Tools for Achieving Usable Ex Post Transparency: A Survey <s> 2) COMPREHENSIBILITY <s> Privacy-enhanced Identity Management can enable users to retain and maintain informational self-determination in our networked society. This paper describes the usability research work that has been done within the first year of the European Union project on "Privacy and Identity Management for Europe" (PRIME). It primarily discusses and compares three alternative Ul paradigms for privacy-enhanced Identity Management, and presents how important legal privacy principles derived from the European Union Directives have been mapped into suggestions of user interface solutions for PRIME. Besides, it discusses results and encountered problems from conducted usability tests on mock-ups implementing the different Ul paradigms and proposes means for addressing those problems. The paper concludes with remarks on the characteristics of usability work for privacy-enhancing technologies. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 2) COMPREHENSIBILITY <s> Today's rich service offer in the World Wide Web increasingly requires the disclosure of personal user data. Service providers' appetite for personal user data, however, is accompanied by growing privacy implications for Internet users. Addressing this rising threat, privacy-enhancing technologies aim at aiding users in protecting their personal data. Even though effective privacy laws facilitate users to edit and revoke already disclosed personal data, few PET solutions support users in exercising this right. Available tools lack intuitive interfaces and are built on powerful infrastructures on the provider side. In this paper we introduce the Data Disclosure Log component within a user-centric privacy architecture. Built on a browser-based logging extension, we present a visualization tool that displays past personal data disclosures from different perspectives. A graph-based view allows for the dynamic presentation of relations between selected entity types. Such an overview enables users to know the conditions of past personal data transactions at any time. This knowledge represents a prerequisite for an ex post revision or revocation of personal data. Usability and user acceptance of the developed prototype is evaluated in a conducted user test. <s> BIB002 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 2) COMPREHENSIBILITY <s> Today's smartphone applications expect users to make decisions about what information they are willing to share, but fail to provide sufficient feedback about which privacy-sensitive information is leaving the phone, as well as how frequently and with which entities it is being shared. Such feedback can improve users' understanding of potential privacy leakages through apps that collect information about them in an unexpected way. Through a qualitative lab study with 19 participants, we first discuss misconceptions that smartphone users currently have with respect to two popular game applications that frequently collect the phone's current location and share it with multiple third parties. To measure the gap between users' understanding and actual privacy leakages, we use two types of interfaces that we developed: just-in-time notifications that appear the moment data is shared and a visualization that summarizes the shared data. We then report on participants' perceived benefits and concerns regarding data sharing with smartphone applications after experiencing notifications and having viewed the visualization. We conclude with a discussion on how heightened awareness of users and usable controls can mitigate some of these concerns. <s> BIB003 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 2) COMPREHENSIBILITY <s> Location-Based Mobile Service (LBMS) is one of the most popular smartphone services. LBMS enables people to more easily connect with each other and analyze the aspects of their lives. However, sharing location data can leak people's privacy. We present PDVLoc, a controlled location data-sharing framework based on selectively sharing data through a Personal Data Vault (PDV). A PDV is a privacy architecture in which individuals retain ownership of their data. Data are routinely filtered before being shared with content-service providers, and users or data custodian services can participate in making controlled data-sharing decisions. Introducing PDVLoc gives users flexible and granular access control over their location data. We have implemented a prototype of PDVLoc and evaluated it using real location-sharing social networking applications, Google Latitude and Foursquare. Our user study of 19 participants over 20 days shows that most users find that PDVLoc is useful to manage and control their location data, and are willing to continue using PDVLoc. <s> BIB004 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 2) COMPREHENSIBILITY <s> We present a prototype of the user interface of a transparency tool that displays an overview of a user's data disclosures to different online service providers and allows them to access data collected about them stored at the services' sides. We explore one particular type of visualization method consisting of tracing lines that connect a user's disclosed personal attributes to the service to which these attributes have been disclosed. We report on the ongoing iterative process of design of such visualization, the challenges encountered and the possibilities for future improvements. <s> BIB005
Comprehensibility 26 issues may arise due to the violation of one or more design principles for usable software, such as 'suitability for the task,' 'self-descriptiveness' and the 'conformity with the expectations of the users'  . Such discrepancies relate to a lack of comprehension and consciousness on the part of the user  , mitigating her ability to correctly interpret the system status or to aptly exercise control in order to change that status as a result of a rational decision  ,  . The availability of 'help and documentation'  is desirable; however, it would ideally not be necessary for TETs that are truly self-descriptive. A deviation of the user's mental model from the functionality provided by a TET can be detected via user evaluations. However, only some of the surveyed papers include evaluation results about the users' ability to comprehend the data processing and data flows visualised by the evaluated TET. In the user study conducted by Kolter et al. BIB002 , participants stated that they found the user control of the TET 'intuitive' and that all information was clearly presented. Likewise, most test subjects of the user study conducted by Hsieh et al.  stated that they found the TET 'intuitive' and 'easy to use.' However, some users stated the flexibility of the UI comes at the price of a tedious bootstrapping process. Some test subjects in the user study conducted by Mun et al. BIB004 stated that they appreciated the functionality of the TET but would have preferred an UI that is more intuitive. The study conducted by Balebako et al. BIB003 indicates that users have difficulty distinguishing between technical terms that the designers of the TET had taken for granted. Users mentioned, for example, that the difference between the 'phone number' and 'phone ID' of a mobile phone is not self-explanatory. Evaluations of 'Data Track' ('GenomSynlig') by Angulo et al. BIB005 revealed that test subjects had difficulty differentiating the client site, where data disclosures were logged locally, from the service side assessable via the UI in exercising their data subject rights to access and intervenability. These results confirmed results gained via previous usability studies that revealed that the users' mental models of data flows between client and services sites and of Internet data flows often do not match with the real world BIB001 , thus conflicting with the usability principle 'match between system and the real world'  .