Farzaneh Karegar
email: farzaneh.karegar@kau.se

Tobias Pulls
email: tobias.pulls@kau.se

Simone Fischer-Hübner
email: simone.fischer-huebner@kau.se

Visualizing Exports of Personal Data by Exercising the Right of Data Portability in the Data Track -Are People Ready for This?

Keywords: Transparency Enhancing Tools, Data Portability, Visualisation, Data Track

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Transparency of personal data processing is an important principle for the privacy of individuals as well as for a democratic society [START_REF] Fischer-Hübner | How can cloud users be supported in deciding on, tracking and controlling how their data are used?[END_REF]. People rarely have a clear understanding about how their personal data are collected, used, shared or accessed [START_REF] Angulo | Usable transparency with the Data Track: a tool for visualizing data disclosures[END_REF]. Consequently, transparency of personal data processing is enforced by most Western privacy laws, including the EU Data Protection Directive (DPD) 95/46/EC [6] and new General Data Protection Regulation (GDPR) [START_REF]679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and[END_REF] which will replace the DPD in 2018. The GDPR grants enhanced data subject rights for transparency and intervenability, such as the right of access by the data subject including the right to receive a data copy of her personal data undergoing processing in a commonly used electronic format (Art. 15), the right to rectification and erasure (Art. [START_REF] Mun | Personal data vaults: A locus of control for personal data streams[END_REF][START_REF] Onwuegbuzie | Validity and qualitative research: An oxymoron?[END_REF], and the right to data portability (Art. [START_REF] Popescu | Increasing transparency and privacy for online social network users-usemp value model, scoring framework and legal[END_REF]. The right to data portability is aiming at increasing user choices of online services and allows users to request all their data from a data controller that in turn has to provide the users with the data in a structured, commonly-used machine readable format which can then be transmitted to any other controllers. Alternatively, the users can also request to transmit their data directly from a service provider to another one, if technically feasible. One way to exert these rights pursuant to GDPR is using technologies which enhance transparency and provide user control. These kinds of technologies are commonly referred to as Transparency Enhancing Tools (TETs) [START_REF] Hildebrandt | Behavioural biometric profiling and transparency enhancing tools[END_REF].

The Data Track (DT) developed at Karlstad University (KaU) is an example of a TET that shows users what data they have disclosed to which service providers under what agreed-upon policies and how their data have been processed. The Data Track development started as a part of the European PRIME 1 and PrimeLife 2 projects and continued as part of the A4Cloud project 3 . This paper reports about a user study on the perception of a new function for visualising exports of personal big data to the data subjects, which we added recently to the Data Track tool. Already today, many service providers, such as Google and Facebook, provide users with data export functions for downloading their personal data. The newly added functionality to the Data Track for visualizing personal data exports from a service provider, which is also available in the form of a stand-alone open source Data Track version 4 , can for instance provide users with an overview of the location data they (or more precisely their devices) have disclosed to Google by first exporting their data from myaccount.google.com as a file and then importing the data to the Data Track for visualisation. At least when the GDPR will apply in May 2018, users could export their personal data from all types of service providers (beyond those providing export functions already today) by exercising their right to receive an electronic copy (Art. [START_REF]Lightbeam add-on for Firefox[END_REF] or their data portability right (Art. 20) and could import them to the Data Track for visualising their disclosed data to different services providers.

In this paper, we present a qualitative user study which has the objective to analyse the users' perceptions of the stand-alone Data Track in regard to the transparency features that it is providing and in regard to the concept of data export from a service provider to the Data Track running at the user's machine by exercising the rights to access and of data portability.

More precisely, we have been addressing the following two research questions and related sub-questions:

1. What are the users' perceptions of transparency with the standalone Data Track?: Does the interface convey that Google has more information about the users other than what they have sent explicitly or implicitly? What kind of transparency options are the users interested in and would they like the Data Track to provide more transparency information related to their data? Do users have any concerns in regard to using the Data Track? 2. What are users' perceptions of data export and portability with the stand-alone Data Tack?: Do users understand and value the idea and the concept of exporting data from a service provider (Google in this case) and importing it to a tool running on their own machines or to another service provider? Consequently, do users understand the differences between locally stored (and thus user controlled) and remotely stored data? (i.e. data stored on their computers in the Data Track under their control after being exported from a service provider vs. data stored at the service's side)?

In the remainder of this paper, Section 2 briefly presents background and related work in regard to TETs and related user studies, Section 3 explains the methods used in our work and the test plan. Section 4 is devoted to analyzing the results. Finally, Section 5 discusses our conclusion and future work.

Background and Related Work

In this section, we first explain the different kinds of TETs. Then we elaborate more on Data Track versions and finally we describe the related user studies.

Transparency Enhancing Tools

There is a variety of TETs that have been developed and evaluated with different types of user tests in the past. TETs can in general be divided into ex-ante TETs-which enable the anticipation of consequences before data are actually disclosed (e.g., with the help of privacy policy statements)-and ex-post TETs which inform about consequences if data already have been revealed (cf. [START_REF] Hildebrandt | Behavioural biometric profiling and transparency enhancing tools[END_REF]).

TETs can be further categorised, in dependence on where the transparency information is stored and controlled, into services side TETs, user side TETs and Third Party TETs. Services side TETs run at the service provider's side and allow authenticated users to receive information about collected, processed or forwarded data at those sides. Examples of services side TETs are the Google Dashboard5 or PrivacyInsight [START_REF] Bier | PrivacyInsight: The next generation privacy dashboard[END_REF]. A Third Party TET requires the user to entrust a third party with the user's personal data for providing transparency services. An example for a Third Party TET is the DataBait tool by the EU project USEMP [START_REF] Popescu | Increasing transparency and privacy for online social network users-usemp value model, scoring framework and legal[END_REF], which derives guesses and predictions about the user's personality by analyzing the user's social media and browser data with machine learning software. User side (or user controlled) TETs store the user's personal information to be made transparent locally on the user's device under the user's control. While user side TETs require the user's device to keep the data safe and may be more demanding to set up and get running from a usability perspective, they are in principle the more privacy-friendly solution, as the users retain control over their data. Examples of user side TETs are Mozilla's Lightbeam [START_REF]Lightbeam add-on for Firefox[END_REF] or personal data vaults, such as Mun's et al. work [START_REF] Mun | Personal data vaults: A locus of control for personal data streams[END_REF], and the different versions of the Data Track that are briefly presented in the next section.

Data Track Versions

The first version of the Data Track was developed within the PRIME project [START_REF] Pettersson | Outlining "Data Track": privacy-friendly data maintenance for end-users[END_REF] and included a "history function" for each transaction, in which the user's disclosed personal data to a service, a record describing to whom the personal data was disclosed (i.e. the identity of the controller), for which purposes and, more precisely, under which agreed-upon privacy policy, as well as a unique transaction pseudonym are stored in a secure manner. It was later complemented in the PrimeLife project with online access functions, which allow users (authenticated as data subjects of data held by a service provider via those transaction pseudonyms) exercising data subject rights to access, correct, rectify or erase those data at the service provider's side [START_REF] Fischer-Hübner | Trust and assurance HCI[END_REF].

