Privacy Research Research Articles

Privacy at a Glance: The User-Centric Design of Glanceable Data Exposure Visualizations

Abstract Smartphone users are often unaware of mobile applications’ (“apps”) third-party data collection and sharing practices, which put them at higher risk of privacy breaches. One way to raise awareness of these practices is by providing unobtrusive but pervasive visualizations that can be presented in a glanceable manner. In this paper, we applied Wogalter et al.’s Communication-Human Information Processing model (C-HIP) to design and prototype eight different visualizations that depict smartphone apps’ data sharing activities. We varied the granularity and type (i.e., data-centric or app-centric) of information shown to users and used the screensaver/lock screen as a design probe. Through interview-based design probes with Android users (n=15), we investigated the aspects of the data exposure visualizations that influenced users’ comprehension and privacy awareness. Our results shed light on how users’ perceptions of privacy boundaries influence their preference regarding the information structure of these visualizations, and the tensions that exist in these visualizations between glanceability and granularity. We discuss how a pervasive, soft paternalistic approach to privacy-related visualization may raise awareness by enhancing the transparency of information flow, thereby, unobtrusively increasing users’ understanding of data sharing practices of mobile apps. We also discuss implications for privacy research and glanceable security.

Benefits of formalized computational modeling for understanding user behavior in online privacy research

PurposeOnline privacy research has seen a focus on user behavior over the last decade, partly to understand and explain user decision-making and seeming inconsistencies regarding users' stated preferences. This article investigates the level of modeling that contemporary approaches rely on to explain said inconsistencies and whether drawn conclusions are justified by the applied modeling methodology. Additionally, it provides resources for researchers interested in using computational modeling.Design/methodology/approachThe article uses data from a pre-existing literature review on the privacy paradox (N = 179 articles) to identify three characteristics of prior research: (1) the frequency of references to computational-level theories of human decision-making and perception in the literature, (2) the frequency of interpretations of human decision-making based on computational-level theories, and (3) the frequency of actual computational-level modeling implementations.FindingsAfter excluding unrelated articles, 44.1 percent of investigated articles reference at least one theory that has been traditionally interpreted on a computational level. 33.1 percent of all relevant articles make statements regarding computational properties of human cognition in online privacy scenarios. Meanwhile, 5.1 percent of all relevant articles apply formalized computational-level modeling to substantiate their claims.Originality/valueThe findings highlight the importance of formal, computational-level modeling in online privacy research, which has so far drawn computational-level conclusions without utilizing appropriate modeling techniques. Furthermore, this article provides an overview of said modeling techniques and their benefits to researchers, as well as references for model theories and resources for practical implementation.

Cybervetting job applicants on social media: the new normal?

With the introduction of new information communication technologies, employers are increasingly engaging in social media screening, also known as cybervetting, as part of their hiring process. Our research, using an online survey with 482 participants, investigates young people’s concerns with their publicly available social media data being used in the context of job hiring. Grounded in stakeholder theory, we analyze the relationship between young people’s concerns with social media screening and their gender, job seeking status, privacy concerns, and social media use. We find that young people are generally not comfortable with social media screening. A key finding of this research is that concern for privacy for public information on social media cannot be fully explained by some “traditional” variables in privacy research. The research extends stakeholder theory to identify how social media data ethics should be inextricably linked to organizational practices. The findings have theoretical implications for a rich conceptualization of stakeholders in an age of social media and practical implications for organizations engaging in cybervetting.

Children and Online Privacy Protection: Empowerment from Cognitive Defense Strategies

At present, very little is known about what might encourage children and teens to limit access to their private information online and to restrict what they share on social media and video sites. Federal and state agencies face challenges encouraging companies to help children, teens, and parents protect their information online. The authors extend previous cognitive defense research by examining (1) effects beyond advertising as applied to information privacy online; (2) not only children’s/teens’ beliefs and knowledge, but also their online privacy decisions; (3) multiple age categories; (4) multiple cognitive defense strategies (educational video, quiz with feedback, or absence of a strategy); and (5) children’s/teens’ motivation to restrict what they share online. Key results indicate significant effects of the quiz and educational video over the absence of a strategy in enhancing favorable online safety beliefs and in restricting online sharing. Findings also demonstrate the role of perceived parental influence and for agencies to offer privacy education campaigns to help empower children to protect their privacy. Implications for policy and privacy research are discussed.

