Tools for Achieving Usable Ex Post Transparency: A Survey <s> I. INTRODUCTION <s> The Trustguide project builds on previous work completed under the Foresight Cyber Trust Project, and seeks to set guidelines for the research, development and delivery of trustworthy ICT. Trustguide extends this earlier work by continuing the dialogue through a series of workshops at which individuals can experience new technologies under development, and understand the related trust issues first-hand. The research laboratories of HP and BT are providing technologies (proof-of-concepts and on-going research) to enable attendees to engage more fully with the issues. Trustguide is partly funded by the DTI under the Sciencewise initiative. The work is being carried out by HP and BT through a collaborative fifteen-month project that is ongoing. This paper describes the work originally begun by Foresight and the latest phase being undertaken now by Trustguide. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> I. INTRODUCTION <s> This paper provides a short survey on transparency tools for privacy purposes. It defines the term transparency tools, argues why they are important and gives examples for transparency tools. A classification of transparency tools is suggested and some example tools are analyzed with the help of the classification. <s> BIB002 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> I. INTRODUCTION <s> The paper investigates the ethics of information transparency (henceforth transparency). It argues that transparency is not an ethical principle in itself but a pro-ethical condition for enabling or impairing other ethical practices or principles. A new definition of transparency is offered in order to take into account the dynamics of information production and the differences between data and information. It is then argued that the proposed definition provides a better understanding of what sort of information should be disclosed and what sort of information should be used in order to implement and make effective the ethical practices and principles to which an organisation is committed. The concepts of "heterogeneous organisation" and "autonomous computational artefact" are further defined in order to clarify the ethical implications of the technology used in implementing information transparency. It is argued that explicit ethical designs, which describe how ethical principles are embedded into the practice of software design, would represent valuable information that could be disclosed by organisations in order to support their ethical standing. <s> BIB003 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> I. INTRODUCTION <s> Just as a burn is an injury caused by heat, so is privacy harm a unique injury with specific boundaries and characteristics. This Essay describes privacy harm as falling into two related categories. The subjective category of privacy harm is the unwanted perception of observation. This category describes unwelcome mental states – anxiety, embarrassment, fear – that stem from the belief that one is being watched or monitored. Examples include everything from a landlord listening in on his tenants to generalized government surveillance. The objective category of privacy harm is the unanticipated or coerced use of information concerning a person against that person. These are negative, external actions justified by reference to personal information. Examples include identity theft, the leaking of classified information that reveals an undercover agent, and the use of a drunk-driving suspect’s blood as evidence against him. The subjective and objective categories of privacy harm are distinct but related. Just as assault is the apprehension of battery, so is the unwanted perception of observation largely an apprehension of information-driven injury. The categories represent, respectively, the anticipation and consequence of a loss of control over personal information. The approach offers several advantages. It uncouples privacy harm from privacy violations, demonstrating that no person need commit a privacy violation for privacy harm to occur (and vice versa). It creates a “limiting principle” capable of revealing when another value – autonomy or equality, for instance – is more directly at stake. It also creates a “rule of recognition” that permits the identification of a privacy harm when no other harm is apparent. Finally, the approach permits the sizing and redress of privacy harm – including privacy in public – in novel ways. <s> BIB004 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> I. INTRODUCTION <s> As the amount of users' information collected and exchanged on the Internet is growing, so are, consequently, the users' concerns that their privacy might be violated. Some studies have shown that a large number of users avoid engaging in online services due to privacy concerns. It has been suggested that increased transparency of privacy related mechanisms may promote users' trust. This paper reviews the relationship between users' privacy concerns, transparency enhancing and privacy enhancing mechanisms on the one hand, and users' trust on the other, based on the existing literature. Our literature review demonstrates that previous studies have produced inconsistent results, implying this relationship should be re-examined in future work. Impact of higher transparency on users' trust has been insufficiently studied. Current research seems to suggest that the increase of the understanding of privacy issues increases importance of