Philip Raschke

Axel Küpper
email: axel.kuepper@tu-berlin.deolha.drozd

Olha Drozd

Sabrina Kirrane
email: sabrina.kirrane@wu.ac.at

Designing a GDPR-Compliant and Usable Privacy Dashboard

Keywords: Data privacy, Privacy dashboard, General Data Protection Regulation, Usability, Transparency-enhancing tools, Privacy-enhancing tools

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In the age of digitalization, the data privacy of an individual can be severely violated by technology. Cases like Google Spain v AEPD and Mario Costeja González 1 highlight the extent of harm technology can do to an individual person by simply providing inaccurate (in this case outdated) information about the data subject. Its controversy had to be eventually decided by the European Court of Justice (ECJ), the highest court of the EU. While the case was solved with a verdict in favor of individuals' data privacy, doubts remained, which were fueled by the revelations of Edward Snowden in 2013, also called the Snowden Effect 2 , and underlined by the invalidation of the Safe Harbor Privacy Principles by the ECJ 3 in 2015. The EU addresses these concerns with the General Data Protection Regulation (GDPR) [START_REF] Hansen | PRIME -A European Project for Privacy-Enhancing Identity Management[END_REF] , which comes into force in May 2018. The GDPR replaces the Data Protection Directive 5 of 1995 by extending the data privacy rights of data subjects in the EU with the goal to adapt to modern data privacy challenges.

A major change of the GDPR, among others, is the explicit requirement of transparency when processing personal information. [START_REF] Janic | Transparency enhancing tools (TETs): An overview[END_REF] In the recitals of the GDPR the lawmakers explain that "[t]he principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used". [START_REF] Jaspers | The think aloud method: A guide to user interface design[END_REF] Taking it literally, this would mean data subjects should be able to obtain any information they want, including the time a controller (i.e. a legal entity that processes personal information) accessed their personal data, from which source, to which processors (i.e. legal entities that process personal information on behalf of the controller) it has been forwarded, which data has been derived from it, and so on. However, in times of Big Data and Cloud Computing, providing this information can be very complex, considering the sheer amount of data a controller might process of a single data subject. Moreover, the processing often involves external third parties, since controllers might use the infrastructure of one or multiple service providers.

The personal data in question is mostly processed digitally, thus it is accessed and assessed by technical means. Granting the privacy rights of the GDPR should be realized by the same means. For this reason, we propose a privacy dashboard, which aims to offer and manage these data privacy rights. To tackle the complexity of the task and achieve a user-friendly result, a usability engineering methodology is applied.

The remainder of the paper is structured as follows. Section 2 discusses requirements for the privacy dashboard imposed by the GDPR. In Section 3, we give an overview of related work in the field of transparency-enhancing tools (TETs) as which privacy dashboards are classified. Section 4 presents the methodology, which is adapted to design the privacy dashboard. In Section 5, we analyze the potential users of the dashboard and the tasks they are supposed to fulfill with it. Based on the analysis, a design is derived that is presented and discussed in Section 6. The development of a prototype and its evaluation are presented in Section 7 and 8 respectively. Finally, we conclude our work in Section 9.

GDPR

The GDPR will be law in 28 countries, but more will be affected by it due to its territorial scope. Controllers from abroad will be subject to it if they offer goods or services to European data subjects or monitor behavior, which happened in the Union. [START_REF] Kani-Zabihi | Increasing service users privacy awareness by introducing on-line interactive privacy features[END_REF] The GDPR consists of 99 articles and 173 recitals. It is a comprehensive regulation covering multiple scenarios in which personal data is processed. This can be seen in Article 6 of the GDPR, which defines conditions for lawful processing of personal data. Given informed consent by the data subject 9 is only one out of a number of bases, including processing personal data to fulfill legal obligations [START_REF] Möller | Quality Engineering[END_REF] or for tasks carried out in the public interest [START_REF] Nielsen | Usability engineering[END_REF] . To narrow the scope, we only focus on processing of personal data based on consent given by the data subject.

To access, review, and manage personal data in a digital format, technological means are necessary. Thus, compliance with the GDPR requires technology to adapt to it. Furthermore, new means must be introduced to grant and use the data privacy rights of the GDPR. Bier et al. [2] draw the same conclusion.

As stated above, the explicit requirement of transparency is one of the major changes of the GDPR compared to its predecessor, the Data Protection Directive of 1995. It required personal information to be "processed fairly and lawfully" [START_REF] Sackmann | Personalization in privacy-aware highly dynamic systems[END_REF] , which is extended by the GDPR by adding the expression "and in a transparent manner " 13 to it. As mentioned in the previous section, the recitals attempt to narrow the transparency principle down, however, it remains debatable which information has to be provided to the data subject to meet the transparency requirement. The data subject can be provided with an overwhelming amount of meta information that is measured whenever personal data is processed. The meta data could give answers to the questions: When was the data collected? From which device was it obtained? To whom was it forwarded? What is the physical location of the processing servers? A first step towards transparency is to grant the right of access 14 . Siljee's [14] Personal Data Table fulfills all requirements to realize the execution of this right. The Personal Data Table should be extended by an element to depict data flows to involved processors.

Articles 16 and 17 of the GDPR grant data subjects the right to request rectification [START_REF] Thatmann | Please, No More GUIs!: A User Study, Prototype Development and Evaluation on the Integration of Attribute-Based Encryption in a Hospital Environment[END_REF] and erasure [START_REF] Weitzner | Transparent Accountable Data Mining: New Strategies for Privacy Protection[END_REF] of data without undue delay. Moreover, the controller is obliged to respond to these requests within one month. This time period is extendable by two additional months with regard to the complexity of the task and the number of requests. [START_REF] Zwick | Whose Identity Is It Anyway? Consumer Representation in the Age of Database Marketing[END_REF] For our design of the dashboard, this means the Personal Data Table must offer the possibility for each data item to request rectification or erasure of the corresponding information.

The Data Protection Directive required consent to be given unambiguously 18 , while the GDPR now requires the informed consent to be given for one or more specific purposes 19 . The recitals advise that if data is used for multiple purposes, consent shall be given for each purpose separately. 20 Furthermore, the data subject shall have the right to withdraw consent at any time and as easy as it was to give consent. 21 The dashboard must include a possibility to review consents given, the purposes they were given for, and a functionality to withdraw them at any time.

The dashboard is supposed to work as interface between data subject and controller. Requests for rectification, erasure or withdrawal of consent cannot be expected to be responded to immediately. Thus, a message section to obtain status information about pending requests is reasonable. The controller may approach the data subject via the dashboard to ask for consent of processing personal data for additional purposes. This way the privacy dashboard may be extended by ex ante capabilities, while being mainly designed as ex post TET.

Related work

Since decades there are numerous and manifold tools that address data privacy issues. Hedbom [5] provides a classification of TETs in 2008. The criteria to classify the tools include the possibilities of control and verification, the target audience and the scope of the tool, the information it presents, technologies it uses, and its trust and security requirements. Hedbom discusses his classification by applying it to examples. For this reason, the Transparent Accountable Data Mining (TAMI) system [16], the Privacy Bird 22 , the PRIME project [4], the approach to obtain privacy evidence in case of privacy violations by Sackmann et al. [12], and Amazon's book recommendations service [17] are presented and explained.

Based on his work, Janic et al. [6] further develop the classification and extend its definitions of TETs by identifying and discussing 13 tools. According to them, tools like the Mozilla Privacy Icons 23 and Privacy Bird fall under tools that address the complexity of privacy policies of websites. The PrimeLife Privacy Dashboard24 and the Google Dashboard 25 are ex post TETs, which provide information on collected and stored data by service providers. Lightbeam [START_REF]Lightbeam for Firefox -Mozilla[END_REF] and Netograph 27 visualize user tracking that is realized via third party cookies. The tool Web of Trust 28 ranks websites according to their trustworthiness, which bases on a reputation system. Janic et al. classify Me & My Shadow 29 , Firesheep 30 , Panopticlick 31 and Creepy 32 as tools that aim to raise privacy awareness by informing the user about techniques commonly used to violate their data privacy. The tool Privacy Bucket 33 and the Online Interactive Privacy Feature Tool by Kani et al. [8] have been released after the paper of Janic et al. was published, but fit in the previous described category.

