Danny S Guamán
email: ds.guaman@dit.upm.es

José M Del Alamo
email: jm.delalamo@upm.es

Hristina Veljanova
email: hristina.veljanova@uni-graz.at

Stefan Reichmann
email: stefan.reichmann@tugraz.at

Anna Haselbacher
email: anna.haselbacher@uni-graz.at

Value-based Core Areas of Trustworthiness in Online Services

Keywords: Trustworthiness, Trust, Privacy, Data Protection, Requirements, Ethical, Sociological, Legal, Label, Assurance

In the digital domain, users can be expected to place their trust in online services if they have a reason to believe that, in addition to the functional and quality of service aspects, their rights will be protected and their shared values respected. However, recent studies and surveys suggest that users do not actually trust in online services, one of the reasons being that technology unable to meet their values and address their concerns. To bridge this gap, this workin-progress paper presents a set of core areas of trustworthiness for online services that have emerged from an interdisciplinary discussion involving a social, ethical, legal and technological perspective while paying due attention to the protection of European fundamental rights and values. It then analyses the manner in which each of these core areas of trustworthiness maps to wellknown system properties and (post-compliance) operational requirements.

Introduction

Online services are an inherent component of most organisation processes and individuals' daily activities. Still, besides the numerous benefits they provide, there are several concerns regarding some of their features that can undermine their trustworthiness and this, in turn, users' trust. As indicated by a Eurobarometer survey, the general public's trust in digital applications and services remains quite low. For instance, 63% of the respondents do not trust online businesses [START_REF] Keighley | Special Eurobarometer 431: Data Protection Report[END_REF].On the one hand, the extensive literature on trust offers multiple perspectives, although most of them define interpersonal trust in terms of a relationship between a trustor (i.e. the subject that places trust in a target entity), and the trustee (i.e. the entity that is trusted) [START_REF] Grandison | Trust in Internet Applications[END_REF]. Accordingly, trust forms the basis for allowing a trustee to perform a particular action important to the trustor, regardless of the ability to monitor or control the trustee.

Moving to the digital realm, wherein often there is no personal trustee, trust requires an objective assessment of the system trustworthiness in order to assure that it will perform as expected by the trustor [START_REF] Taddeo | Modelling trust in artificial agents, a first step toward the analysis of e-trust[END_REF].

On the other hand, the literature conceives trustworthiness as a multidimensional construct, as users can expect an online service to perform a diverse set of actions [START_REF] Avižienis | Basic concepts and taxonomy of dependable and secure computing[END_REF]- [START_REF] Hoffman | Trust beyond security[END_REF]. These actions have been approached primarily through mature system properties, such as security and dependability [START_REF] Avižienis | Basic concepts and taxonomy of dependable and secure computing[END_REF], focusing on those aspects that protect online services from (malicious) users, but not on those aspects that protect users from (malicious) online services [START_REF] Osterwalder | Trust Through Evaluation and Certification?[END_REF]. Trends in users' attitudes suggest that trustworthy services need also to carry out actions to safeguard fundamental rights, such as privacy and autonomy, and to avoid a growing lack of user trust. As suggested by a Eurobarometer survey, the general public's trust in digital applications and online services remains quite low as 72% of Internet users are worried about being asked for a lot of personal data online [START_REF] Keighley | Special Eurobarometer 431: Data Protection Report[END_REF]. Therefore, users can be expected to place their trust in those services if they have a reason to believe that their rights will be protected, and their shared values will be respected.

A sufficient understanding of the concepts of trust and trustworthiness thus needs to be interdisciplinary and include inputs from ethics, law and sociology, addressing concerns regarding users' fundamental rights and values by defining a set of core areas of trustworthiness. Subsequently, these core areas can be (partially) translated into operational requirements to be considered by online services that, in addition to supporting the reliability and dependability of online services, also contribute to engendering trust. The user's trust is not based solely on concrete technical practices for trustworthiness [START_REF] Osterwalder | Trust Through Evaluation and Certification?[END_REF] as the core areas of trustworthiness, stemmed from Social Sciences and Humanities (SSH) realm, cannot be simplified and fully achieved only by technical systems, as they themselves are only subsystems of more complex sociotechnical systems. This is why novel core areas of trustworthiness emerging from an interdisciplinary perspective can complement and extend the understanding of building, assessing, and providing trustworthy online services.

Towards this end, this paper presents some results of the H2020 TRUESSEC.eu project (https://truessec.eu). Taking into account that to this point labels have generally focused either on security or privacy, TRUESSEC.eu envisions a lightweight trustworthiness labelling scheme which overcomes the limitations of current labels by providing a label that not only contains security and privacy aspects but also goes beyond them. By having a strong focus on European values and fundamental rights, the TRUESSEC.eu label stipulates a set of requirements that make an ICT product and service trustworthy thus directly addressing the issue of how to enhance users' trust in ICT. In this direction, this work-in-progress paper presents a multidisciplinary discussion on identifying a set of core areas of trustworthiness and further analysing how this set could be translated into ICT system properties and detailed operational requirements.

The remainder of this paper is structured as follows. Section 2 introduces the core areas of trustworthiness and how they are approached from the perspective of three SSH disciplines, namely, sociology, law and ethics. Subsequently, Section 3 presents the approach followed to translate the core areas of trustworthiness into operational requirements. In Section 4, we outline the related works that is relevant for our proposal. Finally, Section 5 provides the conclusion of this paper and outlines future work.

Core Areas of Trustworthiness

This section starts by approaching the concept of trust and trustworthiness in the digital realm from a sociological ( §2.1), ethical ( §2.2) and legal ( §2.3) perspective. Subsequently, based on the European values and fundamental rights and interdisciplinary work six common core areas of trustworthiness are defined, namely transparency, privacy, anti-discrimination, autonomy, respect, and protection. These core areas reflect the values that should be considered when developing and evaluating ICT products and services which ought to be trustworthy. Table 1 as well as the following subsections summarize our findings and showcase (a) how each of the three disciplines approach trust and trustworthiness against the background of European values and fundamental rights and (b) the disciplinary understanding of the six core areas.

The sociological perspective provides a brief overview over the concept of trust. Additionally, based on survey data collection, the sociological input in Table 1 analyses the core areas from a macro level. The section on ethics presents those aspects that are relevant for trustworthy ICT products and services from a normative point of view. The focus of the legal perspective lies mainly on the European values (Art 2 Treaty on European Union) and the European fundamental rights as stated in the Charter of Fundamental Rights of the European Union as well as the European Convention on Human Rights. For a more detailed description of the core areas interested readers can refer to [START_REF] Stelzer | TRUESSEC D4.3: First draft Criteria Catalogue and regulatory recommendations[END_REF] and [START_REF] Stelzer | TRUESSEC D4.2: Support Study of Ethical Issues[END_REF], [START_REF] Reichmann | TRUESSEC D3.1: Assurance and certification of privacy and security of ICT products and services as a question of trust, acceptance and perceived risks across Europe[END_REF] for details of the support studies.

Trust, Trustworthiness, and Social Interaction

Trust is irreducibly social. In many situations, users display "default trust" [START_REF] Lewis | The social dynamics of trust: Theoretical and empirical research, 1985-2012[END_REF], i.e. trust based on individual assumptions regarding societal expectations pertinent to a given situation. In this way, trust acts as a proxy for cooperation, thereby reducing complexity [START_REF] Luhmann | Trust and power/two works by Niklas Luhmann; with introduction by Gianfranco Poggi[END_REF]. Reduction of complexity becomes especially poignant in the wake of industrialization. Industrial and post-industrial division of labour entails, among other things, that users are increasingly forced to rely on expert knowledge which they do not understand. This has to do with a shift in worldview; pre-modern (traditional) societies believe in a universal order that foregrounds individual action. In such a worldview, there is no place for risk. On the other hand, moderns believe in individual autonomy; intentional actions have unintended consequences, which entails individual and collective risks. Trust thus gains traction in modernity: "The uncertainties and risks modernity entails necessitate a belief in the good intentions of strangers" [START_REF] Reichmann | TRUESSEC.eu-European Values and the Digital Single Market from a Sociological Perspec-tive[END_REF]; however, "risk" should not, for this reason, be part of a definition of trust, as trust is a fundamental aspect of social interaction, whereas risk is part and parcel of a specifically modern ontology. The widespread use of digital products and services can be conceived in terms of reliance on experts (developers, companies, and lawmakers).

Trust in experts can, therefore, be conceived as a proxy for relying on the technologies themselves.

A lack of trust is the main reason for consumers not to use digital products and services [START_REF] Bons | Obstacles for the development of open electronic commerce[END_REF]. Contrary to recent theories of e-trust [START_REF] Taddeo | The case for e-trust[END_REF], which are overtly behaviourist/cognitive, social theorists stress the fundamentally social nature of trust. Conceptions of e-trust suffer from a cognitive/rationalistic bias that stems from the inability of accounts that ground trust in motivations or morality to apply to artefacts (which have no motivation and hence, no morality). Some authors acknowledge that trust is predicated upon contingency [START_REF] Sztompka | Trust: A sociological theory[END_REF]; "trust begins where prediction ends" [START_REF] Lewis | The social dynamics of trust: Theoretical and empirical research, 1985-2012[END_REF]. Contingency implies expectations. Without expectations, action would be impossible. Social action is directed towards the actions of others. Sociologically, trust is therefore conceived as "a reciprocal orientation and interpretative assumption that is shared, has the social relationship itself as the object, and is symbolized through intentional action" [START_REF] Lewis | Social atomism, holism, and trust[END_REF]. Georg Simmel observed that there can be love unrequited, but no unrequited trust [START_REF] Möllering | The nature of trust: From Georg Simmel to a theory of expectation, interpretation and suspension[END_REF]. "Faithfulness", as Simmel put it, is the only emotion sociological in form; it stems from interacting with others and it is epistemically situated between (complete) knowledge and (complete) ignorance of the other. In any case, it is insufficient to conceive of trust in digital products and services as merely psychological or merely behavioural, because trust necessarily refers to principles of morality, of mutual interests, and to social norms that oblige users to trust and be trustworthy.

