I. Introduction

1. The Problem

Internet users are being routinely asked to grant their consent to the collection and use of personal information in connection with gaining access to goods and services. Very often, ‘data subjects’ in terms of data protection law are at the same time ‘consumers’ in terms of consumer protection law. In many cases, obtaining consent is necessary for legitimising the use of personal data.1 In order to be valid, the consent must be ‘informed’.2 Many studies have shown, however, that users often do not read privacy policies they grant their consent to. Due to a host of structural conditions and cognitive deficiencies,3 the consent granted by checking a box that merely provides a link to the full text of the privacy policy might not qualify as informed. One of the key reasons for the lack of informed consent is that users fail to properly evaluate or even recognise the risks (or the potential negative consequences)4 involved in the processing of their data.

2. Motivation and Structure of the Article

This article is part of a five-phased privacy icons project in which we inquire whether visualisation of data processing aspects, specifically via risk-based icons, can contribute to a more informed consent. As part of the first phase of the project, this article outlines the risk-based approach we intend to apply in developing such icons, and it lays down the psychological and legal groundwork necessary for our future work.

In detail, this article starts by highlighting the importance of self-determination and its interrelation with consent as well as data protection law in general (Section II). After explaining the structural and psychological deficiencies of consent that hinder the enforcement of self-determination (Section III), we continue by highlighting visualisation as a possible solution for those deficiencies (Section IV). Based on these findings, we explain our methodology and present the first results of our risk-based approach consisting of a comprehensive analysis of the concept of risk in the General Data Protection Regulation (GDPR) (Section V). Finally, we give an outlook on some of the most important design guidelines and enforcement strategies for privacy icons (Section VI).

II. Autonomy, Self-Determination and Consent

Consent in data protection law as a manifestation of self-determination builds on the notion of autonomy. While thinking about consent as an instrument that promotes self-determination and about its connection to personal autonomy, it should be helpful to briefly explain what these concepts generally mean and how they interrelate.

1. A Brief Introduction to the Notion of Autonomy

The notion of personal autonomy captures centre stage in the fabric of liberal-democratic societies. Political, societal and economic structures in liberal democracies are premised on the ideal and actual freedom of persons to make individual choices in various fields of their lives and with regard to a broad range of matters. The notion of autonomy traces back even to a more fundamental aspect of human existence, as human beings are commonly considered autonomous creatures: Their autonomy consists in the ability to choose whether to think in a certain way, their freedom from obligations in some spheres of life and their moral individuality.5 The literature emphasises that the notion of autonomy and the way in which it is applied is context-related. Essentially an abstract concept, the notion of autonomy may function as a moral, political and social ideal, to which multiple philosophical traditions attached their respective conceptions.

Personal autonomy, generally speaking, is a situation, in which the agent has an authority over herself simply since the agent can initiate her actions.6 In this sense, the authority we have over ourselves and over our actions is intrinsic to our person, that is, to our ‘self’. Having authority to initiate our actions, however, does not mean that when we act, we always exercise that authority. Powers that move us to act, which can be considered ‘external’ to the self, such as desires, urges or compulsions, can be at odds with our authority to act as agents, and in this sense, those powers can be considered as external to ourselves.7 This observation leads to the distinction between actions that are self-governed and actions that are subject to autonomy-undermining influences on the decision, intention or even will of the agent, for example, in situations of brainwashing, dependency or addiction.

