Privacy Policy Statements Research Articles

Declaração de política de privacidade e proteção de dados

The opinion has as its theme the need for a statement of privacy and data protection policy applied to the Brazilian company Empreendedorismo Inovador, headquartered in São Pau-lo/SP, which provides services through a platform intended to offer courses theoretical and practical in the field of entrepreneurship and innovation. The privacy and data protection policy statement is one of the main documents that must be formalized by the data controller in order to demonstrate, in a clear and documented manner, good practices and governance with regard to the treatment of personal data held by him. The opinion answers questions about the essential elements of the privacy and data protection policy statement, its principles, the rights of data subjects, the legal bases for drafting the privacy and data protection statement. The privacy and data protection policy statement must contain all information that involves the processing of personal data, highlighting the occurrence of processing of personal data of minors, as well as the international sharing and transfer of data. The research methodology used in the report is the integrated, analytical, deductive and bibliographic research technique.

Exploring privacy requirements gap between developers and end users

Privacy policies document the privacy requirements guiding developers. Though privacy policies analysis has drawn increasing attention recently, how end users perceive privacy requirements has been less explored. We empirically explore the privacy requirements gap between developers and end users to derive beneficial insights into users’ privacy concerns to support maintenance. We present a semi-automatic privacy requirements gap analysis framework based on text mining including information retrieval, topic modeling, and computational linguistic techniques. The preliminary results of applying our framework to Facebook show that: (1) topic comparison reveals that both privacy related reviews and policy statements involve privacy requirements types of collection, usage, and disclosure as well as account security. The retention requirements are almost not mentioned in reviews as they are hard to be directly perceived; (2) content comparisons reveal that though overlapping with the privacy policy statements, reviews are more general, informal, and negative in wording. The illustrative example with Facebook demonstrates the potential usage of our framework in informing software maintenance, e.g., privacy relevant testing and privacy policy refinement.

Attention Paid to Privacy Policy Statements

The article deals with the topic of attention paid to online privacy policy statements by university students. Privacy policy statements were originally intended to mitigate the users’ privacy con-cerns and support trust, but users disregard them. The article uses the theory of planned behav-iour combined with privacy calculus to find and verify determinants of reading privacy policy statements. We used the survey method and evaluated the results with partial least square struc-tural equation modelling. We concluded that the attitude towards reading privacy policy state-ments is influenced by privacy risks and privacy benefits. The intention to read privacy policy statements is influenced by social norms, understanding the privacy policy and mainly by the willingness to spend time and effort reading the statements. The effect of attitude was also signif-icant, but its size was smaller. Finally, wider conclusions are drawn, as the confusion around pri-vacy policy statements is a symptom of a wider social change in the information society.

Evaluating and Comparing the Usability of Privacy in WhatsApp, Twitter, and Snapchat

With the increased use of social networking platforms, especially with the inclusion of sensitive personal information, it has become important for those platforms to have adequate levels of security and privacy. This research aimed to evaluate the usability of privacy in the WhatsApp, Twitter, and Snapchat applications. The evaluation was conducted based on the structured analysis of privacy (STRAP) framework. Seven expert evaluators performed heuristic evaluations and applied the 11 STRAP heuristics to the privacy policy statements and settings provided in the WhatsApp, Twitter, and Snapchat applications. This study provides useful information for designers and developers of social media applications as well as users of the apps. In particular, the results indicate that Snapchat had the highest severity rating, followed by Twitter and WhatsApp. Moreover, the most notable severity rating for all the apps was regarding the ability to revoke consent, where all of the apps had a very high number of usability problems.

