The need for aggregating privacy policies is present in a variety of application areas today. In traditional client/server models, websites host services along with their policies in different private domains. However, in a cloud-computing platform where aggregators can merge multiple services, users often face complex decisions in terms of choosing the right services from service providers. In this computing paradigm, the ability to aggregate policies as well as services will be useful and more effective for users that are privacy conscious regarding their sensitive or personal information. This thesis studies the problems associated with the Platform for Privacy Preference (P3P) language, and the present issues with communicating and understanding the P3P language. Furthermore, it discusses some efficient strategies and algorithms for the matching and the merging processes, and then elaborates on some privacy policy conflicts that may occur after merging policies. Lastly, the thesis presents a tool for matching and merging P3P policies. If successful, the merge produces an aggregate policy that is consistent with the policies of all participating service providers.

No description available.

The need for aggregating privacy policies is present in a variety of application areas today. In traditional client/server models, websites host services along with their policies in different private domains. However, in a cloud-computing platform where aggregators can merge multiple services, users often face complex decisions in terms of choosing the right services from service providers. In this computing paradigm, the ability to aggregate policies as well as services will be useful and more effective for users that are privacy conscious regarding their sensitive or personal information. This thesis studies the problems associated with the Platform for Privacy Preference (P3P) language, and the present issues with communicating and understanding the P3P language. Furthermore, it discusses some efficient strategies and algorithms for the matching and the merging processes, and then elaborates on some privacy policy conflicts that may occur after merging policies. Lastly, the thesis presents a tool for matching and merging P3P policies. If successful, the merge produces an aggregate policy that is consistent with the policies of all participating service providers.

Social media platforms have to provide a privacy or data policy for users of their services and these legal documents tend to demonstrate characteristics of poor user experience design. A majority of users have difficulties understanding the privacy policy due to the long and legalistic nature of these documents, which will result in fewer readers. By investigating the users’ attitudes towards the privacy policy on the social media platform Instagram, a prototype of an alternative privacy policy aimed to enhance the users’ engagement was designed. The Double Diamond model was used to investigate the design process of the prototype. This included an initial literature study together with qualitative interviews. The results from the interviews showed that participants rarely read privacy policies due to their long and illegible nature and that a more comprehensible policy would be helpful. The final design of the prototype was created iteratively after feedback from the user tests. The novel prototype was found to be easy to comprehend and faster to navigate than the original data policy. The majority of the users also expressed a preference for the alternative prototype. The interesting results from this preliminary study can be taken further in a full-scale study with a larger participant sample with representation from different age groups. / Sociala medieplattformar måste tillhandahålla en integritet eller datapolicy för användare av sina tjänster och dessa juridiska handlingar tenderar att visa egenskaper av dålig användarupplevelse. En majoritet av användarna har svårigheter att förstå integritetspolicyn på grund av den långa och legalistiska karaktären hos dessa dokument, vilket i sin tur resulterar i färre läsare. Genom att undersöka användarnas attityder till integritetspolicyn på den social medieplattformen Instagram, var en prototyp av en alternativ integritetspolicy som syftar till att förbättra användarnas engagemang utformad. Double Diamond-modellen användes för att undersöka prototypens designprocess. Detta inkluderade en första litteraturstudie tillsammans med kvalitativa intervjuer. Resultatet från intervjuerna visade att deltagarna sällan läste integritetspolicys på grund av deras långa och oläsliga natur och att en mer begriplig policy skulle vara till hjälp. Den slutliga utformningen av prototypen skapades iterativt efter återkoppling från användartester. Den nya prototypen visade sig vara lätt att förstå och snabbare för att navigera än den ursprungliga datapolicyn. Majoriteten av användarna uttryckte också en preferens för den alternativa prototypen. De intressanta resultaten från denna preliminära studie kan vidtas ytterligare i en fullskalig studie med ett större antal deltagare och representation från olika åldersgrupper.

Technological advancement has transformed our lives by bringing unparalleled convenience and efficiency. Data, particularly consumer data, essential for influencing businesses and developing personalized experiences, is at the heart of this transition. Companies may improve consumer satisfaction and loyalty by using data analysis to customize their products and services. However, the collection and utilization of consumer data raise privacy concerns. Protecting customers’ personal information is essential to maintaining trust, respecting individual autonomy, and preventing unauthorized access or misuse. Along with the protection of data, transparency is also another essential factor. When companies or organizations deal with users’ data, they are liable to inform these users of anything and everything that happens with their data. Our study focuses on the online privacy policies of Google Chrome browser extensions. We have tried to find the extensions that comply with the data protection guidelines and if all Google Chrome browser extensions are transparent enough to mention the details as per guidelines. Utilizing the power of Natural Language Processing (NLP) techniques, we have employed advanced methodologies to extract insights from these policies.

