No abstract

No abstract

Social media process (sometimes large amounts of) personal data of their users, usually on the basis of informed consent. In this article, a comparison is made between, on the one hand, existing practices of social media regarding informed consent for using personal data of users and, on the other hand, user expectations with regard to privacy and informed consent. The comparison is made on the basis of a set of criteria for informed consent distilled from an analytical bibliography. Next, the privacy policies of a selection of eight social network sites and user generated content sites are analyzed using this set of criteria for informed consent. User expectations regarding these criteria were derived from survey results of a large EU-wide online survey (N ¼ 8,621, 26 countries) on the awareness, values, and attitudes of social media users regarding privacy. We find that not all privacy policy criteria are important to users, but most criteria that are important to users can be found in most privacy policies.

In this paper, user expectations with regard to privacy and consent when using social media are compared with the EU legal framework for personal data protection. This analysis is based on a set of criteria for informed consent distilled from an analytical bibliography. User expectations regarding these criteria are derived from survey results. For each of the criteria for informed consent it is assessed whether there exists legal provisions in the existing EU personal data protection law and in the proposed legal framework in this area. A gap analysis between user expectations regarding each criterion and the availability or absence of related legal provisions shows that many but not all aspects of consent are addressed in both the current and the proposed legislation. Furthermore, the EU personal data protection legislation only provides a very general scope regarding consent and does not contain many details on what adequate consent procedures should look like. There is, at some points, a disconnect between the abstract legal provisions and the concrete practical implementations in the architecture and privacy statements of social media. Suggestions for solving these disconnects are made by suggesting changes at a practical level, by adjusting the legal framework, or both. Finally, the limits of the current models for personal data protection and consent are discussed.

No abstract