From Data Disclosure to Privacy Nudges: A Privacy-Aware and User-Centric Personal Data Management Framework

Abstract

0000−0002−0583−2688] , Shujun Li 1( )[0000−0001−5628−7328] , Athina Abstract. Although there are privacy-enhancing tools designed to protect users' online privacy, it is surprising to see a lack of user-centric solutions allowing privacy control based on the joint assessment of privacy risks and benefits, due to data disclosure to multiple platforms. In this paper, we propose a conceptual framework to fill the gap: aiming at the user-centric privacy protection, we show the framework can not only assess privacy risks in using online services but also the added values earned from data disclosure. Through following a human-in-the-loop approach, it is expected the framework provides a personalized solution via preference learning, continuous privacy assessment, behavior monitoring and nudging. Finally, we describe a case study towards "leisure travelers" and several future areas to be studied in the ongoing project.

From data flows to privacy‐benefit trade‐offs: A user‐centric semantic model

“…We will use behavioral nudging for the privacy recommender system, and the app will be developed to be personalized and independent of any third‐party services. The overarching framework we will follow to develop the app can be found in a related paper we published 2 …”

“…In addition to providing basic services, it is a common practice for service providers to share customers' personal data with other third‐party organizations, such as advertisers, insurers and relevant governmental bodies, due to legal requirements or some business reasons (eg, to offer more personalized services). Furthermore, many people actively share information about their lives online with other people, for example, on online social networks (OSNs) and web forums, 1,2 which further extends the scale of data sharing. While submitting personal information to a service application, people often follow a process known as privacy calculus in the literature to make decisions on data disclosures 3 .…”

“…Most past theoretical work on privacy ontologies and conceptual modeling focuses either on high‐level concepts or a narrow aspect or application domain (eg, privacy policies, OSNs). Except our preliminary work on the data‐flow graph model 1 and how such a model can be used to build a user‐centric privacy protection solution, 2 which form the basis of this extended work, we have not seen any work focusing on user‐centric data flows across different types of data consumers (services, organizations, other people, etc.). In addition, added values (ie, benefits) gained from using online services should be explored as the supplement.…”