Problem Summary

In the digital age, users generate vast amounts of personal data across various platforms, leading to scattered and fragmented data storage managed by multiple service providers. This fragmentation poses significant challenges in ensuring data privacy, security, and user control. Users often lack the tools and understanding needed to manage their privacy preferences effectively, resulting in unintended data exposure and insufficient protection of personal information.

Rationale

To empower users with control over their personal data by implementing secure, user-centric personal data vaults that support advanced privacy management features and compliance with privacy regulations.

Solution

To implement personal data storages or Personal Data Vaults (PDVs) that give users comprehensive control over their personal data. These mechanisms should be equipped with advanced privacy management tools, automated decision-making capabilities, robust security measures, and compliance features to meet regulatory requirements.

Mun et al. [1] propose the PDVLoc framework, a Personal Data Vault (PDV) designed to control the sharing of location data from mobile devices. The framework allows users to store their location data in a centralised vault and manage data sharing with third parties through fine-grained Access Control Lists (ACLs). It includes tools like a rule recommender to help users make informed privacy decisions and a trace audit feature for evaluating privacy policy adherence over time. The aim is to ensure that users have control over their location data, provide secure storage and customisable sharing settings, and help maintain transparency and accountability through auditing.

Singh, Carminati and Ferrari [2] present the Privacy-Aware Personal Data Storage (P-PDS) system, which uses semi-supervised and active learning to automate privacy decisions for user data stored in a centralised repository. The system reduces user burden by learning privacy preferences from both labelled and unlabeled data and adjusts privacy decisions based on user-specific preferences through personalised and history-based active learning. This approach enhances accuracy and efficiency in managing privacy settings. The aim is to provide an intelligent and user-friendly way to manage privacy settings, automating decisions while aligning with individual user preferences and reducing manual configuration efforts.

Sanchez, Torre and Knijnenburg [3] propose a solution for managing privacy preferences in IoT environments using semantic web technology. They introduce the Privacy Preference for IoT (PPIoT) ontology, which integrates privacy preferences, the W3C Semantic Sensor Network Ontology, Fair Information Practices (FIP) principles, and GDPR compliance. The Personal Data Manager (PDM) component mediates and manages user privacy preferences, allowing users to control data disclosure to third parties. The solution includes an Interactive Privacy Preference Model (PPM) to present privacy policies transparently and gather affirmative user consent. This aim is to empower users to manage their privacy settings effectively in IoT environments, ensuring that data disclosure is controlled and compliant with privacy regulations. The source code for the PDM is available on GitHub.

While specific details vary, the practical implementation of these systems often points towards cloud-based storage due to the need for scalability, accessibility, and integration with diverse devices and platforms. Local storage could be used in certain contexts, but cloud storage is more likely given the complexity and volume of data involved in these systems.

Platforms: personal computers, mobile devices, smart devices

Example

Right: The PDVLoc web user interface displays information inferred from collected user data, provides data-sharing feedback, and allows configuration of spatial boundaries; Left: Traceaudit: Web user interface for reviewing shared data [1]. (See enlarged)

The Interactive Privacy Preference Model (PPM) interface for Privacy Policy Settings, which conforms to the PPIoT ontology [3]. (See enlarged)

The Personal Data Manager (PDM) confirmation request and recommendation [3]. (See enlarged)

• User studies indicate high satisfaction and acceptance of privacy management frameworks incorporating policy management tools, such as rule recommenders and trace audits, which enhance user decision-making [1]. Additionally, the integration of semantic web technology in privacy frameworks like PPIoT enables interoperability and scalability across diverse IoT devices and platforms [3]. Combining automation with user consent ensures users maintain control over their privacy settings while benefiting from automated processes, enhancing user experience and regulatory compliance [3].

• Tools like the PDM can only support negotiation when the third-party policy statement is encoded in PPIoT [3].

Privacy choices give people control over certain aspects of data practices. Considering the design space for privacy choices [4], this guideline can be applied in the following dimensions:

The guideline focuses on empowering users to store and manage their personal data, emphasising user consent, control over data sharing, and the ability to configure privacy settings, which aligns closely with the attribute of Control [5]. Other related privacy attributes: