The Curious Case of Usable Privacy: Challenges, Solutions, and Prospects (Synthesis Lectures on Information Security, Privacy, and Trust)

Preface
Contents
Acronyms
1 Introduction to Usable Privacy
	1.1 Introduction
	1.2 Why Privacy and Usable Privacy Matter
		1.2.1 Privacy as a Fundamental Right
		1.2.2 The Need for Usable Privacy Enhancing Technologies
	1.3 Aims and Scope of This Book
	1.4 Defining the Terms and Concepts
		1.4.1 Privacy and Data Protection
		1.4.2 The GDPR and Other Laws
		1.4.3 GDPR Roles and Concepts
		1.4.4 Technical Data Protection Goals and Terms
		1.4.5 Privacy by Design
		1.4.6 Privacy-Enhancing Technologies (PETs)
		1.4.7 Human-Computer Interaction (HCI)
		1.4.8 Usability
		1.4.9 Human-Centred Design (HCD)
		1.4.10 Usable Privacy
		1.4.11 Metaphors
		1.4.12 Mental Models
		1.4.13 Nudging and Dark Patterns
	1.5 Related Surveys and Books
2 Background: Privacy Laws and Technologies
	2.1 Introduction
	2.2 Laws for Privacy Protection
		2.2.1 First Laws for Data Protection
		2.2.2 The European Legal Privacy and Data Protection Framework
		2.2.3 Further European Privacy Legislation
		2.2.4 Privacy Legislation in Non-European Countries Including the USA
	2.3 Technologies and Tools to Protect and Enhance Privacy
		2.3.1 PETs to ``Minimise\'\'
		2.3.2 PETs to ``Hide\'\'
		2.3.3 PETs to ``Separate\'\'
		2.3.4 PETs to ``Aggregate\'\'
		2.3.5 PETs to ``Inform\'\'
		2.3.6 PETs to ``Control\'\'
		2.3.7 PETs to ``Enforce\'\'
		2.3.8 PETs to ``Demonstrate\'\'
3 Overview of Usable Privacy Research: Major Themes and Research Directions
	3.1 Introduction
	3.2 Approach
		3.2.1 Method
		3.2.2 Delimitation and Further Work
	3.3 Usable Privacy in the Context of IoT
		3.3.1 Smart Home Devices
		3.3.2 Wearables
		3.3.3 Helping People Make Better Privacy Decisions in the Context of IoT
		3.3.4 Gaps and Future Directions
	3.4 Efforts Towards More Inclusive Privacy
		3.4.1 Risk Factors Amplifying Privacy Risks of Marginalised People
		3.4.2 Privacy-Protection Practices and Barriers to Effective Mechanisms
		3.4.3 Recommendations for Better Privacy Protection
		3.4.4 Gaps and Future Directions
	3.5 Improving Privacy Through Usable Privacy for Developers
		3.5.1 Developers\' Barriers to Embedding Privacy
		3.5.2 Developers and App Permissions
		3.5.3 Privacy Views and Practices Based on Natural Conversations
		3.5.4 Gaps and Future Directions
	3.6 Adoption, Usability, and Users\' Perceptions of PETs
		3.6.1 Encryption
		3.6.2 Anonymity
		3.6.3 Differential Privacy
	3.7 Towards Usable Privacy Notice and Choice and Better Privacy Decisions
4 Challenges of Usable Privacy
	4.1 Introduction
	4.2 Challenges of Conducting Usable Privacy Research
		4.2.1 Challenge of Encompassing Different and Sometimes Specific Users
		4.2.2 Prioritised and Conflicting Goals
		4.2.3 Difficulty of Measuring the Right Thing and Privacy Paradox
		4.2.4 The Issue of Ecological Validity
		4.2.5 Specific Ethical and Legal Challenges
	4.3 HCI Challenges Related to Privacy Technologies
		4.3.1 Challenges of Explaining ``Crypto Magic\'\' and the Lack of Real-World Analogies
		4.3.2 Challenges and Need to Cater for ``digital-World\'\' Analogies
		4.3.3 Challenges of Usable Transparency-Enhancing Tools
	4.4 HCI Challenges Related to Privacy Laws
		4.4.1 The Discrepancy Between Privacy Laws and What People Need
		4.4.2 Problems with Notice and Choice
5 Addressing Challenges: A Way Forward
	5.1 Introduction
	5.2 Human-Centred and Privacy by Design Approaches Combined
	5.3 Encompassing Different Types of Users
		5.3.1 Inclusive Design
		5.3.2 Culture-Dependent Privacy Management Strategies and Privacy Profiles
	5.4 Configuring PETs and Addressing Conflicting Goals
	5.5 Privacy as a Secondary Goal—Attracting Users\' Attention
		5.5.1 Content, Form, Timing, and Channel of Privacy Notices
		5.5.2 Engaging Users with Privacy Notices
	5.6 Designing Usable Privacy Notices
		5.6.1 Multi-layered Privacy Notices
		5.6.2 Providing Usable Choices
		5.6.3 Personalised Presentations
		5.6.4 Visual Presentations
		5.6.5 Informing Users About Policy Mismatches
		5.6.6 Avoiding Dark Patterns
	5.7 (Semi-)automated Privacy Management Based on Defaults and Dynamic Support
	5.8 Explaining PETs
	5.9 Usable Transparency and Control
	5.10 Guidance for Mapping (GDPR) Privacy Principles to HCI Solutions
6 Lessons Learnt, Outlook, and Conclusions
	6.1 Introduction
	6.2 Key Takeaways
	6.3 Outlook
	6.4 Final Conclusions