Ethics, Trustworthiness, and ICT

Like any other technology, ICT has introduced numerous benefits to the individual and society, but at the same time, it has also created new ethical concerns and challenges. These concerns and challenges mainly stem from the pervasive and ubiquitous character of ICT. Moreover, ICT is also considered to have a tendency to demote particular values [START_REF] Brey | Values in technology and disclosive computer ethics[END_REF]. In that sense, taking values as a starting point for conducting an ethical analysis helps at arriving at a better understanding of the ethical issues related to ICT and paves the way for identifying the central requirements for trustworthy ICT products and services from a normative perspective. The primary "currency" of today's ICT society is data. This has made privacy one of the most pressing issues. Privacy has a normative dimension and can be understood as an individual's claim to exercise control over one's data. Ethical concerns often arise when users lack answers as to activities with their personal data.

Privacy is closely related to the concept of autonomy because the former creates the conditions for the exercise of the latter. One way to reinforce autonomy is through informed consent which stands for the possibility of being informed about data processing activities and having the freedom to act upon one's decisions regarding data. Cases, where informed consent lacks, are ethically problematic as they directly undermine the very essence of autonomy.

The most significant concern in the domain of justice arises around practices of data-based discrimination and biased-decision making. The concerns pertain to cases where decisions are made based on individual's data that may lead to unjust treatment, bias or exclusion of some users or groups from certain opportunities.

The issues of responsibility and accountability play an essential role as well, in particular, due to the possible consequences of ICT. Responsibility and accountability can be observed in a two-fold manner: (a) forward-looking, where responsibility is understood as a duty concerning who should do what, and (b) retrospectively, where the morality of someone's actions is inspected [START_REF] Williams | Responsibility[END_REF].

Security is also one of the leading concepts as it is directly related to privacy, for instance. One way to analyse security issues in an ICT context is as the security of data and systems where data are stored. However, security can also be understood in a much broader sense as freedom from harm and protection of rights and liberties.

Transparency can be considered as the key concept in the ICT discourse as it serves as a means to realising, for instance, privacy, justice, responsibility. Transparency is also even more important due to the extensive informational asymmetry between users and providers of ICT products and services, that is, the lack of clear answers to the question who does what, how, and why with individual's personal data.

Legal Perspective of Trustworthiness in ICT

When two parties decide to establish a legal relationship, its fundament ideally must be mutual trust. We have therefore mapped out the European Union's legal framework regarding ICT, also taking into account the European fundamental rights and values.

Transparency constitutes one main core area of trustworthiness, which is legally assured by information duties. The GDPR's (General Data Protection Regulation) severe monetary fines particularly fuel its enforcement. Just like another requirement, transparency does not constitute a stand-alone area but is rather interconnected with others, such as autonomy or anti-discrimination.

While aiming to strengthen user's trust, privacy plays an essential role, which is emphasized by the fact that the Right to protection of personal data (Article 8 of the EU Charter of Fundamental Rights -CFR) and respect for private and family life (Art 7 CFR) are the two most referenced CFR in secondary EU legislation regarding ICT.

Legally considered, the core area regarding justice means that besides ensuring rights and freedoms to individuals; one must also be provided with effective remedies to effectively enforce the rights (TITLE VI CFR: JUSTICE). From a broader legal understanding justice includes equal treatment of individuals and thus nondiscrimination (TITLE III CFR: EQUALITY). Within the ICT context, antidiscrimination is the key term to consider, meaning humans must not implement any discriminative features or processes in the online service.

Autonomy constitutes another core area of trustworthiness, legally referring to the individual's guaranteed fundamental freedoms (TITLE II CFR: FREEDOMS; including respect for private and family life and protection of personal data as well as the freedom to conduct business). As it is likely that conflicts will arise between the preserved Freedoms and other guaranteed fundamental rights, the aim is to find a balance between them. Considering ICT, autonomy results in the user's freedom to freely make decisions, thus being respected by the online service provider.

Legally speaking, the requirement of respect is referred to as lawfulness and must especially consider consumers. The fact that inside the ICT EU legal framework a usually high number of secondary legal acts can be observed within the area of consumer protection, namely a considerable number of fourteen, supports this view.

From a legal perspective, security means protecting individuals from harm, with the utmost fundamental Right to human dignity and life (TITLE I CFR: DIGNITY). In the ICT context, this implies actively providing protection to users, by preventing them from harm through fulfilling safety and cybersecurity standards information about the products and services, and ii) providing information to users regarding activities with their personal data.

Transparency:

The ICT product or service is provided in line with information duties regarding personal data processing and the product/service itself.

-72% are concerned about the data collected about them on the Internet.

-More than half of internet users are uncomfortable with the use of their personal data for targeted advertising.

-General concern about misuse of personal data by corporate entities and public authorities (CMPD). -Concern about targeted advertising and search engine results, which some users expect to be adapted to their needs. However, this is not a majority.

Justice as the remedies against the unjustified use of force by the state, such as the Right to a fair trial (Art 47 CFR) and the Presumption of innocence (Art 48 CFR). This meaning further entails Equality before the law (Art 20 CFR) and Antidiscrimination (Art 21 CFR).

Justice relates to aspects such as: i) anti-bias, ii) fairness, and iii) distributive justice.

Antidiscrimination:

The ICT product or service does not include any discriminative practices and biases.

-Two thirds to a quarter of EU citizens are concerned about being a victim of cybercrime or that their online personal information is not kept secure by websites or public authorities.

-In general, European citizens dislike public authorities having access to their Internet usage data (fear of surveillance).

Security as the protection from harm, such as the Right to liberty and security (Art 6 CFR) as well as the Right to the integrity of the person (Art 3 CFR) and the Right to life (Art 2 CFR).

Security is understood as freedom from (physical, psychological, economic etc.) harm and protection of one's rights, liberties.

Protection: ICT products and services are provided in accordance with safety and cybersecurity standards.

3

From Core Areas of Trustworthiness to Operational Requirements

The six core areas (transparency, privacy, anti-discrimination, autonomy, respect, and protection) represent high-level concepts that need to be broken down into a set of requirements in the sense that they relate to more specific, well-known system properties of online services. We acknowledge that the core areas of trustworthiness, stemmed from sociological, legal, and ethical contexts, cannot be simplified and fully achieved only by technical systems, as they themselves are only subsystems of more complex socio-technical systems. However, they, can still contribute to satisfying the aforementioned core areas to certain extents. This section, therefore, presents a translation process consisting of two stages: a mapping of the core areas of trustworthiness to meaningful system properties along with the extent to which these contribute to satisfying the core areas ( §3.1) and an operationalization process of the system properties to operational requirements ( §3.2).

Mapping of core areas of Trustworthiness to System Properties

A system property defines a quality or behavioural characteristic of a system that can be evaluated qualitatively or quantitatively. There are numerous system properties enabling trustworthiness already studied in the technical realm (each with a different maturity level), so the knowledge base around them can be leveraged to elicit the specific operational requirements that need to be met and assessed for trustworthy online services. For instance, the S-Cube model considers nine categories of properties or attributes [START_REF] Gehlert | Quality Reference Model for SBA[END_REF], whereas OPTET refines them into 11 categories and 29 subattributes [START_REF] Mohammadi | An Analysis of Software Quality Attributes and Their Contribution to Trustworthiness[END_REF]. Moreover, Hansen et al. [START_REF] Hansen | Protection goals for privacy engineering[END_REF] have further divided the notion of privacy into more concrete system properties, and these, in turn, have been broken down them into more concrete requirements for protecting privacy [START_REF] Meis | Computer-aided identification and validation of intervenability requirements[END_REF]. Our approach does not criticise individual contributions on system properties, but we propose building on these works to build a bridge between the leading SSH requirements and their corresponding operational requirements. By following a top-down approach proposed in a previous work [START_REF] Martín | Engineering Privacy Requirements: Valuable Lessons from Another Realm[END_REF] and backed by interdisciplinary supporting studies (i.e. sociological [START_REF] Reichmann | TRUESSEC D3.1: Assurance and certification of privacy and security of ICT products and services as a question of trust, acceptance and perceived risks across Europe[END_REF], ethical [START_REF] Stelzer | TRUESSEC D4.2: Support Study of Ethical Issues[END_REF], legal [START_REF] Gibello | TRUESSEC D4.1: Legal Analysis[END_REF], and technological [START_REF] Guamán | TRUESSEC D5.1: Technology situation analysis: Current practices and solutions[END_REF]), the core areas of trustworthiness have been mapped into a subset of the more relevant and concrete system properties of online services. When analysing the system properties, several interrelations were observed. Each system property relates to specific Core Areas; however, each system property does not need to address all Core Areas as long as all of them are addressed by a few of the system properties to a satisfactory degree. Table 2 provides an overview of this mapping along with the extent to which a system property contributes to the core areas. A brief rationale for the mapping is elaborated in the following paragraphs; note also that, although the system properties may contribute to multiple core areas to different extents, they are presented within the core area to which they mostly contribute. Table 2. Core areas and related system properties enabling trustworthiness (•: covers the core area to a high extent; ◐: covers the core area to a medium extent; ◔: covers the core area to a low extent; ◌: does not cover the core area)

System property

Core areas of trustworthiness Transparency

Privacy

Antidiscrimination

Autonomy

Respect

Protection

Transparency (Accessibility)

• • ◔ • ◔ ◔
Transparency (Processing of personal data)

• • ◌ ◐ ◐ ◌ Intervenability (Con- sent) ◐ • ◌ • ◔ ◌ Intervenability (Con- trol) ◐ • ◔ • ◐ ◔ Unlinkability ◌ • • ◔ ○ ◔ Explainability ◔ ◌ • ◐ ◔ ◌ Traceabil- ity/Auditability • • • ◌ • ◔ Security ◐ ◌ ◌ ◌ ◔ •
Transparency. This core area mainly relates to transparency including both accessibility and processing of personal data dimensions and auditability. Transparency, in terms of accessibility [START_REF] Schaub | Designing Effective Privacy Notices and Controls[END_REF], refers to the form in which information is provided to users. Thus, while information can refer to the system's functionality, usage or quality features, accessibility ensures that it has an impact on users' awareness. To this end, an online service must provide information that is easy to find and access as well as easily understandable by users.

