Complying with Privacy Legislation: From Legal Text to Implementation of Privacy-Aware Location-Based Services

ISPRS International Journal of Geo-Information

Auriol Degbelo¹  Mehrnaz Ataei¹  Christian Kray¹  Vitor Santos² 

[1] Institute for Geoinformatics, University of Muenster, Heisenbergstrasse 2, 48161 Muenster, Germany;NOVA IMS Information Management School, University Nova Lisboa, 1070-312 Lisbon, Portugal;

关键词: geographical information;    location privacy;    geoprivacy;    general data protection regulation (GDPR);    location-based services;    privacy-aware systems;   

DOI  :  10.3390/ijgi7110442

来源: DOAJ

【 摘 要 】

An individual’s location data is very sensitive geoinformation. While its disclosure is necessary, e.g., to provide location-based services (LBS), it also facilitates deep insights into the lives of LBS users as well as various attacks on these users. Location privacy threats can be mitigated through privacy regulations such as the General Data Protection Regulation (GDPR), which was introduced recently and harmonises data privacy laws across Europe. While the GDPR is meant to protect users’ privacy, the main problem is that it does not provide explicit guidelines for designers and developers about how to build systems that comply with it. In order to bridge this gap, we systematically analysed the legal text, carried out expert interviews, and ran a nine-week-long take-home study with four developers. We particularly focused on user-facing issues, as these have received little attention compared to technical issues. Our main contributions are a list of aspects from the legal text of the GDPR that can be tackled at the user interface level and a set of guidelines on how to realise this. Our results can help service providers, designers and developers of applications dealing with location information from human users to comply with the GDPR.

【 授权许可】

Unknown