A Secured Public Auditing Protocol with Dynamic Structure for Cloud Data

At present Cloud computing is a very successful paradigm for data computing and storage. It Increases the concerns about data security and privacy in the cloud. Paper covers cloud security and privacy research, while focusing on the works that protect data confidentiality and privacy for sensitive data being stored and queried in the cloud. As Survey enlist all the research carried out related to data security and users privacy preserving techniques in detail. Data sharing can be achieved with sensitive information hiding with remote data integrity auditing, propose a new concept called identity based shared data integrity auditing with sensitive information hiding for secure cloud storage. Initially every data would be outsourced to the cloud only after authorized or activated by the proxy. The key would be generated to the file randomly by the key generation Centre. The transaction details such as key mismatch, file upload and download, hacking details would be shown to the proxy and cloud server. If the match occurs, automatically file would be recovered by the user even if hacker access or tamper the file. The main motive is to ensure that when the cloud properly stores the user’s sanitized data, the proof it generates can pass the verification of the third party auditor. And the paper provides various research work done in the field

Patient Privacy Perspectives on Health Information Exchange in a Mental Health Context: Qualitative Study.

BackgroundThe privacy of patients with mental health conditions is prominent in health information exchange (HIE) discussions, given that their potentially sensitive personal health information (PHI) may be electronically shared for various health care purposes. Currently, the patient privacy perspective in the mental health context is not well understood because of the paucity of in-depth patient privacy research; however, the evidence suggests that patient privacy perspectives are more nuanced than what has been assumed in the academic and health care community.ObjectiveThis study aimed to generate an understanding on how patients with mental health conditions feel about privacy in the context of HIE in Canada. This study also sought to identify the factors underpinning their privacy perspectives and explored how their perspectives influenced their attitudes toward HIE.MethodsSemistructured interviews were conducted with patients at a Canadian academic hospital for addictions and mental health. Guided by the Antecedent-Privacy Concern-Outcome macro-model, interview transcripts underwent deductive and inductive thematic analyses.ResultsWe interviewed 14 participants. Their privacy concerns varied, depending on the participant’s privacy experiences and health care perceptions. Media reports of privacy breaches and hackers had little impact on participants’ privacy concerns because of a fatalistic belief that privacy breaches are a reality in the digital age. Rather, direct observations and experiences with the mistreatment of PHI in health care settings caused concern. Decisions to trust others with PHI depended on past experiences with the individual (or institution) and health care needs. Participants had little knowledge of patient privacy rights and legislation but were willing to participate in HIE because of perceived individual and societal benefits.ConclusionsThis study introduces evidence that patients with mental health conditions would support HIE. Participants were pragmatic, supporting HIE because they wanted the best care possible. They also understood that their PHI was critical in supporting the single-payer Canadian health care system. Participant health care experiences informed their privacy perspectives, trust, and PHI sharing attitudes—all accentuating the importance of the patient experience in building trust in HIE. Their lack of knowledge about patient rights and PHI uses highlights the degree of trust they have in the health care system to protect their privacy. These findings suggest that the patient privacy discourse should extend beyond the oft-cited barrier of patient privacy concerns to include discussions about building trust, communicating the benefits of HIE, and improving patient experiences. Although our findings are in the Canadian context, this study highlights the importance of engaging patients in privacy policy discussions, regardless of jurisdiction, to ensure their nuanced perspectives are reflected in policy decisions on their PHI.

