Periambal L Coopamootoo
email: p.coopamootoo@cranfield.ac.uk

Debi Ashenden
email: d.m.ashenden@cranfield.ac.uk

Designing usable online privacy mechanisms: what can we learn from real world behaviour?

Keywords: online privacy mechanisms, persuasive technology, privacy behaviours, usable privacy

A variety of privacy mechanisms have been designed for the online environment but they have not been effective in ensuring end-users' privacy. In this study, we analyse existing privacy theories devised from offline sociopsychological studies and discuss which of those could be useful in the design of usable online privacy. We found that the Communication Privacy Management framework which provides boundary management processes could be used to design online privacy since it addresses information seeking, boundary rules formation, negotiation and means of addressing turbulence. We argue that since privacy is implicit within interpersonal and communication behaviour, a persuasive approach to designing online privacy could help to make privacy implicit within human-computer interactions, provide end-users with the ability to better engage with, and express their online privacy, and further ensure the usability of online privacy mechanisms.

Introduction

Previous research aimed at understanding online privacy behaviour and its relation to privacy concerns has shown that although end-users claimed to have high privacy concerns, they behaved very differently online [START_REF] Acquisti | Losses, Gains, Hyperbolic discounting: an experimental approach to information security attitudes and behaviour[END_REF]. Several studies were performed to understand this discrepancy which was called the "privacy dichotomy". Among the possible explanations attributed to the phenomenon were the imbalance of information between end-users and service providers [START_REF] Spiekermann | E-privacy in 2nd Generation Ecommerce: Privacy preferences versus actual behaviour[END_REF], the need for immediate gratification [START_REF] Acquisti | Privacy in electronic commerce and the economics of immediate gratification[END_REF], behavioural biases, peer pressure to share information and the sharing of private information online to try out identities, for instance among young people [START_REF] Boyd | Why youth love social network sites; The role of networked publics in teenage social life[END_REF]. Some research, however, has also claimed that online privacy approaches are too complicated for end-users to understand [START_REF] Cranor | A Comparative study of online privacy policies and formats[END_REF] and are not easy to use. In this paper we first explore the historical development of privacy as a concept and explain briefly the differences in privacy behaviour and the characteristics of private information shared online versus offline. We follow this with an exploration of the methodological approaches from sociology and psychology used to understand offline privacy behaviour. We compare and contrast this with the research carried out in the information systems field (in particular Human Computer Interaction (HCI)) to develop ways of designing usable privacy mechanisms for online environments. In the discussion section we aim to determine which approaches to understanding real world behaviours around privacy could assist in designing usable online privacy mechanisms. We conclude with recommendations for how a better understanding of interpersonal privacy interactions leads us towards taking a persuasive approach in order to develop effective privacy models before providing an analysis of a disclosure-privacy scenario.

Privacy online versus offline

In this section we explore the historical development of privacy as a concept and then compare the offline privacy mechanisms employed by individuals with the privacy mechanisms available online and the properties of private information shared offline versus online. Following the comparison, we briefly discuss the consequences those differences have on online privacy.

The first systematic, written discussion of the concept of privacy is said to have begun in 1890 with Warren and Brandeis' famous essay "The right to privacy" which cited political, social and economic changes which led to the recognition for the right to be let alone [START_REF] Warren | The right to privacy[END_REF]. They argued that existing law afforded a way to protect the privacy of the individual; the privacy principle they believed was already part of the common law but that new technology, for instance photography and newspapers, made it important to explicitly and separately recognise this protection under the name of privacy. They thus laid the foundation for a concept of privacy that has come to be known as the control over information about oneself. However as explained by DeCew [START_REF] Decew | Privacy[END_REF], it was only in the second half of the twentieth century that philosophical debates concerning definitions of privacy became prominent due to the development of privacy protection in the law.

In addition to this it has been argued that privacy and intimacy are deeply related. Fried [START_REF] Fried | An Anatomy of Values: Problems of personal and social choice[END_REF] argues that privacy has intrinsic value and is necessarily related to, and fundamental to, one's development as an individual with a moral and social personality to be able to form intimate relationships involving respect, love, friendship and trust. Privacy is valuable because it allows one to maintain varying degrees of intimacy [START_REF] Fried | An Anatomy of Values: Problems of personal and social choice[END_REF]. Gerstein [START_REF] Gerstein | Intimacy and Privacy[END_REF] also supports the necessity of privacy for the intimacy which is required in communication and interpersonal relationships for a person to fully experience his or her life. Other researchers such as Rachels [START_REF] Rachels | Why Privacy is important?[END_REF] expand the value of privacy to intimacy by emphasising the importance of developing diverse interpersonal relationships with others. Rachels' analysis emphasises that privacy is not only about limiting control of information but also access to oneself, both of which allows control over relationships with others, thus connecting privacy to one's behaviour and activities [START_REF] Rachels | Why Privacy is important?[END_REF].

In more recent literature related to the advances in technology; privacy has been defined as the freedom from judgement [START_REF] Itrona | Privacy in the Information Age: Stakeholders, Interests and Values[END_REF][START_REF] Adams | Privacy issues in ubiquitous multimedia environments: wake sleeping dogs, or let them lie?[END_REF][START_REF] Strater | Examining privacy and disclosure in a social networking community[END_REF], the ability to exercise privacy tradeoffs [START_REF] Adams | Privacy issues in ubiquitous multimedia environments: wake sleeping dogs, or let them lie?[END_REF], the control over who has access to information, for what purpose it is needed and how sensitive the information is in a particular context [START_REF] Adams | Taming the wolf in sheeps clothing: Privacy in multimedia communications[END_REF]. Although the explicit impact of technology on privacy has been recognised since the arguments of Warren et al. [START_REF] Warren | The right to privacy[END_REF], there have been compelling arguments for overriding the privacy concerns for accountability and security needs [START_REF] Swire | Privacy and Information Sharing in the War on Terrorism[END_REF]. This overview of the historical development of the concept of privacy demonstrates how legal support for privacy has come to the fore and the role of privacy as a key attribute in the development and maintenance of relationships. From a technological perspective, privacy has been depicted mainly as the control over one's private information and the ability to exercise privacy tradeoffs. It could therefore be useful to understand whether and how technology has catered for the legal and interpersonal aspects of privacy.

Privacy is required for communication and interpersonal relationships [START_REF] Gerstein | Intimacy and Privacy[END_REF] and hence by extension required for the maintenance of an identity. It is embedded within the mechanisms of offline communication and participation and differs across societies where individuals socially manage their privacy with respect to others through an ongoing "boundary definition process" [START_REF] Palen | Unpacking" privacy for a networked world[END_REF]. The mechanisms used offline are often implicit within the individual's behaviour in the form of non-verbal cues [START_REF] Patterson | Compensatory reactions to spatial intention[END_REF] including body language, oral and visual cues, accessories such as, for example, clothing, curtains and blinds, to avoid the release of information and achieve varying degrees of privacy or openness.