To the best of our knowledge, the most recent privacy dashboards under development are GenomSynlig, which was merged into the Data Track project 34 by Angulo et al. [1] published in 2015, and the tool PrivacyInsight by Bier et al. [2] presented in 2016. While Data Track visualizes data disclosure in a socalled trace view and thus realizes the transparency principle of the GDPR, PrivacyInsight aims to address the GDPR as whole including the transparency principle, right to rectification and erasure, and the withdrawal of consent. Bier et al. identify legal and usability requirements for a privacy dashboard. In total they present 13 constraints, eight that are legal and five that are usability requirements. A brief summary of the legal prerequisites is given below, while the usability requirements are left out due to page limitations.

R1

The right to access must not be formally or technically constrained. R2 A privacy dashboard must be accessible by every data subject. R3 Access to all data must be provided. R4 All data must be downloadable in machine-readable format. R5 Data flows to all processors and internal data flows must be visualized. R6 All sources of personal data must be named. R7 For all processing steps a purpose must be given. R8 Means to request rectification, erasure, or restriction must be provided.

The requirement R2 includes in particular design strategies that enable access for data subjects with disabilities like visually impaired people. The privacy dashboard must implement accessibility interfaces like the WAI-ARIA 35 standard by the World Wide Web Consortium. The requirements R3, R5, R6, R7, and R8 impose a usability challenge with respect to the sheer amount of data taken into consideration. Internal and external data flows, as demanded by R5, can be complex to be visualized depending on the number of internal entities and external processors. Designing these data flows as graph in a comprehensible manner can be challenging. However, the information it depicts is fundamental in order to enable transparency. To support the data subject and to improve the intelligibility of this graph, it is reasonable to categorize and label personal data. A data subject might not be able to review each data flow to all processors in detail, but is interested in certain data categories.

Methodology

For the design and implementation of the dashboard, we adapt Nielsen's Usability Engineering Lifecycle [11]. It is considered fundamental in the field of usability engineering. In addition, it suits the design of systems well which address inexperienced users that desire to solve complex tasks [15]. For the following summary of the Usability Engineering Lifecycle Möller's notation [10] is used.

The development process starts with the Analysis phase, which examines the users, the tasks to be solved with the system, and the context of use. In the Design phase, the system is designed iteratively, however there may be parallel design versions, which are tested separately. In the Prototyping phase, the system is partly implemented. In this phase a differentiation is made between horizontal, vertical, or scenario-based prototypes. Horizontal prototypes present all functional capabilities of the system to the user, but do not provide the actual functionality. Vertical prototypes implement a certain feature of the system in depth, but do not include and present all planed functionalities to the user. The presentation but not full implementation of a certain feature is called scenario-based prototype.

The resulting prototype is evaluated in the Expert Evaluation phase by socalled usability experts in contrast to the Empirical Testing phase, which involves real users of the system, who are invited to test the tool under laboratory conditions. In the context of software engineering, this means a specific environment is set up including a predefined and tested device, a certain network connection, specific input tools, and so on. Various user studies can be conducted in both phases to either measure the overall quality of the system, or to identify flaws in the design. One of them is the cognitive walkthrough, which was first introduced by Lewis et al. [9] in 1990. After this phase, the next iteration starts, beginning with the Design phase. If the system is eventually deployed, feedback from real users in real-life scenarios can be collected and evaluated to further improve the system.

Analysis

Users Consequently, it can be inferred that a technological mean like a privacy dashboard reaches the majority of the user base, since it is rather familiar with technology and with the Internet. Web applications, which are optimized for mobile devices, suit well as platform. The privacy dashboard is intended to be used to execute data privacy rights granted by the GDPR. These rights are identified as the following tasks the tool should be used for: The Analysis phase also includes the investigation on how the identified tasks would be or are solved without the tool. To the best of our knowledge, there is no dedicated tool to exercise any of these data privacy rights. Consequently, the execution of these rights heavily depends on the context of the controller. If the controller processes personal information digitally and offers the data subject a user interface, then the right to access, rectify, and erase data can be expressed or realized via this user interface. However, to inform about involved processors or to review and withdraw previously given informed consent, data subjects have to revert to written correspondence with the controller or to long privacy policies that nobody reads [3], but may give all required information on how data is forwarded to external third parties or the formal procedure to withdraw consent. It often remains uncertain how and whether controllers respond to these written requests of data subjects. In cases of severe privacy violations with social or economic damage, legal actions need to be taken. 42

T1

Design

This section discusses two possible architectures to deploy and operate the privacy dashboard and presents a first design approach, which serves as a basis for the development of the prototype.

Architecture

We ideally envision one privacy dashboard to manage all privacy rights with regard to all controllers a data subject is concerned with. As Figure 1 shows, Approach 1 requires each controller to deploy and operate their own instance of the tool, which the data subjects can access individually, while Approach 2 allows data subjects to access one instance of the dashboard to manage all controllers they deal with. A controller-operated instance of the privacy dashboard is easier to integrate into the data processing infrastructure of the controller. Consequently, no conversion of the personal data in question is necessary to adapt to an interface of an external third party. The controller would be able to modify and extend the privacy dashboard, for instance, to implement the visualization of customized or proprietary data formats. Security vulnerabilities are avoided, since the personal data in its entirety does not leave the boundaries of the controller, but queried chunks of it are transmitted to the data subject. The proximity of the privacy dashboard to the infrastructure of the controller eases the immediate and automated application of requests to rectify or erase inaccurate personal data. Requests made by the data subject could directly trigger internal processes providing all necessary parameters to take instant action. If the controller uses authentication mechanisms to authenticate data subjects in order to provide a service, the same technique can be used by the privacy dashboard to authenticate a data subject before delivering personal data.

While the data subject might benefit from a single end point to address all privacy concerns to, Approach 2 also implies a series of challenges. This approach is more challenging from an architectural perspective, since personal data from all controllers needs to be aggregated and served by a dedicated component. This would either require the standardization of a common data format or an agreement on an existing one. Interestingly, the right to data portability 43 granted by the GDPR may force controllers to develop or agree upon a common data format to exchange personal data. Still a transformation of the personal data is necessary, to adapt to the visualization logic of the external-operated privacy dashboard. A single machine that stores personal data of one or more individuals from multiple controllers is a security and privacy risk itself. Therefore, programmable interfaces should be defined by each controller to allow querying certain chunks of data. These interfaces require an authentication mechanism to ensure that personal data is transmitted to the right data subject. In this architecture distributed authentication techniques have to be used to solve the task. Consequently, the dashboard is ideally executed on the data subject's device, so no third party has to be involved, however, this comes along with hardware requirements that could violate Requirement R1 (The right to access must not be formally or technically constrained.) of Section 3.

In general, the adoption of the privacy dashboard by all controllers appears as a more likely approach, if it saves controllers the development of an individual privacy dashboard from scratch. Again, the assumption is made here that compliance with the GDPR implies the introduction of a privacy dashboard (see Bier et al. [2] R2).

Data taxonomy

The GDPR's explicit requirement of personal data to be processed transparently highlights the significance of the right to access. In order to execute T1 (as 43 GDPR art. 20 defined in Section 5), all personal data has to be presented to the user. This data is displayed ex post like Siljee's [14] Personal Data Table. This enables answering the question: Which data collected the controller in question about me? The most challenging aspect of this task is to realize the visualization of huge amounts of diverse data. Consequently, the first approach to reduce the complexity of the data is to drill down the amount by limiting the presented data based on a time criteria such as data of the last month, week, or day. Simultaneously, by introducing this limit the dashboard needs to offer a functionality to select a time range the data subject wants to consider and review. This way, the data subject is able to ask more precisely the above mentioned question for a specific time range.

Despite this limitation, it might be that the sheer amount of data still overwhelms the data subject. Thus, it is reasonable to categorize the data and display the different categories. Since the context of use is data privacy, it is consequent to categorize the data according to a data taxonomy that addresses data privacy. Fortunately, Schneier [13] developed such a data taxonomy for social networks. A brief description of the categories is given below:

Service data is any kind of data that is required in order to provide the service in question (name, address, payment information). Disclosed data is any data that the data subject intentionally provides on the own profile page or in their posts. Entrusted data is any data that the data subject intentionally provides on other users' profile pages or in their posts. Incidental data is any kind of data provided by other users of the service about the data subject (a photo showing the data subject posted by a friend). Behavioral data is any kind of data the service provider observes about the data subject while he or she uses the service (browsing behavior). Derived data is any kind of data derived from any other category or data source (profiles for marketing, location tracks, possible preferences).

