitute a legitimate basis for data processing? What are the elements they need to demonstrate to validly invoke a legitimate interest in the data processing? The two recent AEPD decisions under review set a high bar. While the two decisions are primarily remarkable in their substantive motivation (I), we will also highlight some particularly interesting procedural developments (II).

Reconciling the what, when and how of privacy notifications in fitness tracking scenarios

The increasing number of fitness tracking wearables deployed worldwide poses challenges to the privacy of their users, esp. in terms of transparency. Privacy notifications facilitate transparency by providing users with situational awareness about the processing of their personal data. We present the results of two online surveys including English-speaking (nEng=154) and German-speaking (nGer=150) users of fitness tracking devices from Europe, conducted to elicit determinants of notification settings. We found evidence for the perceived usefulness of privacy notifications, and for concordant predictors in terms of when and how users prefer to be notified about personal data processing in 12 scenarios related to fitness tracking.

Honeysuckle

In-app privacy notices can help smartphone users make informed privacy decisions. However, they are rarely used in real-world apps, since developers often lack the knowledge, time, and resources to design and implement them well. We present Honeysuckle, a programming tool that helps Android developers build in-app privacy notices using an annotation-based code generation approach facilitated by an IDE plugin, a build system plugin, and a library. We conducted a within-subjects study with 12 Android developers to evaluate Honeysuckle. Each participant was asked to implement privacy notices for two popular open-source apps using the Honeysuckle library as a baseline as well as the annotation-based approach. Our results show that the annotation-based approach helps developers accomplish the task faster with significantly lower cognitive load. Developers preferred the annotation-based approach over the library approach because it was much easier to learn and use and allowed developers to achieve various types of privacy notices using a unified code format, which can enhance code readability and benefit team collaboration.