Transparency, in terms of the processing of personal data, is one of the three wellknown system properties defined in the privacy realm (i.e. transparency, unlinkability, and intervenability [START_REF] Hansen | Protection goals for privacy engineering[END_REF]). This allows informing users whenever their personal data is processed by providing information on data processing, e.g., the categories of data being collected and used, who access them, the duration for which the data is retained, and the location wherein the data is stored.

Traceability/auditability reflects the capability of a system to generate, collect, and avail the evidence (e.g., records or logs) of a processing instance or any relevant event and, in turn, enable the relative ease of auditing a system. Thus, whereas the target for the above two properties is the user, the target for this property could be a supervisory authority. Increasing transparency requires service providers to clarify how they use and process personal data, and traceability and auditability allow for reconstructing, examining, and using the sequence of events to achieve transparency as well as to demonstrate compliance.

Finally, it can be noted that transparency, as a precursor for specific, comprehensive, and understandable information, is a prerequisite for satisfying other core areas. For instance, autonomy cannot be ensured if users are unable to understand infor-mation for decision-making. Privacy, in the sense of control over personal data processing, is ineffective if users do not understand information related to the processing of their personal data. Similarly, auditability allows for retrospective accountability (which is essential for the Respect core area) by providing evidence to help demonstrate compliance, for example, with. a predetermined privacy policy.

Privacy. This core area mainly relates to transparency, intervenability (control and consent) and unlikability. Intervenability, in the sense of control, allows providing stakeholders (e.g. data subjects and supervisory authorities) with the means "to interfere with the ongoing or planned data processing" [START_REF] Hansen | Protection goals for privacy engineering[END_REF]. To this end, an online service should keep users in the loop by providing them with accessible means to access and review the accuracy and completeness of their data, as well as update and delete their personal data. Accessibility to control options is essential, i.e. users should be able to exercise them with a reasonable effort.

Intervenability (consent) allows users can give and/or withdraw their consent to the processing of their personal data. Therefore, an online service must be able to provide relevant and sufficient information promptly to enable users to make informed decisions about the use of the service and what information is processed about them. It should be noted that transparency, particularly in the sense of accessibility, is a precondition for consent, as users are free to give their consent to something they know and understand.

Unlinkability allows for greater (implicit) control over the processing of personal data. The rationale behind this mapping is that by preventing one event from being linked to another, an online service limits the potential impact on the users' privacy. Unlinkability could prevent that online services built to use unique identifiers (e.g., IP address, SIM mobile, or a Wi-fi SSID) from being associated to users and ultimately prevent undesirable profiling on the actions or data generated by them. Unlinkability is related to data minimization, which states that the amount of data processed should be limited to the minimum possible while the consented purpose is achieved.

Anti-discrimination. This core area mainly relates to unlinkability, explainability and auditability. As already mentioned, unlinkability aims at preventing online services from linking personal data within and across domains. This is particularly important, as today's online services can use technologies that have the potential to process large amounts of (personal) data, very often from multiple domains, allowing significant levels of customization and decision making based on criteria such as religion, political affiliation, social status, incomes, and further on.

Explainability [START_REF] Ribeiro | Why Should I Trust You?[END_REF]- [START_REF] Goodman | European Union regulations on algorithmic decisionmaking and a 'right to explanation[END_REF] allows decision factors or the decision-making process to be informed to the different stakeholders, allowing them to determine whether online services may have any bias. This property aims at explaining the factors used (or not used) by an online service to make a specific decision rather than a detailed explanation of the system's inner behaviour. For example, if an organization claims that an individual was denied a loan because their income is low, then the online service is expected to consider the individual when his income increases.

Autonomy. This core area mainly relates to transparency and intervenability. Autonomy is linked to supporting users in delivering informed consent, i.e., the system should provide the means for users to have the possibility to make an informed decision, e.g., on any processing instance regarding their personal data. In this regard, informed consent encompasses two system properties already explained above, i.e. transparency and intervenability. Transparency ensures that decision-making is supported by comprehensive, accessible, and precise information, while intervenability supports decision-making including the possibility of both granting and withdrawing consent.

Respect. This core area mainly relates to traceability/auditability. As respect implies accountability and liability, this cannot be covered through purely technical measures but requires organizational measures such as the definition of governance, a statement of legal compliance or an appropriate dispute resolution process. Nevertheless, traceability/auditability (already explained) is primarily aimed at supporting this core area by providing the evidence to demonstrate compliance with legal requirements.

Protection. This core area mainly relates to safety, security (i.e. properties of confidentiality, integrity, and availability), and reliability. Safety ensures the absence of risks that may cause physical injury or damage to the users' well-being, whether direct or indirect, as a result of the damage to the system or its environment [START_REF] Avižienis | Basic concepts and taxonomy of dependable and secure computing[END_REF].

Security, on the other hand, assures online service protection against malicious unauthorized access (confidentiality), modification (integrity), or use (availability) [START_REF] Avižienis | Basic concepts and taxonomy of dependable and secure computing[END_REF]. From these initial properties, other refined properties can be identified, e.g., authenticity, non-repudiability, and control [START_REF] Parker | Our excessively simplistic information security model and how to fix it[END_REF].

It can be noted that the protection-related properties are relevant to the 'privacy' core area. Privacy has a great value in the trustworthiness discourse; however, it cannot be guaranteed without the existence of a solid security infrastructure that ensures the security capabilities of online services. It can serve as a shield against any security breaches and cases of identity theft, unauthorized access of third parties, etc.

3.2

From System Properties to Operational Requirements

Once the system attributes have been identified, they can be used as a basis for carrying out an operationalization process and deriving a set of more specific operational requirements. When doing that, a challenge arouse with respect to abstaining from turning it into a compliance checklist, as already there is a law regulating this aspect, which ensures that online services act within the legal framework in this regard. This challenge was addressed by distinguishing between compliance and beyond compliance [START_REF] Luhmann | Trust and power/two works by Niklas Luhmann; with introduction by Gianfranco Poggi[END_REF]. In this sense, compliance is an important aspect of building trust among citizens. However, very often, it is not sufficient. A measure that could help in filling in this gap is the adoption of a "post-compliance approach". It implies doing more than what the law requires and addressing those aspects that the law does not address in their entirety or to which it does not offer straightforward guidance. Introducing ethics is one way to do so, as it could provide solutions to questions that the law leaves unanswered. Against this background, the operational requirements elicited stand on this post-compliance level. At the time of writing, a set of 81 operational requirements has been outlined in [START_REF] Medina | Trust-Enhancing Label launching roadmap[END_REF]. Fig. 1 depicts the interrelations among the elements of the operationalization process. The operational requirements define the capabilities that an online service should guarantee in order to satisfy one or more of the aforementioned system properties. They can be used as a precursor to the selection of more concrete (standard) measures or countermeasures that are known as controls. Finally, controls are realised by one or more specific techniques, which are implementable ways to meet a control.

There are subtle differences and interrelations between the guiding elements of the operationalization process. Although both operational requirements and controls specify system capabilities required (problem domain) and provided (solution domain), respectively, an operational requirement recognises that a capability seldom derives from a single control (i.e., fulfilling an operational requirement may require multiple controls). Controls, therefore, are more concrete measures than operational requirements and often detail a concrete technique(s) to be implemented in a particular context. Accordingly, operational requirements can be satisfied to different extents by implementing different controls and techniques, depending on the needs of the context (e.g. a higher risk scenario may require stronger controls). A trustworthiness profile represents a particular set of controls and techniques necessary to meet the operational requirements of an online service to be used in a particular context. Finally, does the state of the art support the implementations of the operational requirements related to the core areas of trustworthiness? Security and privacy task force has provided some inputs regarding some barriers that may prevent existing technologies from satisfying the core areas of trustworthiness (in particular, members of the IoTUK1 , AIOTI WOG032 , and IoTMark initiatives have been surveyed 3 ). The input received has been crossed with European reports and literature, and the following are highlighted:

