The General Data Protection Regulation (GDPR) requires to conduct a Data Protection Impact Assessment (DPIA) whenever there are high risks to data subjects’ rights and freedoms. Among other provisions, DPIA asks to seek data subjects’ perception where appropriate (article 35.9). Several works pointed out the low level of awareness of lay people for privacy risks. We assessed privacy risk perception of lay people when they are given awareness (RQ1). Identifying risks to data subjects’ rights and freedoms might not be easy even for experts because of their multiple overlaps. For this, we investigated whether experts can distinguish privacy from security risks (RQ2). To answer RQ1 and RQ2, we have conducted two surveys, namely Guided Survey and Unguided Survey, based on a scenario to get people into a certain mindset while avoiding bias. The results of the surveys show that awareness helps participants to better estimate privacy impact when using correct communication; age and context influence people’s perception; and that experts have difficulties in setting apart privacy and security risks. Before running the Guided Survey, we conducted an internal Pilot Survey to refine the Guided Survey.
Following, we provide the links to the three surveys:
- Pilot Survey: https://forms.gle/rHx3wusTcXRpuXiA8
- Guided Survey: https://forms.gle/9UCuauwYxzojp4Ct6
- Unguided Survey: https://forms.gle/M9LVqtioC4nUPV7GA
The raw data collcted from the surveys are provided in the following link: https://www.dropbox.com/scl/fi/myshh9om8ituqv3qoeh9r/GuidedSurvey-BePublished.xlsx?dl=0&rlkey=ysgln6mhnqfukmuqmanmf3i6n