"A Reasonable Thing to Ask For": Towards a Unified Voice in Privacy Collective Action

Title of the Paper

“A Reasonable Thing to Ask For”: Towards a Unified Voice in Privacy Collective Action

Paper Information

• Subject Area: User Privacy and Collective Action
• Keywords: User Privacy, Collective Action, Data Privacy, Security and Privacy, Human-Computer Interaction, Data Breach, Privacy Design, User Agency, Algorithmic Transparency, Online Privacy

Research Background and Problem

• What issues or challenges did the authors identify?
  Users often feel anger and helplessness when faced with Privacy Violating Events by Institutions (PVEIs), such as data breaches or surveillance activities. However, they generally lack concrete means to influence these institutions to change. In current privacy collective actions, users have failed to effectively generate representative demands, leading to the failure of collective efforts.

• Why is this issue important?
  The power gap between data-collecting institutions and ordinary users continues to widen. Privacy violations not only harm individual privacy but also pose a threat to societal trust. Improving how ordinary users can exert pressure on institutional privacy practices is a critical pathway to addressing privacy issues.

• Research Motivation and Related Work
  Although studies have suggested that collective action is an effective way to bridge the power gap, similar collective actions in the privacy domain often fail to generate specific representative demands. For instance, demands and petitions generated after data breaches often fail to trigger actual actions. The authors referenced the Computer-Supported Collective Action (CSCA) framework and found that privacy collective actions often skip the "demand generation and filtering" stage.

Proposed Solution

• What methods or solutions did the authors propose?
  Based on concept-driven design, the authors developed a "sensitization prototype" using a three-stage questionnaire process (Find-Fix-Verify, FFV) to explore how collectives can derive representative privacy demands from individual privacy incidents.

• What is innovative about this solution?
  The FFV method directs the collective's attention to specific subtasks and helps them clarify privacy issues, propose solutions, and verify their feasibility through a clear, structured process. The goal is to encourage collectives to generate actionable demands in an orderly manner, rather than simply signing petitions.

• What are the implementation steps and key technologies used?

  1. Find Phase: Participants read a Privacy Violating Event by an Institution (PVEI) and extract points of concern.
  2. Fix Phase: Participants propose solutions for selected points of concern and designate responsible entities (e.g., institutions, governments).
  3. Verify Phase: Participants evaluate and rank these solutions based on criteria such as specificity, effectiveness, and feasibility.

  The authors conducted large-scale data collection using an online survey platform (Qualtrics) and a task distribution platform (Prolific).

Research Outcomes

• What specific results were achieved?

  • Collective Demands Generated: Participants exhibited clear emotional resonance with privacy violations and were able to quickly consolidate key demands from numerous points of concern. For example, in response to the Equifax data breach, they generated demands for reforming data security regulations.
  • Expert Review: Security and privacy experts reviewed these demands and found that participants expressed a desire for systemic change. However, experts were more inclined toward incremental improvements based on existing legal frameworks (reformist reform).

• What are the advantages compared to existing solutions?
  The FFV sensitization design addresses the issue of generating representative demands in privacy collective actions, enabling collectives to produce more structured and actionable demands. Additionally, combining expert reviews revealed a gap between non-expert collective demands and expert preferences.

• What were the experimental or evaluation results?

  • The demands generated by the collective demonstrated a broad concern for privacy issues, but due to limited knowledge, there were challenges in demand specification.
  • Expert evaluations highlighted clear directions for refinement, though experts showed low acceptance of systemic change.

• Limitations and Future Directions
  Limitations:

  • The expert group was small (only 8 participants), which may not fully represent all perspectives in the S&P field.
  • Conducting experiments on online platforms may not fully reflect real-world spontaneous collective actions.
  • Only three PVEI scenarios were used, limiting the scope of coverage.

  Future Directions:

  • Develop a continuous dialogue process between collectives and experts, rather than a one-time interaction.
  • Explore how to integrate the FFV method into larger-scale, more complex privacy collective action platforms to support the complete chain from demand generation to actual action.
  • Conduct broader research on privacy demands and regulatory environments across different countries or cultural contexts to build a global perspective platform.

Conclusion

This study preliminarily explored how to guide privacy collective actions through a structured process using concept-driven design. It developed the FFV method to facilitate the generation and filtering of demands. By combining expert reviews, the study revealed discrepancies between user and expert demands while exploring new pathways for tool development and system design. This provides an important design benchmark for the future development of privacy collective action platforms.