{"title":"Beware: Processing of Personal Data—Informed Consent Through Risk Communication","authors":"Lukas Seiling;Rita Gsenger;Filmona Mulugeta;Marte Henningsen;Lena Mischau;Marie Schirmbeck","doi":"10.1109/TPC.2024.3361328","DOIUrl":null,"url":null,"abstract":"<bold>Background:</b>\n The General Data Protection Regulation (GDPR) has been applicable since May 2018 and aims to further harmonize data protection law in the European Union. Processing personal data based on individuals’ consent is lawful under the GDPR only if such consent meets certain requirements and is “informed,” in particular. However, complex privacy notice design and individual cognitive limitations challenge data subjects’ ability to make elaborate consent decisions. Risk-based communication may address these issues. \n<bold>Literature review:</b>\n Most research focuses on isolated aspects of risk in processing personal data, such as the actors involved, specific events leading to risk formation, or distinctive (context-dependent) consequences. We propose a model combining these approaches as the basis for context-independent risk communication. \n<bold>Research questions:</b>\n 1. What are relevant information categories for risk communication in the processing of personal data online? 2. Which potentially adverse consequences can arise from specific events in the processing of personal data online? 3. How can consequences in the processing of personal data be avoided or mitigated? \n<bold>Research methodology:</b>\n The GDPR was examined through a systematic qualitative content analysis. The results inform the analysis of 32 interviews with privacy, data protection, and information security experts from academia, Non-Governmental Organizations, the public, and the private sector. \n<bold>Results:</b>\n Risk-relevant information categories, specific consequences, and relations between them are identified, along with strategies for risk mitigation. The study concludes with a specified framework for perceived risk in processing personal data. \n<bold>Conclusion:</b>\n The results provide controllers, regulatory bodies, data subjects, and experts in the field of professional communication with information on risk formation in personal data processing. Based on our analysis, we propose information categories for risk communication, which expand the current regulatory information requirements.","PeriodicalId":46950,"journal":{"name":"IEEE Transactions on Professional Communication","volume":null,"pages":null},"PeriodicalIF":1.6000,"publicationDate":"2024-03-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10472565","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"IEEE Transactions on Professional Communication","FirstCategoryId":"98","ListUrlMain":"https://ieeexplore.ieee.org/document/10472565/","RegionNum":2,"RegionCategory":"文学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q2","JCRName":"COMMUNICATION","Score":null,"Total":0}
引用次数: 0
Abstract
Background:
The General Data Protection Regulation (GDPR) has been applicable since May 2018 and aims to further harmonize data protection law in the European Union. Processing personal data based on individuals’ consent is lawful under the GDPR only if such consent meets certain requirements and is “informed,” in particular. However, complex privacy notice design and individual cognitive limitations challenge data subjects’ ability to make elaborate consent decisions. Risk-based communication may address these issues.
Literature review:
Most research focuses on isolated aspects of risk in processing personal data, such as the actors involved, specific events leading to risk formation, or distinctive (context-dependent) consequences. We propose a model combining these approaches as the basis for context-independent risk communication.
Research questions:
1. What are relevant information categories for risk communication in the processing of personal data online? 2. Which potentially adverse consequences can arise from specific events in the processing of personal data online? 3. How can consequences in the processing of personal data be avoided or mitigated?
Research methodology:
The GDPR was examined through a systematic qualitative content analysis. The results inform the analysis of 32 interviews with privacy, data protection, and information security experts from academia, Non-Governmental Organizations, the public, and the private sector.
Results:
Risk-relevant information categories, specific consequences, and relations between them are identified, along with strategies for risk mitigation. The study concludes with a specified framework for perceived risk in processing personal data.
Conclusion:
The results provide controllers, regulatory bodies, data subjects, and experts in the field of professional communication with information on risk formation in personal data processing. Based on our analysis, we propose information categories for risk communication, which expand the current regulatory information requirements.
期刊介绍：
The IEEE Transactions on Professional Communication is a peer-reviewed journal devoted to applied research on professional communication—including but not limited to technical and business communication. Papers should address the research interests and needs of technical communicators, engineers, scientists, information designers, editors, linguists, translators, managers, business professionals, and others from around the globe who practice, conduct research on, and teach others about effective professional communication. The Transactions publishes original, empirical research that addresses one of these contexts: The communication practices of technical professionals, such as engineers and scientists The practices of professional communicators who work in technical or business environments Evidence-based methods for teaching and practicing professional and technical communication.
求助内容：
应助结果提醒方式：
京公网安备 11010802042870号