privacy for trust. Use of privacy enhancing mechanisms by service provider also seems to promote the trust, but this may only hold when these mechanisms are understood by the user. A need for tools that would provide users with this kind of knowledge has also been repeatedly recognized. Additionally, this paper provides an overview and description of the currently available transparency enhancing tools. To the best of our knowledge, no such overview has been available to this end. We demonstrate that the majority of tools promote awareness. Most of them attempt to provide a better understanding of privacy policies, or provide insight in the third party tracking behavior. Two tools have been identified that provide some insight in the collected user's data. No tool providing specific information on, or access to, processing logic has been identified. <s> BIB005 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> I. INTRODUCTION <s> Privacy and data protection constitute core values of individuals and of democratic societies. There have been decades of debate on how those values -and legal obligations- can be embedded into systems, preferably from the very beginning of the design process. One important element in this endeavour are technical mechanisms, known as privacy-enhancing technologies (PETs). Their effectiveness has been demonstrated by researchers and in pilot implementations. However, apart from a few exceptions, e.g., encryption became widely used, PETs have not become a standard and widely used component in system design. Furthermore, for unfolding their full benefit for privacy and data protection, PETs need to be rooted in a data governance strategy to be applied in practice. This report contributes to bridging the gap between the legal framework and the available technological implementation measures by providing an inventory of existing approaches, privacy design strategies, and technical building blocks of various degrees of maturity from research and development. Starting from the privacy principles of the legislation, important elements are presented as a first step towards a design process for privacy-friendly systems and services. The report sketches a method to map legal obligations to design strategies, which allow the system designer to select appropriate techniques for implementing the identified privacy requirements. Furthermore, the report reflects limitations of the approach. It concludes with recommendations on how to overcome and mitigate these limits. <s> BIB006
Transparency of personal data processing can play an important factor for establishing user trust in applications. As previous studies show, trust in an application can be enhanced if procedures are clear, transparent and reversible, so that users feel in control  , BIB001 . Transparency is also an important privacy principle, and a means for meeting with information asymmetry, which, according to Calo BIB004 , arises due to different, unbalanced perspectives of multiple parties as a potential privacy harm. It is a prerequisite for the data subjects 1 to control their personal spheres, and thus to exercise their rights of informational self-determination. In particular, it is a precondition for 'intervenability' as specified by ENISA BIB006 . Intervenability allows data subjects to 'intervene' with ongoing or planned  A data subject is a natural person about whom personal data is processed. processing of their personal data, for example by requests to correct, block or erase the data. As the German constitutional court declared in its Census Decision, transparency is not only crucial as an individual basic right but also for democracy: ''A society in which individuals can no longer ascertain who knows what about them and when and a legal order that makes this possible would not be compatible with the right to informational selfdetermination.'' Self-determination is in turn ''an elementary prerequisite for the functioning of a free democratic society predicated on the freedom of action and participation of its members'' [5] . Throughout this survey, the term 'transparency' 2 refers to the property of 'visibility' as specified by Turilli et al. BIB003 . In this context, transparency is described as a state in which any obstacles that may impede the visibility of the underlying data are being mitigated. In a transparent environment, data that have been disclosed previously by a data subject are accessible later for information and for enabling future decisions. Processes that aim at being transparent depend on factors such as the availability and accessibility of respective transparency-enhancing mechanisms. Such processes depend on ethical, business and legal factors, all of which may impose constraints on the stakeholders involved in storing and processing the underlying data. In that regard, the meaning of the term transparency differs from the alternative meaning often implied in computer science and computing, BIB004 which denotes the property of 'invisibility,' such as hiding the implementation details of a process or component from the user of the system BIB003 . Most Western privacy and data protection laws or guidelines grant data subjects with extensive information, access and control rights for enforcing transparency and intervenability. For instance, the OECD Privacy Guidelines  aim at enforcing transparency and intervenability by their 'Openness' and 'Individual Participation' principles. The EU General Data Protection Regulation (GDPR)  , which came into force in May 2016 