An effective approach to mobile device management: Security and privacy issues associated with mobile applications

Consumers and organizations often rely on permissions requested during the installation of mobile applications (apps) and on official privacy policies to determine how safe an app is and decide whether the app producer is acting ethically or not. This research raises several concerns about the collection and sharing of personal data conducted by mobile apps without the knowledge or consent of the user. The findings of this case study research clearly demonstrate that permissions and privacy policies are not enough to determine how invasive an app is. By analysing six popular mobile apps we demonstrate how extensive amounts of data, which go well beyond the permissions requested of the user, are commonly collected. This study illustrates the effectiveness of our proposed approach, which is based upon a static and dynamic analysis, in addition to a review of privacy policy statements. From a corporate perspective, the outcomes of this study are important to understand how many mobile apps put employees, and intellectual property, at risk. Furthermore, we have highlighted how sensitive information being collected may eventually be used in public or private investigations. Moreover, we have also evidenced how the data being collected is contrary to the developers' privacy policies. The results of this study will assist policymakers who may be concerned with consumer privacy and data collection practices.

Privacy in Gaming

Video game platforms and business models are increasingly built on collection, use, and sharing of personal information for purposes of both functionality and revenue. This paper examines privacy issues and explores data practices, technical specifications, and policy statements of the most popular games and gaming platforms to provide an overview of the current privacy legal landscape for mobile gaming, console gaming, and virtual reality devices. The research observes how modern gaming aligns with information privacy notions and norms and how data practices and technologies specific to gaming may affect users and, in particular, child gamers. After objectively selecting and analyzing major players in gaming, the research notes the many different ways that game companies collect data from users, including through cameras, sensors, microphones, and other hardware, through platform features for social interaction and user-generated content, and by means of tracking technologies like cookies and beacons. The paper also notes how location and biometric data are collected routinely through game platforms and explores issues specific to mobile gaming and pairing with smartphones and other external hardware devices. The paper concludes that transparency as to gaming companies’ data practices could be much improved, especially regarding sharing with third party affiliates. In addition, the research considers how children’s privacy may be particularly affected while gaming, determining that special attention should be paid to user control mechanisms and privacy settings within games and platforms, that social media and other interactive features create unique privacy and safety concerns for children which require gamer and parent education, and that privacy policy language is often incongruent with age ratings advertised to children and parents. To contribute additional research value and resources, the paper attaches a comprehensive set of appendices, on which the research conclusions are in part based, detailing the technical specifications and privacy policy statements of popular games and gaming platforms for mobile gaming, console gaming, and virtual reality devices.

Going against the (Appropriate) Flow: A Contextual Integrity Approach to Privacy Policy Analysis

We present a method for analyzing privacy policies using the framework of contextual integrity (CI). This method allows for the systematized detection of issues with privacy policy statements that hinder readers’ ability to understand and evaluate company data collection practices. These issues include missing contextual details, vague language, and overwhelming possible interpretations of described information transfers. We demonstrate this method in two different settings. First, we compare versions of Facebook’s privacy policy from before and after the Cambridge Analytica scandal. Our analysis indicates that the updated policy still contains fundamental ambiguities that limit readers’ comprehension of Facebook’s data collection practices. Second, we successfully crowdsourced CI annotations of 48 excerpts of privacy policies from 17 companies with 141 crowdworkers. This indicates that regular users are able to reliably identify contextual information in privacy policy statements and that crowdsourcing can help scale our CI analysis method to a larger number of privacy policy statements.

Privacy Preserving Policy Framework: User-Aware and User-Driven

Privacy policies outline and structure data collection and access management for online services or websites. These policies are often too long, complex, and convoluted for an average internet user to understand which is a factor in why these policies are ignored. Prior work has mostly focused on improving the accessibility of these privacy policies. Here we focus on making the policies more resemble the negotiation they are supposed to represent by proving flexibility to people. An example is a website which offers various services such as photo, video, or location sharing, where the people are required to either accept the privacy policy to access all the services provided by the website or be prevented from using any of the services. Our goal is to map privacy policy statements to the distinct services offered by a website allowing people to agree for only the services they wish to use. By not agreeing to a policy statement, the access would be denied only on the corresponding service instead of following the all or none mechanism. Additionally, this would also prevent the website from collecting data from people for a particular service which they have no current or future desire to use, in accordance with the principle of data collection minimization. We propose a privacy policy framework to promote transparency for consumers, credibility and trust building for the organization, and clarity in data storage for the developers. Our modular service-policy map for developers allow them to easily associate new features to the corresponding privacy policy section. Modularizing enables developers, organizations, customers, and other stakeholders to understand how specific services correspond with individual data compilations. With the current ongoing debate of data access strategies in social media platforms, our initial framework is based on Facebook’s privacy policy because of the diversity in services that the platform offers. However, the framework can be widely applied across various social media, business, and health care policies. Finally, through pilot interviews with existing consumers, we report on the initial validity testing of our proposed framework. Our early findings are promising in terms of meeting the goals of promoting privacy awareness and increasing trust in organizations' privacy policies.