In the online environment, two different approaches are adopted to ensure the privacy of end-users. The regulation approach considers privacy to be a basic human right which requires protection whereas the self-regulation approach views privacy as a commodity which can be traded in the market place. While in the regulated approach, privacy is a must and although privacy mechanisms such as anonymity, pseudonymity and unlinkability technologies are provided, they are usually made explicit, are not often included within the system design and are hard for users to understand [START_REF] Zwick | Models of privacy in the Digital Age: Implications for Marketing and E-commerce[END_REF]. The self-regulation approach on the other hand assumes rational behaviour from online users in consenting to services in exchange for the release of personal information. This idea conflicts with research that looks at the biases and attributions that underpin the behaviour of individuals [START_REF] Acquisti | Losses, Gains, Hyperbolic discounting: an experimental approach to information security attitudes and behaviour[END_REF]. It is apparent from the above that both of these approaches cause difficulties for end-users and this may be a result of the difference between the protection offered by these online mechanisms and how individuals make decisions about privacy in the offline world. Thus while those approaches as implemented online aim to provide for the legal needs of privacy and for further protection of the shared information, they require rational and explicit privacy behaviour from the users. This type of behaviour can consequently make online privacy interactions seem impersonal, and make it hard for users to behave according to their concerns; that are often driven by the context of interpersonal relationships.

The different attributes of information in the online environment may further point us towards understanding some of the reasons for the privacy paradox. Certain types of personal information shared in an offline social environment may be considered to have a brief retention time since it often relies on human memory and is bounded within the context and associated human emotions [START_REF] Blanchette | Data retention and the panoptic Society: The social benefits of forgetfulness[END_REF]. In the online environment, however, information is persistent and is easily replicated due to the nature of the internet infrastructure. The consequences are that the information online can be easily taken out of context at a later time, flattened of its emotional value and made available for analysis and scrutiny by systems or people of which one might not be aware. The information might be given a different meaning and secondary information might be inferred. These characteristics might also deny users of their rights to exercise control on their personal information in terms of who has access to it, when and how.

In the offline environment, individuals tend to share private information with a small number of individuals and generally tend to not broadcast it to the wider public audiences, while online broadcasting is much easier to accomplish and personal information is frequently broadcast to a large audience although the user may be sharing with a specific audience in mind [START_REF] Richter-Lipford | Understanding Privacy settings in facebook with an audience view[END_REF]. The sharing of one's personal information is also usually done by the individual or others close to the individual which differs from the online scenario where personal information is more easily accessible and can potentially be shared by anyone with access to it. For this reason the properties of online data and its transmission affect the very nature of private information and hence no longer cater for the intimacy required for communication and interpersonal relationships [START_REF] Rachels | Why Privacy is important?[END_REF].

To summarise, while offline, privacy is implicitly linked to individual behaviour and communication and the building, development and maintenance of relationships; online it is explicitly designed and dependent on human-computer interactions. Privacy is provided by the online system and hence privacy online is constrained by the technology. Moreover, while privacy has a contextual or situational value, the personal information gathered and stored online may be deprived of its context. A lack of awareness of the properties of information online and of the consequences results in users making a poor risk assessment and unknowingly trading off privacy. The asymmetry of information transmission may also cause ambiguity and assumption of privacy where users might believe their interactions happen within a safe system within their computer system in their physical space, thus explaining the privacy paradox.

Methodological approaches to understanding privacy offline versus online design

In this section, we briefly explore the social-psychological theories of privacy that laid the foundation for further studies and some extensions that have built on those theories through conceptual studies, systematic analysis and empirical studies. We then review the approaches used to design privacy online and discuss how they cater for the social aspect of privacy and the characteristics of offline privacy behaviour and of private information shared.

Foundational social-psychological privacy theories

Westin and Altman's theoretical contributions to the understanding of the socialpsychological aspects of privacy have stood the test of time and provide a firm foundation for other researchers to build on [21; 22]. Westin's theory highlights the ways in which individuals protect themselves by temporarily limiting access to themselves by others [START_REF] Westin | Privacy and Freedom[END_REF]. Since privacy allows individuals, groups or institutions to determine when, how and to what extent their information is communicated to others, it is viewed in relation to social participation and is the voluntary and temporary withdrawal of an individual or group through physical or psychological means.

Westin describes privacy as being a dynamic and non-monotonic process which is also neither self-sufficient nor an end in itself.

According to Westin's theory, privacy has four states which can be thought of as privacy mechanisms, that is, the means through which privacy is maintained. These states are solitude, intimacy, anonymity and reserve. He also posits four functions or goals of privacy. These are personal autonomy, emotional release, selfevaluation, and limited and protected communication [START_REF] Westin | Privacy and Freedom[END_REF]. Empirical research, such as the factor analysis undertaken by Pederson [START_REF] Pedersen | Models for types of privacy by privacy functions[END_REF], not only found support for Westin's states but also tested the relationship between the states and functions of privacy. While describing his results as coherent and inclusive, he proposes a 6 x 5 'types of privacy x privacy functions' model [START_REF] Pedersen | Models for types of privacy by privacy functions[END_REF] which provides the link between the types of privacy behaviour individuals exhibit and the functions or goals of these.

Altman [START_REF] Altman | The Environment and Social Behaviour: Privacy, Personal Space, Territory and Crowding[END_REF] on the other hand places social interactions at the heart of his theory, with the environment providing mechanisms for regulating privacy. While for Altman also, privacy is the selective control of access to the self, he also identifies privacy to be a temporal and dynamic process of interpersonal boundary control. This is the process through which individuals regulate interactions with others where privacy has both a desired and actual level and privacy is non-monotonic, bidirectional and applies at the individual and group level. Altman also provides a range of privacy mechanisms for privacy regulation, such as the verbal content of communications, territorial behaviour to enable separation of personal space from others and cultural norms. He goes on to suggest that privacy should be considered as a social process, and that an in-depth psychological study of the aspects of privacy must include the interplay of people, their social world and the physical environment.