• While it should be recognised that the state of the art already provides plenty of controls contained in standard catalogues and frameworks for other more mature properties (ECSO presents a syllabus with around 290 standards and certification schemes for the cybersecurity realm [START_REF] Ecso | State-of-the-Art Syllabus Overview of existing cybersecurity standards and certification schemes[END_REF]) , controls related to anti-discrimination or autonomy are scarce and only recently there are some efforts and initiatives to address them. (General) • Many system properties that enable trustworthiness (e.g. privacy, security, and transparency properties) are fragile with respect to composition, i.e. "if a system that fulfils a certain property is embedded within or connected to another system, it is hard to assess if that property is preserved" [START_REF] Danezis | Privacy and Data Protection by Design -from policy to engineering[END_REF]. The fragility of these properties is becoming even more critical in the current ICT landscape, where an online service is actually a system of systems, being challenging to ensure end-to-end trustworthiness. (General) • The increasing complexity of the supply chain also increases the difficulty of holding an entity accountable for some action, as "obligations" travels across multiple parties. For instance, it is difficult defining a closed set of technical measures that support the enforcement and auditing of the organizational or legal security obligations due to the cascading effect from the interdependent threats (coming from multiple parties). (General) • Lack of user-centric assurance mechanisms to inform about trustworthiness-related risks. The information on the functional operation and quality attributes of online services is usually conveyed through assurance mechanism (e.g. third-party certification), and they are mainly oriented to the business market instead of the consumer market. For instance, cybersecurity certification of online services can involve the assessment of hundreds of security controls, so it is impossible for users to identify the level of security offered by online services [START_REF] Osterwalder | Trust Through Evaluation and Certification?[END_REF]. It is necessary, therefore, to have alternative user-centric mechanisms, such as ratings, labels and sales, so that users are able to appraise and compare capabilities of different products or services without feeling overwhelmed with technical details. (General) • Controls (and techniques) to ensure anti-discrimination are expensive, as explaining everything is expensive. This is not a purely technical barrier, but it is related to creating a system that, besides performing complex tasks, must provide an explanation that is a non-trivial engineering task. Thus, as remarked by Doshi-Velez et al. "requiring explanation all the time may create a financial burden that disadvantages smaller companies; if the decisions are low enough risk, we may not wish to require explanation" [START_REF] Doshi-Velez | Accountability of AI Under the Law: The Role of Explanation[END_REF]. (Anti-discrimination)

• Conflation about the scope and target audience of transparency mechanisms. Providing transparency about data protection activities has proven to be difficult, with privacy policies being the primary means of informing data subjects. Privacy policies, however, are very complex as users are not familiar with the terminology used by privacy experts, and they do not clearly understand the consequences of accepting the policy because assessing the subsequent risks is not straightforward [START_REF] Schaub | Designing Effective Privacy Notices and Controls[END_REF]. Accordingly, only a minority of users read privacy statements. (Transparency) • One of the essential precursors for informed decision making is to understand what we are agreeing with. Therefore, users cannot exercise their right to autonomy without transparency. However, an issue identified in some of today's online services is that non-expert users cannot connect notices about the processing of their personal data with the risks of consenting to it [START_REF] Felt | Android permissions: User attention, comprehension, and behavior[END_REF]. (Autonomy and transparency) • Users exercise their privacy preferences based on the configuration of permissions or access control rules. For instance, in mobile phones "[some app] should be able to access [some resource]". For these mechanisms to be effective, users must be able to exercise them with reasonable effort. However, current online services (e.g. those accessed through mobile apps) require users to manually set one or two hundred on/off options, requiring an amount of time that could overwhelm them. (Privacy) • Currently, some PETs look like stand-alone solutions that are initiated by users as self-defence measures (e.g. installing web browser add-ons or using anonymityenhanced browsers), but they are not part of the implementation of the service itself, nor are they considered during the initial design stages. This fact is also observed by ENISA (European Union Agency for Network and Information Security) which claims that "software development tools for privacy need to be provided to enable the intuitive implementation of privacy properties" [START_REF] Danezis | Privacy and Data Protection by Design -from policy to engineering[END_REF]. (Privacy) • Plenty of privacy techniques and technologies have been proposed in the last years [START_REF] Danezis | Privacy and Data Protection by Design -from policy to engineering[END_REF], however, one of the key challenges to build a privacy-friendly system "is the difficulty to decide when a PET may be mature enough to implement it in a system" [START_REF] Hansen | ENISA REPORT: Readiness Analysis for the Adoption and Evolution of Privacy Enhancing Technologies[END_REF]. It could lead engineers to try to meet an operational privacy requirement using a low-quality PET. This issue can be found in the literature (e.g., [START_REF] Narayanan | Robust de-anonymization of large sparse datasets[END_REF]), where some supposedly anonymized data sets may be actually linked to the data subjects' identities. (Privacy)

Related Works

Several works have been developed to address different aspects of trustworthiness of online services. Most of them, however, are only approached from a technological perspective addressing only their technical features [START_REF] Mohammadi | An Analysis of Software Quality Attributes and Their Contribution to Trustworthiness[END_REF][7], thus failing to adopt a multidisciplinary perspective to address concerns regarding values and fundamental rights. Others, which are also in the technological realm, focus on a particular system property, primarily concentrating on security or safety ( [START_REF] Avižienis | Basic concepts and taxonomy of dependable and secure computing[END_REF], [START_REF] Parker | Our excessively simplistic information security model and how to fix it[END_REF]) and recently even on privacy ( [START_REF] Hansen | Protection goals for privacy engineering[END_REF], [START_REF] Meis | Understanding the Privacy Goal Intervenability[END_REF], [START_REF] Meis | A taxonomy of requirements for the privacy goal transparency[END_REF]) ,without taking into account other relevant system properties to meet further core areas of trustworthiness. Thus, the work presented in this paper and, in particular, the criteria of trustworthiness represent a novelty owing to several reasons. First, they are the result of a comprehensive interdisciplinary work comprising ethical, legal, societal and technical aspects. Second, substantial emphasis is particularly placed on the ethical input, as the study conducted by Gibello [START_REF] Gibello | Evaluation of existing trustworthiness seals and labels[END_REF] suggests that it misses existing labels very often or is overshadowed by concerns related to the quality of service or by the dominant legal aspects and the focus on compliance. Third, the criteria of trustworthiness focus on cybersecurity and privacy as the most mature domains regarding certification and labelling (e.g., around 290 cybersecurity standards and certifications schemes are available according to ECSO [START_REF] Ecso | State-of-the-Art Syllabus Overview of existing cybersecurity standards and certification schemes[END_REF]). However, at the same time, these criteria of trustworthiness go beyond these two domains and cover various aspects of more recently established ones such as transparency, autonomy, and anti-discrimination. Against this background, the notion that underlies the development of these criteria of trustworthiness, in conjunction with its great focus on the ethical aspects, most closely resembles the framework provided by Luciano Floridi [START_REF] Floridi | Soft Ethics: Its Application to the General Data Protection Regulation and Its Dual Advantage[END_REF]. When referring to digital services, Floridi distinguishes between hard and soft ethics. According to him, the former informs and shapes the law, whereas the latter is "what we usually have in mind when discussing values, rights, duties, and responsibilities -or, more broadly, what is morally right or wrong and what ought or ought not to be done". In this sense, soft ethics operates on the post-compliance level and in this way addresses the issues and aspects that the law does not. This distinction between hard and soft ethics can be valuable in addressing the aforementioned gaps, including the extremely limited focus on ethics or too extensive dominance of legal requirements or servicerelated concerns in the current labels.

Conclusions

In this work, we have presented a set of six high-level core areas of trustworthiness (transparency, privacy, anti-discrimination, autonomy, respect, and protection) which is the result of comprehensive interdisciplinary research, comprising ethical, legal, societal and technical aspects. They complement and extend the state of the art for building and assessing trustworthy online services. Subsequently, these core areas have been translated into well-known properties and turned into (post-compliance) requirements that can be realised and assessed. It should be noted, however, that the requirements described in this paper address ICT products and services in general. This implies that once they are applied to a particular context i.e. particular product or service a certain modification or adjustment can be expected. In this respective, businesses need to recognise the added value of implementing such requirements, which may seem costly in the short run, but actually form an outstanding benefit on the market in the long run. These contributions pave the way to move towards a lightweight and automated labelling solution for the trustworthiness of ICT products and services. In this context, our future work points in two directions: (i) enable machine-to-machine integration based on required trustworthiness levels (defined by users through a policy configuration) and trustworthiness levels offered by the labelling subject matters and (ii) a scalable architecture for the automated assessment of elicited operational requirements applied to the mobile ecosystem.

Fig. 1 .

 1 Fig. 1.Guiding elements of the operationalization process[START_REF] Martín | Engineering Privacy Requirements: Valuable Lessons from Another Realm[END_REF]

Table 1 .

 1 Core areas of trustworthiness (*) The statistical data stem from the Eurobarometer Reports and Summaries and were collected between 2011 and 2017. Details in[START_REF] Reichmann | TRUESSEC D3.1: Assurance and certification of privacy and security of ICT products and services as a question of trust, acceptance and perceived risks across Europe[END_REF]

	Sociological perspective	Legal perspec-	Ethical perspective	Core areas of
	(*)	tive			trustworthiness
	-Only a minority reads	Transparency as	Transparency relates
	privacy statements (less	in	information	to two aspects: i)
	than a fifth) in general	duties laid down	providing clear and
	while about 4 out of 10	in the GDPR, the	sufficient
	internet users read the	Directive	on
	terms and conditions of the	consumer rights
	online platform.	or	the	e-
	-Over 90% want to be	commerce	Di-
	informed if their data ever	rective.
	was lost or stolen,
	-Users who feel well-
	informed are more likely to
	adapt their security behav-
	iour (e.g. changing pass-
	words).

Table 1 .

