User-Centered Privacy-by-Design

Presented by Oshrat Ayalon

Friday, August 16, 2019
3:00 p.m.
ICSI Room 6A

Title:User-Centered Privacy-by-Design

ABSTRACT

The concept of Privacy-by-Design (PbD) suggests embedding privacy protections into systems
during the initial design phase, rather than retroactively. PbD processes are now part of many
privacy regulatory frameworks, such as the Federal Trade Commission (FTC) and the European
Union General Data Protection Regulation (GDPR). However, PbD is also being criticized for
being too focused on compliance to privacy regulation, rather than on answering users’ privacy
expectations. In order to take the users into the development processes considerations, in my
dissertation, I investigate ways to implement PbD while taking a User-Centered Design
approach.
 
In this seminar, I will present the results of two sets of user studies. In the first set of studies, we
explored what is the effect of information framing on users’ perceptions of a system’s
appropriateness. We recruited a total of 952 participants, in which 743 participants were
recruited via Amazon Mechanical Turk (AMT), and 209 participants were students from Tel
Aviv University. We show that framing the system design using data flows results in evaluations
which are less critical, compared to using descriptions of personal experiences. To represent
personal experiences and to manipulate the design framing, we used Personas, which are
hypothetical archetypes of actual users. In an additional result, based on the students’ sample, we
show that students with professional engineering experience are less critical than other students
when assessing the systems’ appropriateness.
 
In the second set of studies, we investigated how A/B testing can be used to test how users
perceive their privacy in system designs. I will describe a series of three online experiments, with
1,313 participants that were recruited via AMT, in which we attempt to develop and validate the
reliability of a scale for Users’ Perceived Systems’ Privacy (UPSP). We found that users’
privacy perceptions of information systems consist of three distinctive aspects: institutional,
social and risk. We combined our scale with A/B testing methodology to compare different
privacy design variants for given background scenarios. Our results show that the methodology
and the scale are mostly applicable for evaluating the social aspects of privacy designs.
 
BIO
Oshrat Ayalon is a Ph.D. candidate at the Faculty of Engineering at Tel Aviv University. Her
research focuses on usable privacy in areas such as online social networks and privacy
engineering