To apply the data taxonomy to all kinds of controllers and not just to online social networks, we propose a generalization of Schneier's taxonomy. For this reason, we categorize disclosed and entrusted data into the category Intentional data, since both types of data are provided by the data subject intentionally. Furthermore, comprehensible labels for the categories are defined below:

Service data -Service data Intentional data -Data I provided Incidental data -Data of me provided by others Behavioral data -Data of my behavior Derived data -Inferred data about me These categories can be applied to all kinds of controllers, although not each controller processes all categories of data. In our design for each category a view is offered with an individual Personal Data Table and the time limitation functionalities described above. In case that one or more categories are not applicable to the domain of the controller, a simple information can be given that no data for this category is available. This might also confirm expectations of the data subject with regard to data collection practices of certain controllers. By applying the data taxonomy and offering separated views for each data category, the dashboard allows the data subject to easily find out whether a controller collects behavioral data of him or her or whether another user disclosed information about him or her.

Prototype

A prototype was developed with the JavaScript framework React 44 and the library Material-UI [START_REF]Material-UI[END_REF] to comply with Google's design standard Material Design [START_REF]Material Design[END_REF] . The prototype has been made publicly available online [START_REF]Privacy dashboard -IFIP Summer School[END_REF] . With respect to the chosen methodology, a horizontal prototype has been developed that implements and presents all features to the user, however, provides reduced or no actual functionality. In practice, this means the scenario of our prototype is completely artificial.

We therefore define an online social network provider as our made-up controller that processes personal data of its users similar to popular services like Facebook or Twitter. All data presented in the dashboard is fake and does not belong to a natural person. However, to simulate a person's personal profile as accurate as possible with regard to the amount of data, we adapt an existing model from a study of the advertising agency Jung von Matt [START_REF] Jung Von | Matt study on typical German Facebook profile[END_REF] . Furthermore, requests to rectification, erasure, or withdrawal of consent are not processed by a controller's backend. The filtering of data according to its processing context, data type, or time of its processing is implemented.

As it can be seen in Figure 2, we designed a three-column layout for the dashboard. We define general functionalities like reviewing given consent, displaying the privacy policy, and obtaining information about involved third parties, which are presented in the left column. Also in the left column and under the general functionalities, filter options are provided allowing the user to display personal data processed in a specific context, of a certain data type, and in a defined time range. The meaning of each processing category and each data type is visually supported by an icon, which is used in other components of the dashboard as well. In the center of the layout, the queried personal data is listed vertically in chronological order beginning with oldest entry. Each entry is furnished with an icon that gives information on its processing context. Under the actual date of when the processing took place, a short descriptive text about it is presented in the header of an entry, which is displayed above the actual personal data. On the right-hand side, general information about the controller are given, such as name, physical address, and email address to directly contact the controller.

In order to use the dashboard to execute task T2, a graph is displayed that shows the user data flows between controllers and involved processors (see Figure 3). In real-life scenarios often many processors are involved in the processing of personal data. There can be multiple controllers as well (so-called joint controllers49 ). Depending on the number of involved processors in the processing of the data subject's personal data, the complete graph can be shown as whole or processors can be clustered into groups according to their business domain for instance. Edges are annotated with data categories giving information on which data is exchanged. The arrows denote the direction of the data flow to clarify whether parties are just provided with data or if parties are actively exchanging data with each other. For the implementation of this graph the JavaScript library vis.js50 has been used. Angulo et al. [1] propose a similar but more detailed approach with the trace view. To reduce complexity, data categories instead of specific data items are used in our approach. Task T3 requires the privacy dashboard to offer a possibility to request rectification or erasure of the data item in question (see Figure 4). Additionally, for each data item information on the purpose of its collection and processing is given (see Figure 4). Multiple purposes can be listed here, if data is processed for more than one purpose. With the help of this component the data subject can answer the question: For what reason does the controller collect and process this data? A redirection to a separate section allows the user to review given consent and the possibility to withdraw it (see Figure 5). Since consent is supposed to be bound to a specific purpose, there is a label and a short description text to give more details about the purpose in question. With a simple interaction, like a click, it is possible to withdraw consent as easily as it was to give it. 51 Fig. 5. A list of purposes for which consent has been given by the data subject. For each purpose a label and a short descriptive text is given. Consent can be withdrawn by simply clicking the toggle on the right.

Evaluation

To evaluate the design approach presented in this paper, an expert evaluation has been carried out according to Nielsen's Usability Engineering Lifecycle. The usability of the data categories is in focus of this evaluation. Möller [10] proposes a formative analysis consisting of a so-called Thinking Aloud test [7] with three to five participants to identify design flaws in a system. In the test, participants are asked to solve one or more specific tasks by interacting with the system while thinking aloud. An analysis of the participants' thoughts and remarks is conducted subsequently. In an expert evaluation so-called usability experts instead of real users are used, since the system might be in a too early stage to present it to external users. For this reason, three fellow researchers were given the following task consisting of multiple questions that have definitive answers.

GDPR art. 7(3)

"European law gives you the right to request from any entity that processes your personal data access to it. Imagine you requested access to your personal data from a company and you're confronted with the tool in front of you. Please answer the following questions:" -Which data did you have to provide when creating an account for this service? -Did you provide any voice recordings to the service? -Have you disclosed your location voluntarily? -Has anyone provided the controller with photos of you? -Does this service provider track your location? -Has the service provider knowledge about your gender? -Does the service provider know your income? -Does the service provider know which websites you visit?

All participants struggled to answer the questions at the beginning, but managed to improve quickly answering the last questions rather fast and confidently. All participants answered the first question using the chronological order instead of using the respective data category assuming the data provided first is the data required for the registration. This is a clear indicator that the data category Service data is redundant and can be categorized as intentional data ("Data I provided"). The so-called AppBar at the top also contributed to confusion. The participants understood the privacy dashboard as a service itself, therefore tried to answer the first question with regard to required information in order to use the privacy dashboard itself. The participants found that the filter options were not visible enough and should be placed more prominent, considering that they are an essential part in the task solving process. Another concern of the participants is the technical feasibility of the data categories. This applies to incidental data ("Data of me provided by others") and derived data ("Inferred data about me") in particular. Generally, the scenario of the privacy dashboard is important. The participants were interested whether the system is operated by the controller or as a separate service, and if it can be used offline or if an Internet connection is required. The evaluation reveals that refining the data categories is necessary in order to improve the usability of the dashboard. However, it also shows that the developed prototype can be used by data subjects to answer questions relating to their data privacy.

Conclusion

This work presents the design and implementation of a privacy dashboard, which addresses the requirements of the GDPR and enables the data subject to execute data privacy rights with the tool. To substantiate the dashboard's design, its potential users and the tasks they are supposed to fulfill with it were analyzed and discussed. A prototype has been developed and evaluated. The results of the evaluation indicate that our design approach is worth pursuing and reasonable, yet needs further improvements and user tests. The redefinition of the data categories and their technical feasibility will be researched in future work. Furthermore, architectures for the deployment of the privacy dashboard need more investigation. Comprehensive user studies are necessary to refine the current design of the dashboard and to develop alternative approaches.

  35 WAI-ARIA (Web Accessibility Initiative). https://www.w3.org/WAI/intro/aria. php, last accessed: 07/25/2017.

Fig. 1 .

 1 Fig. 1. Architectural alternatives for the deployment of the privacy dashboard. Either as single point to manage all controllers, or as data privacy management tool for every controller separately.

Fig. 2 .

 2 Fig. 2. The layout of the developed prototype. General functionalities and filter options are presented on the left-hand side. The queried data is in the center sorted chronologically beginning with the oldest entry. General information about the controller are presented on the right-hand side.

Fig. 3 .

 3 Fig. 3. A graph visualizing internal and external data flows between controller and processors. Edges are labeled with data categories indicating which data is exchanged with whom.

Fig. 4 .