For the next Data Track versions developed in the A4Cloud project [START_REF] Fischer-Hübner | How can cloud users be supported in deciding on, tracking and controlling how their data are used?[END_REF], [START_REF] Angulo | Usable transparency with the Data Track: a tool for visualizing data disclosures[END_REF], we have mainly improved the user interfaces (UIs) and interaction concepts, replacing the tabular presentations of the PrimeLife Data Track with the graphical UI illustrations, as previous research studies suggest that network-like visualizations provide a simple way to understand the meaning behind some types of data [START_REF] Becker | Visualizing network data[END_REF], [START_REF] Freeman | Visualizing social networks[END_REF]. Therefore, for the A4Cloud Data Track (also called "GenomSynlig"), we developed the so-called "trace view" (see Figure 1), presenting an overview of the data items sent to service providers, as well as the data items service providers received about the user. In addition to this "local view" of the trace view, which is graphically displaying the information that is stored locally in the Data Track about what data has been disclosed to whom, a user can also execute online access functions for exercising her data subject rights by clicking on the cloud icon next to the service provider's logo thereby switching to a "remote view" of what (disclosed or derived) data about the user are stored at the service provider side. In addition, an alternative timeline view has been developed for the A4Cloud Data Track, which lists the information about data disclosures in the Data Track records in chronological order for selected time intervals.

The latest version of the Data Track which is, as mentioned earlier, an open source and stand-alone program developed at the end of the A4Cloud project at KaU, is subject of this paper. It provides users with the visualization of data exported from the Google managing archive service. For our first version, we focused on the Google location history to be included in our archive. After successfully exporting the location data from Google and importing it to the Data Track, in addition to the trace and the timeline views, participants have a newly developed map view that allows to visualize location, activity and movement patterns as described in the location history provided by Google (see Figure 2). Activities are data derived by Google based on the locations reported by their devices (i.e., activities are derived by Google and not by the user's device).

Related User Studies

User studies have been conducted for various ex-post TETs, which are mainly demonstrating the usability of graphical network-like presentations to illustrate data flows. For instance, Bier et al. present recent usability studies of the user interfaces of the PrivacyInsight tool in comparison to GenomSynlig and their different network-like data flow representations [START_REF] Bier | PrivacyInsight: The next generation privacy dashboard[END_REF]. Moreover, Kane-Zabihi et al. present usability tests of an "interactive social translucence map" [START_REF] Kani-Zabihi | Increasing service users privacy awareness by introducing on-line interactive privacy features[END_REF]. Other user evaluations studies or TETs using both network-like presentations and chronological presentations of data disclosure events comprise user tests of previous Data Track versions (with its trace and timeline views) and a user test by Kolter et al. of a tool for visualising transaction logs [START_REF] Kolter | Visualizing past personal data disclosures[END_REF].

Prototypes of the trace and timeline views of the A4Cloud Data Track have been evaluated with usability tests and two focus group workshops. These user evaluations revealed that while test participants mostly valued the transparency functionality of the Data Track and could successfully use it for tracking data disclosures, many test users had however problems to understand whether data records were stored in the Data Track client on the users' side (under the users' control) or on the remote service provider's side [8][3]. The specific feature of the Data Track trace view that allows to easily switch from a local view of Data Track records to a remote view providing users with online access to the data stored at the service provider's side, might have contributed to this confusion. As previous A4Cloud Data Track user tests and usability tests conducted in the PRIME project [START_REF] Pettersson | Making PRIME Usable[END_REF] showed the user's confusion of discerning between the locally and remotely data control and access, our user study also analysed the user's understanding of locally and user-controlled data (at the user's side) vs. remotely stored and controlled data (at the service provider's side) for the standalone Data Track with its new map view.

In contrast to those previous user studies of the Data Track, this paper evaluated the new stand-alone version of the Data Track with its newly added map view. This paper presents the first evaluation of the perception of a transparency tool based on exports of personal data from a service provider (Google in this case) and of its perceived value when exercising the right to receive an electronic copy of the personal data or the data portability right pursuant to the upcoming GDPR.

User Study and Methods

We conducted a user study with ten participants with the objective to receive insights on the users' perceptions of transparency functions and of data export and portability with the latest stand-alone version of the Data Track. Our study is primarily a qualitative study using semi-structured interviews, which are allowing to follow and explore new directions as they come up in the interview process, and a grounded theory based approach [START_REF] Charmaz | Constructing grounded theory[END_REF] to surface key themes that arise in our interviews.

Before the user study, we conducted an incremental and iterative pilot study with 16 participants. The reason to conduct the pilot user study was twofold: 1) To test, fine-tune the task and adopt the timing. 2) To tailor and manipulate the questions we ask during the study for better answering our main research questions.

Based on the feedback that we received during the pilot study, we manipulated our interview questions on the grounds that some of them were not suitable enough to answer our two main research questions. Ultimately, we also concluded to guide users during the interview through how they can download the location file from Google. In the pilot test, the participants were supposed to follow the instructions or watch a video on the Data Track to detect where on the Google they can order to export their location data. The results showed that it was really time-consuming and sometimes irritating for the users and due to the fact that we do not intend to test the usability and clarity of Google settings, we decided not to time the users but to guide them. In the following, we present the recruitment, study procedure, and demographic information of the participants.

Recruitment of Participants

We strived to get an unbiased sample of participants by recruiting arbitrary people in Karlstad city center (P1-P4, P10), via a Facebook group related to Karlstad (P5, P9) and participants of an innovation seminar in Örebro (P6-P8). Those who accepted our invitation were compensated with a 100 SEK gift card. All interviews were conducted in English in October 2016.

Study Procedure

To begin with, a study plan was written to serve as the main communication vehicle as well as a blueprint for the study. A study plan is a summary of all the containing documents needed for the user studies [START_REF] Rubin | Handbook of usability testing: how to plan, design and conduct effective tests[END_REF]. To avoid an active researcher (study moderator/interviewer) bias which includes mannerisms and statements made by the researcher that provide the participants with information about the researcher's preferences [START_REF] Onwuegbuzie | Validity and qualitative research: An oxymoron?[END_REF], the procedure was standardized. The leading questions were avoided in the interviews and before conducting the user study and in the recruitment advertisements, we told participants that Data Track was implemented at KaU and that we were just responsible for conducting the user study of it.

During the study, each participant received the same instructions and followed the same blueprint. The study took 30-60 minutes based on how much each individual participant wanted to communicate and consisted of four parts: 1) a welcome session in which we thanked them, briefly talked about what they were expected to do and we obtained informed consent from all of participants. The informed consent imparted that participants agreed to have their screen and audio recorded, alongside with their answers. Consent to the recording was not required, though all participants agreed to be recorded, 2) a pre-task questionnaire for collecting demographics, 3) a role-playing task with a fake Google account to download the location data from Google, upload the same file to the Data Track and view the location data in the map view, and 4) the semistructured interview during which participants answered to the questions while they were still allowed to use and navigate through the tool. Two researchers, one as an interviewer (moderator) and one as a note keeper, participated in the studies.

Participants' own Google accounts were not used in the study. Instead, they were given the role of a persona to play to visualize their data. Using a persona, participants feel secure that they are not compromising their personal details when taking part in the study. Moreover, it allows full control of what each participant encounters, avouching a standard experience that can be compared between participants. The persona details in each case included a username and password of a Google account.

Task

After filling in the pre-task questionnaire, the participants had to conduct a task in which they export (download) the location data from Google, import (upload) it to the Data Track and view the visualization of the data and its characteristics in the map view.

Focusing on the users' perceptions of different concepts in the Data Track, the goal of defining the task was not to measure the participants' efficiency in finding how they should download the data. However, we aimed to have the location data imported to the Data Track as the starting point of discussing the interview questions, providing all participants with a common ground for enabling them to have a better insight into what downloading data from a service provider and uploading the same data to another party mean.

Semi-structured Interview

For learning more about the users' perceptions of transparency and of data export (via their right of access) and data portability, after the task, the participants were asked to answer different questions in semi-structured interviews, in which planned questions were asked and other questions emerged based on answers which were annotated by the note keeper (observer).

The interviews consisted of some core questions, each with the candidate follow-up questions designed to encourage participants to give more information. All interviews followed the structure listed in the study plan including but not limited to the questions below: In what circumstances would they like to download and upload their data from/to service providers? How can the Data Track help them if it provides users with the option to edit/filter data and it saves the changes? What is the preferable way for them to transfer the data between service providers (directly or via the Data Track)?

Captured screen videos were checked against notes taken in each interview. The recordings were transcribed and coded to extract participants' ideas and perceptions. Notes taken during the interviews were compared with corresponding screen recordings to reduce the observer bias and ensure the accuracy of data.

Demographic Information

Demographic information extracted from the pre-study questionnaires and summarized in Table 1 shows that six women and four men participated in our study with different age ranges. All the participants but one have Google accounts, all of them work with computers and use the Internet daily or almost every day, and all of them possess smartphones. As discussed above, we tried to get an unbiased sample by mostly inviting arbitrary people from the city center or the Facebook group for citizens of Karlstad. Nonetheless, the table shows that many of the test participants have an academic background-probably because people with a higher education are more interested to participate in a research study by Karlstad University in English and also the fact that Karlstad is a university town with a high percentage of academics and students probably contributes to this effect.

User Study Results

We analysed the answers that we received during the semi-structured interviews, categorized them using the grounded theory method [START_REF] Charmaz | Constructing grounded theory[END_REF] and identified common themes. In this section, we will provide the results of our user study in relation to our two main research questions.

Users' Perceptions of Transparency Functions

The results of our questions aiming to identify users' perceptions about transparency can be categorized in three main domains: 1) the users' understanding of data derived by service providers vs. explicitly or implicitly disclosed data to service providers, 2) users' attitudes about sensitivity and importance of derived data, and 3) desired transparency functions from the users' point of view.

Derived vs. Disclosed Data

We intended to analyse whether the users were aware of or surprised about derived data and whether they were interested in having it visualized. The exact terms used by Google for derived activities from location data displayed in the Data Track (such as "tilting" or "in vehicle") were not meaningful for the participants and most of them were not much interested in this type of derived activity data that Google reveals in the exported file. However, all of the participants expressed that they were aware that some services providers have more data about them comparing to what they disclose directly. They mostly referred to Facebook and they stated their interests in other kinds of derived data like what Facebook learns about them by analysing the keywords and pages they search for. They were also more interested in derived data related to their long-term behavioral patterns (see Section 4.1.3). We conclude that visualising data exports using the exact wording for the derived data categories that service providers such as Google provide, may thus not always be perceived as useful and more meaningful information about this type of data may be more appropriate to be shown by TETs.

Sensitivity and Importance of Derived Data

Some participants expressed that they do not consider the derived activity data visualized in the Data Track as sensitive. To justify, they mentioned that they are not generally concerned about their privacy but they know that on the other hand other people do care about it. In addition, some other participants explained that it depends on different factors like what service providers can learn from analyzing the information and the combination of information and how they intend to use it. Correspondingly, P6 mentioned about activities users would like to hide and said: "if we are on the highway and speeding in our car or if we are doing something illegal, it is really sensitive."

Interestingly, just two of the participants said it is an important and sensitive kind of information. However, one of them mentioned she herself is not interested to know about it because too much information would only scare her.

Whether to have control or not and whether to know about the risks and benefits of derived data were the other parameters participants mentioned that contribute to the fact of importance of visualising derived data.

It is worth mentioning that the context of derived data was location data and the kind of information that people think could be derived from. However, asking them to think of other contexts than location data, their attitudes differed from previous ones. One Participant (P2) mentioned Facebook advertisements and said: "based on the recipe you look for, they know if you are vegan or based on your membership in different groups they know if you are depressed and it is really sensitive." and the other (P4) expressed his concerns regarding user profiling rather than derived activities from his locations and said: "political view is sensitive and wrong analysis could be harmful for my reputation."

Transparency Functions

To clarify more about users' requirements regarding transparency features of the Data Track, we asked them about what they value in the Data Track, what are their concerns regarding using it and what they think should be improved. Moreover, to have a better insight into those transparency functions in which participants could be more interested and not to limit ourselves and our participants to the location context, we told them that they can think more generally about their most used service providers and what they would like to see visualized. In the following, we explain our observations and findings.

Values and concerns related to the Data Track. Regarding what participants value in a transparency tool like Data Track we avoided asking and reporting positive comments about whether they like the tool but we focused on the particular comments that explain how they may use such a tool. Some participants mentioned they cannot see the point of visualizing their data and they think it is not needed. Some other mentioned they prefer the visualization of the information of which they are not usually aware like behavioral patterns and statistical data about them.

Six participants expressed their concerns regarding privacy and security of their data if they want to use the tool. Also, two referred to trust and symbols making them feel less concerned. Surprisingly, one of the participants (P7) said: "It is certified by the Google (pointing out to the Google logo on the timeline view while navigating through the tool) so I am not concerned. Google has a good reputation in my opinion" and the other (P6) said: "as it is developed at KaU I am less concerned ". In any case, branding may play a role in lowering concerns.

What to be visualized. 1) Behavioral patterns: Most of the participants were interested in knowing more about their movement and travel patterns, usage patterns for different service providers, some statistical data about their behaviors and some information about to whom their data is sold, how it is exchanged and how they receive related advertisements. "One does not know how much data an application really gets, it is interesting to know about it.", said participant one (P1). P3 also mentioned about the speed and movement profile: "by knowing the speed of movement when walking they know that I am not young. it is good for me to know my speed."

2) Have more control: Three participants explained explicitly that they would like to have some functions in the Data Track to exercise more control over their data: "Now that I am informed about the data, what can I do about it? I need to react on it."

3) Knowing about benefits and usage: One participant (P8) clarified that she cannot see the point of using the tool and she needs more information about the advantages of being aware of all her disclosed data.

Some suggestions about more practical information based on the exact locations and more representative icons for location pins were also among the comments.

Users' Perceptions of Data Export and Portability

For user-side TETs like the Data Track which visualizes data exports, it is important that users comprehend the visualized data in the tool is under their control. However, as mentioned earlier, previous Data Track usability tests and related tests conducted in the PRIME project revealed the users' problems to differentiate between user and services sides and confusions about where their data are stored. So first in this section, we report on users' understanding of locally and remotely stored data and we represent the results of people's opinions about who has access to their data uploaded to the Data Track.

Furthermore, adding the new functionality for visualizing personal data exports from a service provider to the latest stand-alone version of Data Track has the objective to allow to export and visualize personal data from users' accounts.

In the future, it could also help people first to visualize and then edit (in future versions) the data exports according to their requirements before sending it to other service providers while they are exercising the right of data portability. Thus we aim to learn more about people's attitudes about Data Track as an intermediary TET when they want to transfer the data from one service provider to another. Since data portability is a new concept for users and it is not offered yet by service providers, we first investigate users' perceptions about downloading their data from a service provider, uploading it to another one and whether they can consider a scenario in which they may need or use these features. Then we investigate about their preferable way when they want to transfer their data from a service provider to another. Finally, we ask about their attitudes towards Data Track as a tool with which they can visualize exports of data, change and then send the edited version to the desired service provider. The results are reported in Section 4.2.2.

Locally vs Remotely Stored Data and Access to the Uploaded Data to the Data Track

When we asked participants about who has access to the data that they uploaded to the Data Track, we received different answers that, with participants' justifications about their statements, are summarized in Table 2. Also in Table 3 we represent participants' opinions about where the data uploaded to the Data Track are stored. Although some participants (P1,P10) correctly answered who has access to the data, they were confused about where the data are stored. On the contrary, P4 who recognized that the data are stored on his machine thought that Google had access to his data uploaded to the Data Track. Data Track is running within the browser. Also, the term upload is usually used for transferring files from the user side to online websites. We assume both of these facts suggest people that the Data Track is a web application connecting to some servers and they usually forget about the file they download to their machines and upload to the Data Track. Also, we assume because they can upload the data which they downloaded previously from Google to the Data Track, they think the Data Track is somehow connected to Google and synchronised with it. It needs more investigations and is the subject of future works. To further investigate about people's perceptions of locally and remotely stored data, we asked participants whether some changes in Google data would affect the visualized data in the Data Track or the other way around and we observed different answers that with participants' justifications about their statements are summarized in Table 4 and5.

Comparing Tables 4 and5, it reveals that although some participants correctly recognized that to see the changes made on the Google data they should again download and upload it to Data Track, they thought that modifying the uploaded data to the Data Track would affect the data on the Google side (P9 and P1). Moreover, although some participants correctly said that changes on the data in Data Track would not affect the Google data, the justifications about their answers were not the real reasons. One said if it removes the Google data it is a "bad software" (P3). In addition, some participants (P2,P3,P5,P6) understood that changes in the uploaded data to the Data Track or Google would not affect the other one (until we download and upload the data again to see the changes we made on Google data). However, interestingly, they could not recognize where the uploaded data to the Data Track were stored and who had access to it.

Users' Attitudes of Data portability, Preferable ways and Usefulness of Data Track

About the usefulness of download and potential upload features in service providers and ability to think of a scenario in which people may use it, we observed different opinions. Some participants explicitly said that they do not need these options because they cannot think of a scenario in which they will use it or they think the risks would outweigh benefits. Some others mentioned they think download and upload options are useful. They explained a scenario like downloading all of their Instagram pictures to have them on their machines or downloading all of their WhatsApp groups and messages to save them somewhere. Impressively, five out of ten people expressed their concerns regarding the risks in regard to security and two out of ten asked about the benefits: "If I can see the benefits and usage of it I will think of these options" (P8) and the other said: "I am not willing at all to download my data on my machine. It is fine on the cloud. It is too risky to have it on my machine because I am responsible for its security and if something happens it is my fault " (P7).

We asked participants to consider a scenario in which they want to transfer their data (Facebook data including all advertisements they have clicked or the people they have searched about in Facebook) from Facebook to a new social network (because their friends moved to the new social network or according to the news the new one has better features) and tell us about their preferable way. They assumed they had two options: 1) download the data from Facebook, change/filter information and then upload it to the new website. 2) use a button on Facebook that directly sends the data to the new website. Different opinions and preferences are summarized in Table 6.

Interestingly, one of the people (P9) who preferred the button emphasized that she needs some kind of information or messages showing what is happening before she sends the data by clicking the button like the information she receives when she uses Facebook login button. The one (P5) who was not sure about her preferred option also mentioned about social login buttons and expressed her privacy concerns about what is transferred when she uses these buttons. Finally, we asked people to consider the same scenario of transferring their Facebook data to another social network and we told them to imagine that Data Track would provide edit functionality and would be able to save the new version of data exports. Then we asked about participants' attitudes of the usefulness of Data Track in this scenario. All participants said that they can see the usefulness of the Data Track to have control over their data, change the parts they do not want to be included and it will be really helpful to adjust the data and visualize what will be transferred. However, some participants also again mentioned that they have privacy and security concerns (see Section 4.1.3).

Conclusion and Future Work

We conducted a user study with ten participants using semi-structured interviews aiming to understand the users' perceptions of data export, data portability and transparency functions in the latest stand-alone version of the Data Track. Albeit most of the participants showed rather little interest in the visualization of derived activity data revealed in the Google exported location data file, they stated their interests in other kind of derived data (e.g. by Facebook or online marketing services), like movement and travel patterns, usage patterns for different service providers, statistical data based on their behaviors and information about to whom their data are sold, how it is exchanged and how they receive related advertisements. In addition to the kind of transparency functions of their interests, some of them also stated that they would like to exercise more control over their data via this tool, e.g. they would like to have added functionality allowing them to delete or correct data (such control functions are actually offered by the previous (non stand-alone) A4Cloud Data Track version).

Analyzing users' perceptions of data export and portability, as we experienced in previous user studies, again confirmed that it is for many users confusing and difficult to differentiate between locally and remotely stored and controlled data. Several test participants were thinking that the data in the Data Track were synchronised with the data in the Google account. Several users were also concerned about the security of their data when they think of downloading the data on their own machines and being responsible for its security. Nonetheless, most participants stated that for the purpose of exercising their right to data portability, they would prefer to first export their data, inspect and filter out some information before uploading it to another service provider, and would appreciate to use a tool such as the Data Track for helping them visualising and filtering data in this context. They thereby clearly would like to be in control when exercising the right of data portability over the easier option of having their personal data transmitted directly from one controller to another one.

We want to note that while we used fake location data of a persona in the first task of our user study, it will be interesting to conduct future user studies for our transparency tools with real data of test participants to analyse how they are reacting if they are confronted their own data traces. This will, however, require further careful preparation for recruiting suitable volunteers, for setting up suitable data protection and ethical procedures and for getting ethical approval by the university's ethics review board.

We are currently extending the stand-alone Data Track for allowing also to visualise data exports of other service providers like YouTube search history or Facebook data, which will let us make other types of disclosed and derived data transparent that participants in our user study showed interest in. Moreover, it will allow the users to compare what data different service providers know about them and what data the service providers have in common (a feature that the previous non-stand alone A4Cloud Data Track version already provided with its trace view).

Moreover, users should be provided with helpful instructions on how they can subsequently exercise their rights to erase or rectify data electronically by logging into the service provider's side (if these control functions are made available by the respective service provider-which is the case at least partially with Google today).

Besides, given the interest by participants to use the Data Track as a visualisation and filtering tool when porting data from one service provider to another one, we intend to expand the functionality of the Data Track supporting users in all data portability steps, i.e., supporting them to export the data from one service provider, to visualise and filter data and to import the altered data set to the new service provider.

Fig. 1 .

 1 Fig. 1. Trace view of the A4Cloud Data Track

Fig. 2 .

 2 Fig. 2. Location data and activities on the map view of the stand-alone version of the Data Track

-

  How do participants understand and perceive the concept of derived and disclosed information visualized in the Data Track? What other type of information about their data are they interested in? What do they value in the Data Track and what do they suggest to improve and what are their concerns regarding using the tool? -Who has access to their data in the Data Track and where is the data that they uploaded to the Data Track stored? Will any changes of the data in the Google account affect the uploaded data to the Data Track and the other way around ?