Social media privacy concerns: trusting beliefs and risk beliefs

PurposeThe purpose of this paper is to build a research model that examines social media privacy concerns (SMPC) in relation to users’ trusting beliefs and risk beliefs.Design/methodology/approachAn instrument with eight constructs (SMPC: collection, SMPC: secondary usage, SMPC: errors, SMPC: improper access, SMPC: control, SMPC: awareness, trusting beliefs and risk beliefs) was developed and administered to subjects from a mid-sized university in the USA. Collected data were analyzed using partial least square structural equation modeling.FindingsThe results showed that three of the six SMPC (i.e. secondary usage, improper access and awareness) were negatively and significantly associated with users’ trusting beliefs. In addition, three of the six SMPC (i.e. collection, errors and improper access) were positively and significantly associated with users’ risk beliefs.Practical implicationsPractical implications were aimed at the social media sites to design simple and straightforward privacy policy statements that are easy to understand; to safeguard users’ online privacy behaviors; and to develop mechanisms to protect personal information.Originality/valueThis study enhances the literature by contributing to a generalized knowledge of SMPC of users as they relate to their trusting beliefs and risk beliefs.

Analyzing Privacy Policies Using Contextual Integrity Annotations

In this paper, we demonstrate the effectiveness of using the theory of contextual integrity (CI) to annotate and evaluate privacy policy statements. We perform a case study using CI annotations to compare Facebook's privacy policy before and after the Cambridge Analytica scandal. The updated Facebook privacy policy provides additional details about what information is being transferred, from whom, by whom, to whom, and under what conditions. However, some privacy statements prescribe an incomprehensibly large number of information flows by including many CI parameters in single statements. Other statements result in incomplete information flows due to the use of vague terms or omitting contextual parameters altogether. We then demonstrate that crowdsourcing can effectively produce CI annotations of privacy policies at scale. We test the CI annotation task on 48 excerpts of privacy policies from 17 companies with 141 crowdworkers. The resulting high precision annotations indicate that crowdsourcing could be used to produce a large corpus of annotated privacy policies for future research.

Exploring User Behaviours when Providing Electronic Consent on Health Social Networks: A ‘Just Tick Agree’ Approach

In an online world, the distinction between public and private is becoming increasingly blurred with rising concerns about the privacy and security of personal health information. The aim of this study is to explore electronic consent (eConsent) on a Health Social Network (HSN) to improve both the form and accessibility of contractual information presented to HSN users. Participants registered on a HSN and their interaction/behaviours were observed when agreeing to the site’s Terms and Conditions (T&C’s) and Privacy Policy (PP) documents. Focus group discussions were used to help us understand how and why certain events occurred. Several themes emerged from this data - ‘Just Tick Agree’ phenomenon, perceived societal benefits for the public good, data privacy concerns and emotional drivers towards eConsent. By achieving a deeper understanding of the eConsent process to a HSN, contributions are presented for both theory and practice. We argue that the complex language used for T&C’s and PP statements when simplified would increase user knowledge, awareness and understanding. Furthermore, HSN user behaviours (i.e. ‘Just Tick Agree’) must change when registering on HSNs and, developers of HSNs should enable user choice on registration by changing how users control their personal health-related data.

Privacy by Design: Informed Consent and Internet of Things for Smart Health

Check: I accept the terms and conditions and privacy policy statements associated with this technological artefact! The informed consent process is becoming more of a challenge with the emergence of Internet of Things (IoT) as data may be collected without the digital health citizen being aware. It is argued in this paper that the first phase for universal usability of IoT within the smart health domain is to ensure that digital health citizens (i.e. user of technology) are fully aware of what they are consenting to when they register an account with such technological artefacts. This point is further reinforced by the proposed ‘Privacy by Design’ requirements associated with the forthcoming General Data Protection Regulation (GDPR). This paper proposes some practical approaches which should be considered when designing and developing IoT for data collection and data sharing within the health domain.