 4 Fig.4. For each specific data item the user is given information on the purpose of its processing, where applicable the possibility to withdraw consent, and the possibility to request rectification or erasure of the data.

  of the privacy dashboard are potentially all natural persons in the EU. According to the statistics provider Eurostat of the European Commission, over 500 million humans lived in the Union in 2016.36 These millions of people live in 28 countries, speak 24 official languages and almost the same amount of migrant languages, while using three different writing systems.37 In 2016, 15.6% of the European population were younger than 14 years, 11.1% of them were between the age of15-24, 34.1% between 25 and 49, 20.1% between 50-64, 13.8% between 65-79, and 5.4% older than 80 years.38 These numbers highlight the challenge a uniform interface for this user base will be, however, it is further reasonable to investigate the user base's affiliation with information and communication technology. In 2016, about 71% of all individuals in the EU and 92% between the age of 16 to 24 accessed the Internet on a daily basis.39 Moreover, 8 out of 10 users use a mobile device to access the Internet.40 In 2012, 80% of individuals between the age of 16 and 24 used the mobile Internet to participate in social networks.41

  Execute the right of access T2 Obtain information about involved processors T3 Request rectification or erasure of data T4 Consent review and withdrawal 36 Eurostat -Population. http://ec.europa.eu/eurostat/tgm/table.do?tab=table& init=1&language=en&pcode=tps00001&plugin=1, last accessed: 07/18/2017. 37 Europeans and their Languages. http://ec.europa.eu/commfrontoffice/ publicopinion/archives/ebs/ebs_386_en.pdf, last accessed: 07/25/2017. 38 Eurostat -Population by age group. http://ec.europa.eu/eurostat/tgm/ refreshTableAction.do?tab=table&plugin=1&pcode=tps00010&language=en, last accessed: 07/25/2017. 39 Eurostat -Internet use and activities. http://ec.europa.eu/eurostat/web/ products-datasets/-/isoc_bde15cua, last accessed: 07/25/2017. 40 Eurostat -Internet use by individuals. http://ec.europa.eu/eurostat/ documents/2995521/7771139/9-20122016-BP-EN.pdf/f023d81a-dce2-4959-93e3-8cc7082b6edd, last accessed: 07/25/2017. 41 Eurostat -Purpose of mobile internet use. http://ec.europa.eu/eurostat/web/ products-datasets/-/isoc\_cimobi\_purp, last accessed: 07/25/2017.

PrimeLife Dashboard. http://primelife.ercim.eu/results/opensource/76dashboard, last accessed: 07/20/2017.

ECLI:EU:C:2014:317 http://curia.europa.eu/juris/documents.jsf?num=c-131/12, last accessed: 07/25/2017.

GDPR art. 26

vis.js -A dynamic, browser based visualization library. http://visjs.org/, last accessed: 11/13/2017.

Acknowledgments

Supported by the European Union's Horizon 2020 research and innovation programme under grant 731601. The authors would like to thank Dirk Thatmann, Iwailo Denisow, and Sebastian Zickau for their valuable feedback to the prototype.


Yefim Shulman
email: efimshulman@mail.tau.ac.il

Towards a Broadening of Privacy Decision-Making Models: the Use of Cognitive Architectures

Keywords: Decision Making, Privacy, Model, Cognitive Architectures, ACT-R

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Privacy issues have been a matter of growing importance for individuals, as well as for business entities and regulators.

The key element in privacy-related interactions with technology is the end-user (i.e., data subject), who is entitled to make, supposedly well-informed, choices about how to deal with one's own personal information. For the most part, decisions concerning privacy are decisions of people giving or revoking their consent. These decisions are imposed on the users whenever they desire to interact with an information service, as well as with some more traditional services.

Other, more particular, decisions can result from the users' initiative (e.g., requesting deletion of their personal information, instituting changes in the data they have shared or in the way the system is allowed to process it, requesting a report on their privacy status, etc.). Such decisions are not usually forced upon the users, and they can be made by users without prior notifications and requests from systems or data holders. Therefore, to address these important issues, it is useful to be able to model human behaviour, when it comes to making decisions on privacy-related interactions.

This paper investigates the state-of-the-art in privacy decision-making literature and suggests the use of ACT-R (Active Control of Thought -Rational) modelling framework to bridge the identified gaps and provide for a better understanding of people's information disclosure behaviour.

Section 2 introduces the current stage of research and outlines and compares main approaches in privacy decision-making. Section 3 introduces the field of cognitive architectures, discusses applicability and potential contributions of models constructed with ACT-R framework. Section 4 provides concluding remarks and challenges of proposed modelling paradigm.

2

Research on Privacy-Related Decision-Making Models Section 2.1 provides an outline of the literature selection process. In Section 2.2 I discuss identified approaches and theories, traversing privacy decision-making research. Section 2.3 gives more attention to the literature on the privacy calculus, which prevails in the state-of-the-art literature on privacy decision-making. Section 2.3 contains further comparisons of the state-of-the-art research and discusses opportunities for improvement.

Literature Selection

As the first step, I identify the existing literature on privacy-related decision-making that should form the body of work, through which we parse in this paper (see Table 1). In my approach, I relied on the guidelines by Webster and Watson [START_REF] Webster | Analyzing the past to prepare for the future: Writing a literature review[END_REF]. For the review I used broad multi-disciplinary databases. I included papers that did not draw significant attention from other scholars over the years. It was important for the purposes of this paper to try and highlight all the ideas applied to study privacy decision-making that had been tested so far.

Approaches and Theories in Privacy-Related Decision-Making

Researchers have studied human decision-making from a psychological and economic standpoints, using a variety of models, based on classical economics (i.e., expected value and expected utility theory) and its generalized extensions, as well as behavioural economics (see Fig. 1).

Acquisti, Taylor and Wagman [START_REF] Acquisti | The Economics of Privacy[END_REF] discuss how privacy has been being regarded as an economic good and provide an explanation on how individuals' informed decisions about their privacy are being hindered, because of asymmetry of the information available to people, when they make privacy-related decisions.

Behavioural economics is a permeant theme in the more recent papers (e.g., Adjerid and Peer [START_REF] Adjerid | Beyond the privacy paradox: Objective versus relative risk in privacy decision making[END_REF]; Dinev, McConnell, and Smith [START_REF] Dinev | Research Commentary-Informing Privacy Research Through Information Systems, Psychology, and Behavioral Economics: Thinking Outside the[END_REF]; Dong, Jin, and Knijnenburg [START_REF] Dong | Predicting Privacy Behavior on Online Social Networks[END_REF]; etc.). Arguably, it may be applicable for modelling human decisions in privacyrelated interactions as an instance of decision-making under risk. Barberis [6] provides multiple examples of how it has been used to model decisions in areas spanning from finance and insurance to understanding betting markets, pricing, consumptionsaving decisions, etc.

Overall, I identified 40 papers on user decisions on online privacy. Nine papers reported surveys, positions, system prototypes, case-studies or user-study experiments and did not deal with model development. They are still included in this paper, representing the current developments in the subject domain. The outline of the families of theories and frameworks used so far is presented in Table 2. [START_REF] Van Gool | To share or not to share? Adolescents' self-disclosure about peer relationships on Facebook: An application of the Prototype Willingness Model[END_REF] Altman-Westin privacy, privacy concerns and attitudes constructs are the underlying theories in most of the reviewed papers. Since they are not directly related to model development, they are not mentioned in Table 2.

Fig. 1. The relations of approaches to modelling decision-making in Economics

Looking at applied theories and frameworks, we can infer that, in general, research on privacy decision-making can be divided by subject areas into four major methodological groups: (1) most pronounced so far, an information science approach with the privacy calculus and its extensions; (2) a psychological, social and information science approach beyond the privacy calculus; (3) a mathematical-economic approach; and (4) a machine learning approach.

The overwhelming majority of research is based on the privacy calculus and its extensions. Hence, I deem appropriate to "detach" this bulk of research from subjectwise division and discuss this theory in more detail in the following Section 2.3. We return to the grand comparison and analysis of existing approaches in Section 2.4.

