Tools for Achieving Usable Ex Post Transparency: A Survey <s> 2) REVIEW PROCESS <s> This paper provides a short survey on transparency tools for privacy purposes. It defines the term transparency tools, argues why they are important and gives examples for transparency tools. A classification of transparency tools is suggested and some example tools are analyzed with the help of the classification. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 2) REVIEW PROCESS <s> As the amount of users' information collected and exchanged on the Internet is growing, so are, consequently, the users' concerns that their privacy might be violated. Some studies have shown that a large number of users avoid engaging in online services due to privacy concerns. It has been suggested that increased transparency of privacy related mechanisms may promote users' trust. This paper reviews the relationship between users' privacy concerns, transparency enhancing and privacy enhancing mechanisms on the one hand, and users' trust on the other, based on the existing literature. Our literature review demonstrates that previous studies have produced inconsistent results, implying this relationship should be re-examined in future work. Impact of higher transparency on users' trust has been insufficiently studied. Current research seems to suggest that the increase of the understanding of privacy issues increases importance of privacy for trust. Use of privacy enhancing mechanisms by service provider also seems to promote the trust, but this may only hold when these mechanisms are understood by the user. A need for tools that would provide users with this kind of knowledge has also been repeatedly recognized. Additionally, this paper provides an overview and description of the currently available transparency enhancing tools. To the best of our knowledge, no such overview has been available to this end. We demonstrate that the majority of tools promote awareness. Most of them attempt to provide a better understanding of privacy policies, or provide insight in the third party tracking behavior. Two tools have been identified that provide some insight in the collected user's data. No tool providing specific information on, or access to, processing logic has been identified. <s> BIB002
In the context of this survey, the review process BIB002 refers to the process of inspecting a data subject's personal data that have been disclosed to a data controller or data processor. The review locality refers to the locality of the system that hosts or enables the inspection process. Reviewing data is temporally, technically, and administratively decoupled from the preceding transaction logging process. The review process of a TET may therefore either be hosted on the same system that writes the transaction logs or on a system that differs in terms of its physical vicinity, its administrative domain, or its legal authority. If the localities of the two processes differ, the personal data disclosed earlier would have to be transferred from the logging locality to the review locality to be inspected there. Consequently, reviewing disclosed personal data is possible without transaction logs being written by a TET, in which case the review process solely relies on the data that are retrieved back from the data processor to which they were originally disclosed. The solid lines in Figure 5 signify two subsequent, decoupled processes that (1) detect personal data that are being BIB002 Review (noun): ''A formal assessment of something with the intention of instituting change if necessary.''  disclosed to a data controller and that (2) enable data subjects to review that data. The upper half of the figure above the dotted horizontal line signifies the sphere of influence of the TET, whereas the lower half signifies the sphere of influence of the data processor. TETs that maintain transaction logs (TL) themselves can use such supplementary information to compare nominally (PD) and actually disclosed data (TL). The platform selected to host the review process likewise falls in one of the three categories of client, server or third party, each signifying the exact same administrative domains as for the logging locality. A client-sided host operates in the immediate vicinity of the user and, as such, allows for direct interaction during the review process. In order to review disclosed personal data, the data must either already reside on the client system or first be downloaded from the remote host of the logging locality, e. g. by exercising the right of data portability. Intervenability regarding rectification or erasure of individual data items requires exercising the data subject's rights in the administrative domain of the data controller. Similarly, a review process hosted by a third party requires first transferring the collected transaction records from the logging locality host, and subsequently resubmitting any changes made to the personal data back to the entities that act as data controllers. Pre-and post-update transmissions can be omitted if the review process is provided by the primary service provider itself. Regardless of the locality of the entities involved, trust in the respective stakeholders is required, as pointed out by Hedbom BIB001 . In a scenario that builds its trust on ex post TETs, trust may or may not be required for more than one stakeholder, if logging locality and review process are distributed among multiple entities. The review locality was mostly found to be limited to a single entity. Either the disclosed personal data collected by the logging locality were available on the review process because both units coincided to begin with, or the reviewing user triggers a process that transfers the necessary data from one entity to the other. Either way, the visualisation of the data then lies with a single party.