Increasing Transparency and Privacy for Online Social Network Users – USEMP Value Model, Scoring Framework and Legal

In this paper we present research results from the multi-disciplinary EU research project USEMP (USEMP is a project funded from EU research framework, additional information about project scope and deliverables are available at project’s public website at: http://www.usemp-project.eu/). In particular, we look at the legal aspects of personal data licensing and profile transparency, the development of a personal data value model in Online Social Networks (OSNs) and the development of disclosure scoring and personal data value frameworks. In the first part of the paper we show how personal data usage licensing and profile transparency for OSN activities provides for Data Protection by Design (DPbD). We also present an overview of the existing personal data monetization ecosystem in OSNs and its possible evolutions for increasing privacy and transparency for consumers about their OSN presence. In the last part of the paper, we describe the USEMP scoring framework for personal information disclosure and data value that can assist users to better perceive how their privacy is affected by their OSN presence and what the value of their OSN activities is.

1. 1.

   On the legal effect of pseudo-anonymization see: Art. 29 WP Opinion 05/2014 on Anonymisation Techniques, and the upcoming General Data Protection Regulation (GDPR) that mitigates some of the obligations of data controllers if they process personal data that have been pseudo-anonymized. The legal definition of pseudo-anonymization (art. 4. 2(a) of the upcoming GDPR reads: 'pseudonjymous data' means personal data that cannot be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organizational measures to ensure non-attribution. A data controller is whoever determines the purpose of processing, i.e. the business model. The liability for compliance with EU Data Protection law rests solely with the data controller.

2. 2.

   Cf. expert interviews reported in [4] indicate a strong need on the side of the industry for a level playing field that will enable enterprises to act ethically sound, once they are sure that their competitors are forced to abide by the same rules.

3. 3.

   Once the legal ground or the purpose for processing has been exhausted personal data should be erased or anonymized, cf. art. 12 and 14 of the current Data Protection Directive D/95/46/EC (DPD).

4. 4.

   Note that art. 7.4 of the upcoming GDPR may prohibit this: ‘the execution of a contract or the provision of a service shall not be made conditional on the consent to the processing of data that is not necessary for the execution of the contract or the provision of the service pursuant to Article 6(1), point (b)’.

5. 5.

   We recognized that we need to qualify this as ‘perceived’ sensitivity, since when the law qualifies certain data as sensitive, based on art. 8 Data Protection Directive (DPD), this has major legal effect, which, however, does not depend on how a user ‘feels’ about the data.

6. 6.

   Clearly, these dimensions are not exhaustive and they do not necessarily match with the legal right to privacy as stipulated in art. 8 of the European Convention of Human Rights, or with the fundamental rights to privacy and data protection of the Charter of Fundamental Rights of the European Union. It is pivotal that perceived privacy and the right to privacy are understood on their own merits, taking note that the latter aims to provide the level playing field for users to develop their own privacy preferences.

7. 7.

   Botnia Living Lab is an environment in Sweden for human-centric research and the development and innovation of new ICT based solutions.

Authors and Affiliations

1. CEA, Paris, France

   A. Popescu, E. Gadeski & H. Le Borgne

2. Radboud University Nijmegen, Nijmegen, The Netherlands

   M. Hildebrandt & K. deVries

3. iMinds-SMIT, Etterbeek, Belgium

   J. Breuer, L. Claeys, R. Heyman & S. van der Graaf

4. CERTH-ITI, Thessaloniki, Greece

   S. Papadopoulos & G. Petkos

5. HW Communication Ltd, Lancaster, UK

   D. Lund

6. VELTI SA, Marousi, Greece

   T. Michalareas, T. Kastrinogiannis & A. Kousaridas

7. Luleå Tekniska Universitet, Luleå, Sweden

   A. Padyab

Corresponding author

Correspondence to T. Michalareas .

Editors and Affiliations

1. Department of Computer Science, KU Leuven, Heverlee, Belgium

   Bettina Berendt

2. Université du Luxembourg, Luxembourg, Luxembourg

   Thomas Engel

3. ENISA, Maroussi Attiki, Greece

   Demosthenes Ikonomou

4. Antenne Lyon La Doua, Inria, Villeurbanne, France

   Daniel Le Métayer

5. ENISA, Maroussi Attiki, Greece

   Stefan Schiffner

Reprints and permissions

© 2016 Springer International Publishing Switzerland

Policies and ethics