Privacy Calculus Modelling Approach

Multiple empirical and methodological studies on privacy decision-making draw from economic constructs such as expected utility theory, employing the privacy calculus (e.g., in Malhotra et al. [START_REF] Malhotra | Internet users' information privacy concerns (IUIPC): The construct, the scale, and a causal model[END_REF]; Hann et al. [START_REF] Hann | Overcoming online information privacy concerns: An information-processing theory approach[END_REF]; Xu et al. [START_REF] Xu | The personalization privacy paradox: An exploratory study of decision making process for location-aware marketing[END_REF]). Their results provide insights for understanding the "privacy paradox" and individuals' attitudes towards privacy-related preferences and decisions, and contribute to the assessment of privacy concerns. Dinev and Hart [START_REF] Dinev | An extended privacy calculus model for e-commerce transactions[END_REF] attempt to measure privacy concerns and estimate dependencies between factors and privacy constructs ("concerns of information finding" and "concerns of information abuse"). Later, Dinev and Hart [START_REF] Dinev | Internet privacy concerns and their antecedents-measurement validity and a regression model[END_REF] provide more ground for the use of an extended privacy calculus, showing that, at least for the example of ecommerce, Internet trust and personal interest can outweigh privacy concerns constructs. After employing common statistical methods of dimensionality reduction and supervised learning in the first work, structural equation modelling in the second, and joined by other researchers, a bigger collective of authors investigates privacy perceptions and develops a theoretical framework for understanding Internet privacy attitudes (Dinev, Xu, Smith and Hart [START_REF] Dinev | Information privacy and correlates: an empirical attempt to bridge and distinguish privacy-related concepts[END_REF]), with an empirically developed structural model attesting to the validity of proposed constructs.

In a set of studies of privacy-related issues in social networking services, Krasnova et al. [START_REF] Krasnova | Privacy concerns and identity in online social networks[END_REF][START_REF] Krasnova | Online social networks: why we disclose[END_REF] turn to the privacy calculus and produce structural models to investigate Internet users' privacy concerns and motivations regarding personal information disclosure. The former research develops and justifies categorisation of privacy concerns, and, then, tests it against self-disclosure dimensions to explore inter-relations between defined privacy concerns and postulated self-disclosure strategies. The latter paper commences in an attempt to build a model of self-disclosure in social networking services. Exploratory in nature, this paper identifies factors of self-disclosure, noting, however, that "(…) other factors beyond those investigated in our study can also have an impact on individual self-disclosure" (Krasnova et al. [START_REF] Krasnova | Online social networks: why we disclose[END_REF], p. 123).

Krasnova et al. [START_REF] Krasnova | Self-disclosure and privacy calculus on social networking sites: The role of culture[END_REF] account for users' mental patterns and uncover cultural implications of privacy attitudes and behaviour. Here the authors address individualism and avoidance of uncertainty as two (out of commonly adopted five) cultural factors of self-disclosure that seem most relevant in terms of social networking services. The paper, as recognised by the authors, is limited in the scope of possible influencing effects. The model itself abstains from considering spatial and temporal factors, as well as cognitive effects and biases at the point of making a decision.

Keith et al. [START_REF] Keith | Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior[END_REF] apply the privacy calculus to show that consumer age is not a significant factor in decisions on online self-disclosure, and the relationship between decisions on personal information disclosure and the intention to disclose such information is weak, while still statistically significant. More practical conclusions reveal that privacy-concerned users do not necessarily properly understand the link between first-and second-order privacy risks of the same nature. Notwithstanding, authors admit that their research "does not account for a consumer's long-term intentions or disclosure behaviour" and "privacy calculus might be better modelled as a sub-theory within a larger framework aiming to elucidate how long term information disclosure relationships form." (Keith et al. [START_REF] Keith | Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior[END_REF], p. 1172). Moreover, the researchers name Kahneman and Tversky's Prospect Theory as a better way than the existing rational privacy calculus for accounting for bounded rationality and obtaining an insight on privacy-related decision-making. Lastly, another take-away from the paper is a seemingly valid point favouring exploration of possible non-linearity of relationship between perceived benefits and risks in self-disclosure decisions.

More and more attempts are made to extend the privacy calculus, apart from the aforementioned works (e.g., Y. Li [START_REF] Li | Theories in online information privacy research: A critical review and an integrated framework[END_REF]). A paper by Wang et al. [START_REF] Wang | Intention to disclose personal information via mobile applications: A privacy calculus perspective[END_REF] is one successful example. The research probes extending the privacy calculus with more psychological factors and adds evidence of the importance of contextual factors in privacy decisionmaking. Relying on a structural model, the authors argue that users value benefits more than risks. The need for cognition effect has been studied, showing a significant relationship with risks and a non-significant relation with benefits.

The vast majority of decision-making models powered by the privacy calculus were built with expected utility or expected value in their core. To scrutinise decisionmaking behind disclosure in exchange for personalisation of services in e-commerce, Zhu et al. [START_REF] Zhu | Privacy calculus and its utility for personalization services in e-commerce: An analysis of consumer decision-making[END_REF] introduce a rank-dependent generalised expected utility model. The authors run their mathematical model through a set of simulations for users with different levels of privacy concerns and companies with different reputation.

Comparison and Discussion

The existing theoretical body of research behind privacy decision-making draws from various subject areas. Let us look closer at the approaches scholars used to study privacy decision-making. Overall, achievements and limitations of the existing models, grouped by prevailing approaches, are represented in a comparative Table 3.

Li [START_REF] Li | Theories in online information privacy research: A critical review and an integrated framework[END_REF] designs a decision-making matrix, based on an elaborate overview of approaches and theories used in privacy research, and on the derived concept of a "dualcalculus model", which is defined as a combination of privacyand risk-calculi for decision-making in privacy-related issues. Researchers try to probe privacy decision-making beyond privacy calculus as well. In that way, Van Gool et al. [START_REF] Van Gool | To share or not to share? Adolescents' self-disclosure about peer relationships on Facebook: An application of the Prototype Willingness Model[END_REF] base their research of disclosure behaviour in adolescents on a Prototype Willingness Model 1 . The authors study adolescents' relationship disclosure in online social networks, and they manage to show that said selfdisclosure is a product of an analytical reasoned process, which can be more or less influenced by the situational context. Li, Sarathy, and Xu [START_REF] Li | The role of affect and cognition on online consumers' decision to disclose personal information to unfamiliar online vendors[END_REF] adopt the S-O-R paradigm 2 in their attempt to model privacy-related decision-making. The authors find that decisions regarding personal information disclosure depend on impressions that users internalize during the first interaction with a website that prompts the users for said decisions to be made.

Mahmood and Desmedt [START_REF] Mahmood | Two new economic models for privacy[END_REF] carry out an attempt to develop mathematical models of privacy, which results in devising a game theoretical model (stochastic almost combinatorial) and a graph theory model (attack and defence multigraphs with certain 1 Prototype Willingness Model (PWM) is a framework from the family of so called "dualprocessing models". It operates under the assumption that there are two paths of decisionmaking: a reasoned path (rational), and a social reaction path (heuristics-based). PWM was developed by M. Gerrard, F. X. Gibbons and their colleagues. It was aimed to be used for health studies, originating in Gibbons and Gerrard [START_REF] Gibbons | Predicting young adults' health risk behavior[END_REF]. 2 Stimulus-organism-response (S-O-R) model postulates that environmental factors affect cognitive reactions in organisms, thusly affecting behaviour (Mehrabian and Russell [START_REF] Mehrabian | An approach to environmental psychology[END_REF]).

simplifications). The researchers argue that users cannot always be careful and thorough, due to bounded rationality and limitations of working memory. Egelman and Peer [START_REF] Egelman | Predicting privacy and security attitudes[END_REF] study privacy decision-making from a psychological standpoint. The authors consider the influence of such factors as personality dimensions on online privacy concerns and self-disclosure behaviour. As a result, they argue that individual differences are better predictors of decisions than the personality traits approach, testing their hypothesis against the Five Factor Model3 .

Koohikamali et al. [START_REF] Koohikamali | Beyond self-disclosure: Disclosure of information about others in social network sites[END_REF] extend the modelling literature by addressing selfdisclosure with the premises of Rest's ethical decision-making model 4 . In contrast with majority of research concerned with self-disclosure, the authors attempt to model decisions about disclosure of personal information about others. They show that disclosure about others is driven by the attitudes towards social network sites and concerns about others' privacy, and is not influenced by the social norms.

