UXPA 2019 Validating GDPR and User Privacy Best Practices with UX Influencers and Users

@AnswerLab / #UXPA2019
UX Dimensions of
Data Privacy and GDPR
Validating GDPR and user privacy best practices with UX influencers and users
AnswerLab
@_bobberry
Bob Berry
Principal UX Researcher

@AnswerLab / #UXPA2019 2
Why are you here?

OBJECTIVES:
Data privacy, GDPR, and UX - where
are we, how did we get here, where
are we going?
3
… and a challenge.

AGENDA
How did we get here?
• What is GDPR?
• Why UX, GDPR, and data privacy?
Where are we?
• Our studies with users, influencers
• Key Findings
• User Experience Best Practices
• Business Best Practices
Where are we headed?
4

Bob Berry
AnswerLab since 2017
BS Computer Science / Math
25ish years in UX, e-learning
@_bobberry
AnswerLab.com

@AnswerLab / #UXPA2019 6CONFIDENTIAL
Experience

@AnswerLab / #UXPA2019 7CONFIDENTIAL

GDPR?
What is

What is GDPR?
The General Data Protection Regulation
9https://eugdpr.org/

What are the
major
components
of GDPR?
10
1. Consent
2. Right to Access
3. Right to be Forgotten
4. Data Portability
5. Privacy by Design
6. Territorial Scope
7. Data Protection Officers
8. Breach Notification
9. Penalties

What are the
major
components
of GDPR?
11
1. Consent
2. Right to Access
3. Right to be Forgotten
4. Data Portability
5. Privacy by Design
6. Territorial Scope
7. Data Protection Officers
8. Breach Notification
9. Penalties

GDPR
Data
privacy
issues
Data-driven
behavioral
predictive analytics
Governance

What does GDPR have
to do with the U.S.?
13

What does GDPR have
to do with UX?
14

The goals of
UX and behavioral
analytics are
What does data privacy have to do with UX?
virtually identical

GDPR
Data
privacy
issues
Data-driven
behavioral
predictive analytics
Influence
users
UX
Governance

The user
encounters
both experiences

We need to
guidecompliance

We create & validate
effective data
privacy controls and
experiences

We lead
the future

DO
The Right Thing

Studies and Methodologies
23

Phase One
Results:
3 Levels of
User
Awareness
24@AnswerLab / #UXPA2019

Phase One Results:
8 Recommendations

Study Phase
One:
Spring 2018
26
GDPR Education
https://www.answerlab.com/insights/gdpr

Study
Phase
Two:
Spring
2019
27
Influencers
22 End Users
Internal studies Internal experts
Secondary research

Major Findings
Phase Two
28

Almost no users
are aware of GDPR,
And many are
not knowledgeable
on privacy

In a study on online skills,
Privacy
was one of 20 topics
- but rated the lowest on:
• Maintaining privacy
• Understanding policies
• Ease of changing settings
• Confidence in settings
• Trust in online services

The Gap Widens
between predictive analytics and
users’ knowledge, tolerance, and
engagement

Why?
Users see little or no value,
or opt out due to fear and suspicion

Forgot to opt-in
to notifications
33

Effectiveness of data
makes people think of
eavesdropping
and in other cases, what they see is
totally irrelevant

Savvy users
control their privacy
via their behavior,
not just
their privacy
settings

Power User
36
• Wary of stalking
• Checks in after leaving
• Keeps it vague
• Keeps it anonymous

CHANGES
are coming in the U.S.

Best practices
start in the operation

Data is more valuable than product,
and ‘people have become the product’
One product transaction may be worth $100.
An algorithm derived from 1,000,000 user choices that can cause
10,000 users to buy that $100 product is worth $1M!

Overlapping intent
of UX and behavioral predictive analytics

Have you changed
your behavior?

