Privacy and proportionality: adapting legal evaluation techniques to inform design in ubiquitous computing

ABSTRACT

We argue that an analytic proportionality assessment balancing usefulness and burden on individual or group privacy must be conducted throughout the design process to create acceptable ubiquitous computing (ubicomp) applications and services. We introduce the principle of proportionality, which originates within the legal and data protection communities. Inspired by this principle, we develop a design method for ubicomp applications, based on our own experience, and aimed at HCI practitioners and designers. We discuss the method in relation to real-world examples, user inquiry techniques and requirements engineering models. Finally, we report a sample application of the method, involving a ubiquitous, personal memory aid tool.

REFERENCES

• 1: Mark S. Ackerman , Lorrie Faith Cranor , Joseph Reagle, Privacy in e-commerce: examining user scenarios and privacy preferences, Proceedings of the 1st ACM conference on Electronic commerce, p.1-8, November 03-05, 1999, Denver, Colorado, United States [doi>10.1145/336992.336995]
• 2: Barkhuus, L., Dey, A. Location-Based Services for Mobile Telephony: a study of users' privacy concerns. Proc. Interact 2003, IOS Press, (2003) 709--712.
• 3: Belair, R., Bock, C. Police Use of Remote Camera Systems for Surveillance of Public Streets. Surveillance, Dataveillance and Personal Freedoms: Use and Abuse of Information Technology, Columbia Human Rights Law Review, Burdick, Fair Lawn, NJ, USA (1973). ISBN 0-913638-03-X.
• 4: Bellotti, V., Sellen, A. Design for Privacy in Ubiquitous Computing Environments. Proc. ECSCW '93, Kluwer A.P., Dordrecht, The Netherlands (1993).
• 5: Jacques Berleur , Klaus Brunnstein, Ethics of computing: codes, spaces for discussion and law, Chapman & Hall, Ltd., London, UK, 1996
• 6: Boehm B.W., Bose, P., Horowitz, E., Lee, M.J. Software Requirements As Negotiated Win Conditions, in Proc. First International Conference on Requirements Engineering, IEEE Press (1994), 74--83.
• 7: Michael Boyle , Christopher Edwards , Saul Greenberg, The effects of filtered video on awareness and privacy, Proceedings of the 2000 ACM conference on Computer supported cooperative work, p.1-10, December 2000, Philadelphia, Pennsylvania, United States [doi>10.1145/358916.358935]
• 8: British Institute of International and Comparative Law, The implementation of Directive 95/46/EC to the Processing of Sound and Image Data (2003). http://europa.eu.int/comm/internal_market/privacy.
• 9: Eric S. Chung , Jason I. Hong , James Lin , Madhu K. Prabaker , James A. Landay , Alan L. Liu, Development and evaluation of emerging design patterns for ubiquitous computing, Proceedings of the 2004 conference on Designing interactive systems: processes, practices, methods, and techniques, August 01-04, 2004, Cambridge, MA, USA [doi>10.1145/1013115.1013148]
• 10: Electronic Privacy Information Center, Privacy Guidelines for the National Information Infrastructure - A Review of the Proposed Principles of the Privacy Working Group, Report 94-1 (1994). http://www.epic.org
• 11: European Commission Article 29 Working Party. Opinion 4/2004 on the Processing of Personal Data by means of Video Surveillance. 11750/02/EN WP89 (2004). http://europa.eu.int.
• 12: European Commission Article 29 Working Party. Working Document on Biometrics. 12168/02/EN WP80 (2003). http://europa.eu.int.
• 13: Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. European Union Official Journal L281 (1995), 31--50.
• 14: Garfinkel, S. Adopting Fair Information Practices to Low Cost RFID Systems. Presented at Ubicomp 2002 Privacy Workshop (2002).
• 15: Geason S., Wilson, P. Preventing graffiti and vandalism. Australian Institute of Criminology, Canberra, Australia (1990). ISBN 0-642-14936-4.
• 16: Hall, E. The Hidden Dimension: Man's use of Space in Public and Private. Doubleday, New York, NY (1966).
• 17: Hayes G., Patel, S.N., Truong, K.N., Iachello, G., Kientz, J.A., Farmer, R., Abowd, G.D. The Personal Audio Loop: Designing a Ubiquitous Audio-Based Memory Aid, Proc. Mobile HCI 2004.