 1 Core areas of trustworthiness, continued.

		Privacy as pre-	Privacy stands for the	Privacy: The ICT
		serving Respect	individual's claim to	product or service
		for private life	control the access to	allows the user to
		(Art 7 CFR) and	and the use of one's	control access to
		the Protection of	personal information.	and use of their
		personal data (Art	The idea behind it is	personal	infor-
		8 CFR) in the	that people have the	mation and it
		context of ICT.	claim to determine	respects the pro-
		This includes the	who knows what	tection of personal
		GDPR and Di-	about them thus	data.
		rective		preventing unjusti-
		2002/58/EC.	fied interferences by
				others.
	-7 out of 10 are concerned	Lawfulness as in	Under the concepts	Respect:	ICT
	about their personal infor-	lawful	conduct	of responsibility and	products	or
	mation being used for other	and taking pre-	accountability	fall	services are to be
	purposes that it was col-	ventative care in	the following as-	provided	in
	lected for.	accordance with	pects: i) Attribution	accordance with
	-Citizens state a negative	the law, especial-	of responsibility, ii)	the	legitimate
	impact of state surveillance	ly when dealing	Accepting responsi-	expectations
	activities on their general	with consumers	bility, and iii) Pre-	related to them.
	trust in ICT.	(Art 38 CFR).	vention

https://iotuk.org.uk

https://aioti.eu/working-groups

Appendix B of this document shows the survey carried out in the task force: https://truessec.eu/content/deliverable-52-technical-gap-analysis.

Acknowledgement. The research leading to these results has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 731711. The first author would like to extend thanks to his sponsor Escuela Politécnica Nacional


Arianna Schuler Scott

Michael Goldsmith

Harriet Teare

Helena Webb

Sadie Creese

Arianna Schuler
email: arianna.schulerscott@cs.ox.ac.uk

Why We Trust Dynamic Consent to Deliver on Privacy

Keywords: dynamic consent, privacy, trustworthiness, engagement, revocation

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Giving consent for a research study to make use of personal information is widely considered to be a personal and individual choice. Historically, consent procedures were meant to prevent physical harm to participants caused by unethical medical research [START_REF] Rickham | Human experimentation. Code of ethics of the world medical association. Declaration of Helsinki[END_REF]. The degree to which the choice to participate is a free one, given societal obligations and personal motivation varies depending on the study and context in which it is being done [START_REF] Barreteau | A framework for clarifying participation in participatory research to prevent its rejection for the wrong reasons[END_REF] but it is generally accepted that researchers are trusted to have ethical oversight of their work and are required to be able to prove that human participants elected to take part. Societal expectations around research such as to advance thinking in expert areas, provide solutions and contribute to the betterment of society, create individual expectations which contribute to an individual's motivation to take part. They generally wish to contribute and choose what their information is used for, opting to delegate implementation to those with relevant expertise -namely, researchers [START_REF] Whitley | Consent and research governance in biobanks: evidence from focus groups with medical researchers[END_REF].

There has been work done to explore the concept of "trustworthiness" where experts must demonstrate behaviour/s that justify this inherent trust in research to invite and encourage participation. This shift towards two-way, transactional knowledge development draws parallels with some of the conceptual development around privacy, especially in medical research. In "Rethinking Informed Consent in Bioethics" [START_REF] Manson | Rethinking informed consent in bioethics[END_REF] the authors discuss privacy as normative, grounded in how information is communicated rather than what is communicated. General privacy rules fall short, they argue, because these rules are too vague. Trying to define "data acquisition" in general as a privacy violation is too broad as there are legitimate reasons for wanting to gather data. Instead, the authors focus on narrower definitions where the means of acquisition are problematic rather than the kind of data being collected -acquiring information through intrusive or impermissible action results in violation. Technology increases the amount of information that can be put together about an individual, and be used for good or ill. Rather than simply trying to increase general trust levels, O'Neill argues that it is the placement of trust (or mistrust) that is key [START_REF] O'neill | Trust, trustworthiness and transparency[END_REF]. For individuals to place trust, institutions must show trustworthiness, or consent decisions will be made based on the lack of it. Being specific about what an individual consents to, allows controllers to be more specific as to what constitutes a violation.

This paper makes the claim that a dynamic form of consent goes some way to meeting the requirements put forward by a normative, transactional privacy model. We do not make the claim that informed consent can be used as a way for an individual to control information as this dives into a conversation that we will later address, on contemporary positions as to why current implementations of consent cannot be used to protect data (for an excellent discussion on this, see [START_REF] Nissenbaum | Interview) Stop Thinking About Consent: It Isn't Possible And It Isn't Right[END_REF]). Data holds value and we discuss data protection obligations held by those who collect, store, control, use and share personal data in a research context. The term "personal information" includes: data gathered directly from someone such as name and medical history, the meaning drawn from these attributes, and inferences that can be made as part of the wider research process. Such an overwhelming amount of information can be difficult to access, to parse and to make informed decisions about and while accounts differ as to whether individuals want that level of control, institutions ultimately have legal obligations and business interests (such as not being fined) to consider.

Literature

Consent is a mechanism for protecting an individual's rights within research [START_REF] Boulton | Informed consent in a changing environment[END_REF] and consent decisions must have the potential to change over time, simply because people are prone to changing their minds. A dynamic choice is more representative. There are areas of concern regarding informed consent: people's choices can be coerced, especially where there is a power imbalance, (online for example, where they may be forced to agree to data-sharing in order to access a service) and they often do now know the options available to them (due to obscure privacy policies and an overwhelming amount of information being presented). Even if these problems did not exist then the issue remains as to how much control data subjects actually exercise. This can be unclear due to differences between business and user requirements that often cannot be bridged [START_REF] Whitley | Privacy and informed consent in online interactions: Evidence from expert focus groups[END_REF]. Solutions exist -promoting informed consent has been shown to reduce decisional conflict and increase perceived knowledge and understanding [START_REF] Kinnersley | Interventions to promote informed consent for patients undergoing surgical and other invasive healthcare procedures[END_REF], and focusing on "genuine" (rather than wholly informed consent) where individual control over permissible actions for a data controller to take, and the amount of information received from that controller [START_REF] O'neill | Some limits of informed consent[END_REF] are the priority.

There are two significant cases where trust collapsed due to poor consent management and engagement with the public in a medical context: the scandal at Alder Hey Children's Hospital and the case of NHS England's Care.data project. Alder Hey Children's hospital did not ask parents of deceased children whether their child's organs could be used for research purposes before collecting tissue. Interestingly, it was not that the organs were used that constituted a violation, it was that parents were not asked beforehand. While medical professionals may have been guided throughout their training and careers to protect patients from hard news or difficult decisions, this case signals a shift from paternalism to more inclusive practice. While post-mortems may be carried out without parents' consent, hundreds of organs were kept for years after death which meant unfettered access to samples that were unethically procured. On the recommendations of an independent enquiry, The Human Tissue Act was established in 2004 to mandate how organs were to be used for research purposes, and an oversight committee was established: the Human Tissue Authority [START_REF] Hall | Reflecting on Redfern: What can we learn from the Alder Hey story?[END_REF].

Care.data was not so retrospective, the project simply broke down. England's National Health Service (NHS England) wanted to implement a national database for medical records that crossed primary and secondary care. Despite the obvious benefits centralizing this kind of information might result in, the overall rollout strategy did not prioritise communication with the Great British Public. The scheme was opt-out by default which made people feel as if the decision had already been made for them, and there were no doctors or public-facing experts who could field questions or convince the public that the initiative was in any way trustworthy. Public trust in NHS England plummeted and a project that could have provided valuable services to many people was dropped. The national data guardian produced a report after the fact where she suggested that a more thought-out communication strategy and dynamic consent/optout procedure may have resulted in a more receptive response [START_REF] Limb | Controversial database of medical records is scrapped over security concerns[END_REF], [START_REF] Godlee | Editor's Choice) What can we salvage from care.data?[END_REF].

Dynamic Consent

The "dynamics" of dynamic consent consist of: enabling individuals to give and revoke consent to the use of their samples, centralizing all transactions and interactions, allowing individuals to be approached for different projects or their feedback on emergent ethical considerations, and letting consent preferences be modified over time [START_REF] Aitken | Moving from trust to trustworthiness: Experiences of public engagement in the Scottish Health Informatics Programme[END_REF]. Dynamic consent, built on the principles of revocation and engagement, was created to address problems with one-time, broad consent. The most significant issue with broad consent is that it is not informed, due to only asking the participant once for their consent and delegating future decisions to an unseen "expert". Developed to build trust and improve participant recruitment and participation over time [START_REF] Schuler Scott | Wider Research Applications of Dynamic Consent[END_REF], dynamic consent builds on work done by the Ensuring Consent and Revocation (EnCoRe) project that aimed "to make giving consent as reliable and easy as turning on a tap, and revoking that consent as reliable and easy as turning it off again" [START_REF]EnCoRe: EnCoRe -Ensuring Consent and Revocation[END_REF].

Allowing people to revoke consent for data-use is one of the two underlying concepts of this model. Engaging in communication around data-use is the other. Arguments against dynamic consent decry the expense generated having to design revocation and engagement into research practice at an early stage. Granted, it may be the case that new procedures may need to be adopted, or the relationship between researcher and participant reconsidered [START_REF] Budin-Ljøsne | Dynamic consent: a potential solution to some of the challenges of modern biomedical research[END_REF] but dynamic consent improves trust in how electronic records are used because control is passed to the participant. If information has been shared without authorisation or sold then trust is lost, and when this happens then data is less likely to be shared [START_REF] Williams | Dynamic consent: a possible solution to improve patient confidence and trust in how electronic patient records are used in medical research[END_REF] and research relies on data.