Within the more specific framework of moral and political philosophy, the discussion on autonomy begins with the moral capacity of a person to be herself, her own, authentic person, and to live her life according to her own reasons and motives. This capacity, which entails under most autonomy conceptions also a moral responsibility, contrasts with a situation of the agent being guided by manipulative or distorting external forces. Viewed through this prism, autonomy underpins some moral and political rights and freedoms emanating from the capacity to self-reflect and endorse one’s own values via choices and actions. Autonomy, hence, correlates to some degree with notions of authenticity, independence and freedom.8

Ben Colburn suggested to classify autonomy conceptions as falling under one of three families: reason-based theories, motivation-based approaches and autonomy conceptions building on Joseph Raz’s scholarship that place individuality at their centre of gravity and are constructed around the ideal of self-creation.9 As one common thread running through all these theoretical approaches to autonomy, Colburn identified at their core something that can generally be referred to as self-governance or control of one’s commitments.10 The idea of autonomy as self-rule, indicated already by its Latin etymology, ‘autos’=self, and ‘nomos’=rule, accommodates alongside independence also the components of deliberation and choice of an agent having the intrinsic capacity to rule herself.11

Deliberation and choice are key for understanding the connection between these theoretical principles and consent in data protection law. Conceptually, notions of individual autonomy and a personal interest in informational self-determination are intimately related, and it is hard to speak of a meaningful actualisation of autonomy if the agent has little or no idea about the implications of the decision to grant consent for herself and her environment.

2. Data Protection Law

The ideal of individual autonomy is manifested in various branches of the law. In the area of relationships between private parties, the request for consent is usually connected to some sort of a bargain. Setting aside for the moment the public policy question about the adequacy and validity of personal data as subject matter of a binding contract,12 there is a common basic element present in both, namely, the power of the individual to alter legal positions via a declaration of intention to be bound by the agreement. This power emanates from the recognition of the legal system in the authority of the individual as an autonomous agent while exercising this power.

Moving now to examine positive privacy/data protection law,13 a cursory glance at the GDPR reveals numerous provisions that manifest the rights and entitlements of natural persons to determine the use of personal data. Alongside the power to extend their consent with respect to certain usage of their personal data by others,14 data subjects have entitlements to withdraw consent at any time15 or control in various ways data usage once in the hands of third parties.16

The great importance attributed to individual decisions can be linked to the underlying theory that conceptualises privacy law as protecting the right of individuals to exercise control over the communication of personal information concerning them by determining when, how and to what extent such information can be communicated to others.17 Control-based conceptions of privacy law as well as related data protection doctrines developed in Germany, which uphold the right to informational self-determination,18 exemplify an approach of general prohibition unless a legal ground for data processing is established.19 This approach also significantly underlies current EU data protection law.20

One of the most cited sources in this context is the seminal decision of the German Federal Constitutional Court on the 1983 census (Volkszählungsurteil), where the fundamental right to informational self-determination has been explicitly recognised and formulated. Specifically, the constitutional right guarantees the power of individuals, in principle and to some degree, to determine how personal data is to be used.21 Such self-determination is significantly achieved via the instrument of consent.

Nevertheless, consent currently struggles to fulfil this role. On the one hand, consent competes with other statutory alternatives that provide valid justifications to processing personal data.22 On the other hand, also within the instrument consent itself, there are various deficiencies hindering it from fostering self-determination as intended.

III. The Troubles with Consent

After briefly discussing below some of those deficiencies, we will take a closer look at the underlying psychological factors.

1. Structural Deficiencies of Privacy Policies

Every privacy decision takes place within a given context and under conditions of uncertainty that ultimately influence behaviour. In the case of online consent, the user typically faces a window, frame or some other element on an electronic screen asking the user to check an ‘I agree’ box. The screen refers (typically by providing a hyperlink) to the full text of the privacy policy, but the substantive information provided by the privacy policy, and importantly, data processing aspects and their inherent risks, often go unnoticed by humans.23

Structural and cognitive deficiencies that influence online consent decisions have been extensively discussed and documented in literature. Textual complexity24 and length25 of privacy policies, language26 and design manipulation27, information asymmetries28 and incomplete information,29 all intensifying users’ susceptibility towards heuristics and cognitive biases,30 are some of the most frequently cited deficiencies. One result of these decisional factors is that while the advantages of consenting to data processing (=benefits) are mostly clear and explicit within the decision framework and context, possible negative consequences (=costs) remain obscure.