Intresset för den personliga hälsan ökar inom samtliga sociala grupper. Människor vill få utökad kontroll över hur sin hälsosituation och de tar till allt fler hjälpmedel för att kunna få bättre svar. Med det digitala samhället nära till hands dyker det upp allt fler tjänster och produkter som agerar hjälpmedel för att produktens användare ska kunna få en större och bättre kontroll över sin hälsa. Produkter och tjänster som gör detta ingår i området Internet of Sports. I samband med att fler användare ansluter sig till dessa tjänster och produkter ökar därmed också datamängden de samlar in. Skyddas denna data i överföringen mellan användaren och företagen och skyddar de som samlar in datan användarens personliga integritet? Uppsatsens syfte är att undersöka detta genom att granska utvalda företag som verkar inom Internet of Sports och se om det går att komma över användarnas personliga data genom man in the middle-attacker. / The interest for personal health is growing in all demographic groups. People want better control regarding their personal health and they are using more aids to get better answers. With the digital society close to hand new products and services are appearing to aid users to get a better knowledge and control of their personal health. The products and services that aim to do this are categorized as Internet of Sports. As more users are signing up for and using these products and services the gathering of data is growing. Is the data that these companies gather safely transfered from the user to the companies and are the companies protecting the user’s privacy? The thesis’ purpose is to examine chosen companies within Internet of Sports and to see if it is possible to access the user’s personal data through man in the middle attacks.

Utvecklingen av digital teknik tillsammans med nya affärsmodeller har nått nya nivåer under de senaste åren vilket har resulterat i att behandlingen av personuppgifter både ökat och förändrats. Problematiken med detta innefattar att den personliga integriteten i större utsträckning kränks. I syfte att harmonisera behandlingen av personuppgifter och att stärka skyddet av den personliga integriteten har EU infört en ny dataskyddsförordning. Förordningen träder i kraft den 25 maj 2018 och ska tillämpas i nationell lagstiftning vilket gör att den svenska personuppgiftslagen ersätts. Syftet med studien var att identifiera vilka åtgärder ett antal organisationer vidtagit för att följa dataskyddsförordningens regler samt vilka utmaningar som kan uppstå i omställningen. Studien är avgränsad till samtyckestexter och behandling av personuppgifter. Studien är kvalitativ och vi har med hjälp av intervjuer tagit del av ett antal organisationers syn på utmaningar och åtgärder gällande formuleringar av samtyckestexter och dess personuppgiftsbehandling. Slutsatsen i denna studie visar att samtliga organisationerna har problem att formulera samtyckestexter på ett informativt sätt vilket dataskyddsförordningen kräver. Organisationerna ser även utmaningar i behandlingen av personuppgifter. Dessa utmaningar består av komplexa IT-system innehållande mängder av personuppgifter som idag inte kan hanteras i enlighet med dataskyddsförordningen då relevant systemstöd saknas. / The rapid development of digital technology together with new business models has reached new levels in recent years, which has resulted in the processing of personal data both increasing and changing. The problem with this development involves the violation of personal integrity to a greater extent. In order to harmonize the processing of personal data and to strengthen the protection of personal privacy, the EU has introduced a new data protection regulation. The regulation will enter into force on May 25, 2018 and will apply in national legislation, which will replace the Swedish Personal Data Act. The purpose of the study was to identify what measures a number of organizations have taken to comply with the rules of data protection regulations and the challenges that may arise in the conversion. The study is limited to consent texts and processing of personal data. The study is qualitative and we have, through interviews, taken note of a number of organizations' views on challenges and measures regarding formulas of consent texts and their personal data processing. The conclusion in this study shows that all organizations have problems formulating consent texts in an informative way, which is required for adequate data protection. Organizations also see challenges in the processing of personal data. These challenges consist of complex IT systems containing amounts of personal data that today cannot be managed in accordance with the Data Protection Regulation, as relevant system support is lacking.