Two important extensions of Altman's regulation theory are based on the linkage of privacy and disclosure [START_REF] Margulis | On the status and collaboration of Westins's and Altman's Theories of Privacy[END_REF]; these build on Altman's dialectical conception of privacy as a process of opening and closing a boundary to others. Petronio [START_REF] Petronio | Boundaries of privacy: dialectics of disclosure[END_REF] proposes a conceptual and theoretical framework in her articulation of Communication Privacy Management (CPM), arguing that individuals depend on a rule-based boundary system when deciding whether to disclose private information. Central to Petronio's approach is the need to strike a balance between the positive opportunities to interact with others, made possible by technology, and the dangers of losing the means to control and regulate access to one by others. The rules are used to balance revealing and concealing private information -that is disclosure and privacy. These rules are dynamic since they can change, grow or remain stable for periods. Derlega & Chaikin [START_REF] Derlega | Privacy and self-disclosure in social relationships[END_REF] on the other hand extend Altman's boundary concept to a dual boundary model while exploring its applicability to information privacy. They suggest that individuals function within a dyadic boundary that is perceived as a safe zone within which they disclose to invited others or across which disclosure does not pass [START_REF] Derlega | Privacy and self-disclosure in social relationships[END_REF].

Newell [START_REF] Newell | Perspectives on Privacy[END_REF] performed a systematic classification of past privacy studies across a variety of disciplines and proposed a framework which extends from both Westin's and Altman's theories. She classifies past studies into person-centred, place-centred and interaction perspectives. Within the interaction perspective, privacy is an attitude, a behaviour, a goal or a process. Privacy as behaviour includes choice, control, boundary regulation, interaction management and information management [START_REF] Newell | Perspectives on Privacy[END_REF] since privacy presupposes the existence of others, the opportunity of interactions with them and the ability to control this interaction.

From the above overview of socio-psychological studies, interpersonal communication through a process of boundary control within behaviour is highlighted as prerequisite to the development and maintenance of relationships. This corresponds with Gerstein [START_REF] Gerstein | Intimacy and Privacy[END_REF] and Rachels' [START_REF] Rachels | Why Privacy is important?[END_REF] ideas outlined earlier around the necessity of privacy for communication and the development of interpersonal relationships.

Approaches to designing online privacy

We can see that the design of privacy into online systems had its roots in the legal need to protect end-users from the threat of misuse of their personal data and for them to provide an informed consent to its further processing or sharing. Thus privacy policies were implemented as liability shields for businesses and are often long texts that are too legalistic and complicated for end-users to read and understand. In response to this some research has looked at the design of privacy policy plug-ins or user agents [START_REF] Cranor | User interfaces for privacy agents[END_REF] that allow end-users to select their preferences and make it easier for them to be alerted when a website does not comply with their preferences. This, however, has to be set a priori to interactions and does not form part of the humancomputer interaction during the online experience (for example, in ecommerce transactions or online social networking). Other kinds of plug-ins devised have tried to minimise the collection of profiling information which end-users might not be aware of such as browser filtering or cookie removers. Primelife has also worked towards enhancing the transparency of policies through the 'Creative Commons' type layered approach to privacy [START_REF] Hansen | Putting privacy pictograms into practice: a european perspective[END_REF]. Whilst needing to overcome the challenges listed by [START_REF] Hansen | Putting privacy pictograms into practice: a european perspective[END_REF], this is an important work in progress towards enhancing end-users' understanding of their privacy online.

There are also tools and research initiatives that look at embedded access control mechanisms which provide users with the technological functionality of controlling access to themselves and provide them with feedback for the control applied. Examples of this are the fine-grained access controls of Facebook and the user-controlled privacy research carried out by Cornwell et al. [START_REF] Cornwell | User-controllable security and privacy for pervasive computing[END_REF]. A few steps further and we find user-centric identity management systems that provide users with control of the private details they share and therefore their online identity. The Prime project for instance has analysed and translated legal principles into HCI requirements which were further supplemented by social needs [START_REF][END_REF]. They extend the privacy policy user-agent by allowing end-users to express their policy preference regarding data disclosure as well as negotiate it with the service provider. The negotiated policy is attached to the data shared and a data track feature can provide the end-users with a comprehensive report of their history of data sharing and of the policies attached to the disclosures [START_REF] Leenes | User-Centric Identity Management as an indispensable tool for privacy protection[END_REF].

Discussion

As reviewed above, studies for the design of online privacy have concentrated on providing technological solutions for the legal needs of privacy while working towards making it usable and providing some control to the end-user. Projects such as Primelife [START_REF] Leenes | User-Centric Identity Management as an indispensable tool for privacy protection[END_REF] also provide for policy negotiation and reporting facilities which might be more helpful for certain types of end-users to manage their privacy. While this approach provides the technological solution for further control, and feedback mechanisms about information shared online and hence one's identity, it does not consider privacy as an implicit process within interpersonal communications which is an essential component of privacy and disclosure behaviours and of how one manages one's identity. Moreover, privacy in this approach is made explicit and adds additional steps to be performed during the online experience. Making privacy an additional task during online interactions, although enhancing trust in the service provider could make it cumbersome to use the service and make online communication less natural which undermines the aim of social features embedded within online systems. The aim is to persuade end-users of the interpersonal aspect of human-computer interactions in order to enhance online participation -a large proportion of which includes the disclosure of private information.

Newell [START_REF] Newell | Perspectives on Privacy[END_REF] suggested more than a decade ago that the vagueness and ambiguity in the definition and representation of privacy could be resolved and wide support obtained if privacy was viewed as an interactive condition of the person and the environment. Pederson's [START_REF] Pedersen | Models for types of privacy by privacy functions[END_REF] states versus functions matrix (adapted from Westin [START_REF] Westin | Privacy and Freedom[END_REF]) might help to design mechanisms if the privacy goals are known. Moreover, while Pederson's matrix is highly valuable for securing the link between the types or means of privacy and the functions or goals of privacy, it is at a high level and cannot be practically applied to interaction design. An application of the matrix will require further research to ensure the concepts can be translated into online interaction design requirements.

Petronio's Communication Privacy Management (CPM) framework [START_REF] Petronio | Boundaries of privacy: dialectics of disclosure[END_REF] on the other hand has been used to understand how people decide to disclose private information in offline settings and also to understand and address the tension between disclosure and privacy by examining how and why people decide to reveal or conceal private information within the ecommerce context [START_REF] Metzger | Communication Privacy Management in Electronic Commerce[END_REF]. CPM is also a practical framework which can more easily be used to assess online systems although there are fundamental differences between the nature of offline and online environments. CPM is a rule-based theory proposing that individuals develop rules to aid decisions about whether to reveal or conceal information, the rules developed help people maximise the benefits while minimising the risks of disclosure and are a function of the context and disclosure goals.

