Awareness Learning Tools for Data Sharing Everywhere

In digital environments personal information is collected, used and disclosed. Today a majority in the online population will know that information about their online search-activities is shared with advertisers and sometimes with other companies. Relevant research questions are: when using social media, a search-engine or installing an app, to what extent is the user aware of the fact that the information is shared to third parties? To what extent is the user aware of the choices the person has to reduce or stop this sharing? In Awareness Learning Tools for Data Sharing Everywhere (ALerT) have investigated whether or not we can evoke awareness about the collection and use of personal data. ALerT is a research project that aims to contribute to knowledge on how we make choices in digital environments. We combine serious game techniques with experimental methods from psychology and decision science. With serious games we can mimic situations and present realistic scenarios for users and investigate what it takes to raise awareness. ALerT addresses how to increase awareness about the use of these data, and how users can make informed choices and exercise legal rights in this context. The researchers in ALerT will study and analyse sharing of personal information by using choice experiments. ALerTs objective is also to help citizens to reflect on their behaviour in actual situations. Secondary objective is to test a tool that will give information to mobile-phone users about sharing, permission and how data is used. ALerT has an interdisciplinary project team with experts from ICT, serious games techniques, privacy, psychology, and decision science. The General Data Protection Directive (GDPR) is a regulation on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area including Norway. ALerT cooperates with international experts in academia and through the network of the Norwegian Consumer Council. Project-results; Reports by the The Norwegian Consumer Council: * Deceived by design. An analyzes of a sample of settings in Facebook, Google and Windows 10 showed how default settings and a number of tactics are used to push consumers toward sharing as much data as possible. * Every Step You Need. According to this study Google violates the privacy law GDPR because consumers are deceived into being tracked when they use Google services. This happens through a variety of techniques, including withholding or hiding information, deceptive design practices, and bundling of services. *Out of Control. How Consumers are Exploited by the Online Advertising Industry. * You can Log Out, but You can Never Leave. How Amazon Manipulates Consumers to Keep them Subscribed to Amazon Prime. * Time to ban Surveillance-based Advertising.The Case Against Commercial Surveillance Online. - What is the foundation for privacy? In ALerT, privacy is an underlying theme in a paper by Tjostheim presented at the International Association for Computing and Philosophy. - The project ha commissioned four national surveys with questions about sharing of personal data, privacy and digital profiles. All four surveys has had an experiments named the consent-test. The findings for this experiment has been reported in a front-page news article in Aftenposten and many other newspapers. The Minister of Digitalization in the Government and the Data Protection Commissioner Bjørn Erik Thon were interviewed about the findings that showed that young men were the most vulnerable groups for misuse of data. The two reports by Tjøstheim & Høibø "Nordmenn og deling av persondata" summarizes the findings from surveys. - The paper with the title Did App Privacy Improve After the GDPR has been published in the journal IEEE Security & Privacy. The authors analyzed Android apps and permission privileges. After the implementation of the GDPR the declared intent to use permissions have declined. For instance, there are substantially fewer permissions that measured idling app although some permissions are being used more often. - The two papers by Tjostheim and Waterworth (2020) and Tjostheim (2022) with the titles "Predicting personal susceptibility to phishing"and "Phishing, Data-Disclosure and The Cognitive Reflection Test" show that the consent-test and the Cognitive Reflection Test can be used to predict vulnerabilities to phishing attacks. - a paper for the European Conference on Games Learning on Dark Pattern. The game was been developed together with the company Serious Games Interactive. Students, 16-18 years old in Copenhagen and Oslo have play the game. The students knowledge before and after playing the game have been tested. Our findings indicate an increase in the level of knowledge about, not all types but some of the types of dark patterns that are in the game. http://www3.nr.no/en/projects/alert-awareness-learning-tools-data-sharing-everywhere