• 18: Jason I. Hong , Jennifer D. Ng , Scott Lederer , James A. Landay, Privacy risk models for designing privacy-sensitive ubiquitous computing systems, Proceedings of the 2004 conference on Designing interactive systems: processes, practices, methods, and techniques, August 01-04, 2004, Cambridge, MA, USA [doi>10.1145/1013115.1013129]
• 19: Scott E. Hudson , Ian Smith, Techniques for addressing fundamental privacy and disruption tradeoffs in awareness support systems, Proceedings of the 1996 ACM conference on Computer supported cooperative work, p.248-257, November 16-20, 1996, Boston, Massachusetts, United States [doi>10.1145/240080.240295]
• 20: Jacobs, A., Abowd, G.D. A framework for comparing perspectives on privacy and pervasive technologies. IEEE Pervasive Computing, 2, 4 (2003), 78--84.
• 21: Xiaodong Jiang , Jason I. Hong , James A. Landay, Approximate Information Flows: Socially-Based Modeling of Privacy in Ubiquitous Computing, Proceedings of the 4th international conference on Ubiquitous Computing, p.176-193, September 29-October 01, 2002, Göteborg, Sweden
• 22: Katz v. United States. 389 U.S. 347; 88 S.Ct. 507 (1967).
• 23: Marc Langheinrich, Privacy by Design - Principles of Privacy-Aware Ubiquitous Systems, Proceedings of the 3rd international conference on Ubiquitous Computing, p.273-291, September 30-October 02, 2001, Atlanta, Georgia, USA
• 24: Latour, B. We Have Never Been Modern, Harvard University Press (1993).
• 25: Lessig, L. The Architecture of Privacy. Vanderbilt Journal of Entertainment Law & Practice, 1, Spring 1999; 1 Vand. J. Ent. L. & Prac. 56.
• 26: Melenhorst, A.S., Fisk, A.D., Mynatt, E.D., Rogers, W.A. Potential intrusiveness of aware home technology: Perceptions of older adults. Proc. Human Factors and Ergonomics Society 48th Annual Meeting, HFES Press (2004), 266--270.
• 27: Müller, G., Rannenberg, K., eds. Multilateral Security in Communications - Technology, Infrastructure, Economy. Addison-Wesley-Longmann, München, (1999). ISBN 3-8273-1360-0.
• 28: Neustaedter, C., Greenberg, S. The Design of a Context-Aware Home Media Space for Balancing Privacy and Awareness. Proc. Ubicomp 2003, LNCS 2864, Springer Verlag (2003), 297--314.
• 29: Norris, C., Armstrong, G. The maximum surveillance society: The rise of CCTV. Berg, Oxford, England (1999). ISBN 1-85973-226-7.
• 30: Organization for Economic Cooperation and Development. Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980).
• 31: Leysia Palen , Paul Dourish, Unpacking "privacy" for a networked world, Proceedings of the SIGCHI conference on Human factors in computing systems, April 05-10, 2003, Ft. Lauderdale, Florida, USA [doi>10.1145/642611.642635]
• 32: Kai Rannenberg, Multilateral security a concept and examples for balanced security, Proceedings of the 2000 workshop on New security paradigms, p.151-162, September 18-21, 2000, Ballycotton, County Cork, Ireland [doi>10.1145/366173.366208]
• 33: Terrell, T., Jacobs A. Privacy, technology, and terrorism: Bartnicki, Kyllo, and the normative struggle behind competing claims to solitude and security. Emory Law Journal, 51, 4, Fall 2002, 1469--1511; 51 Emory L.J. 1469.
• 34: United Kingdom Information Commissioner, Data Protection Act 1998 Legal Guidance, http://www.dataprotection.gov.uk
• 35: United States Department of Health, Education and Welfare. Records, Computers and the Rights of Citizens, Report of the Secretary's Advisory Committee on Automated Personal Data Systems (1973).
• 36: United States Department of Health and Human Services. Standards for Privacy of Individually Identifiable Health Information; Final Rule, 45 CFR Parts 160 and 164 (2002).
• 37: Venkatesh, V., Morris, M.G., Davis, G.B., Davis, F.D. User Acceptance of Information Technology: Toward a Unified View. MIS Quarterly, 27, 3 (2003), 425--478.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.2 Design Tools and Techniques

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.1 Requirements/Specifications

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

General Terms:
Design, Legal Aspects

Keywords:
data protection, privacy, proportionality, sensing technology, social issues, ubiquitous computing