There comes a baby! What should I do? Smartphones' pregnancy-related applications: A web-based overview.

Our article aims to give an overview of the most mentioned smartphones' pregnancy-related applications (Apps). A keywords string with selected keywords was entered both in a general search engine (Google(®)) and PubMed. While PubMed returned no pertinent results, a total of 370 web pages were found on Google(®), and 146 of them were selected. All the pregnancy-related Apps cited at least eight times were included. Information about App's producer, price, contents, privacy policy, and presence of a scientific board was collected. Finally, nine apps were considered. The majority of them were free and available in the two main online markets (Apple(®) App Store and Android(®) Google Play). Five apps presented a privacy policy statement, while a scientific board was mentioned in only three. Further studies are needed in order to deepen the knowledge regarding the main risks of these devices, such as privacy loss, contents control concerns, the digital divide and a potential humanization reduction.

Privacy policies and practices in Portuguese local e-government

This paper contributes to the knowledge body by establishing the current situation in terms of need, adoption and advertising of privacy policies in the websites of Portuguese local authorities, and by collecting evidence of its compliance with privacy practices. Websites of all the 308 Portuguese municipalities were surveyed for the presence of privacy policies, the usage of tracking cookies and measures taken to secure user credentials. A conceptual analysis was performed on privacy policies to categorise their content. Results were compared with other international studies. It was found that only 26% of the municipalities provide privacy policy statements and many of those exhibit significant gaps considering the information that can be expected in such documents. Furthermore, evidence of non-compliance with the advertised privacy policies and the legislation was also collected. The presented conclusions are useful for both academics and practitioners in the areas of e-government, privacy assurance and local government.

The role of privacy assurance mechanisms in building trust and the moderating role of privacy concern

Privacy policy statements and privacy assurance cues are among the most important website features that online providers use to increase individuals’ trust and willingness to disclose private information online. The focus of this study is a comprehensive examination of the process by which privacy assurance mechanisms influence trust and the moderating role of privacy concern in this process. We use the lens of the Elaboration Likelihood Model to investigate the way different individuals perceive and process privacy assurance mechanisms. We argue that the trust-enhancing role of these mechanisms depends on the individual’s privacy concern. The results of this study articulate the process by which various privacy assurance mechanisms operate in enhancing an individual’s trust, and show that there are distinct behavioral differences between individuals with high- vs low-privacy concern when forming their trust to disclose private information. The paper sheds new light on the role of elaboration in the trust building process, and shows why privacy assurance mechanisms have different impacts depending on individuals’ privacy concerns.

A Broken System of Self‐Regulation of Privacy Online? Surveillance, Control, and Limits of User Features in U.S. Websites

This article examines user control of privacy online as indicated by functional features of commercial websites. While prior studies have focused on what's written in privacy policy statements, systematic attention on the interactive aspects of the Web have been scant. This analysis, based on a sample of 398 commercial sites in the United States, shows that the more popular sites did not necessarily provide better privacy control features for users than sites that were randomly selected. In addition, there was no clear relationship between website characteristics and the functional features of privacy control. Implications are discussed for the current status of online privacy policy in the United States and the European Union.

Social Networking Privacy: Understanding the Disconnect from Policy to Controls

A proposed method for mapping privacy policy statements to privacy controls can help providers improve data management transparency, thereby increasing user trust.

Presentation Formats of Policy Statements on Hotel Websites and Privacy Concerns

Information privacy is one of the major reasons that explains why many travelers are hesitant to provide personal information for online reservations. Despite the fact that most hotels provide privacy policy statements on their websites, little research has been done to examine how the format of these privacy statements affects customer trust. Based on the control/restricted theory and cognitive theory of multimedia learning, this study demonstrates how perceived control and learning can affect trust. Participants were shown validated privacy policy statements in a text format or a video format before they rated the trustworthiness of the hotel. The findings from 193 usable samples confirmed that the video was more effective in increasing trust and that it did so by increasing perceived control. The results suggest that hotel companies without a strong brand history can still establish customer trust by providing a well-located, well-executed, and easily understood online video privacy statement. Theoretical and managerial implications are discussed, and future research suggestions are provided.