Griffin et al. [START_REF] Griffin | A Model of Paradoxical Privacy Behavior in Online Users[END_REF] formulate a mathematical model, acknowledging behavioural economics arguments and presumably able to predict privacy decisions. Through treating user behaviour as an optimization of comfort with sharing and perceived control, the model reconciles maximization of perceived user control and costs associated with providing that control by social networks. Validation and testing is needed to evaluate the quality of the model.

Eling, Krasnova, Widjaja and Buxmann [START_REF] Eling | Will you accept an app? Empirical investigation of the decisional calculus behind the adoption of applications on Facebook[END_REF] take an inductive approach to build a decision-making model, linking trust in a service provider and intrusiveness of requested information to highlight the decisional calculus proposed in their paper. Although the authors manage to obtain (and corroborate with an experiment) a depiction of the cognitive process underlying the decisions about application acceptance, the paper does not proceed to construct a cognitive model behind situational decisionmaking. Overall, decisional calculus, unveiled in Eling et al. [START_REF] Eling | Will you accept an app? Empirical investigation of the decisional calculus behind the adoption of applications on Facebook[END_REF], is in line with the privacy calculus.

Ghosh and Singh [START_REF] Ghosh | Predicting Privacy Attitudes Using Phone Metadata[END_REF] provide one of the use cases for applying machine learning to build a predictive model of privacy concerns. Feeding phone usage metadata, refined through classification algorithms, they manage to achieve enough accuracy (for their classification design) to predict users' privacy attitude category.

As particularly mentioned, most authors admit the limitations in their sets of influencing factors; unaccounted possible relations between factors, risks and benefits; and unexplored effects of cognition. Such usually unaddressed aspects may include the momentary awareness of privacy issues, the current level of fatigue and (or) mental workload, attention span and sense-making of privacy indications, and other mental effects (e.g., information overload, cognitive laziness, etc.).

Additionally, there is a discussion on the more convenient ways to convey privacyrelated information to the individuals. As suggested by Wang et al. [START_REF] Wang | Designing the default privacy settings for facebook applications[END_REF] regarding mobile applications, privacy notices requesting self-disclosure from users, inadequately reflect the scope of privacy intrusion or request unreasonable amounts of selfdisclosure. In a survey comparing the effect of fine-grained privacy indications to the effect of coarse-grained ones Eling, Rasthofer, Kolhagen, Bodden and Buxmann [START_REF] Eling | Investigating Users' Reaction to Fine-Grained Data Requests: A Market Experiment[END_REF] hypothesise that more concrete privacy indications may influence users' willingness to disclose information. In a controlled experiment Egelman, Tsai, Cranor and Acquisti [START_REF] Egelman | Timing is everything?: the effects of timing and placement of online privacy indicators[END_REF] demonstrate that the temporal aspect of privacy indications impacts the acceptable amount of costs that users are willing to bear to preserve their privacy.

The issue of defining a better way to communicate privacy-related information to assist users' decision-making is addressed in Bal et al. [START_REF] Bal | User Control Mechanisms for Privacy Protection Should Go Hand in Hand with Privacy-Consequence Information: The Case of Smartphone Apps[END_REF][START_REF] Bal | Styx: Privacy risk communication for the Android smartphone platform based on apps' data-access behavior patterns[END_REF]. Reflecting upon "privacy consequences" and echoing the problematic nature of "second-order privacy risks" with the aforementioned Keith et al. [START_REF] Keith | Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior[END_REF], the researchers argue that communicating privacy outcomes from privacy-related actions to mobile users should facilitate better decisions.

Opportunity for Future Research: Cognitive Architectures

In order to include various effects of internal and external factors influencing decision-making 5 , as well as different interdependencies, we can try a broader model of cognitionone that simulates dynamic cognitive processes as functions in a system, consisting of input and data acquisition, memory, attention, decision-making, and output generation. The modelling of complex cognitive phenomena is widely and rigorously addressed in cognitive architectures. Most notable and well-established examples of cognitive architectures in use include ACT-R, SOAR, LIDA and EPIC. 6SOAR and LIDA focus on artificial general intelligence (Samsonovich [START_REF] Samsonovich | Comparative table of cognitive architectures[END_REF]). SOAR specialises on task execution and problem-solving, providing software agents with spatial reasoning, anticipation and real-time strategy definition. LIDA has been applied to create software agents replacing human operators in certain tasks, but lacking visual and auditory input modalities and being limited in terms of learning capabilities (Ramamurthy et al. [START_REF] Ramamurthy | LIDA: A working model of cognition[END_REF]). EPIC is poised as a framework for human-system interactions simulation, assisting in the development and validation of systems interfaces. Another example -4CAPShas been used to describe behavioural patterns in neuropsychology related to executive functions of cognitive control (Just et al. [START_REF] Just | The organization of thinking: What functional brain imaging reveals about the neuroarchitecture of complex cognition[END_REF]).

When it comes to privacy decision-making, the research model should be able to simulate dynamic cognitive processes as functions in complex systems, comprised of elements accounting for input and data acquisition, memory, attention, decisionmaking, and output generation. One of the most well-established cognitive architectures, which offers sufficient flexibility of application, is the ACT-R framework. Section 3.1 introduces ACT-R in the field of human decision-making. Section 3.2 discusses possible contributions of ACT-R to privacy decision-making, and provides a comparison of ACT-R with the modelling approaches discussed in Chapter 2.

3.1

The ACT-R Modelling Framework

ACT-R is one of the most detailed frameworks for modelling perception, procedural cognition and decision processes (Anderson et al. [START_REF] Anderson | An integrated theory of the mind[END_REF]). As argued by Gonzalez and Lebiere [START_REF] Gonzalez | Instance-based cognitive models of decision-making[END_REF], there are numerous benefits to the modelling of economic decisionmaking by using cognitive architectures, where ACT-R outcompetes its rivals, being in possession of a "more realistic characterization of the flexibility and adaptability of human behavior" (p. 26).

Attempts have been made to create comprehensive integrated theory to approach modelling of the recognition heuristics and judgments (Marewski, Pohl and Vitouch [START_REF] Marewski | Recognition-Based Judgments and Decisions: What We Have Learned (So Far)[END_REF]). Here the authors address issues of an "ecological model of decision-making", pointing out how scarce the research is on real-world decisions with utilizing "sense of prior encounter". Thomson, Lebiere, Anderson and Staszewski [START_REF] Thomson | A general instance-based learning framework for studying intuitive decision-making in a cognitive architecture[END_REF] argue that modelling paradigms (Taatgen, Lebiere and Anderson [START_REF] Taatgen | Modeling paradigms in ACT-R. Cognition and multi-agent interaction: From cognitive modeling to social simulation[END_REF]) enabled in ACT-R, namely instance-based learning, can be applicable to modelling intuitive decision-making. Authors manage to show that by using this cognitive architecture it is possible to implement risk aversion in learned (not forced) strategy choice. Veksler, Gray and Shoelles [START_REF] Veksler | Goal-Proximity Decision-Making[END_REF] demonstrate that the ACT-R framework can be used to implement human decision-making arising from "associative learning", not involving an a-priori notion of rewards and punishments.

Overall, the theoretical background and existing body of empirical research indicate that using ACT-R to model human decision-making can attain new value over the so far prevalent approaches. ACT-R is capable of modelling long-term (both declarative and procedural) and working memory functioning, perception and logic processes and, as shown by Peebles and Banks [START_REF] Peebles | Modelling Dynamic Decision Making with the ACT-R Cognitive Architecture[END_REF], it is suitable for dynamic decision-making, even though with certain limitations.

ACT-R: Applicability and Discussion

Aforementioned features may help to build a model that can accommodate the context, in which the decisions are made, including but not limited to, simulating momentary awareness, as well as the individual's attention and judgment processes, and other cognitive functions. 7 Additionally, incorporating the Cumulative Prospect Theory to model deviations from rational micro-economic decision-making with the ACT-R architecture seems as plausible as it may prove fruitful. A summary of modelling opportunities enabled in ACT-R is outlined in Table 4. It should be clearly stated, that, beyond any doubt, I am not denying the existing body of research all its achievements in formulation of the initial understanding of antecedents of privacy decision-making, and the inter-relations of various factors. As we have seen, though, with other approaches, their applicability can be limited by their theoretical background and, oftentimes, by the goal of each particular study. Additionally, each study usually does not allow for broader generalisations orto the other extreme particularisations (true for most of the mathematical economic models). ACT-R may be capable of contributing to the field of human decision-making entailing privacy consequences in several ways. Consider a situation: "A person X with a fatigue F in a situation S with environmental noise E, surrounded by the amount of people N, while exercising an activity A, is asked to disclose information M and receives a warning W with the properties T." What will be the X's response?