Trustworthiness

People can show trust in an institution despite a lack of trustworthy behaviour (such as transparency [START_REF] Aitken | Moving from trust to trustworthiness: Experiences of public engagement in the Scottish Health Informatics Programme[END_REF]) that they claim should be the norm. We make this point because it is pertinent that people do not have the option to behave in the way they would like to due to a lack of institutional support. Further discussion on institutional expectation lies outside the scope of this paper. We make the distinction here between trustworthiness (shown by a data controller) and trust (given by a data subject). The fact that people are willing to entrust their data to researchers in the absence of trustworthy practice, as shown in the Alder Hey example, is significant because it strengthens the idea of a social contract between science and society. Data is derived from the public, so it must benefit them [START_REF] Goodman | A data dividend tax would help the NHS monetise health data[END_REF]. This social contract means that scientific improvement must meet the needs of the public [START_REF] Meslin | Research ethics in the era of personalized medicine: updating science's contract with society[END_REF], needs which can be collected and formalised using dynamic consent [START_REF] Kaye | Dynamic consent: a patient interface for twenty-first century research networks[END_REF].

Privacy gives people the opportunity to negotiate how others access or use their information, and the attitude towards these "others" is influenced by the level of trust in them. There is a level of trust in research institutions that is strong enough for individuals to feel comfortable delegating decisions about unknown, broad uses of their personal data. As long as data is handled correctly, consent is revocable and studies are ethically approved [START_REF] Hansson | Should donors be allowed to give broad consent to future biobank research?[END_REF] then broad consent is acceptable. Trust is fundamental for broad consent to be an option. Researchers are assumed to be trustworthy or have trustworthy infrastructure in place such as ethics review boards, so research participants can trust them with their consent decisions.

Privacy

Privacy is often associated with notions of self-identity [START_REF] Whitley | Informational privacy, consent and the 'control' of personal data[END_REF] and individuals have been shown to want control over personal information and the decisions they make pertaining to that data [START_REF] Hammami | Patients' perceived purpose of clinical informed consent: Mill's individual autonomy model is preferred[END_REF]. There has been interesting discussion framing privacy as the freedom of an individual to make decisions that let them shape who they are [START_REF] Kanellopoulou | Legal philosophical dimensions of privacy[END_REF]. In this case, the author's criticism of many privacy discussions is that while information controls are often discussed, more attention needs to be given to underlying philosophical and ethical foundations, as well as the information itself that's being controlled. In terms of research data-use, asking "which data are being used, and for what purposes" might begin to address this. While discussing information under control, a significant area of research to mention is the development of contextual integrity, where information flows provide privacy (my doctor sends medical information to another consultant) and their breakdown constitutes a violation (my doctor sends medical information to a non-medical party) [START_REF] Nissenbaum | Privacy in context: Technology, policy, and the integrity of social life[END_REF]. This normative stance on privacy has directly influenced the approach this paper has taken towards data-use.

Results

In this section we present a privacy model that compares acceptable and unacceptable scenarios given normative privacy modelling around data-sharing for research use, and an initial specification for dynamic consent as it might be implemented as part of a research project. This is novel in that we do not have any way to measure whether or not an implementation of dynamic consent is achieving what the literature positions it to do. What we find is that the unacceptable scenarios could be mitigated by incorporating dynamic consent into the research process at the design stage. For example, just knowing what individual preferences are in terms of who data can be shared with could be used as a filter when exporting data or creating reports that are to be shared, as the EnCoRe project was able to demonstrate. We suggest that the following serve as indicators of conceptual evidence for the use of dynamic consent by data controllers as a privacy mechanism.

Privacy Model

The key sources used to build the comparisons in table 1 were the General Data Protection Regulation (GDPR) [START_REF]the European Parliament and of the Council, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC[END_REF] and Onora O'Neill's "Rethinking Informed Consent in Bioethics" [START_REF] Manson | Rethinking informed consent in bioethics[END_REF]. The former provides obligations that data controllers must meet, while the latter provided a normative approach to what privacy violations could look like and how those might be avoided through developing a consent process that asks an individual for their preferences when they are recruited and allows them to change their mind.

In the case where an individual is asked about sharing their data with a third party for example, these preferences must have some level of granularity as this overarching question can be broken down further. Options may include sharing data with a third party for research use, sharing data with a third party for any purpose, and "ask me before you share my data with a third party for any reason".

In table 1, while the placement of most statements will appear obvious, the fourth row may appear untenable to some readers. "Data is shared with explicit consent to do so" is placed under "Unacceptable" because the point of this system is not to overload the data subject with every single request for their data.

Table 1.

Normative privacy in the context of research.

Acceptable Unacceptable

Data is processed for the purposes stated with consent (of any kind) to share data for stated purposes.

Data is processed for the purposes stated without consent (of any kind) to share data for stated purposes.

Data is processed for unstated research purposes, with consent to only share for research purposes.

Data is processed for unstated research purposes, without consent to share for other research purposes.

Data is processed for commercial purposes, with consent to share for commercial purposes.

Data is processed for commercial purposes, without consent to share for commercial purposes.

Data is shared without explicit consent. Data is shared with explicit consent to do so.

Second-order enforcement of consent means that secondary use is possible because this was indicated at the time of consent.

Second-order enforcement of consent is not carried out as data is used and consent was not originally given.

Second-order enforcement of consent means that secondary use is possible because this was indicated after the original consent.

Second-order enforcement of consent is not carried out as data is used and consent was not given at any point.

Dynamic Consent Specification

The following (table 2) has been constructed from existing literature on dynamic consent (basic principles [START_REF] Kaye | Dynamic consent: a patient interface for twenty-first century research networks[END_REF][START_REF] Budin-Ljøsne | Dynamic consent: a potential solution to some of the challenges of modern biomedical research[END_REF], trust-building [START_REF] Williams | Dynamic consent: a possible solution to improve patient confidence and trust in how electronic patient records are used in medical research[END_REF], interface design [START_REF] Sanders | for research and use of health data[END_REF], biobank consent methods [START_REF] Whitley | Consent and research governance in biobanks: evidence from focus groups with medical researchers[END_REF][START_REF] Teare | Towards 'Engagement 2.0': Insights from a study of dynamic consent with biobank participants[END_REF]) and inclusive approaches to engagement (reciprocity [START_REF] Gottweis | Connecting the public with biobank research: reciprocity matters[END_REF][START_REF] Hobbs | The privacy-reciprocity connection in biobanking: comparing German with UK strategies[END_REF], awareness [START_REF] Riordan | Patient and public attitudes towards informed consent models and levels of awareness of Electronic Health Records in the UK[END_REF][START_REF] Ludman | Glad you asked: participants' opinions of re-consent for dbGap data submission[END_REF] and trust [START_REF] Lipworth | An empirical reappraisal of public trust in biobanking research: rethinking restrictive consent requirements[END_REF]). This specification is currently a list of design and implementation prompts aimed at encouraging thought around data-use at the start of a research project that will make use of personal data.

Discussion

Dynamic consent is a model resting on participant engagement and the facilitation of data, participation and consent revocation if necessary. Rather than protecting privacy as an abstract concept, this protects tangible privacy interests. Individuals need to be given the option to say no and this option needs to be communicated. There need to be options that allow data-sharing as well as options to share sharing privileges. Data subjects may want a flexible level of participation and it is the controller's responsibility to check-in (and keep checking in, especially in the case of longitudinal studies) to gauge understanding of the study, which could also indicate whether understandings are shared between controller and subject. One concern with recent data protection legislation is the level of ambiguity around implementation. Establishing transparent and relevant policy is important, but to be able to communicate and measure those rules institutionally would be invaluable when providing an audit trail, for example.

Consent provides assurance about what data is used for and why, but it has not been helpful as an information control. This is largely due to it being considered n obstacle, particularly in research where ethical oversight can delay or otherwise impact research. Rather than talk about controlling data, proponents of contextual integrity aspire to control flows of data, the contexts in which those flows act, and what happens when data crosses contexts it is not meant to. This "socialised" construct can direct technical implementation -dynamic consent could support the flow of new knowledge between the laboratory and the clinic, central to translational research and personalised medicine [START_REF] Kaye | Dynamic consent: a patient interface for twenty-first century research networks[END_REF]. Consent was not designed to work as an assurance in every possible case. It can be unclear at the point of initial consent as to what exactly data might be used for and individual preferences should be direct future action. This thinking is in a similar vein as EnCoRe's development of consent preferences as filters for automated data-use [START_REF]EnCoRe: EnCoRe -Ensuring Consent and Revocation[END_REF].

Informed consent was established to prevent harm, specifically research consequences which are identifiable as they are physical or otherwise obvious. In terms of data-use, it is much harder to know what information could be used for and the impact, or impacts, this might have. Bad consent practice is demonstrated online through cookies that coerce data-donation, privacy policy obfuscation, and designs that actively draw attention away from options that inhibit data-sharing. Research involving human beings makes heavy use of consent and this is especially the case in medical research. Consent can be used as a basis for data-processing as enshrined in recent data-protection legislation like GDPR, but so can contracts, legal obligation, vital interests, public contribution or "legitimate interests". Cases in which consent might not be required might mean that anonymised datasets can be used, but individuals still express a preference for ultimate control even when publicly accessible data about them is used.