The choice architecture of many websites and applications present additional challenges. Companies sometimes design choice architectures that require multiple clicks and redirections to subpages, rendering the task of finding relevant privacy information more tedious.31 The lack of structural standards of privacy policies, the use of multiple information hierarchies in building sites and the lack of knowledge about available options and tools and their functionality to protect online privacy have also been identified as problematic aspects of online consent.32

2. Psychological Factors Influencing Privacy Related Decisions

A closer look at psychological processes underlying privacy-related behaviours may shed more light on the issues sketched above and explain the intentional use of certain design aspects in order to drive users into less deliberate, even misguided decisions. Research indicates that the majority of users are most likely not able to manage their online privacy in an adequate manner due to a variety of factors. One may view trade-offs such as disclosing personal information in exchange for the benefits of high-quality personalisation,33 or ignoring complex and time-consuming security advices due to a low likelihood of severe consequences to occur,34 as components of rational decisions. However, users who perform privacy-related decisions operate under conditions of privacy uncertainty,35 for instance, due to incomplete and asymmetric information.36 This means that privacy decisions’ consequences and the probability of their occurrence are mostly unknown to users, which argues against the mere rational weighting of costs and benefits involved in the so-called privacy calculus.37

The rationality assumption of the privacy calculus has its limits and is just one explanation for the observed incongruence between privacy attitudes and behaviour – a phenomenon known as information privacy paradox.38 Study results from research fields such as psychology and information systems indicate that privacy-related decisions heavily depend on the given context and are impacted by humans’ innate bounded rationality39 and incomplete or asymmetric information. Further influencing factors are, inter alia, affective states,40 motivational aspects,41 personality traits,42 pre-existing awareness and knowledge, social norms,43 and cultural44 and generational45 influences. This complexity of factors often leads to users leaning on heuristics. A heuristic is defined as ‘a strategy that ignores part of the information, with the goal of making decisions more quickly, frugally, and/or accurately than more complex methods’.46 Heuristics mostly result in efficient and acceptable judgments. At the same time, they might lead to systematic misjudgements, so-called cognitive biases.47 In the context of privacy policies, the framing effect is just one example of cognitive biases: privacy decisions are affected by the way in which various choices are framed, for example, through wording, settings or situations. Often, options that are less sensitive to privacy considerations are framed solely in a positive manner, while intentionally leaving out possible adverse implications for users. Sometimes, such framing may present consequences that intend to intimidate the user, for instance, with the threat of losing their account.48

IV. Visualisation Through Privacy Icons as a Solution Approach

In literature, there is a broad discussion on how regulation should deal with those deficiencies. This section provides a short overview on solution approaches that have been proposed, and then, it elaborates on the advantages of visualisation through privacy icons as a solution approach that preserves the role of individual consent.

1. Solution Approaches Alternative to Visualisation

In light of the manifold deficiencies as described above, some scholars are sceptical about viability of consent in general,49 and others considered giving up on consent altogether,50 or, based on the argument of consent overuse,51 suggested limiting52 its scope or making it subsidiary vis-à-vis other grounds of processing.53 Accordingly, instead of performing a balancing of interests on an individual level, the legality of data processing would be determined by third parties, either ex post through the judicial system or ex ante through competent authorities.54 However, such a substitution of consent with decisions of higher authorities would not sufficiently observe the underlying principle of autonomy as described above.55

Alternatively, other proposals aim to improve the process of granting consent by mostly focusing on making users better informed. One early example for a technical approach is the Platform for Privacy Preferences Project (P3P).56 By using a machine-readable syntax for privacy policies, it enabled the user’s browser to interpret the privacy statements, and could, for example, warn of unwanted elements in accordance with the user’s preferences.57 While the P3P could not reach a critical mass in terms of broad usage, there are similar recent projects that try to utilise the newest research results in the fields of machine-learning58 and artificial intelligence in order to assist consent decisions.