How do users react?
42@AnswerLab / #UXPA2019

general attitudes
”Where does this end, and
how extensive is it?”
”I don’t mind ads but don’t want
to be inundated.”
”Social media is more of a concern. They provide
their service for free, so we are the product.”
”When I’m done searching for it,
I don’t want to see it anymore.”
”I’m overwhelmed.
It’s too much.”
”I’m busy so not real motivated.”

acceptance
“That ship has
sailed.”
”There’s not too much I can
do about it.”
“Need to accept a
lack of privacy to
get the convenience.”
“Accept that
they’ll use
your data,
or don’t use
their system.”

control ”I have not figured out
how to control this.
It’s beyond me.”
”Eventually, they will
change it and force
me to do it again.”
”I’m trying to be
proactive about my
future, and I don’t see
how. It’s all history.”
”Don’t tell me what
you think I should be
reading or interested
in.”
”I prefer companies that
leave me alone. I want a
choice.”

trust
“They say it’s secure,
but you’re never 100% sure.”
“Negative things could happen
and I might not know.”
”Companies will always
choose their bottom line.”
“What do they mean
extra secure? What is
less secure?”

Users’
reactions to
their own
data
privacy
47
aware
care
attempt
find
notice
understand
act
succeed
trust
reflect

Most of these are theoretical to users
track my history
see relevant content
get personal offers
see better reviews
Potential
Benefits for
Users
get better service
discover interests
meet new friends
save life events

How can we, as UX professionals, enhance this?
track my history
see relevant content
get personal offers
see better reviews
Potential
Benefits for
Users
get better service
discover interests
meet new friends
save life events

Best Practices
50
1. User Experience
2. Business

Know your
users: Create
personas and
maps
51
USER EXPERIENCE Best Practices

Know your
touchpoints: do
an omni-
channel audit
52

Integrate the
UX and the
analytics
experience
53

• General: how easily can your users find out what you’re collecting
and what you’re doing with it, and how easily can they control that?
• Consent: what are users consenting to? How do they find out what
they are consenting to?
• Right to access: how easily can users access their data and get clear
descriptions of what it is? How well do they understand it all?
Consider: Start with GDPR

• Right to be forgotten: do you allow accounts to be deleted? How else
can users choose to ‘be forgotten’ and what does that mean? Under
what circumstances?
• Data portability: do you allow downloading of user data? How can
users interpret that download? Where and why would they do that?
• Privacy by design: do you build it in from the start? How ‘integrated’
is your privacy user experience, or is it an after-thought?
Consider: Start with GDPR

Privacy
by Design
Principles
56
Proactive
not reactive,
preventative
not remedial
Privacy as
the default
Privacy
embedded
into design
Full
functionality
– positive-
sum, not
zero-sum
End-to-end
security –
full lifecycle
protection
Visibility,
transparency –
keep it open
Respect
user privacy
– keep it
user-centric

Don’t
overwhelm
57

Provide clear
entry points
58

Embed
controls in the
flow
59

Layer options
for easy
access
60

Provide clear
examples
61

Use common
language
62

Group related
settings
63

Use colors,
icons, and
visual cues
64

Many more
65
Meta Approaches
• Explain the benefits
• Provide Help and FAQ
• Consider video tutorials
• Create wizards or
assessment tools
• Update your update dates
• Inform users when settings
or systems change
• Check in if users haven’t
shown up for awhile
• Ensure functional integrity
Core UI
• Provide access at sign-
up and anytime
during active use
• Summarize policies
• Clearly label controls
• Minimize steps
• Minimize paths
• Show progress
• Layer complexity
• Simplify terminology
• Clarify end-points
• Reward success

Top Reasons
to create effective
experiences for
data privacy
controls
66
1. Stay out of trouble
2. Acquire, retain customers
3. Sustain customer satisfaction
4. Use analytics well
5. Sustain public image
6. Do the right thing

Best practices
start in the
operation
67
For stakeholders:
BUSINESS Best Practices

Data
Protection
Impact
Assessment
(DPIA)
68
https://gdpr-info.eu/art-35-gdpr/
For stakeholders:

Know your business
model and the role
of data
Balance investment
with business model
69
For stakeholders:

Test, validate,
iterate,
re-test
70

Thank You
AnswerLab
@_bobberry
Bob Berry

Questions?

UXPA 2019 Validating GDPR and User Privacy Best Practices with UX Influencers and Users

Recomendados

Recomendados

Mais conteúdo relacionado

Mais de UXPA International

Mais de UXPA International (20)

Último

Último (20)

UXPA 2019 Validating GDPR and User Privacy Best Practices with UX Influencers and Users