The theory proposes three iterative processes for boundary management [START_REF] Petronio | Boundaries of privacy: dialectics of disclosure[END_REF]. The first process, boundary rule formation includes the seeking of information and rules development to regulate when and under what circumstances people will reveal rather than withhold personal information whereas the second process, boundary coordination refers to the negotiation of privacy rules between parties through the setting and maintenance of boundary linkages, boundary ownership rights and boundary permeability. The third process, boundary turbulence might result from differences in privacy rules between parties, privacy rule violations or deficient boundary coordination. Boundary turbulence refers to the dynamic process of maintaining and negotiating boundaries to manage personal disclosures.

The different CPM processes could cater for the properties of privacy identified above. For instance, CPM caters for the dynamic and temporal nature of privacy through the coordination and turbulence recovery processes and for bidirectional flow of information through the information seeking and negotiation processes. In addition, despite the fact that the internet causes persistency of data, a CPM approach to online privacy would allow the user to be to some extent in control of the lifespan of the private information shared according to the coordinated and negotiated boundary. Also, the CPM approach would mean that the user would have control over the audience to which his or her private details are broadcasted.

The processes of the CPM, that is, boundary rule formation, coordination and turbulence are however, dependent on the interaction mechanisms employed within the online environment which can be highly persuasive in favouring rules that minimise the apparent effects of risks and maximise benefits of sharing personal details. Information technology is never neutral but always influences users' attitudes and/or behaviour in one way or another [START_REF] Oinas-Kukkonen | Persuasive system design: key issues, process model and system features[END_REF]. Moreover, privacy is embedded within human behaviour and communication while expression and persuasion is a big part of communication. Hence persuasion is important for expressive privacy which relates to the social and communication dimension of privacy and encompasses an individual's ability and effort to control social contacts [START_REF] Altman | The Environment and Social Behaviour: Privacy, Personal Space, Territory and Crowding[END_REF]. Thus to enable endusers to express their privacy through human-computer interactions and for service providers to be better able to convey details of information processing, a persuasive approach could be useful. Direct persuasion approaches such as rational arguments or indirect approaches such as simple cues could allow end-users to be in a better position to communicate and participate online while maintaining their privacy. Privacy behaviour for instance, consists of boundary regulation while enjoying social interactions without negatively affecting oneself or the other party. Furthermore, since individuals want to be private and do not explicitly perform privacy decisions at every instant their privacy behaviour is implicit. But in online interfaces privacy mechanisms are made explicit and mostly kept away from the interaction paths. It seems very relevant then to suggest that a persuasive approach could also cater for the implicitness property of privacy behaviour within human-computer interaction and consequently enhance the usability of the online privacy mechanisms.

The Persuasive CPM

In this section we first introduce persuasive systems and propose the persuasive CPM approach as a means to enhance usability of privacy online. We then evaluate a disclosure-privacy scenario with respect to the CPM stages in an attempt to identify the boundary rules that can be formed with the current interaction design and to understand whether the design caters for privacy as a communication process.

Persuasive Systems

Persuasive systems are 'computerised software or information system designed to reinforce, shape or change attitudes or behaviours or both without using coercion or deception' [START_REF] Oinas-Kukkonen | Towards deeper understanding of persuasion in software and information systems[END_REF]. Such systems employ persuasive techniques that are designed to enable compliance, change behaviour or attitudes and that rely on the voluntary participation of end-users [START_REF] Oinas-Kukkonen | Behaviour change support systems: a research model and agenda[END_REF]. Studies have shown that human beings have an innate privacy need and hence attitudes to privacy. Since end-users already have a privacy attitude, we suggest employing persuasive techniques to influence behaviour. Hence, the context of the persuasive topic tackled by this paper and research is online privacy behaviour change for adopted, or learnt disclosure behaviour, privacy reinforcement for those privacy behaviours that are already present but hard to maintain and sustain and the shaping of new privacy behaviours.

A persuasive system design approach [START_REF] Oinas-Kukkonen | A Systematic Framework for Designing and Evaluating Persuasive Systems[END_REF] though quite a recently developed approach can be used to direct the analysis of systems requiring persuasive strategies and the selection of specific persuasive principles that can be used to achieve specific goals, in different contexts. Persuasive design principles [START_REF] Oinas-Kukkonen | A Systematic Framework for Designing and Evaluating Persuasive Systems[END_REF] can provide for primary task support, human-computer dialogue support, perceived system credibility and social influence.

The Proposed Persuasive CPM

In Figure 1 below we propose a persuasive CPM for usable online privacy. The persuasive CPM model is a preliminary adaptation of CPM with persuasive techniques selected for each process of privacy boundary management using the four categories of persuasive systems principles of the persuasive system design approach of Oinas-Kukkonen & Harjumaa [START_REF] Oinas-Kukkonen | A Systematic Framework for Designing and Evaluating Persuasive Systems[END_REF].

Figure 1: The persuasive CPM -a preliminary diagram based on Petronio's CPM [START_REF] Petronio | Boundaries of privacy: dialectics of disclosure[END_REF] and Oinas-Kukkonen & Harjumaa's persuasive system design approach [START_REF] Oinas-Kukkonen | A Systematic Framework for Designing and Evaluating Persuasive Systems[END_REF] For each stage of the CPM we propose a set of persuasive principles that have the potential of enhancing usability of privacy interactions. For instance, for boundary formation, information is sought and new rules are formed or existing rules are acquired. Hence, the persuasive principles listed in Figure 1 for boundary formation could facilitate communication to make the end-user aware of the type of boundaries being formed, to help decide on the type of privacy rules and also help facilitate the process of setting these rules.

While this model still needs to be subjected to rigorous analysis and testing, we can already advance that this persuasive CPM approach could cater for the transparency need of privacy and also help towards providing the ability, motivation and trigger to end-users to exercise their right of control over their private information.

Analysis of a disclosure-privacy scenario with respect to the CPM and the persuasive system design principles

We analysed the profile creation of Amazon UK in an attempt to understand how interactions within this scenario have been designed with respect to disclosure and privacy using the CPM processes. We explored the scenario to understand how information can be sought, what boundary rules can be formed, how they are coordinated and negotiated and how turbulence can be resolved. We then identified persuasive principles used within this scenario that would favour disclosure and privacy.

While the first two criteria of rule formation, culture and gender are not affected by the interaction design, the design can however contribute to other criteria of rule formation such as motivation, context and risk-benefit ratio awareness. Moreover, the boundaries coordinated during disclosure-privacy can be inclusive, intersected or unified. In order to identify the type of boundary that can be formed within the scenario, we look for the possibility of coordinating boundaries that is by forming linkage, ownership and permeability rules. For each of the different types of boundaries, different linkages and ownership rules can be coordinated. For instance, within inclusive boundaries, role, coercive or susceptibility linkages and manipulative, benevolent or obligatory ownerships occur. Within intersected boundaries, the linkages are goal or identity linkages, and both parties share responsibility of ownership.

