Putting Privacy into Perspective -- Comparing Technical, Legal, and Users' View of Data Sensitivity

TL;DR

This paper compares how legal, technological, and user perspectives define data sensitivity, revealing discrepancies that impact privacy protection and user autonomy in digital environments.

Contribution

It provides an integrated analysis of legal, technological, and user views on data sensitivity, highlighting differences and their implications for privacy policies.

Findings

Legal and user perceptions of data sensitivity often diverge.

All data are considered potentially sensitive from a technological standpoint.

Discrepancies affect the effectiveness of privacy protections.

Abstract

Web 2.0, social media, cloud computing, and IoT easily connect people around the globe, overcoming time and space barriers, and offering manifold benefits. However, the technological advances and increased user participation generate novel challenges for protecting users' privacy. From the user perspective, data disclosure depends, in part, on the perceived sensitivity of that data, and thus on a risk assessment of data disclosure. But in light of the new technological opportunities to process and combine data, it is questionable whether users are able to adequately evaluate the risks of data disclosures. As mediating authority, data protection laws try to protect user data, granting enhanced protection to 'special categories' of data. In this publication, the legal, technological, and user perspectives on data sensitivity are presented and compared. From a technological perspective, all data can be referred to as 'potentially sensitive.' The legal and user perspective on data sensitivity deviate as some data types are granted special protection by the law but are not perceived as very sensitive by the users, and vice versa. Merging the three perspectives, the implications for informational self-determination are discussed.