Beware, Data Processing! Proposing Categories for Risk Communication Related to the Processing of Personal Data

Few people understand what they get themselves, and their personal data, into when they consent to data processing. Privacy policies are rarely read and people lack appropriate mental models of how their data is processed, which interferes with accurate risk perception and decision-making. This talk proposes information categories for risk communication based on an interdisciplinary research effort, based on expert and user studies, identifying risk-relevant and important aspects of data processing, specific consequences, relations between them, and strategies for risk mitigation. Combining the results with case studies and preliminary proposals for visualizations will demonstrate how controllers, regulatory bodies, and data subjects can profit from a better understanding and communication of risk formation in personal data processing. The talk presents joint work from the speaker as well as Rita Gsenger, Filmona Mulugeta, Marte Henningsen, Lena Mischau, and Marie Schirmbeck.