Privacy by design is a great idea, but it needs a push to move it from theory into practice. Even with willingness, doing privacy by design is hard. It requires commitment to understand the practices, terminology and epistemic commitments of ordinarily distinct communities. To help this process, we throw an offering into the ring: information privacy cards. We’re using these over the next year in a Horizon and MSR project in a series of industry and higher education workshops. We want to explore their practical utility in ‘doing’ privacy by design . They are designed as an ideation tool to help technology designers explore the legal implications of their work and they build on prior work presented in Seoul at CHI 2015 last year. The concept is gaining traction internationally, as we have a US partner project at NYU too. Ewa Luger and me also did a couple of seminars on the concept last month to the UK ICO.
I’ve spent some time over the past few months working on developing the legal text for the new cards which are now complete and printed. The cards are meant to be much broader than the original version which focused on data breach notifications, the right to be forgotten, privacy by design and explicit consent. Now I’ve tried to translate the new EU General Data Protection Regulation (post trilogue version) into a more accessible form for non-lawyers. This was no easy task … it turns out taking large paragraphs of legalese and trying to translate them into a bite size chunks is tricky! Who would have thought! Nevertheless, in order to split up the law into more digestible parts I’ve clustered the cards thematically into action and background cards. Broadly, the action cards are system designer responsibilities like conducting PIAs, or ensuring security of data; end user rights like the right to erasure or to object; data protection principles & consent like purpose limitation and lawfulness of processing; and lastly international considerations like challenges of US data transfer.
There are also
background cards on core concepts in data protection like definitions of personal data or data controllers. A particularly challenging part of this process was capturing the intent behind the different legal provisions, whilst avoiding overloading the cards with legal jargon that designers may not be familiar with. The end result is 5 legal suites within a deck, alongside the system (eg smart car, wearable health tracker) , constraint (eg limited connection, low cost) and user (eg elderly, visually impaired) cards.
Aesthetically, the end result looks rather nice (thanks to Mike Golembewski from MSR) and I’ve included a couple of snaps of legal cards.
Originally posted at https://lachlansresearch.wordpress.com/2016/02/25/new-information-privacy-by-design-cards/
https://lachlansresearch.wordpress.com/2016/02/25/new-information-privacy-by-design-cards/