Privacy Policy Disclosures of Companies: An Exploratory Study of Country Level and Industry Level Differences

Growing customer privacy concerns are resulting in companies paying increased attention to privacy. The main challenge to e-commerce companies is to balance the competitive advantages provided by the use of personal information with the privacy concerns that customers may have regarding the use of their personal information. This study investigates companies’ privacy policies stated in their privacy policy disclosures (i.e., privacy policy statements). We examine 360 companies’ privacy disclosures from six countries (U.S., Canada, U.K., Germany, Japan, and China). Our findings indicate that there are important differences in companies’ privacy disclosures and, by implication, privacy policies and practices across countries. The results also show that regulatory intervention significantly increases companies’ privacy policy disclosures compared to no regulation. However, the self-regulation regime practiced in the U.S. led to privacy policies that were no less extensive than those implemented by companies in government regulation regimes. Finally, no difference was found in the privacy policy disclosures of companies in more information-sensitive industries compared with those in less information-sensitive industries.

Exploratory Analysis Of The Readability Of Information Privacy Statement Of The Primary Social Networks

<p class="MsoNormal" style="text-align: justify; line-height: normal; margin: 0in 27pt 0pt 0.5in; mso-pagination: none;"><span style="font-family: "Times New Roman","serif"; font-size: 10pt;">The goal of a privacy policy statement of a web site is to inform users of the policies and procedures of a web-site as it relates to their collection, use, sharing, access, security and use of technology as it relates to collection of data (cookies and web beacons) and disclosure of personally identifiable information when a user visits the web site. </span></p><p class="MsoNormal" style="text-align: justify; line-height: normal; margin: 0in 27pt 0pt 0.5in; mso-pagination: none;"><span style="font-family: "Times New Roman","serif"; font-size: 10pt;"> </span></p><p class="MsoNormal" style="text-align: justify; line-height: normal; margin: 0in 27pt 0pt 0.5in; mso-pagination: none;"><span style="font-family: "Times New Roman","serif"; font-size: 10pt; mso-fareast-font-family: 'Times New Roman';">In this paper we perform exploratory data analysis of the historical evolution of the readability as well as the reading grade level of the privacy policy statements of Google, Yahoo, Myspace and Facebook. <span style="mso-spacerun: yes;"> </span>We used the Flesch-Kinkaid, Gunning Fog and SMOG reading grade analysis measures. We gathered summary statistics of the complexity of each privacy statement (count of 3<sup>+</sup> syllables words, count of 6<sup>+</sup> characters words, count of 20<sup>+</sup> word sentences). </span></p><p class="MsoNormal" style="text-align: justify; line-height: normal; margin: 0in 27pt 0pt 0.5in; mso-pagination: none;"><span style="font-family: "Times New Roman","serif"; font-size: 10pt;"> </span></p><p class="MsoNormal" style="text-align: justify; line-height: normal; margin: 0in 27pt 0pt 0.5in; mso-pagination: none;"><span style="font-family: "Times New Roman","serif"; font-size: 10pt; mso-fareast-font-family: 'Times New Roman';">We conclude that (1) Except for Yahoo.com, these privacy policy statements are currently written for web-users with a minimum of 2 years of college education. This is not the case for most of social networks users. (2) Using Yahoo.com as a benchmark, privacy policy statements can accomplish their goals and maintain a reading grade level of high school education or less. Accordingly, social networks can accomplish their goal of providing clear and concise privacy policy statements without having to complicate the policy statements with too many 3+ syllable words, 6+ characters words and 20+ word sentences. <span style="mso-spacerun: yes;"> </span>In summary, it is possible to write a legally binding privacy policy statement that is also clear and easy to read.</span></p>