This paper models privacy as the "how" rather than the "what", focusing on safeguarding interests rather than specific pieces of information. Dynamic consent originated in the context of bio-banking where those who donate tissue may wish to delegate consent to an oversight panel or retain ultimate control over who uses what and when. In a similar vein, individuals must also make their own risk calculations when sharing personal data. As different people have different risk levels, the way in which these preferences are going to be collected must take these differences into account. This does not exclude automation -preferences should be able to be translated as rules that are checked before data is transmitted or put to use. Privacy is a moral and social issue, as is consent. A key driver behind why people should have a say is because organisations are obliged to give them one. As society tends towards inclusivity and away from paternalism in research, there is still considerable trust in experts to make decisions in the best interests of data subjects. These subjects want a say but also want to leave the details to those who know better.

Conclusion

Rather than trying to re-word consent forms or privacy policies the position of this paper is that an overhaul is needed. By claiming that dynamic consent can be used as a privacy control, we mean that it can be used by data subjects to manage how they share information and the extent to which those details can be shared further, and by data controllers to provide evidence that they are complying with individual consent preferences. This, by extension, provides evidence of compliance with data-protection regulations like the GDPR and the Data Protection Act. While there are persuasive arguments as to why consent in its current form has no place in conversations around privacy, these arguments are largely grounded in two assumptions: that privacy is a social construct and that there is an ideal version of informed consent that current implementations will eventually become through various modifications. We address these concerns through two things. The first, by modelling privacy as the "how" rather than the "what", rather than focusing on which data are shared (or not) we explore how privacy interests can be safeguarded. The second is that our approach to consent is that there is no single solution, it must be flexible and allow the participant to indicate their preference or preferences for the data controller to act on accordingly.

To conclude, there are few cases in which user preferences are not sought at all regarding data-use. They may be coerced, obfuscated or hidden but they are there. Consent is a central tenet of research and needs developing as technology improves and the way we think about data changes. Dynamic consent provides an updated model for privacy control and rather than exclaim "Death to Consent!", it is our intention to demonstrate that given the very real concerns around data ownership in the digital age we find ourselves in, current practices are unfit for purpose and the need to re-think consent as a privacy control is very much alive.

Future work

This is part of a work in progress, there is a clear need for empirical work that looks at whether projects that are actually implementing dynamic consent match up to the academic claims made by the literature.

Table 2 .

 2 Prompts for incorporating dynamic consent and building trustworthiness into the research process.

	Included Design prompt	Implementation
		Will dynamic consent impact participant recruitment?	 Standardised recruitment  No geographical limitations  Process entirely/partly online
			 Other
		Will dynamic consent impact	 Various info. formats
		how informed consent is col-	 Record is viewable online
		lected?	 Process can be entirely/partly online
			 Communication options set
			 Other
		Will dynamic consent impact	 Electronic authorisation
		consent management?	 Standardised access to preferences
			 Secure storage/access
			 Revocation options available
			 Other
		Will dynamic consent impact	 Online forums
		participant retention?	 Feedback is delivered online
			 Data can be collected online
			 Other
		Is dynamic consent going to	 Money
		save resources?	 Time
			 Other
		What does the researcher/par-	 Is this a culture change?
		ticipant relationship look like?	 Participants feed into process
			 Other
		Who do you have buy-in from	 Researchers
		(who gains from/supports the	 Clinicians
		project)?	 Public services
			 Other
		How will you feed back to par-	 Regularly/occasionally/when prompted
		ticipants?	 Using a method they have specified
			 Other
		What will you feed back to	 Information about the research process
		participants?	 Where their data is used
			 Who their data has been used by
			 Parties data is shared with
			 Other


Arthur S Campbell

John R Dolan
email: dolan@obs--vlfr.fr

Charles Arthur Kofoid

Campbell'

Keywords: History of Protistology, tintinnid cilates, microfossils, foraminifera, radiolaria Introduction

Arthur Shackelton Campbell was an American protistologist active mostly in the first half of the 20th century. To those of us who work on ciliates, he is known as the second author of two classic monographs on tintinnid ciliates with Charles A. Kofoid. To those of us who work on microfossils, or on rhizaria, he is known for some of the first American monographs on fossil radiolarians with Bruce L. Clark, and articles on fossil foraminifera with Joseph A. Cushman, as well as for chapters on fossil radiolaria and tintinnids in Raymond C. Moore's treatise on invertebrate paleontology. Arthur Campbell worked then with major figures of his time, but is little known in his own right. This is perhaps because he worked successively on very different taxa. He began writing as an undergraduate on a variety of invertebrate taxa, then focused on tintinnid ciliates, followed by fossil foraminifera, and finally on fossil radiolarians. Here a

The first article Arthur Campbell published after his Ph.D. studies concerned a plankton collecting device published in the March 23 issue of Science [START_REF] Campbell | A Simplified plankton bucket[END_REF]. He gave his affiliation as San Bernardino Valley Union Junior College. The first publication with a Saint Mary's College affiliation was an abstract from the December 1928 meeting of the Society of Zoologists (Sup Ref: [START_REF] Kofoid | A Conspectus of the Marine and Freshwater Ciliata Belonging to the suborder Tintinnoinea, with Despcriptions of New Species Principally from the Agassiz Expedition to the Eastern Tropical Pacific 1904--1905[END_REF]. Most of Campbell's subsequent publications gave his affiliation as Saint Mary's College. However from 1951 onward, some articles listed an affiliation as also with the University of California. In his last publication [START_REF] Campbell | Radiolaria[END_REF] he listed his affiliation as "Protozoologist, Saint Mary's College of California and Museum of Paleontology, University of California, Berkeley, Calif." Scientific Contributions Arthur Campbell's scientific research stretched across nearly 4 decades and concerned a wide variety of taxa. This can be seen in Figure 2 that shows an early portrait and a "word cloud" from the titles of his 38 publications; the supplementary file contains a complete listing of his publications. His early work was conducted while he was an undergraduate at Pomona College. His first published study was on the nervous system of a centipede (Sup Ref : Campbell 1920). He then apparently benefitted from the Pomona College's Marine Station in Laguna Beach (CA, USA) as he published on echinoderms (Sup Ref Campbell 1921a,b,c;1922a), andhydroids (Sup Ref: Campbell 1922b), signing his papers, all published in the College's Journal of Entomology and Zoology, as 'Contribution from the Laguna Marine Laboratory of Pomona College'. Campbell's first paper after leaving Pomona College for the Canton Christian College was also on invertebrates, "Some Common Chinese Mollusca", and was also published in the Journal of Entomology and Zoology but with affiliation "the Zoological laboratory and Museum of the Biological Survey of South China, of Canton Christian College" (Sup Ref : Campbell 1923).

Figure 2. Arthur Campbell, circa 1929, pictured in an early yearbook of Saint Mary's College (courtesy of Brother Charles Wilkins) and a 'word cloud' of terms from the titles of all of Campbell's publications (1920Campbell's publications ( to 1957)). The size of words shown is indicative of their frequency of occurrence. Both authors have collaborated in the revisions which have arisen from new viewpoints of systematic relationships, the recognition of structures of greatest systematic value, the detection of areas of greatest environmental modification, and clearer concepts of generic and specific characters and limits. The senior author has revised and condensed the second draft to its present form." According to the publication date, the 1939 Kofoid & Campbell was the second of Arthur Campbell's monographs on tintinnids. Campbell's third and last monograph on tintinnid ciliates, "The Oceanic Tintinnoina of the Plankton Gathered during the Last Cruise of the Carnegie", of 134 pages, with Campbell as sole author, appeared in 1942 [START_REF] Campbell | The oceanic Tintinnoinea of the plankton gathered during the last cruise of the Carnegie[END_REF]. The last cruise of the Carnegie had ended many years before, and famously, with the explosion of the ship in November of 1929, about halfway through the planned expedition, while re--fueling in Somoa. The blast killed J.P. Ault, the Captain and Chief Scientist. None of the samples were lost as they had been periodically off--loaded and shipped back to Washington D.C. However, the death of the chief scientist left the exploitation of the expedition results to J. A. Fleming, Director of the Department of Terrestrial Magnetism at the Carnegie Institution of Washington D.C., and he had neither oceanographic nor biological training. Exactly how Campbell got involved with working up the Carnegie samples, and when he started working on them is unclear. Many researchers of renown (Albert Mann, Henry Bigelow, etc.) were mentioned as interested in, or working on, biological samples from the last cruise of the Carnegie in the Carnegie Institution Yearbooks from 1931 onward (Sup Ref: Anon. 1931, 1932, 1933, 1934, 1935). However, the first mention of Campbell is in the 1936 Yearbook which states that Campbell had made good progress in his investigations and would soon be submitting his report (Sup Ref: Anon. 1936), an apparently accurate statement as the tintinnid monograph was completed and submitted in 1937 (Sup Ref: Anon. 1937). Unfortunately, publication was delayed until another monographic work, on dinoflagellates by Herbert Graham, was finished. Although likely of little consolation, Campbell's 5 year wait was not the longest an author had to wait to see his worked published. Charles B. Wilson's monograph on the copepods of the Last Cruise of the Carnegie had been submitted in 1933(Anon. 1933) and it also appeared in 1942, one year after Wilson's death. Arthur Campbell's Carnegie monograph represented a very substantial amount of work. He examined 648 samples from the 165 stations sampled during the cruise throughout the Pacific Ocean and the North Atlantic. Most of the samples, 560, contained tintinnid material. He found 307 species in the Carnegie material including forms he designated as new species (Fig. 4). In comparison, the [START_REF] Kofoid | Reports on the scientific results of the expedition to the Eastern Tropical Pacific, in charge to Alexander Agassiz[END_REF] monograph on the tintinnids of the Albatross Expedition to the South Pacific was based on the examination of 174 samples from 130 stations. The 1939 monograph, stated as having been in preparation from at least 1911, reported on 347 species, 25 of which were described as new, numbers quite comparable to those of Campbell's Carnegie monograph.