The comprehensiveness of the ACT-R modelling framework theoretically allows us to model the entire problem space of this situation. It makes it possible to come up with specific predictions about individual decisions of people, usually described by person-specific sets of features.

The extendibility of the ACT-R framework should help with building models in stages. Starting up with a certain simplistic basis of privacy-concerned decisionmaking, new features can be gradually added to account for additional effects and factors of the situation, extending its complexity.

Scalability of the ACT-R framework may be used to "switch off" chosen features impacting decisions. That can shed light on some emergent effects and interactions between features, which might have been left obscured and unexplored otherwise.

Features like the learning process, larger sets of user characteristics, attention mechanism, fatigue dynamics and cognitive capacity, task-distraction conflict, environmental noise, and others are extremely cumbersome to address with other approaches. These features, including their inter-dependence, can be addressed with ACT-R in a more structured and explicit, less demanding fashion. With ACT-R we may tackle problems like: ─ studying effects of factors in different combinations with each other; ─ modelling non-linear relationships in people's perceptions of costs, benefits and risks of personal information disclosure; ─ studying human privacy decisions in different mental states; ─ modelling decisions made by users with different privacy attitudes according to various attitude taxonomies; ─ accounting for intertemporal nature of privacy-related decisions; ─ incorporating lower-level mental processes into the picture; ─ comparing different models within ACT-R framework against each other.

Overall, at the current stage of developments in the field of privacy-concerned decision-making, we have obtained substantial knowledge about antecedents and factors of users' disclosure behaviour. Thus, based on what we have learnt so far, it may be possible, in principle, to build a decision-making model with the ACT-R framework, which should be able to contribute new knowledge and provide better understanding of situational privacy-concerned decision-making under various restrictions.

Conclusion

This paper provides an attempt to identify gaps in the current stage of research exploring users' decision-making with privacy considerations. The state-of-the-art models of decision-making under privacy restrictions show limitations attributed to their levels of flexibility, practical applicability, and comprehensiveness. A possible idea to overcome some limitations of existing models is proposed in the current paper. This idea of using cognitive architectures may also be a solution that can advance our understanding of human decision-making regarding such a "fuzzy" issue as privacy.

However, the mapping of the behavioural economics approach and (or) extended privacy calculus to decision-making onto the ACT-R cognitive architecture creates major challenges. Economic modelling does not provide a generalised method for defining the costs and benefits for every problem. Additional problems that should be resolved in order to apply, for instance, Cumulative Prospect Theory include: determining the reference point, from which gains and losses can be defined; quantifying the benefits and costs of personal information disclosure; and devising a justified probability weighting.

Simultaneously, ACT-R modelling can be a challenge in and of itself, as it is developed to be a comprehensive architecture, simulating human cognitive processes at large. To be successful in developing an ACT-R model, one needs to apply domainspecific knowledge to the architecture and conduct a proper scoping of the problem to be resolved. Of course, the biggest challenge "is that it takes a substantial intellectual commitment to learn to understand models of a particular architecture and to learn to construct models" (Taatgen and Anderson [START_REF] Taatgen | The past, present, and future of cognitive architectures[END_REF], p. 699).

Accompanied by empirical validation, the implementation of the ACT-R cognitive architecture in the field of privacy will be a major challenge that can help privacy research, as well as enrich the ACT-R modelling methods.

Comments and Acknowledgements

I

  gratefully acknowledge the suggestions from my Ph.D. advisor, Professor Joachim Meyer. This paper is a part of the author's Ph.D. research on "Modelling Responses to Privacy-related Indications". The research is conducted under and supported by the Privacy & Us innovative training network (EU H2020 MSCA ITN, grant agreement №675730).

Table 1 .

 1 The outline of the selection process

	Selection Criterion	Restriction Properties
	Main Sources Databases	Google Scholar, Scopus, Web of Science
	Venue Locations	Not restricted
	Journals / Conferences	Not restricted
	Disciplines	Not restricted
	Amount of Citations	Not restricted
	Status	Published or "to-appear-in" state
	Versions priority	First: Official publication
		Second: Final edition from an author's website
		Third: Proceedings version and pre-print
	Date of publication	Not restricted
	Search terms	"model", "privacy", "decision", "making"
	Exclusion criteria	"mental models"
		Court decision-making and legal cases
		Papers written not in the English language
		Medical disclosure and other papers related to rules, proce-
		dures, regulations, instructions and orders
	Additional sources	Lists of references in the relevant papers.
		Lists of mentions of the relevant papers.

Table 2 .

 2 Theories and Frameworks in privacy decision-making literature

	Theories and Frameworks	Relying Papers
	Privacy Calculus,	Knijnenburg and Kobsa; Dinev et al.; Dong et al.; Kehr,
	in conjunction with Theory of	Kowatsch, Wentzel, and Fleisch; Zhu, Ou, van den Heuvel,
	Reasoned Action (TRA) and	and Liu; [10, 12, 23, 26, 60] etc. -
	Theory of Planned Behaviour	Majority of papers is based on privacy calculus approach or
	(TPB)	its extensions, see Section 2.2 for more detailed discussion
	TRA and (or) TPB,	Kim, Ferrin and Rao; Z. Wang and Liu; Koohikamali, Peak
	excluding Privacy Calculus	and Prybutok [25, 27, 57]
	Bounded rationality and Gen-	Pu and Grossklags; Kehr et al.; Zhu et al. [23, 42, 60]
	eralised Expect Utility
	Behavioural Economics	Dinev et al.; Adjerid and Peer [2, 10]
	Cognitive Scarcities	Veltri and Ivchenko [53]
	Social Identity Theory, Social	Koohikamali et al.; Shih, Lai and Cheng [27, 47]
	Exchange Theory
	Five Factor Model	Egelman and Peer; Koohikamali et al.; Ross et al. [13, 27,
		45]
	Machine Learning (Decision	Dong et al.; Ghosh and Singh; Lee and Kobsa [12, 17, 32]
	Trees, Cluster Analysis, Clas-
	sification)
	Technology Acceptance Model Kim, Ferrin and Rao [25]
	Hofstede's Cultural Dimen-	Krasnova, Veltri and Günther [30]
	sions Theory
	Mathematical Economics:
	Classic Decision Theory	Griffin, Rajtmajer and Squicciarini [20]
	Optimization Theory	Griffin et al. [20]
	Graph Theory	Mahmood, S. and Desmedt, Y.; Pu and Grossklags [36, 42]
	Game Theory	Mahmood, S. and Desmedt, Y.; Panaousis, Laszka, Pohl,
		Noack and Alpcan [36, 40]
	Markov Decision Process	Venkitasubramaniam [54]
	Expectancy Theory	Hann, Hui, Lee and Png; Keith, Thompson, Hale, Lowry
		and Greer [21, 24]
	Conjoint Analysis	Hann et al. [21]
	Fuzzy Logic	Zhu et al. [60]
	Stimulus-Organism-Response	H. Li, Sarathy and Xu [33]
	(S-O-R) Model
	Protection Motivation Theory Y. Li; Z. Wang and Liu [34, 57]
	Social Contract Theory	Malhotra, Kim and Agarwal [37]
	Elaboration Likelihood Model Dinev et al. [10]
	Valence Framework	Dinev and Hart; Kim et al.; Eling, Krasnova, Widjaja and
		Buxmann [8, 15, 25]
	Experience Sampling Method Lee and Kobsa [32]
	Prototype Willingness	Van Gool, Van Ouytsel, Ponnet and Walrave
	Framework

Table 3 .