Especially so-called Personal Information Management Systems (PIMS)59 should be mentioned. One of the key elements of PIMS is an algorithm that learns about the user’s privacy behaviour and preferences, and then helps him or her in implementing those preferences through a (partly) autonomous choice architecture. Those opportunities facilitated by machine-readable privacy policies have not gone unnoticed by the European legislature; unfortunately, machine-readability is only briefly mentioned within the GDPR.60 Efforts in this field are ongoing and the direction of research is promising, but it is too early to assess the future impact of such technical solutions as of yet. In the remainder of this Section IV, we elaborate on visualisation via privacy icons as a promising solution approach.

2. Definition of Privacy Icons

Our study focuses rather on a measure that could be implemented more quickly: Privacy icons. With the term ‘privacy icons’ we refer to a set of standardised,61 easily (even intuitively) comprehensible and self-implementable62 pictograms that display aspects of specific data processing practices (evaluated on the basis of their risks).63 Thus, users may gain a better understanding of possible privacy consequences, which would reduce uncertainty and facilitate better informed decisions. By investigating questions of design and content of such privacy icons in the past several years, various projects have established the foundation for further research in the field.64

3. Chances and Challenges of Privacy Icons

Privacy icons have a significant potential to counteract many of the previously mentioned factors that hamper the decision process.

Pictures, as opposed to texts, have an advantage in terms of faster recognition as well as less effortful memory recall, an effect known as ‘picture superiority’65. The effect of pictorial representations on privacy-protective behaviours has been observed in some studies. Raja et al showed that users were able to better comprehend warning information and had a better risk perception when they were confronted with firewall warnings that depicted metaphors, such as a locked door and a bandit, compared to the usual text warnings.66

Generally, it should be kept in mind that data protection is usually not a priority for users, as they are mostly focused on achieving their primary goal, for instance, acquiring a commodity or obtaining access to an online service. In order to draw their attention away from their primary goal towards data processing aspects, highly salient, external stimuli are needed.67 This could be achieved through risk-based icons.

Icons have additional advantages: they can communicate meanings independently of textual literacy and linguistic barriers in a standardised manner. It is important, however, to consider cultural differences in terms of the meaning of symbols and colours.68 Further, standardised privacy icons would enable comparability of options across entities, which ultimately could lead to users’ awareness of truly having a choice, especially in e-commerce: In 2011, Tsai et al discovered that when privacy information of websites is made more accessible and noticeable in a way that enables users to easily detect differences in retailers’ privacy management, they prefer retailers that are more privacy-protective, even if this means paying more for a product, compared to cheaper offers from retailers less protective of users' privacy.69 The resulting privacy-sensitive reconsideration of the data processing induced by icons could even be utilised as a competitive advantage.70

Icons, of course, are not a silver bullet. Broad and frequent display carries the danger of users habituating to them. Empirical studies on security warning habituation report a decrease in users’ visual attention due to the repeated exposure to standardised warning messages.71 However, there are some mechanisms that can be taken into consideration while working against habituation effects, such as polymorphic variations of the design, for example, variations in colour, highlights, signal words, contrasts or borders.72

The icons set cannot be exhaustive, however. The presentation of too many icons would most likely lead to an information overload,73 which would affect not only attentional processes but would also be problematic with regard to the limited capacity of the working memory.74

Therefore, a set of icons can neither replace legal transparency obligations under the GDPR, nor can it visualise all risky aspects of data processing. Its mission is rather to reduce uncertainty and cognitive effort by increasing the transparency and tangibility of possible privacy consequences. Furthermore, icons should increase users' attention, motivation and awareness in dealing with typical data processing aspects and their inherent risks prior to consent. Hence, the icons set will merely supplement the privacy policy while functioning as an attention-getting entry point. The challenge is to develop icons that are salient and meaningful and, at the same time, indicate their limitations of being non-exhaustive in order to not mislead users.75

4. The Legal Framework

Such a solution is also encouraged by the GDPR, which, for the first time in EU data protection legislative history, indicates the importance of visualisation in the field of data protection and even included a suggestion for a set of icons in an earlier draft.76 Alongside possibilities such as certificates, seals and marks (Articles 42 and 43 GDPR), it allows for displaying standardised icons in Article 12(7), 12(8) GDPR.77 Icons that are already encouraged to be used voluntarily under Article 12(7) can also be made obligatory:78 According to Article 12(8), the Commission can determine the information to be displayed by icons and the procedures for providing such icons. When executing its power, the Commission can expect support from the European Data Protection Board (EDPB) (Article 70(1)(r)) and should undertake appropriate consultations – especially at expert level79 (Recital 16) – which stresses the relevance of a science-driven process.

