Beyond the Legal Lens: A Sociotechnical Taxonomy of Lived Privacy Incidents and Harms

TL;DR

This paper develops a sociotechnical taxonomy of digital privacy incidents and harms, revealing a broader spectrum of harms beyond legal definitions, emphasizing psychological impacts like fear and safety loss.

Contribution

It introduces a comprehensive framework capturing lived privacy harms beyond legal scope, based on analysis of 369 real-world incidents.

Findings

Most privacy harms are non-tangible, involving fear and psychological safety loss.

Existing legal frameworks do not fully encompass the range of privacy harms.

A new sociotechnical taxonomy of privacy incidents and harms is proposed.

Abstract

To understand how privacy incidents lead to harms, HCI researchers have historically leveraged legal frameworks. However, these frameworks expect acute, tangible harms and thus may not cover the full range of human experience relevant to modern-day digital privacy. To address this gap, our research builds upon these existing frameworks to develop a more comprehensive representation of people's lived experiences with privacy harms. We analyzed 369 privacy incidents reported by individuals from the general public. We found a broader range of privacy incidents and harms than accounted for in existing legal frameworks. The majority of reported privacy harms were not based on tangible harm, but on fear and loss of psychological safety. We also characterize the actors, motives, and information associated with various incidents. This work contributes a new framework for understanding digital privacy harms that can be utilized both in research and practice.