This work considers the privacy attributes mapped by the work of Barth, Ionita, and Hartel [1], summarised in the listing bellow.

Accountability refers to holding the service provider responsible for any violations of privacy policies, including ensuring that their practices comply with legal standards and regulations.


Accountability is related to the following guidelines:

Anonymisation involves removing all identifiable markers from data so that it cannot be traced back to an individual, ensuring that personal information is irreversibly obscured.

Anonymisation currently has no related guidelines.

Involves identifying the types of data collected, such as IP addresses, phone numbers, and credit card information. It distinguishes between personally identifiable information and anonymous data and emphasises data minimisation by collecting only necessary data for service provision


Collection is related to the following guidelines:

The key aspects of control are consent, opt-out options, self-determination, influence over data handling, and user-friendly privacy settings.


Control is the main privacy attribute of the following guidelines:


Control is also related to the following guidelines:

Correctness involves correcting incorrect or no longer valid data after it has been disclosed, ensuring that it remains accurate and up-to-date.


Correctness is related to the following guidelines:

Addresses the balance between privacy and the utility of a service, ensuring users are not forced to choose between maintaining their privacy and accessing a service's full capabilities. It involves designing systems that don't restrict features or services unless personal data is provided, thereby preventing artificial limitations that could coerce users into sharing more personal information than they are comfortable with for full functionality.


Functionality is related to the following guidelines:

Pseudonymisation refers to replacing personal identifiers in data with artificial identifiers or pseudonyms, allowing data to be matched with individuals only when combined with additional information, thereby reducing the risk of privacy breaches while maintaining data utility.


Pseudonymisation is related to the following guidelines:

Collected data can be used for purposes such as service provision, advertising, and profiling. Also considers the legal basis for data processing, including legal requirements or vital/public interest.


Purpose is related to the following guidelines:

How long is the collected data stored? This attribute addresses the duration of data storage to ensure that data are not kept longer than necessary.


Retention is related to the following guidelines:

Refers to allowing individuals to request the deletion or removal of their personal data.

Right to be forgotten currently has no related guidelines.

Refers to selling personal data to third parties for commercial gain.

Sale currently has no related guidelines.

The sharing attribute refers to whether and how collected data is shared with third parties without monetary compensation. This includes sharing data with other companies, advertisers, research institutions, and other external entities. Sharing can encompass both voluntary and unintentional disclosures.


Sharing is related to the following guidelines:

The ability users have to access information about how their personal data is handled, including through open-source code, privacy policies, and regular audits. Also involves proactive distribution of information to users, demonstrating the implementation of privacy attributes to data subjects and regulators.


Transparency is the main privacy attribute of the following guidelines:


Transparency is also related to the following guidelines:

References

[1] Susanne Barth, Dan Ionita, and Pieter Hartel (2022). Understanding Online Privacy — A Systematic Review of Privacy Visualizations and Privacy by Design Guidelines. ACM Comput. Surv. 55, 3, Article 63 (February 2022), 37 pages. DOI: https://doi.org/10.1145/3502288