 3 Summary of approaches to studying privacy decision-making

		Approaches
	Problems and measures	Motivations	Limitations
	Information Science and (Extended) Privacy Calculus
	Problems addressed:	Achievements:	1. Sample bias in surveys
	users' personal information disclo-	formulation and explana-	and experiments.
	sure decisions in online environ-	tion of "Antecedents -	2. External validity of the
	ments: mobile applications, social	Privacy Concerns -Out-	experiments can be chal-
	networks, e-commerce, location	comes" (APCO, Dinev et	lenged.
	tracking, personalisation and recom-	al. [10]) pathway of ob-	3. Scope of factors is
	mendations in online services;	servable decision-making	usually restricted.
	study of the "privacy paradox".	on practice.	4. Perceptions are often
	Methods:	Advantages:	studied in isolation from
	linear regression; structural equation	1. Mature methodology.	how they are being trans-
	modelling (SEM);	2. Findings are coherent	lated to behaviours.
	confirmatory factor analysis (CFA);	between multiple studies.	5. "Stimuli -Thought
	exploratory factor analysis (EFA);	3. Empirically enabled	effort -Action" assump-
	systematic review and deduction;	research approach.	tion, that is challenged by
	empirical studies; induction.	4. Results easily tested and	certain advancements in
	Determinants (factors):	verified in practice.	psychology and behav-
	perceived risks, benefits, trust, and	5. Uncovers relations	ioural economics.
	control; personal interest; privacy	between factors.	6. Inter-temporal nature of
	concerns; satisfaction; antecedents		privacy trade-offs is over-
	(experience; culture; context; person-		looked.
	ality, etc.); information sensitivity.
	Psychology,

Social Science and Information Science beyond Privacy Calculus Problems addressed

		Approaches
	Problems and measures	Motivations	Limitations
	strictions.	rational privacy decision-	2. Prone to quantification
	Methods:	making formulation.	problem and reliability
	SEM; game simulations; Markov	Advantages:	problem, when behaviour-
	process simulations; dynamic pro-	1. Outstanding theoretical	istic or cognitive exten-
	gramming; ANOVA; cluster analysis.	rigour.	sions attempted.
	Determinants (factors):	2. Applicable for building	3. Real-world applicability
	valences; outcomes; risks; time;	macromodels.	may pose a challenge.
	population.
	Machine Learning
	Problems addressed:	Achievements:	1. Models are not descrip-
	predicting users' behaviour;	privacy attitudes predic-	tive.
	identifying influencing determinants.	tions;	2. Models are not extend-
	Methods:	decisions on personal	able factor-wise.
	decision trees; clustering; classifica-	information sharing pre-	3. Is not suitable for mod-
	tion.	dictions.	elling human intelligence.
	Determinants (factors):	Advantages:	4. Models are sample-
	metadata; location; data holder prop-	1. Depending on data	bound and data-hungry.
	erties; contextual factors, etc. Any	properties, models can	5. High level of abstrac-
	quantifiable features.	always be constructed to	tion from nature: factors
		have better-than-random	lack explainability.
		level of predictive power.	6. Reasoning behind
		2. Predictions may be	decisions cannot be in-
		modelled for decisions	ferred.
		with almost arbitrary set of	7. Decision-making pro-
	:	Achievements: determinants.	1.Sample bias in surveys cess is not modelled.
	users' personal information disclo-	testing and explanation of	and experiments.
	sure decisions in online environ-	effects of personality,	2. External validity of the
	ments: mobile applications, social	cognitive load, environ-	experiments can be chal-
	networks, e-commerce, online ser-	ment, ethics and culture on	lenged.
	vices preferences;	intentions to disclose	3. Compromise between
	study of the "privacy paradox".	personal information.	quantification capability of
	Methods:	Advantages:	factors and practical
	multiple regression; principal com-	1. Empirically enabled	applicability of models.
	ponents analysis; EFA; CFA; SEM;	research approach.	4. Models do not usually
	empirical studies.	2. Results easily tested and	possess predictive capabil-
	Determinants (factors):	verified in practice.	ity.
	personality traits; affect; familiarity;	3. Uncovers relations	5. Models are not particu-
	social identity; cognitive load; moti-	between factors.	lar: do not account for
	vation; etc., sometimes in conjunc-	4. Explains roles of social,	individual differences.
	tion with privacy calculus	cultural and psychological	6. Models explain inten-
		effects in privacy deci-	tions rather than behav-
		sion-making.	iours.
	Mathematical Economics
	Problems addressed:	Achievements:	1. Models do not account
	(sub)optimal decision strategies;	mathematical formulations	for factors that cannot be
	privacy-utility trade-offs;	of privacy-constrained	expressed in terms of
	privacy-utility-profit trade-offs;	decision-making;	costs, benefits, risks,
	decisions' payoffs;	utility calculation formula-	expected utility, probabil-
	decision-making under budget re-	tions;	ity of success, agent profit.

Table 4 .

 4 Comparison of modelling capabilities of the identified approaches and the ACT-R functionalities.8

	Feature	Privacy	Beyond	Mathemati-	Machine	ACT-R
		calculus	privacy	cal Econom-	learning
			calculus	ics
	Behaviour predictive capability	Provided	Possible	Not provid-ed	Provided	Possible
	Behaviour descriptive capability	Possible	Provided	Provided	Not provid-ed	Limited
	Behaviour models based on human intelligence	Limited	Provided	Not provid-ed	Not provid-ed	Provided
	Extendibility, scala-bility	Limited	Limited	Possible	Not provid-ed	Possible
	Individual decisions	Not provid-ed	Possible	Not provid-ed	Possible	Provided
	Indication properties	Not provid-ed	Possible	NA	Limited	Provided
	Learning behaviour	NA	NA	NA	Provided	Provided
	Personal traits	Possible	Provided	Limited	Possible	Provided
	Cognitive effects	Limited	Possible	Limited	Possible	Provided
	Environmental effects	Limited	Possible	Limited	Possible	Provided
	Temporal outcomes	NA	NA	Provided	NA	Possible
	Causal (exploratory) models	Provided	Provided	Not Provid-ed	Provided	Limited
	Executive functions	NA	NA	NA	NA	Provided
	Practical application	Possible	Possible	Limited	Provided	Provided

Five Factor Model (FFM, also "Big Five Personality Traits") is a tool used to describe aspects of individual personality through five dimensions (or traits): Extraversion, Agreeableness, Conscientiousness, Neuroticism, and Openness to Experience. Modern version of FFM, mentioned by Egelman and Peer[START_REF] Egelman | Predicting privacy and security attitudes[END_REF] and used by some other studies discussed in the current paper, refers to a work by Digman[START_REF] Digman | Personality structure: Emergence of the five-factor model[END_REF]

].[START_REF] Bal | User Control Mechanisms for Privacy Protection Should Go Hand in Hand with Privacy-Consequence Information: The Case of Smartphone Apps[END_REF] Here the authors are referring to Rest's Four Component Model(Rest [44]). Determinants of ethical behaviour in that model include: ethical sensitivity, moral judgment, moral motivation and moral character.

E.g., cognitive load, highlighted in Veltri and Ivchenko[START_REF] Veltri | The impact of different forms of cognitive scarcity on online privacy disclosure[END_REF], or selective attention mechanisms, shown to be instrumental in reducing distraction effects (Lavie, Hirst, De Fockert and Viding[START_REF] Lavie | Load theory of selective attention and cognitive control[END_REF]).

[START_REF] Barberis | Thirty years of prospect theory in economics[END_REF] See in more detail, for example, in Lieto, Chella and Frixione[START_REF] Lieto | Conceptual Spaces for Cognitive Architectures: A lingua franca for different levels of representation[END_REF].

The importance of these factors is shown in numerous empirical studiesfor example, see above H. Li et al.[START_REF] Li | The role of affect and cognition on online consumers' decision to disclose personal information to unfamiliar online vendors[END_REF]; or Veltri and Ivchenko[START_REF] Veltri | The impact of different forms of cognitive scarcity on online privacy disclosure[END_REF], who show that cognitive scarcity has a negative effect on the disclosure of personal information, raising the volume of disclosed information.

Evaluations: not applicable (NA, feature is irrelevant in a given approach); not provided (feature is not enabled); limited (feature is enabled for each particular study; single use); possible (feature can be enabled with additional effort or study; should be specifically addressed); provided (feature is usually enabled "by design").