Users today are concerned about how their information is collected, stored and used by Internet sites. Privacy policy languages, such as the Platform for Privacy Preferences (P3P), allow websites to publish their privacy practices and policies in machine readable form. Currently, software agents designed to protect users' privacy follow a "take it or leave it" approach when evaluating these privacy policies. This approach is inflexible and gives the server ultimate control over the privacy of web transactions. Privacy policy negotiation is one approach to leveling the playing field by allowing a client to negotiate with a server to determine how that server collects and uses the client's data. We present a privacy policy negotiation protocol, "Or Best Offer", that includes a formal model for specifying privacy preferences and reasoning about privacy policies. The protocol is guaranteed to terminate within three rounds of negotiation while producing policies that are Pareto-optimal, and thus fair to both parties. That is, it remains fair to both the client and the server.

When joining a new service, in order to access its features, users are often required to accept the terms of service and privacy policy. However, the readership of these documents is mostly non-existent, leaving an information asymmetry, the imbalance of knowledge between two parties. Due to this, users are sacrificing their online data privacy without being aware of the consequences. The purpose of this work is to investigate the readership of terms of service and privacy policies among users of social media services. We implemented a prototype called ‘ShareIt’, which resembles a photo-sharing platform to gain insight about readership, behavior and effectiveness of our adjusted presentations of terms of service and privacy policies in regard to readership and comprehension. We conducted a survey experiment using the prototype with 31 participants and concluded, that 80,6% of our participants did not spend more than ten seconds in our terms of serviceand privacy policy. The observed behavior suggests, that social media users are used to sharing information on the internet which in addition to their trust towards online services leads to the aforementioned low readership. We presented adjustments to the presentation of terms of service and privacy policies which showed a slight tendency of higher engagement in comparison to the current way of accessing these documents. This result however, due to the lack of readership examined for our participants, has to remain debatable and needs further investigation.

[pt] A adoção de modelos de inteligência artificial está alterando a relação entre organizações e consumidores e o volume de produtos digitais dependentes de dados pessoais cresce a cada dia. As políticas de privacidade são o principal instrumento de informação do cidadão sobre como suas informações serão tratadas por empresas com as quais se relaciona. Porém, atualmente, as interfaces destes instrumentos não comunicam de forma objetiva suas informações. O presente estudo demonstra que a aplicação de diretrizes de design nas políticas de privacidade promove uma experiência mais satisfatória e uma aquisição de informação mais rápida de seu conteúdo pelos usuários. A metodologia do estudo abarcou uma revisão bibliográfica, pesquisa documental, adaptação da escala Internet Users’ Information Privacy Concerns, teste de usabilidade e análise de conteúdo. Literaturas de direito e design foram relacionadas para identificar requisitos legais que poderiam ser melhor atendidos por meio do design, o nível de preocupação com a privacidade dos participantes foi verificado e um teste comparativo de usabilidade foi conduzido. Uma réplica da política do Facebook foi comparada à nova proposta, que contava com elementos que representavam diretrizes de design. Os dados mostraram redução no tempo para localização de informações e na taxa de erro entre os usuários que acessaram a nova proposta, assim como maior frequência de declarações positivas a respeito desta versão. A pesquisa contribui para a ampliação do conhecimento sobre a influência do design de interface na construção destes instrumentos ao esclarecer que a consideração de boas práticas deste campo facilita a aquisição de informação. / [en] The use of artificial intelligence models is changing the relationship between organizations and consumers, and the volume of digital products dependent on personal data is growing every day. Privacy policies are the primary tool for informing citizens about how their information will be handled by companies with which they interact. However, currently, the interfaces of these instruments do not objectively communicate their information. The present study demonstrates that the application of design guidelines in privacy policies promotes a more satisfactory experience and faster user acquisition of information from its content. The study methodology encompassed a bibliographical review, documentary research, adjustment of the Internet Users Information Privacy Concerns scale, usability testing, and content analysis. Literature from law and design fields could be interconnected to identify legal requirements that could be addressed more effectively through design, the level of privacy concern of the study s participants was verified, and a comparative usability test was conducted. A replica of Facebook s policy was compared to a new interface, which included elements that represented design guidelines. The data showed a reduction in the time to find information, the error rate among users who accessed the new proposal, and a higher frequency of positive statements regarding this version. This research enhances the understanding of how interface design affects the creation of such instruments by showing that following best practices in this area facilitates information acquisition.