Privacy concerns in E-commerce: A taxonomy and a future research agenda

Safeguarding consumer privacy is a key challenge for the growth of e-commerce. The dramatic technological changes advanced by online platforms, big data, artificial intelligence, virtual reality, virtual assistants, and blockchain technology are transforming the way we shop online. This paradigm shift in e-commerce has only intensified the perplexities of privacy issues. Corresponding to the growing concerns of privacy in practice, research in this area has surged during the last two decades. The aim of this paper is to review the current state of consumer privacy research in business to consumer e-commerce and thereby understand what has been studied, what is omitted, and what potential research areas have emerged in the course of transformational technological changes. We conducted a systematic review of behavioral studies published on analyzing privacy concerns at the individual level during the last 20 years. We methodically analyzed the selected literature using the thematic analysis technique. The results revealed eight main themes. We present a taxonomy of consumer privacy concerns and a research agenda that could lead to a more cohesive and comprehensive understanding of privacy dynamics in e-commerce.

Meta-Analysis of Information Privacy Using TSSEM

With widespread use of information technologies, information privacy issues have been gaining more attention by not only the public but also researchers. The number of studies on the issues has been increasing exponentially, which makes incomprehensible the whole picture of research outcome. Thus, it is necessary to conduct a systematic examination of past research. This study developed two competing models with four essential constructs in information privacy research and empirically tested the models with data obtained from previous studies. This study employed a quantitative meta-analysis method called TSSEM. It is one of MASEM methods in which structural equation modeling and meta-analysis are integrated. The analysis results indicated that risk-centric model exhibited much better model fits than those of concern-centric model. This study implies that traditional concern-centric model should be questioned it’s explanatory power of the model and researchers may consider alternative risk-centric model to explain user’s intention to provide privacy information.

A Survey on Interdependent Privacy

The privacy of individuals does not only depend on their own actions and data but may also be affected by the privacy decisions and by the data shared by other individuals. This interdependence is an essential aspect of privacy and ignoring it can lead to serious privacy violations. In this survey, we summarize and analyze research on interdependent privacy risks and on the associated (cooperative and non-cooperative) solutions. We also demonstrate that interdependent privacy has been studied in isolation in different research communities. By doing so, we systematize knowledge on interdependent privacy research and provide insights on how this research should be conducted and which challenges it should address.

Evaluating privacy impact assessment methods: guidelines and best practice

Purpose This paper aims to practically guide privacy impact assessment (PIA) implementation by proposing a PIA process incorporating best practices from existing PIA guidelines and privacy research. Design/methodology/approach This paper critically reviews and assesses generic PIA methods proposed by related research, data protection authorities and standard’s organizations, to identify best practices and practically support PIA practitioners. To address identified gaps, best practices from privacy literature are proposed. Findings This paper proposes a PIA process based on best practices, as well as an evaluation framework for existing PIA guidelines, focusing on practical support to PIA practitioners. Practical implications The proposed PIA process facilitates PIA practitioners in organizing and implementing PIA projects. This paper also provides an evaluation framework, comprising a comprehensive set of 17 criteria, for PIA practitioners to assess whether PIA methods/guidelines can adequately support requirements of their PIA projects (e.g. special legal framework and needs for PIA project organization guidance). Originality/value This research extends PIA guidelines (e.g. ISO 29134) by providing comprehensive and practical guidance to PIA practitioners. The proposed PIA process is based on best practices identified from evaluation of nine commonly used PIA methods, enriched with guidelines from privacy literature, to accommodate gaps and support tasks that were found to be inadequately described or lacking practical guidance.

Of promoting networking and protecting privacy: Effects of defaults and regulatory focus on social media users’ preference settings

Privacy research has debated whether privacy decision-making is determined by users' stable preferences (i.e., individual traits), privacy calculus (i.e., cost-benefit analysis), or “responses on the spot” that vary across contexts. This study focuses on two factors—default setting as a contextual factor and regulatory focus as an individual difference factor—and examines the degree to which these factors affect social media users' decision-making when using privacy preference settings in a fictitious social networking site. The results, based on two experimental studies (study 1, n = 414; study 2, n = 213), show that default settings significantly affect users' privacy preferences, such that users choose the defaults or alternatives proximal to them. Study 2 shows that regulatory focus also affects privacy decisions, such that users with a strong promotion focus select options favoring a higher social networking utility, perceiving lesser cognitive efforts and more confidence in decisions. Finally, we find a significant interaction effect between default setting and regulatory focus on perceived effort and confidence, suggesting that the default effect is contingent on users’ goal orientations (operationalized as regulatory focus). We discuss the implications for research and practice.