Concerning the contents of such obligatory icons, Article 12 GDPR draws no exact guidelines. Article 12(7) indeed refers to Articles 13, 14 and states that the icons may complement the information duties laid out in those articles. However, Article 12 neither determines that icons should represent all the obligatory information mentioned in Articles 13, 14, nor does it provide that the contents are limited to this kind of information. Instead, the reference to Articles 13, 14 only addresses the scope of Article 12(7) and 12(8). The provisions concerning icons should (primarily) apply when Articles 13, 14 require a provision of information – in contrast to information presented based on Article 15, for example.80 However, when it comes to possible contents of the icons, Article 12(7), 12(8) should be interpreted broadly81, as it is the GDPR’s aim to inform the user comprehensively. Correspondingly, Recital 60 states that ‘any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context’ should be delivered to the data subject and may be provided through icons. Consequently, when choosing the contents of the icons, Articles 13, 14 do not limit the Commission’s power under Article 12(8).

As obligatory icons would touch upon the data processor's rights and protected commercial interests, their content, design and implementation would have to be proportionate and compatible with superior legal frameworks. For instance, the processor's freedom to conduct a business according to Article 16 of the Charter of Fundamental Rights of the European Union (CFR)82 would need to be balanced against the data subject's fundamental rights according to Articles 7, 8 CFR. In order not to violate the GDPR itself, the presentation of the icons would also have to unambiguously demonstrate that they only represent some key facts and should in no way obstruct access to the underlying privacy policy.

V. A Risk-Based Approach to Privacy Icons

We have seen that privacy icons can contribute to making consumers better informed before giving consent by alleviating some of the structural deficiencies mentioned above. In order to achieve the best possible results, the concept and the development of the icons must necessarily be based on scientific findings.

1. A Methodology for Icons Development

In the following, we outline our preliminary project plan. The development of the final icons set is divided into five phases.83 The final goal is to create icons that visualise data processing aspects selected on the basis of their inherent risks and also to indirectly communicate those risks to the users.

Due to the complexity of possible negative privacy consequences, users will always encounter difficulties of identifying and estimating risks and will therefore be confronted with privacy uncertainty online. However, privacy uncertainty can be reduced and users decisions can be improved through a risk assessment84 of data processing aspects (to be conducted within the first two phases explained below). We will identify risks, categorise them and develop decision criteria for the evaluation of their impact and severity using a multi-method approach.

Phase 1: The aim in phase one is to gather a broader understanding of the concept of risk which underlies the GDPR (see below V.2) and on that basis generate a comprehensive catalogue of data processing aspects and possible inherent risks. For this purpose, legal experts will conduct a qualitative content analysis85 to systematically examine the GDPR. Thereafter, the tentative list will be enriched by further insights from expert interviews. In this context, we define ‘experts’ as persons who are active in data protection research or practice, such as IT security experts, information scientist, lawyers, et cetera.

Phase 2: In this phase, we will narrow down the selection to the most relevant and important data processing aspects that should be ultimately visualised. To do so, we will ask experts to rank data processing aspects according to their inherent risk based on predefined criteria such as the impact and severity of adverse privacy events, counterbalance aspects such as the use of state-of-the-art technologies, et cetera. Furthermore, we will ask a representative user sample to rank the same data processing aspects as well. This allows us to compare the expert and user sample ranking with each other and reveal any misconceptions about privacy risks in the public. A revelation of significant differences could highlight the importance of digital literacy and the need for change in the educational system, for instance, by introducing privacy and security courses. Moreover, this comparison would provide insights into the needs of users and to determine the presentation order of our final privacy icons set in order to further increase users' attention towards data protection. The last step within this phase will be the determination of different risk levels and their grading criteria of each data processing aspect, for example, which criteria lead to categorising encryption technologies as more safe or less safe.

