Emerging technologies are hard to regulate because law changes slowly but technologies develop quickly. Information privacy concerns are a challenge for data driven systems, and the problem space is becoming increasingly complex with technologies like the Internet of Things. Governments and policymakers recognise the need to include technology designers in regulation, and are now advocating privacy by design (PbD).
PbD requires technology designers to think about privacy risks as early as possible in the design process, to address challenges ideally before anything is built and hits the market.
However, doing this in practice is complex. A key challenge is bringing the legal and design communities closer together. As Professor Tom Rodden explains: “designers struggle with many abstract legal concepts involved in regulation. The challenge is how to make these abstract legal concepts real and relevant for the designers”.
We want to support designers dealing with privacy in their work by sensitising them to information privacy laws in a constructive way. As a direct response to the new European Data Protection Law (GDPR), which legally mandates information privacy by design, we’ve developed a set of privacy ideation cards. These translate the law into a design tool that designers can engage with on their own terms. We tested these within a range of organisations to better understand use of the tool in practice.
Our idea has been gaining traction at the international level. We had a US partner project funded by the National Science Foundation for $175,000[4] at Tandon School of Engineering at New York University with partners at Intel, Microsoft and University of California, Irvine. This finished in Autumn 2016.
We presented the paper "Playing the Legal Card" at ACM SIGCHI 2015 in Seoul, South Korea. We’ve also had media coverage on technology news site the Register, and within the UK technology law community in the Society of Computers and Law publication, Computers and Law. In 2016, we presented the cards to the UK Information Commissioner Office at their ‘Know About’ sessions. ‘Privacy by Design in Action’ and both domestically and internationally at events in London, Edinburgh and Barcelona. In 2017, the cards are to be used as a teaching tool with Masters IT Law students at University of Strathclyde.
Based on this research, we identified need for greater support for small and medium technology companies and startups to address legal concerns. Accordingly, in the future we will conduct further research to develop design tools to support these communities.