Mobile users’ information privacy concerns and the role of app permission requests

Recent privacy-related incidents of mobile services have shown that app stores and providers face the challenge of mobile users’ information privacy concerns, which can prevent users from installing mobile apps or induce them to uninstall an app. In this paper, we investigate the role of app permission requests and compare the impact on privacy concerns with other antecedents of information privacy concerns, i.e., prior privacy experience, computer anxiety, and perceived control. To test these effects empirically, we conducted an online survey with 775 participants. Results of our structural equation modeling show that prior privacy experience, computer anxiety, and perceived control have significant effects on privacy concerns. However, concerns for app permission requests have approximately twice as much predictive value than the other factors put together to explain mobile users’ overall information privacy concerns. We expect that our findings can provide a theoretical contribution for future mobile privacy research as well as practical implications for app stores and providers.

Investigating People’s Privacy Risk Perception

Abstract Although media reports often warn about risks associated with using privacy-threatening technologies, most lay users lack awareness of particular adverse consequences that could result from this usage. Since this might lead them to underestimate the risks of data collection, we investigate how lay users perceive different abstract and specific privacy risks. To this end, we conducted a survey with 942 participants in which we asked them to rate nine different privacy risk scenarios in terms of probability and severity. The survey included abstract risk scenarios as well as specific risk scenarios, which describe specifically how collected data can be abused, e.g., to stalk someone or to plan burglaries. To gain broad insights into people’s risk perception, we considered three use cases: Online Social Networks (OSN), smart home, and smart health devices. Our results suggest that abstract and specific risk scenarios are perceived differently, with abstract risk scenarios being evaluated as likely, but only moderately severe, whereas specific risk scenarios are considered to be rather severe, but only moderately likely. People, thus, do not seem to be aware of specific privacy risks when confronted with an abstract risk scenario. Hence, privacy researchers or activists should make people aware of what collected and analyzed data can be used for when abused (by the service or even an unauthorized third party).

A Survey of System Architectures, Privacy Preservation, and Main Research Challenges on Location-Based Services

Location-based services (LBSs) have become popular in recent years due to the ever-increasing usage of smart mobile devices and mobile applications through networks. Although LBS application provides great benefits to mobile users, it also raises a sever privacy concern of users due to the untrusted service providers. In the lack of privacy enhancing mechanisms, most applications of the LBS may discourage the user’s acceptance of location services in general, and endanger the user’s privacy in particular. Therefore, it is a great interest to discuss on the recent privacy-preserving mechanisms in LBSs. Many existing location-privacy protection-mechanisms (LPPMs) make great efforts to increase the attacker’s uncertainty on the user’s actual whereabouts by generating a multiple of fake-locations together with user’s actual positions. In this survey, we present a study and analysis of existing LPPMs and the state-of-art privacy measures in service quality aware LBS applications. We first study the general architecture of privacy qualification system for LBSs by surveying the existing framework and outlining its main feature components. We then give an overview of the basic privacy requirements to be considered in the design and evaluation of LPPMs. Furthermore, we discuss the classification and countermeasure solutions of existing LPPMs for mitigating the current LBS privacy protection challenges. These classifications include anonymization, obfuscation, and an encryption-based technique, as well as the combination of them is called a hybrid mechanism. Finally, we discuss several open issues and research challenges based on the latest progresses for on-going LBS and location privacy research.

A contextual approach to information privacy research

In this position article, we synthesize various knowledge gaps in information privacy scholarship and propose a research agenda that promotes greater cross‐disciplinary collaboration within the iSchool community and beyond. We start by critically examining Westin's conceptualization of information privacy and argue for a contextual approach that holds promise for overcoming some of Westin's weaknesses. We then highlight three contextual considerations for studying privacy—digital networks, marginalized populations, and the global context—and close by discussing how these considerations advance privacy theorization and technology design.