Table 1 .

 1 Summary of participants' information

					Demographic Information
	ID	Age range	Gender	Educational background	Google account	Smartphone	Computer usage	Internet usage	Knowledge of computer security and privacy
	P1	21-25 Female	Bachelor: Law	Yes	Yes	Almost everyday	Everyday	A bit familiar
	P2	26-30 Female	Master: Psychology	Yes	Yes	Almost everyday	Everyday	A bit familiar
	P3	61-65	Male	PhD: Natural sciences	No	Yes	Everyday	Almost everyday	No knowledge
	P4	51-55	Male	High school	Yes	Yes	Everyday	Everyday	A bit familiar
	P5	31-35 Female	High school	Yes	Yes	Everyday	Everyday	Quite familiar
	P6	36-40	Male	Bachelor: Physiotherapy	Yes	Yes	Everyday	Everyday	A bit familiar
	P7	46-50 Female	PhD: Business administrator	Yes	Yes	Everyday	Everyday	A bit familiar
	P8	51-55 Female	Bachelor: Social sciences	Yes	Yes	Everyday	Everyday	A bit familiar
	P9	46-50 Female	Bachelor: Psychology	Yes	Yes	Everyday	Everyday	A bit familiar
	P10 61-65	Male	Human resource management	Yes	Yes	Everyday	Everyday	Professional

Table 2 .

 2 Participants' attitudes about who has access to the uploaded data to the Data TrackWho has access to your uploaded (imported) data to the Data Track?

	ID	P1-P10	P2-P5-P9	P4-P7	P6-P8
			Some companies -
	Answer	Just me	probably all the world -my phone,	Google	Tool developers
			my account
	Justification	If hackers cannot, it is just me -I downloaded the file and gave it to Data Track	Google sells the big brother! data to others -everything online can be accessed by others -you know,	It is synchronized with Google -functioning within Google	It is developed at Kau and I uploaded my data to it

Table 3 .

 3 Users' attitudes about where the data are stored

		Where the uploaded data to the Data Track are stored?
	ID	P1-P2-P3-P7-P8	P6	P4	P5-P10
	Answer	Somewhere on the Cloud	Hopefully in a server at Kau	On my computer	Google and my computer

Table 4 .

 4 Users' attitudes about changes in Google data and its effect on the uploaded data to the Data Track Does editing the Google location data affect the uploaded data to the Data Track?

	ID	P1-P2-P3-P5-P6-P9	P4-P7-P8-P10
	Answer	No	Yes
		I should download and upload first to	It is synchronized with Google -It
	Justification	see the changes, not simply refresh the	should be updated automatically -I
		page	hope so, I do not know really

Table 5 .

 5 Users' attitudes about changes in uploaded data to the Data Track and its effect on Google data

	Does editing the uploaded data to the Data Track affect the Google location data?
	ID	P2-P3-P5-P6-P10	P1-P4-P7-P8-P9
	Answer	No	Yes
	Justification	They do not work together, they are not connected -It would be a bad tool otherwise -Google does not allow, it is downloaded	If you refresh Google, it will fetch new changes -They are connected -It is a service from Google

Table 6 .

 6 Participants' preferable way to transfer data from one Service Providers (SP) to another Do you prefer to use a button directly or download the data and then upload it to a new SP?

	ID	P1-P2-P3-P4-P6-P9	P7-P8-P10	P5
	Preferable way	Download and then upload	The button	I am not sure
	Justification	I feel safer -I want to have control over my data -By using button, I do not know what is going on, I want to see what is transferred	less time-consuming -no need to think -easy and convenient	I remembered the Facebook login button. It transfers the data but I am not sure what Facebook sends to the others.

Google dashboard. https://www.google.com/settings/dashboard.

Acknowledgment

The authors gratefully acknowledge Daniel Lindegren for his contribution in conducting pilot study and John Sören Pettersson for his reviews that helped to improve the pilot study design. Furthermore, the authors also thank anonymous reviewers and participants of IFIP Summer School (2016), whose comments and suggestions greatly contributed to enhance and clarify our work.

project PRIME, http://www.prime-project.eu 2 EU FP7 project PrimeLife, http://primelife.ercim.eu/ 3 EU FP7 project A4Cloud, http://www.a4cloud.eu 4 https://github.com/pylls/datatrack


Bernd Carsten Stahl
email: bstahl@dmu.ac.uk

Emad Yaghmaei

The Role of Privacy in the Framework for Responsible Research and Innovation in ICT for Health, Demographic Change and Ageing

Keywords: Responsible innovation, privacy, data protection, RRI framework, RRI in industry

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Responsible Research and Innovation (RRI) is now a well-known approach in the field of research governance. The RRI concept has been progressing and received support from of previous European research programmes, as well as European and national policies. It is now widely acknowledged that the future of new technologies requires consideration of the social and ethical aspects and a genuine engagement of all stakeholders. Stakeholder engagement approaches have been widely accepted among research and innovation actors as the new normative foundation (e.g. [START_REF] Greenwood | Stakeholder Engagement: Beyond the Myth of Corporate Responsibility[END_REF]DEECD, 2011). These approaches are especially fruitful for the development of emerging technologies, quantum computing, nanotechnologies, internet of things or synthetic biology, to name but a few, where multiple innovative initiatives are in place to address advanced innovation issues, and stakeholder dialogue are organized at different levels (i.e. local, regional, national, and international levels).

The European Commission report "Options for Strengthening Responsible Research and Innovation" (European Commission, 2013) outlines the fact that a large number of innovation fields still lack RRI approaches. In fact, the focus of RRI is currently mainly on the project and policy level of publicly funded research, and little attention has been given to industry contexts. Research and innovation in industry need to embed consideration of values, such as privacy, security, sustainability, among others, into the innovation process for industrial stakeholder and citizens.

For example, when big data and internet of things (IoT) are combined with stakeholder engagement, and comply with privacy regulation and data protection principles, they enable a better understanding of users' expectations and behaviors. These could ultimately support the creation of innovative products and services, anticipate the right designs for them, and help discover appropriate ways to use them.

The paper starts by discussing the concept of RRI and explaining how it relates to industry. This is followed by a description of the framework for RRI in Industry that was used as a basis for the workshop. This workshop, and the way it was framed around the question of privacy in RRI for Industry, is discussed in the subsequent section. The discussion section highlights key insights which inform recommendations spelled out in the conclusion.

RRI in Industry

In defining RRI, Von [START_REF] Schomberg | Prospects for Technology Assessment in a framework of responsible research and innovation[END_REF] argues that "a transparent, interactive process by which societal actors and innovators become mutually responsive to each other with a view on the (ethical) acceptability, sustainability and societal desirability of the innovation process and its marketable products".

The European Commission's reading of RRI comprises six key areas: Governance; Public engagement; Gender equality; Science education; Open access/open science; Ethics (European Commission, 2012). More recent work on RRI focuses on expanding the notion in relation to societal challenges. The Rome Declaration in 2014 emphasizes that "the benefits of Responsible Research and Innovation go beyond alignment with society: it ensures that research and innovation deliver on the promise of smart, inclusive and sustainable solutions to our societal challenges." (Rome Declaration, 2014). In line with this approach, the recent report from the Expert Group on Policy Indicators for Responsible Research and Innovation [START_REF] Strand | Indicators for promoting and monitoring Responsible Research and Innovation[END_REF] has considered two additional areas: "sustainability" and "social justice/inclusion", in reference to the Europe 2020 strategy.

