Advances of the state of the art produced by the ESRs aim at answering the research problem on how to protect citizens' privacy. The ESRs looked at this research problem with different perspectives. Their results range from socio-psychological and legal perspectives to technical data protection aspects.
We looked into instruments for measuring human attitudes and behaviors related to privacy decision making. We also built mathematical models for the decision making process that aim to better represent the interactive and reinforcing factors involved in deciding when to share or to share not personal data.
The results of our experiments on an individual's emotional state, visual cues and graphical representations of privacy policies, show that individuals can be nudged towards deciding whether to share their personal data or not depending on how the requests are displayed. This finding is important because it shows that it is possible to steer the decision of an individual to share personal data or not. Our results reinforced the idea that privacy decision making is neither purely rational nor purely irrational.
We worked on usability aspects that improve transparency. Hence, individuals can better understand what, when, how, and why their data is collected and later follow up if their personal data is processed accordingly. Better informed individuals can also better perceive and evaluate privacy risks, and we advanced the understanding of risk perception with a series of users studies. We looked into how men engaging in a dating app for meeting other men disclose their HIV status or not and how this decision affected others' perception of them. We proposed a number of design considerations that could mitigate stigmatization of users in these platforms.
We developed usable security and privacy tools following user-centered designs and produced a legal analysis on unfair data practices and proposed legal measures for preserving privacy and the autonomy of individuals. Following field studies on how people use NFC payment terminals, we redesigned the NFC payment experience to improve its usability, security and privacy with an improved screen design and sensory feedback. We also looked into personal data leaks in mobile apps and observed the positive practical impact of the GDPR in reducing the amount personal data leaks.
The general lack of access to graphical interfaces in IoT devices mean that is extremely difficult to understand what, why, how and when personal data is collected by these devices. We proposed the use of nutrition-like privacy labels to be printed on the package of those devices to make it transparent to the users so they would be able to easily compare functionally between similar IoT devices and decide beforehand on the conditions to share their personal data.
Concerning measurable results, the ESRs published 51 peer-reviewed and numerous general audience publications. The project successfully reached out to educate schoolchildren, teenagers and their teachers about privacy, especially in the context of social networks and smartphones, on events at local schools in the UK.
