Martin Degeling: Tracking, Profiling and the GDPR

Title:
Tracking, Profiling and the GDPR

Speaker: Martin Degeling (Ruhr University Bochum)

Short bio:

Martin Degeling is a post-doctoral researcher at Ruhr University Bochum. He finished his PhD in 2016 and worked at Carnegie Mellon University before returning to Bochum in 2018. Is research on online privacy is based on empirical methods to measure the personal data information flows and encompasses studies on all ends of these social-technical systems from end-users to developers and privacy experts.

Abstract:

Informational privacy has become a primary concern for societies in the digital age. While we, as users, appreciate new ways to communicate and express ourselves, there are drawbacks of personal information being shared and used in constantly changing forms.
The goal of many legal regulations, including the GDPR, is to support informational self-determination – the idea that individuals should understand who knows what about them. For a long time, computer science has translated this idea into technical measures of confidentiality, control and transparency of the data to be released. But instead of following privacy- and security-by-design principles websites nowadays try to trick users into accepting insecure and privacy invasive scripts. Overwhelmed by too many choices or left with none users accept practices that they do not approve. Therefore, it is necessary to think beyond the notice and choice model and develop technical means that support privacy and security that take the complexity of the socio-technical context of users as well as developers into account.

In this talk I will present my research results based on large-scale website scans as well as studies with users and developers showing that the notice and choice model is often contradictory to the goal of protecting privacy and that ideas of the GDPR have not yet led to the expected improvements. I will demonstrate how the focus on increasingly complex technical consent solutions makes it harder to control personal information and how companies at the heart of surveillance capitalism benefit from rules supposed to strengthen privacy. Novel approaches to usable privacy and security need to reconsider privacy as contextual to develop transparency and intervening control option in the data life cycle beyond the disclosure state. To foster the adoption of these technologies future research needs to also focus on the development processes and understand developers as users of privacy enhancing technologies.

Sustainable Comupting Lecture Series

Chairs:
Soheil Human, Vienna University of Economics and Business (WU Wien)
Arianna Rossi, SnT, University of Luxembourg
Cristiana Teixeira Santos, Utrecht University
Martin Degeling, Ruhr-University Bochum (RUB)