We Care About Different Things: Non-Elite Conceptualizations of Social Media Privacy

This study explores privacy from the perspective of the user. It leverages a “framing in thought” approach to capture how users make sense of privacy in their social media use. It builds on a unique dataset of privacy definitions collected from a representative sample of 608 US social media users. The data are analyzed using topic modeling and semantic network analysis to unpack the multidimensionality of social media privacy. These dimensions are further examined in relation to established demographic antecedents of privacy concerns and behaviors. Results indicate the dominance of frames related to horizontal dimensions of privacy, or privacy vis-à-vis peers, as compared with the vertical dimensions, or privacy vis-à-vis institutions. In addition, the findings suggest that user conceptualization of privacy reflects a cognate-based approach that emphasizes control and limits to information access. Implications for privacy research, policy, and technology design are discussed.

Perceived information sensitivity and interdependent privacy protection: a quantitative study

From a theoretical point of view, previous research has considered information sensitivity in terms of potential negative consequences for someone who has disclosed information to others and that information becomes public. However, making information public could also have negative consequences for other individuals as well. In this study, we extend the concept of information sensitivity to include negative consequences for other individuals and apply it in a quantitative research study. The results prove that the extended concept of information sensitivity leads to a better understanding of privacy-related concepts especially in an interdependent privacy setting. We contribute to theory by defining the extended concept of information sensitivity and by drawing conclusions on how to use it in future privacy research studies.

פרטיות: תמונת מצב Privacy: A Snapshot

תקציר בעברית: שוב ושוב שמענו בעשורים האחרונים על מותה של הפרטיות, אולם למרות ההכרזות הרבות על מותה, הפרטיות חיה ובועטת. מדינות מבקשות לאסוף מידע מוקדם כדי למנוע טרור גלובלי ומקומי ולאכוף את החוק; תאגידים אוספים מידע פרטי בשם היעילות והחדשנות ולשם המודל העסקי שלהם; התקשורת מבקשת לפרסם מידע מסוגים שונים בשם חופש הביטוי וחופש העיתונות; אנחנו מבקשים לדעת עוד על חברים; הרשתות השונות – באינטרנט וברשת הסלולרית – מעודדות אותנו לשתף ומתעקשות ששיתוף הוא ברכה. כל אלה הם אינטרסים לגיטימיים וחשובים אבל הם לא ניצבים לבד בזירה. מולם ניצבת הפרטיות שלנו, כנורמה חברתית וכזכות משפטית. כנורמה חברתית – אנחנו עדיין מתעקשים על הפרטיות גם כשנדמה לנו שהיא אבדה; גם ילדים ובני נוער רוצים פרטיות, אף על פי שלנו המבוגרים נדמה לעתים אחרת. כזכות משפטית – הפרטיות היא זכות יסוד באמנות בין-לאומיות רבות, בחוקות רבות וגם בחוק יסוד: כבוד האדם וחירותו בישראל.למרות הלחצים, הביקורות וההספדים על הפרטיות, כל אחת מאיתנו זקוקה למרחב פרטי וכל אחד צריך מקום שקט שבו אפשר לתהות, לנסות, לחשוב ולהתבטא, וגם לטעות, בלי מעקב ממשטר וממשמע. זהו מרחב שבו אנחנו יכולים להיות עצמנו, מרחב שבו האוטונומיה שלנו מתקיימת, מרחב שבו אנחנו – ולא אחרים – מקבלים החלטות לגבי עצמנו ומממשים בכך את כבוד האדם שלנו. זה המרחב שבו אנחנו מממשים את השליטה שלנו במידע על אודותינו. בהתאם, זו תפיסת הפרטיות כשליטה.המשא ומתן החברתי על הפרטיות שלנו הוא אחד המאפיינים הבולטים של החברה האנושית בראשית המאה העשרים ואחת. מאמר זו הוא ההקדמה לכרך של כתב העת משפט, חברה ותרבות, שמבקש לברר סוגיות שונות בלב הפרטיות ואת הטלטלה הדרמטית שהיא חווה בשנים האחרונות. המאמר – הקדמה לספר – מתארת בקצרה את אבני הבניין של השיח על אודות הפרטיות – המעבר לחיים מידעיים (כלומר מבוססי-מידע) וחברת המעקב; אצביע על הרקע של הדיון, שהוא הוויכוח החברתי הנמשך בדבר עצם חשיבותה של הפרטיות; אתאר את הכלים שעומדים לרשותנו להגן על הפרטיות – כלים משפטיים, חברתיים וטכנולוגיים; אשרטט בקווים כלליים תמונת מצב עכשווית של הזכות לפרטיות בדין הישראלי ושל המחקר בתחום, ואציג בתמציתיות את מאמרי הכרך. English Abstract: Repeatedly we have heard in recent years that “privacy is dead”. Nevertheless, privacy is alive and kicking. States collect data to fight terrorism and to enforce the law; corporations process data to support innovation and their business models; the media is interested in publishing data in the name of freedom of the press; we want to know more about our “friends”, and so called social networks encourage us to share data, explaining that sharing is caring. These are all legitimate interests, but they are not the only ones. As a social norm, we still insist on our privacy; as a legal right – it is protected as a fundamental human right. Despite the criticism of privacy, each of us needs a private space, where we can wonder, experiment, think and speak, as well as making mistakes, without a disciplining gaze. The social negotiation about our privacy is one of the main characteristics of contemporary society. The current volume of Law, Society & Culture (in Hebrew; abstracts in English) seeks to inquire some of the issues at the heart of this debate. This introductory chapter outlines the building blocks of the privacy discourse: the shift to informational lives, and the intensification of the surveillance society. The chapter provides an overview of the state of privacy research, and a contemporary snapshot of privacy in Israeli law.