An alternative reading of RRI that is based on the work undertaken by Owen, Stilgoe and their collaborators (Owen et al. 2013; Stilgoe et al. 2013), and that was subsequently adopted by the UK Engineering and Physical Sciences Research Council, which proposed the AREA framework as key to RRI (Owen, 2014). AREA stands for anticipation, reflection, engagement and action. It suggests that research and innovation, in order to be responsible, need to anticipate possible outcomes and impacts, to reflect on the research and innovation activities themselves as well as the way they are implemented, to engage with relevant stakeholders and to take action according to the outcomes of the first three steps. This reading of RRI is arguably broader than the one proposed by the European Commission based on its policy agendas, but they both aim in the same direction of rendering research and innovation more open to societal influences with a view to ensuring they meet societal needs.

One shortcoming of the RRI discourse is that it is mostly focused on publicly funded research. This is understandable, as it is driven by public research funders who have an interest in ensuring that their work contributes to the wellbeing of the taxpayers who provide the funding for the research. At the same time, it is a shortcoming, as much research and most of the innovation activities that are closer to the market are undertaken by companies. The question of whether and how RRI principles and ideas are already implemented in industry and how current practices can improve industrial research and innovation activities is therefore at the heart of this paper.

To give a number of examples, the benefits of mitigating risks associated with the innovative actions, the enhancement of company brand value, greater competitive advantage in the market, and attracting the best talent by engaging citizens and public authorities are perfectly understood as advantages by industrial stakeholders that can be encouraged to develop a genuine interest in RRI. In so far as responsible innovation leads, for a company, to developing added value, making its business more sustainable and enabling its customers to have more privacy, tapping into new markets, launching new business models, and increasing customers and stakeholders' confidence, industrial stakeholders can be expected to commit to an RRI approach.

However in practice, industrial stakeholder engagement in responsible innovation as it stands is facing significant obstacles. These limitations most often come from the fact that these benefits are long-term objectives, and responsible innovation can be viewed in the first place as a constraint, or an additional normin both cases, an external element, far away from the core business and immediate value of the company. While the ambition to move towards RRI is supported, the practical route to responsible innovation for industry remains difficult. In markets where awareness of social and environmental impacts can deliver economic value, can companies continue to avoid Responsible Innovation? Is RRI a prerogative of those public research organizations and large companies that have either a duty or the resources to address these aspects?

A lack of awareness of ethical, legal, environmental and social issues often leads companies to either overestimate or underestimate the associated risks [START_REF] Carroll | The business case for corporate social responsibility: A review of concepts, research and practice[END_REF]. Fundamentally, costs and time to overcome the environmental, social or ethical challenges of an innovation are considered too high, and the business will opt for the development of othermore standardizedproducts and services that do not raise 'unmanageable' concerns. In another case, companies equally consider that they have insufficient time and resources to take these challenges on board and would then prefer to ignore them, and push their service or product forward, overlooking stakeholders' concerns or legal and social regulations, irrespective of the fact that these may eventually jeopardize their business model [START_REF] Carroll | The business case for corporate social responsibility: A review of concepts, research and practice[END_REF]. In both cases, the "environment" is seen as a threat, not as an opportunity. Furthermore, the detriment to innovation is obvious: new products and services are not launched, or they are developed with a weak consideration of their environment and ultimately have a greater chance of failing. However for companies, ignoring responsible innovation challenges is no longer an option either. The acceptability of their business is at stake and opportunities of advanced positions in markets can be lost.

More regulation may not be the answer to engage companies in RRI because few new issues have arisen that were not anticipated . Many aspects of RRI are subject to regulation, but exclusively relying on public regulation is unlikely to achieve the aim of ensuring RRI acceptability and desirability.

This leads to key questions such as: How can the route to responsible innovation be made easier? Is this a matter of leading companies to responsible innovation, or of growing responsible innovation in the business innovation?

The range of innovation support methods (e.gDahlander and Gann, 2010) becomes richer every year with new approaches and concepts developed: eco-design, cradle to cradle, the circular economy, open innovation etc. These methods have proven to be efficient in many respects. Nonetheless, they often face limits as they only consider one aspect of the business. Whilst a particular value can be gained e.g. making privacy for research and innovation, the whole business model depends on a larger series of aspects that are all equally important. Often the gap to applying responsible innovation lies in the fact that these innovation support methods are used in isolation.

Collectively, social, environmental and ethical issues should be addressed in particular industries. Specific issues such as privacy need to be taken into account, and specific knowledge needs to be taken on board, for example with regards to established ways of dealing with such issues. This requires support tools and roadmaps to be adapted to the particular features of the industry and calls for a collaborative approach, where companies and support organizations draw external resources of knowledge and advice, whilst engaging with stakeholders. The questions remain, however, how this can happen, who should be in charge and how success can be measured. In order to respond to these questions we have developed what we called a framework for RRI in industry that we outline in the next section.

Framework of RRI in Industry

In order to better understand how RRI is currently undertaken in industry and which gaps remain, the Responsible-Industry project (www.responsible-industry.eu) undertook a number of activities to map current practice, compare it with the RRI discourse, and develop ideas about how RRI can be integrated into industrial practice. The activities undertaken by the project include a review of the literature on RRI and industry, five illustrative case studies, a set of 30 expert interviews with stakeholders from the information and communication technology (ICT) industry and a Delphi Study comprising more than 170 respondents. On this basis we developed a framework for RRI in industry. 1This framework starts with a vision of RRI industry that shows its roots as well as the link with existing activities. It provides options and recommendations for implementing RRI in companies. These are grouped around key questions such as who is responsible for what? How can RRI be integrated along the value chain? How can ethical and social impact analysis be performed? What tools can be used for RRI?

The ensuing recommendations can be summarized as follows:

 Reflect on a vision for RRI within the organization, promoting capacity building and instilling RRI in the culture of the organization.  Integrate RRI into existing structures and processes, including research and innovation (R&I), corporate social responsibility, quality and other company functions.  Promote reflection and awareness of ethical and societal issues related to specific R&I products in ICT for an ageing society.  Perform in depth ethical analysis of ICT products/services from early stages of the R&I value chain.  Support early identification of appropriate preventive and precautionary measures.  Foster stakeholder engagement, and in particular end users, from early stages of product development.  Pursue open and transparent communication with stakeholders about risk and impact.  Perform ongoing assessment and management of the impacts of ICT products and services, both in the short/ medium term and longterm.  Ensure training and professional development opportunities to enable staff to fully participate and take responsibility.  Foster multidisciplinarity between engineering, natural sciences, ethics and social sciences.  Apply equality principles in recruitment and career progression.

The framework also provides examples of policy and communication actions that can support and foster RRI in industry and links to resources that enable these to be realized.

This framework is currently being tested and scrutinized through a number of indepth case studies and industry-led focus groups. It will be finalized in early 2017. The workshop during the IFIP summer school served as one way of assessing the quality and value of the framework. Its specific question was whether privacy is well represented in the framework and how this might be improved.

