Publications • Human-Centered Computing • Department of Mathematics and Computer Science

Communicating the Privacy-Utility Trade-off: Supporting Informed Data Donation with Privacy Decision Interfaces for Differential Privacy

Franzen, Daniel; Müller-Birn, Claudia; Wegwarth, Odette

New York: ACM | 2024

Appeared in: Proceedings of the ACM on Human-Computer Interaction 8, Computer-Supported Cooperative Work and Social Computing 1

Daniel Franzen, Claudia Müller-Birn, and Odette Wegwarth. 2024. Communicating the Privacy-Utility Trade- off: Supporting Informed Data Donation with Privacy Decision Interfaces for Differential Privacy. Proc. ACM Hum.-Comput. Interact. 8, CSCW1, Article 32 (April 2024), 56 pages. https://doi.org/10.1145/3637309

Data collections, such as those from citizen science projects, can provide valuable scientific insights or help the public to make decisions based on real demand. At the same time, the collected data might cause privacy risks for their volunteers, for example, by revealing sensitive information. Similar but less apparent trade-offs exist for data collected while using social media or other internet-based services. One approach to addressing these privacy risks might be to anonymize the data, for example, by using Differential Privacy (DP). DP allows for tuning and, consequently, communicating the trade-off between the data contributors' privacy and the resulting data utility for insights. However, there is little research that explores how to communicate the existing trade-off to users. % We contribute to closing this research gap by designing interactive elements and visualizations that specifically support people's understanding of this privacy-utility trade-off. We evaluated our user interfaces in a user study (N=378). Our results show that a combination of graphical risk visualization and interactive risk exploration best supports the informed decision, \ie the privacy decision is consistent with users' privacy concerns. Additionally, we found that personal attributes, such as numeracy, and the need for cognition, significantly influence the decision behavior and the privacy usability of privacy decision interfaces. In our recommendations, we encourage data collectors, such as citizen science project coordinators, to communicate existing privacy risks to their volunteers since such communication does not impact donation rates. %Understanding such privacy risks can also be part of typical training efforts in citizen science projects. %DP allows volunteers to balance their privacy concerns with their wish to contribute to the project. From a design perspective, we emphasize the complexity of the decision situation and the resulting need to design with usability for all population groups in mind. % We hope that our study will inspire further research from the human-computer interaction community that will unlock the full potential of DP for a broad audience and ultimately contribute to a societal understanding of acceptable privacy losses in specific data contexts.

Foregrounding Values through Public Participation: Eliciting Values of Citizens in the Context of Mobility Data Donation

Value Scenario

Sörries, Peter; Franzen, Daniel; Sperl, Markus; Müller-Birn, Claudia

New York: ACM | 2023

Appeared in: Mensch und Computer 2023 (MuC ’23), September 3–6, 2023, Rapperswil, Switzerland.

Citizen science (CS) projects are conducted with interested volunteers and have already shown promise for large-scale scientific research. However, CS tends to cultivate the sharing of large amounts of data. Towards this, our research aims to understand better citizens‘ potential privacy concerns in such participation formats. We, therefore, investigate how meaningful public participation can be facilitated to foreground citizens‘ values regarding mobility data donation in CS. In this regard, we developed a two-step method: (1) a workshop concept for participatory value elicitation and (2) an analysis procedure to examine the empirical data collected systematically. Our findings based on three workshops provide new directions for improving data donation practices in CS.

"Am I Private and If So, how Many?" -- Using Risk Communication Formats for Making Differential Privacy Understandable

"Am I Private and If So, how Many?"

Franzen, Daniel; Nunez von Voigt, Saskia; Sörries, Peter; Tschorsch, Florian; Müller-Birn, Claudia

arXiv.org | 2022

Mobility data is essential for cities and communities to identify areas for necessary improvement. Data collected by mobility providers already contains all the information necessary, but privacy of the individuals needs to be preserved. Differential privacy (DP) defines a mathematical property which guarantees that certain limits of privacy are preserved while sharing such data, but its functionality and privacy protection are difficult to explain to laypeople. In this paper, we adapt risk communication formats in conjunction with a model for the privacy risks of DP. The result are privacy notifications which explain the risk to an individual's privacy when using DP, rather than DP's functionality. We evaluate these novel privacy communication formats in a crowdsourced study. We find that they perform similarly to the best performing DP communications used currently in terms of objective understanding, but did not make our participants as confident in their understanding. We also discovered an influence, similar to the Dunning-Kruger effect, of the statistical numeracy on the effectiveness of some of our privacy communication formats and the DP communication format used currently. These results generate hypotheses in multiple directions, for example, toward the use of risk visualization to improve the understandability of our formats or toward adaptive user interfaces which tailor the risk communication to the characteristics of the reader.

Am I Private and If So, how Many? Communicating Privacy Guarantees of Differential Privacy with Risk Communication Formats

Overview and composition of the seven privacy risk notifications.

Franzen, Daniel; Nunez von Voigt, Saskia; Sörries, Peter; Tschorsch, Florian; Müller-Birn, Claudia

New York: ACM | 2022

Appeared in: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

Every day, we have to decide multiple times, whether and how much personal data we allow to be collected. This decision is not trivial, since there are many legitimate and important purposes for data collection, for examples, the analysis of mobility data to improve urban traffic and transportation. However, often the collected data can reveal sensitive information about individuals. Recently visited locations can, for example, reveal information about political or religious views or even about an individual's health. Privacy-preserving technologies, such as differential privacy (DP), can be employed to protect the privacy of individuals and, furthermore, provide mathematically sound guarantees on the maximum privacy risk. However, they can only support informed privacy decisions, if individuals understand the provided privacy guarantees. This article proposes a novel approach for communicating privacy guarantees to support individuals in their privacy decisions when sharing data. For this, we adopt risk communication formats from the medical domain in conjunction with a model for privacy guarantees of DP to create quantitative privacy risk notifications. We conducted a crowd-sourced study with 343 participants to evaluate how well our notifications conveyed the privacy risk information and how confident participants were about their own understanding of the privacy risk. Our findings suggest that these new notifications can communicate the objective information similarly well to currently used qualitative notifications, but left individuals less confident in their understanding. We also discovered that several of our notifications and the currently used qualitative notification disadvantage individuals with low numeracy: these individuals appear overconfident compared to their actual understanding of the associated privacy risks and are, therefore, less likely to seek the needed additional information before an informed decision. The promising results allow for multiple directions in future research, for example, adding visual aids or tailoring privacy risk communication to characteristics of the individuals.