and will apply in EU member states from May 25th, 2018, provides data subjects with extensive rights for transparency, intervenability and control. In contrast to the high level statement of transparency principles of the OECD Guidelines, it defines in much detail what transparency should comprise. For this reason, this survey is based on the legal stipulations by the GDPR. The concept of transparency comprises both 'ex ante transparency' and 'ex post transparency'  . Ex ante transparency informs about the intended data collection, processing and disclosure, and thus enables the anticipation of consequences before data are actually disclosed, for example with the help of privacy policy statements. Ex post transparency provides insight about what data were collected, processed or disclosed by whom and to whom, and whether the data processing has been in conformance with negotiated or stated policies and should particularly inform about consequences if data already have been revealed. Transparency Enhancing Tools (TETs) can help individuals to exercise their right for transparency, and subsequently for intervenability, by technological means. TETs can be defined as tools providing insight into how the users' data are being collected and processed, and visualise related consequences in an accurate and comprehensible way BIB005 . Even though research has been conducted on ex ante and ex post TETs, as well as on the usability of both types of TETs, technical standards for how such tools should be implemented are still missing. Existing implementations often focus on a handpicked selection of features, but it is not always clear how the respective feature sets relate to the underlying legal principles and societal needs. As far as the authors are aware, no classification of ex post TETs exists that explicitly focuses on usability and that is based on a systematic review of such artifacts in the scientific body of knowledge. This paper presents a survey for assessing the state of the art of ex post TETs for enhancing privacy and their usability aspects in the scientific literature. It aims to discuss and classify them in terms of their common features, unique characteristics and overarching concepts. The authors' focus has especially been on surveying ex post TETs and their usability features, which support users to achieve ex post transparency and which may also enable them to subsequently exercise their intervenability rights, for the following reasons: The GDPR has specifically extended the data subject rights to ex post transparency BIB006 and to intervenability. 5 Besides, the GDPR emphasises that transparency should be provided in a concise, intelligible and easily accessible, that is usable, form. Usable ex post TETs that enable end users to exercise these data subject rights of access and to intervenability online will therefore play an even more important role for the users' privacy self-protection in the future, which has motivated this survey on usable ex post TETs. Moreover, the authors' decision to focus on ex post TETs was also motivated by the fact that in comparison to ex ante TETs, which comprise a broad range of technical tools and concepts, the area of ex post TETs is less researched and the scope is more limited. Existing literature surveys on TETs BIB005 , BIB002 have neither focused in depth on ex post TETs nor on recent TETs and their usability. In that regard, this survey analyses the means employed by the reviewed ex post TETs to provide their respective functionality, and seeks to find patterns in the attempt to make the tools usable by the target audience. In the specific context of ex post TETs, this survey aims to make a contribution to science by answering the following questions: 1) What are the characteristics of usable ex post TETs for enhancing privacy published in scientific literature? 2) How can these TETs be classified? 3) How does the proposed classification relate to and differ from the findings of previous surveys on TETs and PETs? 4) What aspects of usable ex post TETs are not covered by the TETs in the reviewed literature? The remainder of this paper is organised as follows: Section II derives legal privacy and Human Computer Interaction (HCI) principles for usable transparency that will be used as a basis for the classification and assessment. Section III discusses previous work related to the subject matter. Section IV elaborates on the method that led to the selection of the reviewed literature, and consequently the basic set of TETs that are discussed throughout the rest of BIB006 For example by extending the right of data access with the right to receive also an electronic copy of their data undergoing processing, and by allowing the data subjects to receive the information in a commonly used electronic form for request done by electronic means. 5 For example by extending the right to data erasure, that is, the 'right to be forgotten,' and introducing the right to data portability. the paper. Section V proposes a classification scheme based on the characteristics detected in the reviewed TETs. Section VI summarises and assesses the major findings obtained by classifying the TETs of the reviewed literature, and discusses limitations of the reviewed state of the art literature in terms of the derived principles for usable transparency. Thereby, it also shows aspects of TETs areas that are worthwhile to research and develop further. Section VII finally concludes the paper with major conclusions with regard to the research questions.