RRI, Privacy and Economic Concerns

Privacy is the most widely discussed ethical and social concern linked to ICT [START_REF] Stahl | The Ethics of Computing: A Survey of the Computing-Oriented Literature[END_REF]. Concerns around privacy are not novel and contemporary discussion is often led back to Warren and Brandeis' seminal paper on the topic (Warren & Brandeis, 1890). It is therefore not surprising that privacy has been highlighted as a key concern that RRI in ICT needs to deal with [START_REF] Stahl | Responsible research and innovation: The role of privacy in an emerging framework[END_REF]. Achieving data safety and security in ICT is not what companies might expect by applying RRI in the first place but it is certainly something that is highly discussed in responsibility in ICT in long run. The threat is obvious. Breaches of privacy occur not just from a theft of customer data and passwords or credit cards. In fact, if companies have too many breaches of data privacy that undermines consumer trust, which is absolutely counter productive to the use of technologies that could otherwise have a beneficial effect on environmental and social questions. Thus, it is absolutely essential that ICT must comply with basic privacy principles as laid down by the General Data Protection Regulations (GDPR) 2 .

Before we discuss how privacy concerns have been integrated into the framework for RRI in industry, however, we think it is important to highlight that privacy is far from the only ethical issue that companies need to consider. This implies that ways of addressing privacy need to be sensitive to other ethical and social issues. Similarly, privacy as a social value can conflict with other values. Ways need to be found to balance competing values. Data ownership, quality of data, intellectual property and traceability are some of the most important issues of debate from a legal and technical point of view [START_REF] Baysinger | Effects of board and ownership structure on corporate R&D strategy[END_REF][START_REF] Granstrand | The economics and management of intellectual property[END_REF][START_REF] Batini | Methodologies for data quality assessment and improvement[END_REF]. Based on an open innovation model, these technologies challenge traditional business models: where does the value stem from: the data or the service? What is the most effective way to redistribute dividends to different links in the value chain?

Emerging technologies and big data imply a significant pervasiveness of technology in every place and a new set of relations between individuals and objects, with a stronger dependence on ICT, despite and because of its original ambition to increase its relevance and adherence to users' needs. Big can include the collection of large amounts of personal information, the protection of which is regularly challenged. Regardless of the definition of privacy, one can realize a significant role for it in solving research and innovation challenges in emerging technologies and big data. The GDPR and its requirements for privacy impact assessment [START_REF] Clarke | Privacy impact assessment: Its origins and development[END_REF]; Information Commissioner's Office 2009) or an ethics impact assessment [START_REF] Wright | A framework for the ethical impact assessment of information technology[END_REF]) are very high on the companies' agenda these days because of either the necessity of assessment activities towards privacy issues or the increased fines that the GDPR (see section 148) will introduce and which therefore may scare industry. As such, industrial stakeholders dealing with ICT must consider privacy in order to address RRI issues, and ICT designers must highlight privacy by design in their design process (Guerses et From an economic viewpoint, being aware of these challenges and developing a capacity to address them will enable any company to become more competitive and sustainable. While emerging technologies and big data are more than ever at a crossroad between ethical issues and economic opportunities, what role can a company play in this area? How can a company seize and create value from big data whilst still operating in an ethical and safe environment? Some initiatives have been taken to draw entrepreneurs' attention to the ethical and legal issues raised by emerging tech- nologies and big data. However, companies support services often remain segmented: business development, legal and ICT aspects and social issues (such as stakeholder engagement) are not addressed systematically, and are usually separated from one another for the simple reason that they relate to different expertise and organizational units.

The responsible innovation framework will take the ambition to address all related challenges in a comprehensive approach by bringing together stakeholders and experts, and eventually help companies, in particular ICT companies to benefit from the big data revolution whilst securing their own development.

Privacy in the RRI Framework

In light of the importance of privacy in ICT in general, as well as the possible conflict between privacy and other values, it is important to spell out which role privacy plays in version of the framework for RRI in industry that was used in the workshop.

Privacy first appears in the framework document in the context of open questions that should motivate companies to consider RRI. These are a list of likely upcoming developments that can raise concern and of which companies should be aware. This list was compiled on the basis of the AALIANCE2 roadmap3 , a document stemming from the AALIANCE 2 project for the purpose of planning the future of assistive technologies. Privacy is recognized in this list as one of the likely concerns that can motivate companies to take RRI seriously. It forms part of a set of concerns that were summarized as individual rights and liberties that may be vulnerable to challenge from new ICTs.

One way of dealing with open questions in RRI is through the introduction and use of standards. The framework therefore highlights issues that may be subject to standardization: this includes privacy and data protection. The idea of privacy by design is strongly promoted by privacy advocates and can be seen as an attempt to create standards to safeguard this particular value. The framework therefore references these ideas as one option that companies can pursue in the governance of their research and innovation activities.

Privacy is furthermore already a well-established right enshrined in legislation and regulation. Companies wanting to be responsible need to comply with such legislation. The framework therefore makes reference to legislation such as the Privacy Directive (EC) 95/46/EC on processing and free movement of data, regulation (EC) 45/2001 on processing and free movement of data by EU institutions and bodies, Directive 2002/58/EC (e-Privacy) processing of personal data and the protection of privacy.

One can thus argue that there is significant attention paid to privacy in the framework. However, in order to ascertain whether this way of including privacy is sufficient and convincing, we undertook the workshop around privacy in the IFIP summer school that is described in the next section.

Workshop on Privacy in RRI in Industry

The idea behind the workshop was thus to collect feedback on privacy as a particular component of the framework from an audience which is either expert in privacy issues or has a high level of interest in privacy and identity management. We wanted to find out whether the way in which privacy was included in the framework resonated with this audience and whether audience members could provide further insights into how to improve the framework.

It was decided to assess the framework with five groups of participants (each group consist of 2-3 members). Each group was asked whether the framework would have helped them to gain an insight into RRI, how they could develop the current responsible business model, and whether it could help the RRI community promote responsibility within research and innovation initiatives. The workshop was also used to gain further insights into whether questions of privacy and data protection are currently covered well enough, which aspects could be strengthened and how they could be communicated to intended audiences.

The aims of the workshop included:

 to reflect on the effectiveness of the RRI framework:  to discuss the way in which privacy is represented in the framework; to explore opportunities to refine the RRI framework;  to explore facilitation methods to best use the RRI framework.

The workshop developers introduced the responsible industry project framework, elaborated on the main aspects of RRI in industry, and presented responsible industry case studies in the domain of ICT for healthy ageing. The intention of RRI to ensure acceptability and desirability of research and innovation is often translated as a focus on grand social challenges. One of the key ones in Europe, due to its demographic development is that of healthy ageing. ICT is often portrayed as a technology that can help address this challenge, which renders ICT for healthy ageing a primary candidate for RRI.

During the second half of the workshop, participants were asked to comment directly on the framework. The aim was to gather a structured form of feedback from participants at the end of the workshop using the RRI framework to identify which methods or techniques should be applied to fulfill key responsibilities for RRI within the organization.

Relevant feedback was expected to arise from the following questions:

 How can the framework be improved?  How should the framework be communicated and disseminated?  Is privacy adequately covered?  Which aspects are missing?  How should they be included? Documentary evidence from the workshop supported assessment of the quality and value of the framework. The collected data were used in the discussion section of this work to address the above questions.

