YaPPL - A Lightweight Privacy Preference Language for Legally Sufficient and Automated Consent Provision in IoT Scenarios

Ulbricht, Max-R.; Pallas, Frank

doi:10.1007/978-3-030-00305-0_23

Cited by 26 publications

(24 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A recent approach towards facilitating informed and GDPR-compliant user consent is proposed by Ulbricht and Pallas [27]. The authors present a privacy preference language, called YaPPL, that is targeted on consent for data practices on the Internet of Things (IoT).…”

Section: Technical Solutions For Seeking Consentmentioning

confidence: 99%

Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR

Machuletz

Böhme

2020

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

The European Union’s General Data Protection Regulation (GDPR) requires websites to ask for consent to the use of cookies for specific purposes. This enlarges the relevant design space for consent dialogs. Websites could try to maximize click-through rates and positive consent decision, even at the risk of users agreeing to more purposes than intended. We evaluate a practice observed on popular websites by conducting an experiment with one control and two treatment groups (N = 150 university students in two countries). We hypothesize that users’ consent decision is influenced by (1) the number of options, connecting to the theory of choice proliferation, and (2) the presence of a highlighted default button (“select all”), connecting to theories of social norms and deception in consumer research. The results show that participants who see a default button accept cookies for more purposes than the control group, while being less able to correctly recall their choice. After being reminded of their choice, they regret it more often and perceive the consent dialog as more deceptive than the control group. Whether users are presented one or three purposes has no significant effect on their decisions and perceptions. We discuss the results and outline policy implications.

show abstract

Section: Technical Solutions For Seeking Consentmentioning

confidence: 99%

Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR

Machuletz

Böhme

2020

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…3 shorturl.at/hlmS2 LPL. A privacy preference language, called YaPPL, was introduced in order to realize user consent requirements of GDPR within an IoT ecosystem [8]. This work also aligns with the focus of our efforts, however the verification of user consent based on the purposes of data processing was not undertaken in a transparent and automatic way in YaPPL.…”

Section: Gdpr Use For Cloud Servicesmentioning

confidence: 75%

Privacy & Cloud Services: Are We There Yet?

Marikyan

Llanos

Barati

et al. 2021

2021 IEEE International Conference on Service-Oriented System Engineering (SOSE)

View full text Add to dashboard Cite

The General Data Protection Regulation (GDPR) remains an important requirement for many electronic services which utilise user data. GDPR compliance verification for a cloud provider is aimed to confirm that personal data provided by a user is shared in-line with the requirements of this legislation, so that any subsequent audit carried out on the provider does not lead to a financial penalty. This verification involves two aspects: (i) ensuring that user consent has been obtained; (ii) sharing of data with external cloud providers is undertaken in a transparent way, so that the user is aware of which providers the information was shared with and for what purpose. Using a survey we describe why users are still ambivalent about the use of GDPRand how its adoption can be improved using a Blockchain-based architecture that can provide greater transparency on how GDPR compliance is supported by cloud providers.

show abstract

“…Beyond this, we also introduce vocabulary elements for Recipients, Third Country Transfers, Special Category (Art. 9 GDPR), Profiling, and Purposes (here we integrated YaPPL [28]). All of these vocabulary elements consist of curated fields for declaring all relevant information according to table 1 (see Req.…”

Section: Transparency Vocabularymentioning

confidence: 99%

“…Besides, all utilizers and purposes can each be grouped if they concern the same processing activity. For a future version, we also consider directed acyclic graph structures for linking and building hierarchies between these entities and categories thereof such as described in related work [28].…”

Section: Managing Transparency Informationmentioning

confidence: 99%

TIRA: An OpenAPI Extension and Toolbox for GDPR Transparency in RESTful Architectures

Grünewald,

Wille,

Pallas

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Transparency -the provision of information about what personal data is collected for which purposes, how long it is stored, or to which parties it is transferred -is one of the core privacy principles underlying regulations such as the GDPR. Technical approaches for implementing transparency in practice are, however, only rarely considered. In this paper, we present a novel approach for doing so in current, RESTful application architectures and in line with prevailing agile and DevOps-driven practices. For this purpose, we introduce 1) a transparency-focused extension of OpenAPI specifications that allows individual service descriptions to be enriched with transparency-related annotations in a bottomup fashion and 2) a set of higher-order tools for aggregating respective information across multiple, interdependent services and for coherently integrating our approach into automated CI/CD-pipelines. Together, these building blocks pave the way for providing transparency information that is more specific and at the same time better reflects the actual implementation givens within complex service architectures than current, overly broad privacy statements.

show abstract

YaPPL - A Lightweight Privacy Preference Language for Legally Sufficient and Automated Consent Provision in IoT Scenarios

Cited by 26 publications

References 11 publications

Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR

Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPR

Privacy & Cloud Services: Are We There Yet?

TIRA: An OpenAPI Extension and Toolbox for GDPR Transparency in RESTful Architectures

Contact Info

Product

Resources

About