Mitigating e-services avoidance: the role of government cybersecurity preparedness

PurposeThe purpose of this study is to understand why individuals choose to avoid using e-services due to security concerns and perceived risk when these factors are affected by the perceived degree of government cybersecurity preparedness against cyberattacks.Design/methodology/approachThe authors adopt the information systems success model to predict the role of government security preparedness efforts in influencing the determinants of e-services avoidance. The conceptual model includes four variables: security concerns, perceived risk of cyberattacks, perceived government cybersecurity preparedness and e-services avoidance. Data from 774 participants were used to analyze our conceptual model.FindingsFirst, the findings show that security concerns regarding personal information safety and perceived risk of cyberattacks are barriers to e-services use, with the former having a stronger effect. Second, the findings showed that perceived government cybersecurity preparedness significantly reduces security concerns and perceived risk of cyberattacks. Third, the post hoc group analysis between individuals with a bachelor’s degree or higher versus those without a bachelor’s degree showed that the effect of both security concerns and perceived risk of cyberattacks on e-services avoidance was greater for individuals without a bachelor’s degree. The same relationship between perceived risk of cyberattacks and e-services avoidance was not supported for individuals with a bachelor’s degree or higher.Originality/valueExtant privacy research fails to adequately examine the role of institutional factors, such as government efforts, and how these mitigate or amplify cybersecurity concerns and risks related to e-services. This research takes the first step toward addressing this limitation by examining the influence of government cybersecurity preparedness efforts on the determinants of e-services avoidance.

Ensuring High-Quality Private Data for Responsible Data Science

High-quality data is critical for effective data science. As the use of data science has grown, so too have concerns that individuals’ rights to privacy will be violated. This has led to the development of data protection regulations around the globe and the use of sophisticated anonymization techniques to protect privacy. Such measures make it more challenging for the data scientist to understand the data, exacerbating issues of data quality. Responsible data science aims to develop useful insights from the data while fully embracing these considerations. We pose the high-level problem in this article, “How can a data scientist develop the needed trust that private data has high quality?” We then identify a series of challenges for various data-centric communities and outline research questions for data quality and privacy researchers, which would need to be addressed to effectively answer the problem posed in this article.