Findings. The interface does not provide explicit information to notify or explain that entering personal data will result in a dyadic boundary nor is the risk of disclosure highlighted. On the other hand, it motivates the end-user to disclose using the words 'share' and 'friends'. Thus, the end-user might not realise that he or she is disclosing information to the service provider rather than still being within his or her personal boundary. In fact, the creation of a profile involves a dyadic boundary formation, where the criteria used to trigger boundary rule formation includes context (type of products bought), motivation and benefits -apart from culture and gender. The rules formed within this dyadic boundary are also acquired by the end-user without his or her awareness. Since there are no disclosure warnings and rules cannot be negotiated, the end-user has to accept pre-existing rules set by the service provider.

As the end-user goes through a process of boundary appropriation by appropriating an already defined and set boundary and without having been provided with information about the type of boundary being formed, the coordinated boundary is inclusive. In this type of boundary coordination in the current scenario, the linkages formed can be either coercive or role linkages. In this case it is coercive linkage since the end-user is not made aware that he or she is leaving the personal boundary to form a dyadic boundary during the interactions of profile creation. If the end-user was aware of this it would be the result of prior experience and the boundary linkage within this inclusive coordination would be role linkages. Role linkages refer to linkages formed with the service provider who takes control of the information disclosed by the end-user due to the former's role of providing services that requires disclosure from the part of the end-user. In both cases, the end-user does not know who else might be linked and have access to this new boundary.

The type of boundary ownership formed is either manipulative or obligatory. That is the service provider manipulates the end-user into disclosing while not making the end-user aware that a dyadic boundary is being formed and that control of ownership of information shared has been lost. The ownership could also be obligatory if the end-user can understand that he or she has left his personal boundary but is obliged to disclose and give up ownership in order to benefit from services. Hence the end-user is not given any control over how the disclosed information can be distributed. Profile creation in this scenario precludes editing and the visibility of the profile is automatically set to 'public'. The profile creation page does not lead immediately to profile editing meaning that one would not know how the profile is visible.

We also identified the persuasive techniques that are present within the interaction design and the table below provides the identified list from each of the four categories of persuasive system design principles that favours disclosure.

System Credibility Support

Trustworthiness: trustworthy since it is Amazon (widely used) and says 'If you are not X, click here'. Surface credibility: the interface/website looks and feels competent; there are for instance no adverts.

Dialogue Support

Rewards: 'Your Profile is a one-stop place for your friends and other people to find you and learn more about you.'

Social Support

Normative influence: 'Connect with friends and other Amazon customers.' For persuasive techniques that could favour privacy; there is a link at the bottom of the page in very small print. Clicking on the link reveals a page of text that provides for reduction since the text is divided into sections. However the text within the separate sections is condensed and would probably not encourage reading. This analysis has allowed us to identify the linkages and ownership rules that could be coordinated within the current scenario and the type of boundary that could be formed. We also found that the interactions designed within this scenario fail to provide for the boundary management processes of the CPM. We identified some persuasive system design principles that could favour disclosure but only one that would favour privacy. It would be valuable to find out whether the addition of persuasive principles for privacy (via the boundary management process of the CPM) would enhance privacy usability online.

Conclusion and future work

In this paper we have discussed the differences between offline and online privacy. The online and offline environments differ fundamentally in a way that causes a difference in the properties of the private details shared. We explored socialpsychological theories of privacy and highlighted that privacy is intertwined with communication and interpersonal relationships. We then suggested an approach through which offline privacy behaviour could to some extent be replicated online, that is by using Petronio's [START_REF] Petronio | Boundaries of privacy: dialectics of disclosure[END_REF] privacy boundary management theory. We proposed a persuasive Communication Privacy Management (CPM) as a means for end-users to be better able to express, and communicate, and hence engage, with their privacy online and analysed a disclosure-privacy scenario with respect to the CPM. The proposed approach has not yet been tested but paves the way for research which considers the changing, reinforcing and shaping of online privacy behaviour through enhancement of human-computer privacy interactions which will lead to usable online privacy. The next step for the research is to analyse other scenarios of online privacy mechanisms added and embedded within systems with respect to the CPM framework and then analyse their persuasiveness according to the persuasive system design approach. We will then perform empirical usability studies with an aim to explore the effect of a persuasive CPM approach on the usability of privacy mechanisms.

Table 1 :

 1 Persuasive techniques used to favour disclosure

	Primary task support
	Reduction: 'It's easy! Just choose a
	public name for Your Profile.'
	Self-monitoring: 'Your profile contains
	information about you and your Amazon
	activities such as your Wish List and
	reviews you've written.'
	Suggestion: of a name in the textbox
	Personalisation: personalised suggested
	name.
	Tunnelling: by providing a text box to
	write a name and a yellow button to
	create profile.


Manuela Berg
email: manuela.berg@tu-dresden.de

Katrin Borcea-Pfitzmann

Andreas Pfitzmann

Implementability of the Identity Management Part in Pfitzmann/Hansen's Terminology for a Complex Digital World

Based on a widely cited terminology, this paper provides different interpretations of concepts introduced in the terminology asking for an implementable privacy model for computer-mediated interactions between individuals. A separation of the digital world and the physical world is proposed, as well as a linkage of the two worlds. The digital world contains digital representations of individuals and it consists of pure data. The physical world contains individuals and it consists of information (produced by individuals) and data. Moreover, a refined definition of privacy is being elaborated that serves as justification for identity management of individuals interested in a sophisticated perspective of privacy.

Introduction

Since time immemorial, relationships between individuals have been a need of mankind. Interaction, meaning mutual action and communication, between individuals is the basis for establishing a social system [START_REF] Luhmann | Soziale Systeme: Grundriss einer allgemeinen Theorie[END_REF]. During the last decades, technology rapidly developed. Computer-mediated interaction became important and reached its current high point with the Web 2.0 movement. In contrast to early computer-mediated interaction, users are now more and more active in content and application production.

User profiles and content of web applications are sources of personal data. Apart from explicit publishing of personal data, users also implicitly disclose personal attitudes, opinions, or even personal statements within bulletin boards, blogs etc. Moreover, users publish data non-related to themselves. In many cases, users are not aware of the risks connected with the possibilities of linking different sources of information.

Applications are usually built to achive a certain functionality (such as communication). Privacy is usually considered as a secondary (or even tertiary) functionality, which is valuable for individuals if the primary functionality is fulfilled. Consequently, privacy aspects are not involved in many applications. An identity management system is an application, which fulfills privacy aspects as primary functionality. This could be a reason, why identity management systems are not accepted in the public. No matter, which importance the functionality of privacy has, it is of importance. We elaborate a definition of privacy based on existing approaches.