Discussion

During the workshop there was a general recognition by the participants of the necessity to embed privacy in the framework for RRI in industry. This discussion section covers two different sets of concerns, both of which are important for RRI in industry. On the one hand there are issues of organizational structure and governance, which are not related to privacy per se but which are relevant in order to instill the very idea of RRI into an organization. On the other hand there are privacy issues in a narrow that immediately pertain to personal data.

The organizational issues of privacy were recognized as crucial. There was a discussion about engaging companies' owner(s) and investor(s) into RRI actions. One participant argued that "whilst probably individual investors will be more willing to implement ethical procedures, institutional investors will likely respond only to financial considerations." In principle, consultation with owner(s) in addition to chief executive officers was highly valued by the participants.

There was also discussion about the usefulness of the framework for different sizes of companies. From the responses, it is understood that the framework seems to assume a large rigid organization. It is less clear how small and medium sized enterprises (SMEs) can implement it, which has to be taken into account for further development of the framework.

The discussion and further recommendations from participants for improving the framework can be summarized as follows:

 Acknowledge the need for engaging companies' owners and stress the distinction between individual investors and institutional counterparts;  Consider SMEs for the framework;  Refine the actual information flows in the framework;  Highlight the process of embedding responsibility in industry which will likely be an iterative, rather than a one-off, exercise;  Develop some practical tools to assist thinking about RRI principles.

First, there is a common recognition by participants to involve owners of the company as well as the chief executive officer (CEO). Since the CEO executes the plan set by the owners, there is a need for the framework to stress the role of companies' owners and investors. Second, workshop participants stressed that the RRI framework targets mainly multinational corporations, and misses somewhat to consider specific approaches of applying RRI in SMEs. Third, understanding actual information flows in the framework between different sections needs to be revisited: e.g. innovation can come from any group; marketing may provide customer requests as well as disseminate information. Fourth, industrial stakeholders must consider RRI as an iterative process rather than a one-off exercise. Finally, there are still a limited number of practical RRI tools that can be used by industrial stakeholders, and this generally needs to be drawn attention to in any improved version of the RRI framework.

The RRI framework and workshop results identified the need to embed privacy into Responsible-Industry framework. Figure 1 demonstrates the interaction between privacy and various organizational functions. This figure was used to stimulate the discussion among workshop participants.

Accordingly, privacy should be at the core of Responsible-Industry framework. In fact, the workshop represents the benefits delivered to industry by embedding privacy in the RRI framework. Individual stakeholders and different departments collectively may apply privacy in company' governance, innovation, compliance, and communication initiatives. Put differently, privacy helps to improve executive management, research and innovation, corporate social responsibility, legal, human resources, and marketing; steers company activities to new level of ethical behaviour"; and introduces new RRI-oriented products and services. "Privacy is perhaps too abstract a concept in the example given of the healthcare user. Privacy as an abstract concept may not be important but personal autonomy or freedom from discrimination may be important despite requiring privacy".

The results of the discussion and the recommendations made by the workshop participants highlighted the relevance of privacy in RRI. This did not come as a surprise, given that privacy and data protection have long been recognized as a key aspect that raises concerns across a vast range of ICTs. The discussion showed furthermore that privacy is interlinked with other ethical and social concerns. It is furthermore distributed across the organization, and it is difficult to pinpoint one particular area that has exclusive or dominant responsibility for it.

From the point of view of the framework, we learned that the level of attention paid to privacy in the framework itself seems to be appropriate. There was very little discussion of the concept of privacy in the workshop. This may reflect the backgrounds of the workshop participants who had a significant amount of expertise in privacy, and who may not therefore have felt the need to delve into the conceptual side of privacy in any more detail. It may also reflect the fact that there is a finite amount of space in a document like the framework and therefore there must be a limit to the level of conceptual discussion that can be included.

An interesting finding from the workshop, from the perspective of the Responsible-Industry project and framework, was that there was also relatively little discussion of the technical detail concerning specific privacy measures. When presenting the framework to an expert audience with a particular interest in privacy and identity management, we had expected requests for more detail of the way in which privacy in ICT for health, demographic change and wellbeing is addressed. There was little discussion of such detailed questions, which we interpret as a sign that the treatment of privacy in the framework is at an appropriate level.

Conclusion

From the perspective of the Responsible-Industry project, the workshop described in this paper constituted an opportunity to reflect on and further refine the framework. For the participants it gave an opportunity to see the way privacy is addressed in a slightly different context where privacy is one of many different issues.

In substantive terms, the outcomes of the workshop constitutes a confirmation of the principles and content of the way in which privacy is treated by the Framework for RRI in ICT as developed by the Responsible-industry project. It did not lead to any significant changes or point to major omissions in the framework. Interestingly, it also did not point to particular technical developments that might need to be included.

The value of the workshop was in improving the presentation of the framework and raising awareness of its existence in the community of privacy scholars. It should thereby contribute to a better uptake of RRI by industrial actors, with specific reference to privacy and data protection. Privacy is a key to delivering future responsibility. The RRI framework is intended as a primary step in RRI literature for embedding privacy into the core of industrial stakeholder activities. The workshop's participants helped in raising awareness of privacy within subsequent versions of RRI frameworks, to support industrial stakeholders on the journey towards responsibility.

The workshop contributed to:

 Raising awareness of RRI principles among privacy scholars;  Improving privacy and social inclusiveness within RRI principles and actions.

In addition to helping reflect on and improve the Responsible-Industry framework, we believe that the workshop will have developed participants' understanding of the way in which social and ethical issues in ICT more broadly can be addressed in an industrial setting.

Much research in the area of data protection and privacy is technical, focusing on questions of encryption, storage, data transmission etc. Such work is of vital importance for privacy preservation. However, we believe that the framework shows clearly that many of the key privacy concerns are not technical. A company developing a new technology needs to have the organizational resources and processes in place, in order to safeguard privacy. Without these pre-requisites, the technical capability to protect privacy is unlikely to suffice.

Working with the RRI in industry framework showed the participants the complexity and number of linkages between different organizational functions, environments and processes that need to be considered when addressing privacy issues. Finally, at the risk of stating the obvious, we believe that the workshop made it clear that privacy and data protection are one important issue but, at the same time, they are one issue among many. Privacy must not be seen in isolation, rather it should be understood as an important and valid social concern that interacts with and links to numerous others.

In this spirit, we hope that the insights gained by the Responsible-Industry consortium that will help us further refine the RRI in industry framework have been matched by the learning of workshop participants. Both of these aspects will hopefully have contributed to the overall shared goal of ensuring that new and emerging technologies contribute to the greater good of society.

  eur-lex.europa.eu/legalcontent/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG&toc=OJ:L:2016:119:TOC, accessed 27.01.2017

Fig. 1 .

 1 Fig. 1. Embedding Privacy into the Responsible-Industry Framework

  al. 2011; Hoven et al. 2012; Information Commissioner's Office 2008).

The full text of this framework is available on the project website. The full URL is: http://www.responsible-industry.eu/activities/framework-for-implementing-rri (accessed11.11.2016)

http://www.aaliance2.eu/newaalroadmap, accessed12.11.2016.

Acknowledgements. The research leading to these results has received funding from the European Community's Seventh Framework Programme (FP7/2007-2013) under grant agreement n° 609817 (Responsible-Industry; www.responsibleindustry.eu). The authors acknowledge the contribution of all consortium partners to the development of the framework which is the basis of this paper.

The authors would also like to thank the participants in the IFIP summer school for their input that informed the discussion section of this paper.