Phase 3: This phase involves a collaboration with information designers to determine the final icons set in terms of the feasibility of visualising certain data processing aspects and their inherent risk levels.

Phase 4: Here, we will test the icons with regard to their intended purpose. We will evaluate and revise them at various stages of the development process using mixed methods. For example, a possible test could address the icons' comprehensibility, recognisability and information scent. We intend to research whether the icons increase users' motivation to engage with and their awareness of data protection issues. Moreover, it is of interest to find out whether the icons draw users' attention towards data protection in general.

Phase 5: In the final step, we plan to create a manual with instructions for controllers on how to implement the icons set, for instance, in deciding which icons to use when certain data protection processes take place.86

2. The Concept of ‘Risk’ in the GDPR

The main objective of phase one of the project is to generate a comprehensive catalogue of data processing aspects and their inherent risks based on the GDPR. Therefore, we first need to understand the concept of ‘risk’ which underlies the GDPR.

a. Introduction

The central criterion underlying our project is the so-called ‘risk-based approach’. This concept is neither new nor limited to the GDPR. It can already be found within the Data Protection Directive87, for instance, in the context of the provisions on security in Article 17(1), or on prior checks of processing operations in Article 20(1).88 The (former) Article 29 Working Party strongly supports this concept. In its respective statement, it explains that the level of risk involved in a specific data processing operation must be without any prejudice to the data subject's rights, while, however, the scale of the controller's obligations shall increase as the risk in the specific case increases.89

While the risk-based approach has been applied in particular to compliance requirements so far, our understanding is broader. The special Eurobarometer report on data protection from 2015 has shown that EU citizens are concerned about various risks in the context of personal data processing.90 Communicating data processing aspects and their inherent risks in a way that is more accessible and transparent to users could address those concerns and promote informed decision-making. Against this backdrop, we intend to consider the particular level of risk associated with various aspects of personal data processing as a methodological criterion for deciding which aspects of the processing should be visualised by privacy icons, how to design these icons, and how to implement them.

b. Legal Analysis

Our approach raises the basic question of how to understand the notion of ‘risk’ in accordance with the GDPR. While the GDPR does not provide for a legal definition of the term ‘risk’, numerous explicit and implicit references can be found within its provisions, such as in the context of the responsibility and liability of the controller (Article 24(1)), data protection impact assessments (DPIAs) (Article 35(1), (3), (4)), or profiling (Article 35(3)(a)).91

In principle, the GDPR distinguishes between situations where personal data processing is ‘unlikely to result in a risk to the rights and freedoms natural persons’ (Recitals 80, 85, Articles 27(2)(a), 33(1)), where personal data processing is ‘unlikely to result in a high risk’ (Recital 77), or, to the contrary, where the processing of personal data ‘is likely to result in a risk’ (Article 30(5)) or is even ‘likely to result in a high risk to the rights and freedoms of natural persons’ (Recitals 84, 89, Article 34(1)).92 Specifically, Recitals 75, 76 state that the risk ‘may result from personal data processing which could lead to physical, material or non-material damage’ while the risk's ‘likelihood and severity […] should be determined by reference to the nature, scope, context and purposes of the processing […] on the basis of an objective assessment’. The GDPR does not define these key terms, yet the wording ‘rights and freedoms’ and ‘physical, material or non-material damage’ indicates the intention to provide a comprehensive protection to data subjects. It thereby calls for a broad understanding of the notion of ‘risk’.