We consider computer-mediated interaction triggered by individuals 1 . On the one hand, this interactions generate networks of individuals. We refer to the amount of individuals as physical world. On the other hand, computer-mediated interactions generate networks of digital representations of the individuals, which we refer to as digital world. 2 Of course, individuals and their digital representations are linked, so they are not independent from each other. The digital world in all its complexity and its linkage to the individuals is what we refer to when talking about a complex digital world.

The authors of [START_REF] Clauß | Identity management and its support of multilateral security[END_REF] introduce the concept of privacy-enhancing identity management using partial identities, i.e., subsets of an individual's digital identity, to tackle potential privacy problems caused by linking information from different sources to the individual's identity. Related to this, Pfitzmann and Hansen continuously work on a comprehensive terminology framing the area of privacyrelated terms [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF]. The objective is to start an analysis of that widely accepted and cited terminology from the perspective of the complex digital world.

In this paper, we reason that two worlds have to be distinguished, the physical world and the digital world. The two worlds are linked by two functions -Ego( ) and Oge( ). While the latter maps from the physical world to the digital world and delegates the individual's communication to the digital representation, the former indicated function maps from the digital world to the physical world and carries information of the communication of digital representations back to the individuals. Moreover, we propose an extended definition of privacy, which is described as a state attained by a desire of an individual. Given computer-mediated communication, this state influences the communication of an individual and its digital representations with others in the complex digital world. Considering the building of applications and the separation of the digital and the physical world, we give a definition of privacy. We also discuss this definition regarding concepts of privacy as given in [START_REF] Solove | Conceptualizing Privacy[END_REF] and [START_REF] Decew | Pursuit of Privacy: Law, Ethics and the Rise of Technology[END_REF].

Accordingly, the following section will frame the problem space by briefly introducing the kind of complexity shaping the complex digital world from an analytical point of view and stating the research questions being the road map for the following sections. In Sect. 3, we discuss the Pfitzmann/Hansen terminology by confronting it with the setting of the complex digital world. Finally, Sect. 4 takes up the issues figured out in the previous section and discusses the separation of the physical as well as the digital worlds. Further, this section proposes an enhanced definition of privacy applied on personal interaction as well as on computer-mediated interaction, which is discussed in terms of known concepts of privacy.

Framing the Problem Space

Regarding the complex digital world, individuals are considered as actors in the physical world and digital representations of the individuals are considered as actors in the digital world. We call an actor entity. Further, we call connections between entities resulting from possible or occurred communication a relationship. With respect to an established relationship, we call an entity that participates in this relationship involved entity. Of course, relationships might be created even if there has not been any direct communication between the involved parties yet. Consequently, those relationships can be manifested by the involved entities or by non-involved entities.

Traditionally, communication is modeled using the bilateral sender-receiver model and privacy has been studied mainly in scenarios involving service providers and service consumers. We argue that communication, and so interaction, is more complex: (a) interaction does not only take place between one particular user and one or more service provider(s). In this paper, we focus on interactions between individuals3 . The implications on privacy protection of them have not yet been studied in detail. (b) interaction does not only occur bilaterally. Given that at one particular point in time, there exists one sender at maximum for a message, there might, nevertheless, be several recipients (or zero or only one) for this message.

Interactions constitutes a dynamic system, which develops over time. An interaction is usually describable by a bunch of message that are sent by different individuals. In the sender-receiver model, more than one message can be regarded only if the messages are considered as a totally ordered sequence while in the complex digital world, messages can be transmitted concurrently. However, there is a certain order of the messages (for example ordered by the time of sending). We call a bunch of messages interaction, if one recipient of a former message becomes a sender and the sender of a former message becomes a receiver. Consequently there are usually several senders in an interaction. (c) between two entities, there might exist relationships of different quality and quantity. We defined a relationship between entities as a connection resulting from communication independent from any semantics and quantity. Further research should extend the understanding of relationships by more differentiations, i.e., by considering relationship semantics such as "is friend of" or "is colleague of" and take into account frequencies and durations of communications as well as preferred means of communication.

(d) to be mentioned here is that entities might act differently in different situations.

The authors in [START_REF] Borcea-Pfitzmann | Model of Multilateral Interactions[END_REF] address the above mentioned issues. They introduce the concepts of entity, view, relationship, and context as parts of a model that touches various aspects of a complex digital world. Regarding the analysis of the Pfitzmann/Hansen terminology [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF], this paper particularly focuses on entities and relationships.

In the complex digital world as outlined above, we raise the following research questions:

1. Are there concepts in [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF] that make it necessary to separate individuals and their digital representation? 2. What precisely are the entities, and how are entities characterized when transcending the borders of the physical and digital world? 3. What are the interests of entities regarding the disclosure of personal information? 4. Having learned about entities and their interests, does this help us to develop an application that supports entities pursuing their interests?

3 Analyzing the Notion of Identities in the Terminology of Pfitzmann/Hansen

In 2000, Pfitzmann and Köhntopp4 published a terminology describing the concepts of anonymity, unobservability, and pseudonymity [START_REF] Pfitzmann | Anonymity, Unobservability, and Pseudonymity -A Proposal for Terminology[END_REF]. In June 2004, they extended their terminology collection with definitions of terms related to identity management with regard to data minimization and user-control. Since then, the authors continuously extended and refined that terminology. The most recent version [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF] serves as basis for our analysis regarding the questions raised in Sect. 2. In [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF], the traditional sender-receiver model is assumed, where usually one message is considered and a subject is defined as a human being, a legal person or a computer. Different kinds of relationship and different situations are not considered. Table 1 compares the setting of the Pfitzmann/Hansen's terminology with the setting of the complex digital world. We analyze the questions raised in Sect. 2:

1. Anonymity in [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF] is defined as follows.

Definition 1. "Anonymity of a subject from an attacker's perspective means that the attacker cannot sufficiently identify the subject within a set of subjects, the anonymity set."

