How to make privacy policies both GDPR-compliant and usable

Karen Renaud; Lynsay Shepherd

doi:10.1109/CyberSA.2018.8551442

How to make privacy policies both GDPR-compliant and usable

Karen Renaud
, Lynsay Shepherd

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution book

43 Citations (Scopus)

17 Downloads (Pure)

Abstract

It is important for organisations to ensure that their privacy policies are General Data Protection Regulation (GDPR) compliant, and this has to be done by the May 2018 deadline. However, it is also important for these policies to be designed with the needs of the human recipient in mind. We carried out an investigation to find out how best to achieve this.We commenced by synthesising the GDPR requirements into a checklist-type format. We then derived a list of usability design guidelines for privacy notifications from the research literature. We augmented the recommendations with other findings reported in the research literature, in order to confirm the guidelines. We conclude by providing a usable and GDPR-compliant privacy policy template for the benefit of policy writers.

Original language	English
Title of host publication	2018 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)
Place of Publication	Piscataway, New Jersey
Publisher	IEEE
Number of pages	8
ISBN (Electronic)	978-1-5386-4565-9
ISBN (Print)	978-1-5386-4566-6
DOIs	https://doi.org/10.1109/CyberSA.2018.8551442
Publication status	Published - 29 Nov 2018
Event	Cyber Science 2018 - Glasgow, United Kingdom Duration: 11 Jun 2018 → 12 Jun 2018 https://c-mric.org/csa2018

Conference

Conference	Cyber Science 2018
Abbreviated title	Cybser SA 2018
Country/Territory	United Kingdom
City	Glasgow
Period	11/06/18 → 12/06/18
Internet address	https://c-mric.org/csa2018

Keywords

privacy
guidelines
usability
companies
design methodology
data privacy
data protection

Access to Document

10.1109/CyberSA.2018.8551442

Renaud-Shepherd-IEEE-CSA2018-How-to-make-privacy-policies-both-GDPR-compliant-usableAccepted author manuscript, 1.73 MB

https://rke.abertay.ac.uk/en/publications/how-to-make-privacy-policies-both-gdpr-compliant-and-usable

Cite this

@inproceedings{066c1fe3c462444898d50affb046adfa,

title = "How to make privacy policies both GDPR-compliant and usable",

abstract = "It is important for organisations to ensure that their privacy policies are General Data Protection Regulation (GDPR) compliant, and this has to be done by the May 2018 deadline. However, it is also important for these policies to be designed with the needs of the human recipient in mind. We carried out an investigation to find out how best to achieve this.We commenced by synthesising the GDPR requirements into a checklist-type format. We then derived a list of usability design guidelines for privacy notifications from the research literature. We augmented the recommendations with other findings reported in the research literature, in order to confirm the guidelines. We conclude by providing a usable and GDPR-compliant privacy policy template for the benefit of policy writers.",

keywords = "privacy, guidelines, usability, companies, design methodology, data privacy, data protection",

author = "Karen Renaud and Lynsay Shepherd",

note = "{\textcopyright} 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting /republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.; Cyber Science 2018, Cybser SA 2018 ; Conference date: 11-06-2018 Through 12-06-2018",

year = "2018",

month = nov,

day = "29",

doi = "10.1109/CyberSA.2018.8551442",

language = "English",

isbn = "978-1-5386-4566-6",

booktitle = "2018 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)",

publisher = "IEEE",

url = "https://c-mric.org/csa2018",

}

TY - GEN

T1 - How to make privacy policies both GDPR-compliant and usable

AU - Renaud, Karen

AU - Shepherd, Lynsay

N1 - © 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting /republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

PY - 2018/11/29

Y1 - 2018/11/29

N2 - It is important for organisations to ensure that their privacy policies are General Data Protection Regulation (GDPR) compliant, and this has to be done by the May 2018 deadline. However, it is also important for these policies to be designed with the needs of the human recipient in mind. We carried out an investigation to find out how best to achieve this.We commenced by synthesising the GDPR requirements into a checklist-type format. We then derived a list of usability design guidelines for privacy notifications from the research literature. We augmented the recommendations with other findings reported in the research literature, in order to confirm the guidelines. We conclude by providing a usable and GDPR-compliant privacy policy template for the benefit of policy writers.

AB - It is important for organisations to ensure that their privacy policies are General Data Protection Regulation (GDPR) compliant, and this has to be done by the May 2018 deadline. However, it is also important for these policies to be designed with the needs of the human recipient in mind. We carried out an investigation to find out how best to achieve this.We commenced by synthesising the GDPR requirements into a checklist-type format. We then derived a list of usability design guidelines for privacy notifications from the research literature. We augmented the recommendations with other findings reported in the research literature, in order to confirm the guidelines. We conclude by providing a usable and GDPR-compliant privacy policy template for the benefit of policy writers.

KW - privacy

KW - guidelines

KW - usability

KW - companies

KW - design methodology

KW - data privacy

KW - data protection

UR - http://www.c-mric.org/index.php/csa2018

U2 - 10.1109/CyberSA.2018.8551442

DO - 10.1109/CyberSA.2018.8551442

M3 - Conference contribution book

SN - 978-1-5386-4566-6

BT - 2018 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)

PB - IEEE

CY - Piscataway, New Jersey

T2 - Cyber Science 2018

Y2 - 11 June 2018 through 12 June 2018

ER -

How to make privacy policies both GDPR-compliant and usable

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this