Despite decades of research on privacy on the internet, there is still insufficient research on how to better protect or encourage users to protect themselves, especially those who do not take protective measures due to structural reasons, lack of knowledge or lack of motivation. We postulate that the generally useful construct of informed consent based on privacy literacy falls short at this point and needs to be reconceptualised in relation to vulnerable groups. Many users of digital services often give consent to the collection and processing of their data without being aware of the consequences this may have. This problem is particularly acute for those groups of people who, for structural or individual reasons, have less background knowledge about digital privacy. They also often lack the feeling of being able to make self-determined decisions in technical areas.
Since it makes little sense and is not practicable to reach these groups of people, e.g. in evening courses, and thus strengthen privacy literacy, alternative approaches are to be tested instead. Based on an ethically founded re-systematisation of vulnerable groups and their specific requirements and needs in the context of privacy, protection concepts are to be developed and tested. Instead of cognitive mediation, the implications of privacy invasions should be made tangible through real-world, if necessary sensually perceptible signals. This could be done, for example, by evoking emotions through a real-life presentation of the potential consequences of data disclosure on the internet. Building on this, the presentation of awareness-raising signals can be used in subsequent technology interactions as a reminder not to agree too quickly. The aim of the project is therefore to explore a) what specific needs vulnerable groups in particular have in terms of access to privacy protection and b) what mechanisms can be implemented to raise awareness in daily internet use that behavioural data is systematically collected in digital communication and how this can be prevented. Furthermore, the project c) provides an ongoing media-ethical reflection on communication with and about (vulnerable, marginalised) social groups that do not meet the standards of the majority society in terms of competence requirements for privacy literacy. This is to support the free and self-determined use of digital services by vulnerable groups.
At the moment, for example in the GDPR, this free and self-determined use in data protection law is almost exclusively controlled by the mechanism of ”informed consent”, which in turn only works if the individual has sufficient knowledge. “Informed consent” is an ethical and legal principle for legitimising the collection of personal data. In principle, the prerequisites for informed consent should be knowledge, voluntariness and decision-making capacity. According to the individual cognitive and socio-emotional status, these three prerequisites are not equally applicable to all members of society. Certain cognitive abilities (e.g. understanding privacy, assessing consequences for the future) may not (yet) be present or may be limited by communication barriers, but also low levels of experience or structural power asymmetries can lead to individuals or groups being less likely to clearly identifying and expressing their interests (cf. Stapf et al., 2020).
The innovation proposed in the project is to develop alternatives to the correlation of informed consent and privacy literacy based on ethical and psychological competence. Instead of focusing solely on how users can be educated in the area of informational self-determination, as in previous approaches, this project focuses on intuitive behaviour as an alternative to digital literacy, which requires clear media education. It is ethically developed and psychologically-empirically tested to what extent it is helpful, especially for vulnerable groups, to evoke visceral reactions rather than pursue knowledge transfer.
The project thus aims to improve the everyday lives of diverse vulnerable groups. The goal is to design and evaluate methods and procedures to adequately support citizens in expressing their consent, which can serve as a basis for new privacy-by-design procedures. It will also be addressed how the aspects of design and evaluation of user interfaces enable the exercise of rights according to the GDPR independent of the social, technical and cultural background of the users. In particular, the project will highlight the limits of informed consent for data processing in social environments and find and test solution strategies.