Subject is defined in [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF] and covers the physical body with its feelings, needs and also its digital representation. The German law for data protection [8, §3 1. The comparison of the complex digital world and the model of Pfitzmann/Hansen [START_REF] Borcea-Pfitzmann | Model of Multilateral Interactions[END_REF]] defines anonymization as the act of transforming personal data in a way to make it difficult or impossible to link personal data to the individual. Since an attacker can be settled either in the physical world or in the digital world (depending on what the attacker wants to find out) and since personal data is part of the individual's digital representation, we can distinguish three types of anonymity: (a) An individual is anonymous in a set of individuals, which means either that an attacker in the physical world wants to identify an entity in the physical world. (b) Anonymity is regarded as unlinkability between an individual and his digital representations, which either means that an attacker in the physical world (which has control over his digital representations) wants to find out which digital representations belong to a physical entity (or which physical entity belongs to a digital representation) or it means that the attacker in the physical world wants to link some digital representations belonging to the same entity or the same group, e.g., the group of employees of one company. (c) A digital representation is anonymous in a set of digital representations, which means that an attacker in the digital world wants to identify an entity in the digital world. Depending on the respective situation, an individual has different preferences towards the kind of anonymity to be protected most. The three types of anonymity are not independent from each other. If, for example, a digital representation is not anonym and it is also linkable to its individual, then the corresponding individual can not be anonymous neither. Further, we have to admit that representing an individual just by data might not be enough to characterize this individual (see Sect. 4). 2. Referring to individual persons, the authors of [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management[END_REF] define identity as follows: Definition 2. (Identity) "An identity is any subset of attribute values of an individual person which sufficiently identifies this individual person within any set of persons."

The definition implies that every individual may have more than one identity. We will reveal different interpretations of this concept. (a) We can consider identity as a socio-centric concept. This means that identities are omnipresent. For example, an all-knowing entity would consider the information he knows about an individual as an individual's identity. This means that information gained from perceptions of this individual about his interaction partners might be included in his identity. Such an approach of understanding the concept of identity might be interesting for service providers, but it is not reasonable for individuals caring for their privacy because individuals should have control of their data. (b) The term identity can also be considered as an ego-centric concept. For an individual that wants to show himself differently to different people, this is the more appropriate approach. However, this implies even more questions: If we assume that an individual establishes an identity of himself, then this is a digital representation of himself. This approach of defining identity, however, misses the aspect of perceptions. We will refer to the individual's perception of an interaction partner as view of an individual on an interaction partner. The concept of a view can be realized as a set5 in an application. On the one hand, an individual's digital representation has views on its interaction partners. So the question arises, whether these views are part of the identity established by the individual. On the other hand, the interaction partner has a particular view of the individual. This leads to the question whether the view can be compared with the identity and if they can be compared, then one may ask when do the identity and the view coincide. 3. Every individual has his own attitudes regarding his privacy. When discussing privacy aspects, Pfitzmann and Hansen refer to the definition given in [START_REF] Westin | Privacy and Freedom[END_REF]: Definition 3. (Privacy) "Privacy is the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others."

In our view, this definition misses some aspects of variety. Nevertheless, the sentences following the cited definition in [START_REF] Westin | Privacy and Freedom[END_REF] contain some of our intended aspects. For example, negotiation between functionality and non-disclosure of data as well as the dependency of situations are two aspects that are mentioned and shall be included in an extended definition (see Sect. 4).

Pfitzmann and

Hansen embed the definitions of their terminology in an environment aiming at achieving privacy by data minimization through usercontrolled identity management. However, the terminology provides little information of how to implement the concepts of privacy protection when designing applications for the digital world.

The above-mentioned issues describe first problems that can be solved by separating the physical and the digital world. Consequently, the following section points out a first approach to model privacy and identity-related concepts in a complex digital world.

Approach to Model a Complex Digital World with Respect to Privacy and Identity Management

We propose a model for a complex digital world referring to the problems raised in Sect. 3. The three types of anonymity elaborated there require a separation of the digital representation from the individual of the physical world. We call the digital representation digital entity and the individual physical entity.

Similarly, Semančík distinguishes the notions of entities in the digital world and in the physical world as follows: native digital entities (e.g., software components), physical entities (persons of the physical world), and digital proxies (digital representations of a physical entity) [START_REF] Semančík | Basic Properties of the Persona Model[END_REF]. Thereby, digital proxies (data structures characterizing the entity) are representations of the physical entities. Also, a physical entity may have several native digital entities and several digital proxies in "the same or in a different computer system." We neglect the notion of native digital entities here because we are interested in the (inter)action of the entities. Moreover, we think that native digital entities and digital proxies can be subsumed under the set of digital entities. Data and information were discussed by several authors as parts of the knowledge hierarchy for information systems and knowledge management. Two possible differentiators between data and information have been identified in [START_REF] Rowley | The wisdom hierarchy: representations of the DIKW hierarchy[END_REF]: meaning and structure. So, information is defined either as data that have been given meaning (or a value) or as data that has been processed or organized. The choice of the differentiator implies consequences where information is embedded: either in systems or in individuals' minds or in both. Usually, information defined by meaning either is said to be produced by individuals or nothing is said about the producer of information. We refer to meaning as the differentiator and assume that information can only be produced by individuals 6 . So, the digital entity consists of pure data while the physical entity can produce information. More precisely, the physical entity has feelings and needs (e.g., regarding communication and privacy) and he is able to interpret data, i.e., produce information.

In [START_REF]Information technology -Vocabulary -Part 1: Fundamental Terms[END_REF], a standardization of data and information was given which has been rejected in the meanwhile. The definitions of data and information are broadly discussed as a part of the wisdom hierarchy (also known as DIKW hierarchy), e.g., in [START_REF] Ackoff | From data to wisdom[END_REF], [START_REF] Davenport | Working Knowledge[END_REF] and [START_REF] Bellinger | Data, Information, Knowledge, and Wisdom[END_REF]. We refer to the definitions of [START_REF] Ackoff | From data to wisdom[END_REF] as given in [START_REF] Rowley | The wisdom hierarchy: representations of the DIKW hierarchy[END_REF]: Data are defined as symbols that represent properties of objects, events and their environment. They are the products of observation. But are of no use until they are in a useable (i.e. relevant) form. The difference between data and information is functional, not structural. Information is contained in descriptions, answers to questions that begin with such words as who, what, when and how many. Information systems generate store, retrieve, and process data. Information is inferred from data. The digital entities exist in the digital world, which is a world of pure data, and the physical entity is part of the physical world (cf. Fig. 1), where information is part of. The digital world and the physical world are not independent from each other, as it will be explained in the following. Considering an individual A that interacts with an individual B, we assume that, first, A sends a message to B. A decides which message(s) he wants to send and how. He also decides which of his personal data he wants to reveal. But, there might be details about himself that he reveals implicitly or not intentionally. All the matters related to the action of sending can be explicitly fixed in the digital world as data. Those matters are details A reveals about himself consciously and items that A knows (maybe or for sure) or only believes to know about B. Modeling how A delegates the communication from the physical world to the digital world, we introduce the function Oge( ). It is a function which transforms information into data by creating according data structures. If A receives a message from B, then A probably receives new data apart from data that A already stored. Depending on historical knowledge and other parameters such as communication time, place, or the mood of A, the function Ego( ) models how A transforms data into information 7 . In general, for different physical entities, the functions Oge( ) and Ego( ) are not the same. Depending on the derivations gotten in Sect. 3 regarding the term identity, one could consider identity as being part of the concept of entity. That means that we have physical identities and digital identities. The existence of physical identities of an individual can be justified by sociological approaches as elaborated in [START_REF] Goffman | The Presentation of Self in Everyday Life[END_REF]. A digital identity can be described as subset of a digital entity which sufficiently identifies the corresponding entity. From a social point of view, a physical entity is usually interested in whether its digital entities established in the digital world can be linked to the physical entity and whether other physical entities can conclude anything about this particular entity and what. In this respect, we propose a definition of privacy in a complex digital world: Definition 4. (Privacy) Privacy of a physical entity is the result of negotiating and enforcing when, how, to what extent, and in which context which of its data is disclosed to whom. This definition is not limited to considerations in a complex digital world and is achieved considering the following aspects:

