Personal privacy through understanding and action: five pitfalls for designers

By Scott Lederer, Jason I. Hong, Anind K. Dey, James A. Landay. Personal and Ubiquitous Computing, 2004

352 citations recorded by the source corpus.

To participate in meaningful privacy practice in the context of technical systems, people require opportunities to understand the extent of the systems’ alignment with relevant practice and to conduct discernible social action through intuitive or sensible engagement with the system. It is a significant challenge to design for such understanding and action through the feedback and control mechanisms of today’s devices. To help designers meet this challenge, we describe five pitfalls to beware when designing interactive systems—on or off the desktop—with personal privacy implications. These pitfalls are: (1) obscuring potential information flow, (2) obscuring actual information flow, (3) emphasizing configuration over action, (4) lacking coarse-grained control, and (5) inhibiting existing practice. They are based on a review of the literature, on analyses of existing privacy-affecting systems, and on our own experiences in designing a prototypical user interface for managing privacy in ubiquitous computing. We illustrate how some existing research and commercial systems—our prototype included—fall into these pitfalls and how some avoid them. We suggest that privacy-affecting systems that heed these pitfalls can help users appropriate and engage them in alignment with relevant privacy practice.

Subfields: Information Systems, Sociology and Political Science, Human-Computer Interaction

View Paper: https://www.semanticscholar.org/paper/b28bf1feb36225a73950fc483328181ed683358a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Sociology and Political Science

In Human-Computer Interaction

Citations in the corpus

Nudges for Privacy and Security (2017, background): “Several studies have investigated feedback in the context of location-sharing applications [Sadeh et al. 2009; Lederer et al. 2004; Tsai et al. 2009; Iachello et al. 2005; Raento and Oulasvirta 2005; Jedrzejczyk et al. 2010].”
Privacy Expectations and Preferences in an IoT World (2017, background): “identified five “pitfalls” in designing systems, particularly in ubiquitous computing environments, which lead to negative implications for individual privacy [18].”
Privacy and Data Protection by Design - from policy to engineering (2014, background): “Such dashboards have to be carefully designed to ensure that they do not mislead users and actually do not worsen rather than improve the situation [138].”
Counteracting the Negative Effect of Form Auto-completion on the Privacy Calculus (2013, background): “Giving people control over their disclosure decisions would thus empower them to carefully choose the level of privacy they desire (Lederer et al. 2004; Sadeh et al. 2009).”
Location disclosure to social relations: why, when, & what people want to share (2005, background): “Similarly, Lederer et al. [ 15 ] warned that designs should not require excessive configuration to create and maintain privacy, since configurations are de-situated from the contexts to which they apply.”
Online Privacy and the Disclosure of Cookie Use: Effects on Consumer Trust and Anticipated Patronage (2008, methodology): “Moreover, browsers do not allow users to understand when the cookies that persist on their hard drives are actually used (in essence, retrieved rather than set) by visited Web sites and how the retrieving Web sites use them (Lederer et al. 2004; Millett, Friedman, and Felten 2001).”
A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements (2011, background): “For instance, the concept of personal information feedback tools has been promoted [16, 17] to help users gain privacy awareness and self-determine which personal data to disclose.”
Privacy risk models for designing privacy-sensitive ubiquitous computing systems (2004, background): “In a related paper, we offer a set of pitfalls in designing user interfaces for privacy [24] and ubicomp design patterns for privacy [11].”
An architecture for privacy-sensitive ubiquitous computing (2004, background): “10 Parts of this chapter were previously published as [95] in the journal Personal and Ubiquitous Comput ing.”
Urban sensing systems: opportunistic or participatory? (2008, neutral): “On the other hand, studies by Palen and Dourish [17] and Lederer, et al [13] argue that a priori con.guration of applications that disclose private information will usually not work given the dynamics of life.”
The Third Wave?: Inclusive Privacy and Security (2017, neutral): “In addition, there are more design-oriented privacy frameworks [12, 40, 52, 57, 87].”
Information Privacy Research: An Interdisciplinary Review (2011, background): “Yet, many legal and social scholars (Altman 1975, 1977; Hirshleifer 1980; Laufer and Wolfe 1977; Lederer et al. 2004; Malhotra et al. 2004; Margulis 1977a, 2003a; Solove 2004, 2006, 2008; Waldo et al. 2007; Westin 1967, 2001, 2003) believe that general privacy—its conceptual understanding, rigorous…”