Complying with privacy legislation

from legal text to implementation of privacy-aware location-based services

Mehrnaz Ataei, Auriol Degbelo, Christian Kray, Vitor Santos

Research output: Contribution to journalArticle

4 Downloads (Pure)

Abstract

An individual’s location data is very sensitive geoinformation. While its disclosure is necessary, e.g., to provide location-based services (LBS), it also facilitates deep insights into the lives of LBS users as well as various attacks on these users. Location privacy threats can be mitigated through privacy regulations such as the General Data Protection Regulation (GDPR), which was introduced recently and harmonises data privacy laws across Europe. While the GDPR is meant to protect users’ privacy, the main problem is that it does not provide explicit guidelines for designers and developers about how to build systems that comply with it. In order to bridge this gap, we systematically analysed the legal text, carried out expert interviews, and ran a nine-week-long take-home study with four developers. We particularly focused on user-facing issues, as these have received little attention compared to technical issues. Our main contributions are a list of aspects from the legal text of the GDPR that can be tackled at the user interface level and a set of guidelines on how to realise this. Our results can help service providers, designers and developers of applications dealing with location information from human users to comply with the GDPR.

Original languageEnglish
Article number442
JournalISPRS International Journal of Geo-Information
Volume7
Issue number11
DOIs
Publication statusPublished - 1 Nov 2018

    Fingerprint

Keywords

  • General data protection regulation (GDPR)
  • Geographical information
  • Geoprivacy
  • Location privacy
  • Location-based services
  • Privacy-aware systems

Cite this