1. The understanding of privacy in [START_REF] Westin | Privacy and Freedom[END_REF] includes the following sentence:

"Thus each individual is continually engaged in a personal adjustment process in which he balances the desire for privacy with the desire of disclosure and communication of himself to others, in light of the environmental conditions and social norms set by the society in which he lives." It consists of the idea of negotiating the desires for privacy and communication by the physical entity with himself. We believe that negotiation also takes place between the physical entity and other physical entities. We subsume these aspects by the term "negotiating" in Definition 4. 2. Further, we add the term "enforcing" to the privacy definition because privacy is not only a desire but it is a state resulting from the negotiation process. Violation of privacy can, therefore, be explained as a lacking ability of enforcement.

3. We usually differentiate to whom exactly we disclose which information. We do not see all the other physical entities as a mass. Hence, we replace others by "whom" in Definition 4.8 4. The involvement of situations is already mentioned by [START_REF] Westin | Privacy and Freedom[END_REF] (see above). The concept of "context" is an appropriate concept for modeling situations. Context as a concept required in information technology research is typically described with respect to locations [START_REF] Schilit | Context-Aware Computing Applications[END_REF]. Regarding privacy, the concept needs to be elaborated with respect to user-control (cf. [START_REF] Nissenbaum | Privacy as Contextual Privacy[END_REF]) or integrity (cf. [START_REF] Pfitzmann | Privacy 3.0 := Data Minimization + User-Control of Data Disclosure + Contextual Integrity[END_REF]).

The definition of privacy emphasizes the property of being a state as well as the importance of user control. Especially in respect to the latter, our definition is similar to the definition given by [START_REF] Westin | Privacy and Freedom[END_REF].

In [START_REF] Solove | Conceptualizing Privacy[END_REF] and [START_REF] Decew | Pursuit of Privacy: Law, Ethics and the Rise of Technology[END_REF], several concepts of privacy are described. In [START_REF] Solove | Conceptualizing Privacy[END_REF], Solove found the following conceptions:

1. The Right to Be Left Alone, 2. Limited Access to the Self, 3. Secrecy, 4. Control Over Personal Information, 5. Personhood, and 6. Intimacy, where 3. and 4. are subsets of 2. in [START_REF] Solove | Conceptualizing Privacy[END_REF]. DeCew distinguishes informational privacy, accessibility privacy and expressive privacy [START_REF] Decew | Pursuit of Privacy: Law, Ethics and the Rise of Technology[END_REF]. These concepts of privacy are subsumed under 2., 4. and 5. by Solove. Definition 4 matches the concepts of DeCew since informational privacy is covered by the data that is processed and accessibility matches the user control in this definition. Automatic or semiautomatic decision making would not omit this point unless the user keeps control. Since this definition is valid for computer-mediated communication, the body can not be accessed, only the mental properties are concerns of accessibility in the sense of DeCew. The expressive privacy is covered due to possible modification in context, the data itself, and the negotiation. The Right to Be Left Alone is difficult to cover, since not every intrusion is an invasion of privacy.

With the differentiation of an individual's privacy concerns, one can see the separation into identities as an implication of the privacy definition. Similarly, the separation of identities (resulting in partial identities) has been identified as one of the important paradigms of privacy (apart from privacy as confidentiality and privacy as self-determination) in [START_REF] Gürses | Multilateral Privacy Requirements Analysis in Online Social Network Services[END_REF].

Conclusion

In this paper, we proposed the separation of the physical world and the digital world as well as a linkage between the two worlds by introducing the functions Oge( ) and Ego( ). An enhanced definition of privacy is given for physical entities.

At this point of work, we did not yet elaborate on the notion of partial identities being an essential part of the identity-related terminology by Pfitzmann/Hansen. This needs to be done in further research. Also, we did not characterize what exactly entities in the physical world could be. At the current point of research, we restrict our considerations to individuals only and did not elaborate on organizations or legal persons. This was mainly addressed in privacy considerations until now. Moreover, groups of entities represent a further challenge if they are physical entities themselves and control their digital (group) entities. Further research will address elaborations regarding the relationships between entities as well as dynamics based on time.

In our paper we apply the definition of Westin to yield a refined definition of privacy. However, scientific literature covers more definitions of privacy. Depending on the context or domain, those definitions of privacy could also serve as starting points for discussion with respect to the digital and physical worlds.

Regarding the definitions of entities (digital and physical), formal methods could be applied to allow more detailed analysis of privacy in a complex digital world. For example, social network analysis using graph theory and matrix representation are approaches to model entities and their relationships, including relationships of different kinds. Game theory would be another modeling approach. We would like to thank Professor Andreas Pfitzmann, Stefan Köpsell and the three unknown reviewers for lots of discussions and comments.

Fig. 1 .

 1 Fig. 1. The world of data and the world of information are connected by the functions Oge( ) and Ego( ).

Organizations and computers can be imagined to trigger computer-mediated interaction, too, but we do not consider this case here.

[START_REF] Clauß | Identity management and its support of multilateral security[END_REF] Besides digital representation, there might be other items in the digital world that we do not consider in this paper.

Usually, entities comprise organizations and technical devices, apart from individuals.

Taking identity management serious, Hansen and Köhntopp are names for the same person.

A View might also be an empty set.

If one considers organizations then they produce information only by individuals. Computers can not produce information at all. But individuals can use data out of computers to get information.

The functions are labelled Oge( ) and Ego( ), because "Ego" shall indicate that the way how an individual derives information from data is an essential part the (identity of the) individual.

If one assumes that organizations have privacy, then the definition should use the word "whom" not only for individuals but also for organizations or computer. Another, even more flexible possibility is the replacement of "whom" by "which entity".