Forskerne og deltakerne i prosjektet står bak en rekke publikasjoner. Et eksempel er Did App Privacy Improve After the GDPR, i IEEE Security & Privacy som Dr. Lothar Fritsch, Karlstad Universitet, er medforfatter av. Dette er et eksempel på den vitenskapelige formidlingen i prosjektet. Like viktig som vitenskapelig artikler er resultatformidlingen til allmennheten. Forbrukerrådet har utgitt flere publikasjoner som har avslørt hvor lite personvernvennlig praksisen til mange firmaer. Et eksempel er rapporten “Out of Control. How consumers are exploited by the online advertising industry” som blant annet fikk presseomtale i New York Times. Forbrukerrådet ved Finn Myrstad har en rekke ganger vært intervjuet i internasjonal presse. Dette har ført til at flere av de omtalte firmaer i større grad har fulgt GDPR, og gjort endringer for å i vareta personvernet og rettigheter til deres brukere. For å få frem i hvilken grad brukere av digitale tjenester er villig til å gi samtykke til å dele data, og hvem som er mest villig til å dele ble det gjennomført en samtykke-test. Samtykketesten var en del av de nasjonal undersøkelse utført av IPSOS, Pollstat og Norstat. Testen var inspirert av Cambridge Analytica skandalen, en skandale hvor informasjon fra Facebook ble (mis)brukt. Resultatene ble presentert i rapporten «Nordmenn og deling av persondata» og Aftenposten laget en større nyhetssak om funnene. Tittelen på førstesiden 14. oktober 2019 var «Facebook forsøk: En av fire lokket til å gi fra seg persondata.» Denne nyhetssaken ble gjengitt av NTB, i ca 20 aviser. Prosjektleder ble intervjuet i NRKs nyhetssending samme dag. NRKbeta laget dessuten saken «Undersøkelse: 75% av nordmenn vil det skal bli vanskeligere å samle inn persondata» med utgangspunkt i den nasjonale undersøkelsen. Det er viktig å nå både beslutningstakere og allmennheten med forskningsresultater. Kommunaldepartementet har mottatt rapporter fra prosjektet og hatt dialog med prosjektleder om resultatene. Nyhetssaken i Aftenposten ble lagt merke til av mange. Aftenposten intervjuet både daværende sjef for Datatilsynet Bjørn Erik Thon og Digitaliseringsminister Nikolai Astrup blant annet om behovet for regulering og om personvernlovgivningen. Et annet eksempel er Kronikken i Aftenposten «Er spørsmålet om en vaksine skal brukes en kost-nytte avveining» ved prosjektleder Tjøstheim viser hvordan Tversky og Kahneman’s Prospect theory har relevans for å forstå risiko. Denne formen for kunnskapsformidling fra prosjektet andre forskere som primært leser de vitenskapelige publikasjonene. Det internasjonale samarbeidet inkluderer samarbeidet med Serious Games Interactive i København som har utviklet spillet Dark Pattern i sammen med forskere i prosjektet. Spillet er, i prosjektperioden spilt av elever på 5 skoler, men vi antar flere skoler vil bruke spillet etter at prosjektet er avsluttet.

ALerT will develop novel tools that will be used to gain new knowledge about how people make decisions about ubiquitous data, on privacy and sharing of personal information. These tools will help citizens to reflect on their behaviour in actual situations and give consumer councils a tool for guiding consumers of ubiquitous services. We will combine serious game techniques with experimental methods from psychology and decision science. Digital devices, apps and AI-based technology make use of personal data. Taken together, this represents ubiquitous data. ALerT addresses how to increase awareness about the use of these data, and how users can make informed choices and exercise legal rights in this context. An outcome of the project will be the tools for practitioners (ordinary citizens) and tools for researchers and experts. For researchers, ALerT can be used to study and analyse sharing of personal information,. For users, the tools can be used for practising, for feedback and reflection of what happens with their personal data, including possible misuse of information. The interdisciplinary project team includes experts from ICT, serious games techniques, security, privacy, education, psychology and decision science. The outcome of the project will be knowledge about online behavior and insight on how to evoke reflection on personal data in digital environments. As a tangible outcome, a gamification-based tool for assessment of such behavior and for practising purposes will be available for schools, consumer councils, and citizens that contact or use the online services of the consumer council. Through a co-operation of consumer councils, ALerT will receive a strong European perspective.