Campbell and Cushman published 4 papers, all on fossil foraminifera from deposits in California, all authored as Cushman & Campbell (Sup Ref: Cushman & Campbell 1934,1935,1936,1943). Campbell began a shift from fossil foraminifera to fossil radiolaria by the early 1940's, working with Bruce L. Clark of the Paleontology Department of the University of California, Berkeley. Clark was described as an outstanding authority on invertebrate paleontology and like Campbell, an alumnus of Pomona College (Sup Ref: Camp 1946). Clark's expertise was molluscs, not protists. Campbell and Clark produced four substantial monographs on fossil radiolaria. In the first monograph on Eocene radiolaria from the Mt. Diablo Area (Sup Ref: Clark & Campbell 1942), it is stated that Clark was responsible for the geology, some of the general conclusions, and served as critic in connection with problems of taxonomy. Campbell was said to have been responsible for the descriptive and taxonomic work, the bulk of the monograph, representing 81 of the 93 text pages. The three later monographs, on the Miocene radiolaria from Southern California (Campbell & Clark 1944a), radiolaria from the Upper Cretaceous of Middle California (Campbell & Clark 1944b and on radiolaria from the Kreyenhagen formation near Los Banos, California (Sup Ref: Clark & Campbell 1945), contained no information on author contributions but all three greatly resembled the first monograph in that following a short introduction on the geological context of the samples, the bulk of the monographs consist of descriptive and taxonomic text on radiolaria. It would seem reasonable to attribute the taxonomic and systematic work in all three monographs to Arthur Campbell. Collectively, the four monographs contain descriptions and images of 360 spumellarian and nassularian forms, described as new fossil species (for examples, see Figure 5). Campbell is among the most prolific authors of new radiolarian species, in seventh place, after Haeckel, Kozur, Mostler, Ehrenberg, Pessagno and Dumitrica (Lazarus et al. 2021). Bruce Clark died in September of 1945, leaving Arthur Campbell as the authority on fossil radiolaria in North America. Until his retirement, Arthur Campbell worked nearly exclusively on fossil radiolaria. Miocene Radiolarian Faunas from Southern California" (Campbell & Clark 1942a). From 1951 to 1957 Campbell published 6 articles on fossil radiolaria, 5 as first author. The articles ranged from general to more specialised taxonomic works, for example 'New genera and subgenera of Radiolaria' (Sup Ref : Campbell 1951) and 'An introduction to the study of Radiolaria' (Sup Ref : Campbell 1952). The articles, as well as the protist book chapters, "Radiolaria" and "Tintinnina" [START_REF] Campbell | Protozoa. in Moore RC (ed) Treatise on Invertebrate Paleontology, Part D Protista 3. Protozoa (Chiefly Radiolaria and Tintinnina)[END_REF]) in Moore's 'Treatise on Invertebrate Paleontology' indicate that Campbell was indeed the authority on fossil radiolaria in North America. However it should be noted Campbell's revision of Haeckel's taxonomy in [START_REF] Campbell | Protozoa. in Moore RC (ed) Treatise on Invertebrate Paleontology, Part D Protista 3. Protozoa (Chiefly Radiolaria and Tintinnina)[END_REF] has been widely ignored (Lazarus et al. 2021). While Campbell authored fewer publications, and very many fewer pages on radiolaria than he did on tintinnids, he finished his career as an authority in his own right on radiolaria. Arthur Campbell's co--authors, Kofoid, Cushman, and Clark are recognized today as important figures. For example, both Kofoid and Cushman were featured in Corliss's 1978 "Salute to 54 great microscopists of the past". Campbell though appears to have been largely forgotten. He has received but meager recognition. A genus of tintinnid ciliates, Ascampbellelia, was named after him to replace a previously occupied generic name (Sup Ref: Corliss 1960) and a species of fossil radiolarian, Spongosaturnalis campbelli (Sup Ref: Foreman 1968) was named in his honour. . Hopefully, this essay will serve as evidence that Arthur Campbell, best known as second author to famous figures, made substantial contributions to protistology.

Figure 5 .

 5 Figure 5. Plate from Campbell & Clarks's 1942 monograph " Miocene Radiolarian Faunas from Southern California" (Campbell & Clark 1942a). From 1951 to 1957 Campbell published 6 articles on fossil radiolaria, 5 as first author. The articles ranged from general to more specialised taxonomic works,

  Moving to Berkley, Arthur Campbell's focus shifted to protists. His Ph.D work, under the direction of Charles Kofoid at the University of California, was on tintinnid ciliates. Like many of Kofoid's students, he appears to have spent considerable effort in documenting the existence of the now de--bunked ciliateThe first well--known works of Arthur Campbell, still regularly cited today, are the Kofoid & Campbell monographs on tintinnid ciliates. The first[START_REF] Kofoid | A Conspectus of the Marine and Freshwater Ciliata Belonging to the suborder Tintinnoinea, with Despcriptions of New Species Principally from the Agassiz Expedition to the Eastern Tropical Pacific 1904--1905[END_REF]) is a 403 page monograph entitled "A Conspectus of the Marine and Freshwater Ciliata Belonging to the suborder Tintinnoinea, with Descriptions of New Species Principally from the Agassiz Expedition to the Eastern Tropical Pacific 1904--1905". In 1939 a second, 473 page monograph appeared[START_REF] Kofoid | Reports on the scientific results of the expedition to the Eastern Tropical Pacific, in charge to Alexander Agassiz[END_REF]) with more detailed descriptions of the species from the Agassiz Expedition and a revision and re--organization of many tintinnid taxa. It was one of the many reports of the Agassiz Expedition to the Eastern Tropical Pacific. With regard to the two tintinnid monographs published with Kofoid, it is difficult to assess Arthur's Campbell's role as second author. Did he work as an equal or an assistant to Kofoid? Obviously we cannot know for certain. However, the tintinnid monographs differed considerably from Kofoid's three other large monographic works, all on dinoflagellates, with regard to the expertise of his It appears plausible that Kofoid and Campbell could have interacted as peers in producing the tintinnid monographs, perhaps unlike the second authors of Kofoid's dinoflagellate monographs. In the 1929 monograph no description appears of the contributions of the authors except a statement that the senior author(Kofoid) collected some material while traveling on steamers. In the 1939 monograph, clear statements are made in the Acknowledgements concerning Campbell's apparently considerable contribution, and are given below:"The junior author has utilized his research time and his vacations from his obligations as Professor of Zoology in St. Mary's College, California, for the revision of the senior author's first draft of the manuscript of all families except the Undellidae and the Tintinnidae, and for the preparation of the first draft of the manuscript of those families.

	'neuromotor system', supposed to be a sort of protistan nervous system of fibers
	joined by a central 'neuromotorium' that governed and coordinated the activity
	of cilia. It was first described by Kofoid's student Robert Sharp in the rumen
	ciliates Diplodinium eucaudatum (Sup Ref: Sharp 1914). All of Kofoid's students
	following Sharp who worked on ciliates appear to have been obliged to describe
	it. Campbell's efforts can be seen in the title of his thesis, "The cytology of
	Tintinnopsis nucula (Fol.) Laachmann with an account of its neuromotor system,
	division, and a description of a new intra--nuclear parasite"; the 1926 newspaper
	article shown in Figure 1 which mentions a tintinnid brain spot more complex
	than the brain of a bee, and Campbell's 1927 article "Studies on the marine ciliate
	Favella (Jorgensen), with special regard to the neuromotor apparatus and its role
	in the formation of the lorica" (Sup Ref Campbell 1927). Various actual
	structures, such as a ventral kinety (see Fig. 3), were identified as components of

the apparatus. The existence of a neuromotor apparatus in ciliates was finally laid to rest with advent of Transmission Electron Microscopy

(Sup Ref: Pitelka 1970)

.

Figure

3

. An illustration of cellular structures of Tintinnopsis from

Campbell's Ph.D. thesis work, published in Campbell 1926

. Note the identification of a 'neuromotorium' (mot.) and a ventral kinety (v.f.) identified as as a 'ventral fiber of the neuromotor apparatus'. second author. Campbell was a bona fide expert on tintinnids; he had published as much on tintinnids as Kofoid himself. By 1929, Campbell had published 3 articles on tintinnids (Sup Refs

: Campbell, 1926a,b; 1927)

as had Kofoid according to Goldschmidt's memoir on

Kofoid (Sup Ref: Goldschmidt 1951)

. In contrast, all three of the second authors of Kofoid's dinoflagellate monographs had no apparent expertise with regard to dinoflagellates prior to publishing with Kofoid. Olive Swezy of

Kofoid & Swezy 1921 (Sup Ref: Kofoid & Swezy 1921

) was a parasitologist, Tage Skogsberg of

Kofoid and Skogsberg 1928 (Sup Ref: Kofoid & Skogsberg 1928)

, was an ostracod taxonomist, and Alastair Adamson of

Kofoid & Adamson 1933 (Sup Ref: Kofoid & Adamson 1933)

was a graduate student at the University of California in entomology. Neither Skogsberg nor Adamson published further on dinoflagellates or with Kofoid. Only Olive Swezy continued to publish with Kofoid but on parasites

(Sup Ref: Goldschmidt 1951)

.

Acknowledgements

The comments and suggestions of the Monitoring Editor, Barry Leadbeater, and the anonymous reviewers led to significant improvements in the text. However, I retain full responsibility for all errors of fact, omission, and interpretation.

Campbell had been awarded a fellowship to

Supplementary Data

Supplemental References and an Arthur S. Campbell bibliography are provided in the online version at 'xxxx'