According to Article 1(2), it is the GDPR’s explicit objective to protect ‘the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data’. In comparison, the notion of ‘rights and freedoms’ in the context of risk is broader and does not only refer to the fundamental rights provided for by the CFR – and its Article 8 on the protection of personal data in particular – or by the European Convention for the Protection of Human Rights and Fundamental Freedoms, but covers also ordinary law such as the GDPR itself.93 Therefore, each personal data processing operation by default entails a certain risk to the right on the protection of personal data and to the rights secured for data subjects under the GDPR. Such risk materialises as a damage where the processing is not in accordance with the GDPR.94 In addition, the wording ‘physical, material and non-material damage’ also is conceivably wide and can – according to the German data protection authorities95 – be understood as any negative consequence of the intended processing itself, or even as any negative consequence of any deviation from the intended processing, for instance, unauthorised disclosure.

The GDPR provides specific examples of risks in several provisions. In particular, Recital 75 lists both risks and situations that are prone to jeopardise the rights and freedoms of natural persons, namely:

Additional examples can be found in Recital 71 on profiling, Recital 85 on notifications of personal data breaches, or Recital 91 and Article 35(3) on situations where a DPIA is necessary.96 It is also noteworthy that the GDPR does not clearly draw a distinction between data protection risks and typical IT security risks. Especially Recital 83 (and similarly Article 32(2)) states, that

Also, provisions such as Articles 8, 9 and 10 GDPR that do not explicitly refer to risks indicate that certain aspects of data processing are prone to particular high risks by imposing special obligations on controllers.97

c. Risk Assessment

Although it seems difficult to measure certain risks mathematically, the GDPR stresses (Recital 76) the importance of an objective risk assessment.98 Pursuant to this and based on the legal text of the GDPR, the Article 29 Working Party developed nine criteria of especially risky data processing. Those are ‘Evaluation or scoring’, ‘Automated-decision making with legal or similar significant effect’, ‘Systematic monitoring’, ‘Sensitive data or data of a highly personal nature’, ‘Data processed on a large scale’, ‘Matching or combining datasets’, ‘Data concerning vulnerable data subjects’, ‘Innovative use or applying new technological or organizational solutions’ and ‘When the processing in itself prevents data subjects from exercising a right or using a service or a contract’.99 It explains ‘that the more criteria are met by the processing, the more likely it is to present a high risk […] regardless of the measures which the controller envisages to adopt’.100

Pursuant to Article 35(4) GDPR, the national data protection authorities have developed so-called ‘black lists’ that provide an overview of personal data processing operations that typically cause high risks, and therefore, always require a DPIA. These non-exhaustive lists specify the stipulations of Article 35(1) GDPR, which, however, prevails in case of a possible conflict.101 In order to ensure consistency throughout the EU, the EDPB has been publishing opinions on the respective lists.102 The German data protection authorities, for instance, describe seventeen different aspects of personal data processing with inherent high risks, including, amongst others, ‘Large-scale processing of personal data about the location of natural persons’ such as ‘Vehicle data processing – Car Sharing / Mobility Services’ or ‘Traffic flow analysis based on location data of the public mobile network’.103 More generally and without limitation to DPIAs, the German data protection authorities also suggest a risk matrix that may help assessing specific risks by examining whether their likelihood and severity are minor, manageable, substantial or major.104

d. Individual v Societal Risks

Another question is whether only individual risks to the respective data subject may be taken into account, or whether societal risks105 can be considered as well. The GDPR does not refer to societal risks explicitly, but it does not limit itself to specifically individual risks in general either.106 It speaks of ‘[t]he risk to the rights and freedoms of natural persons’ (Recital 75) in a relatively general way, and in the context of DPIAs even of ‘the rights and legitimate interests of data subjects and other persons concerned’ (Article 35(7)(d)). Even more important, Recital 72 refers to the individual ‘risks involved for the interests and rights of the data subject and that prevents, inter alia, discriminatory effects on natural persons’ without limiting such discriminatory effects to the data subject in question. Moreover, the GDPR acknowledges in Recital 4 that ‘[t]he processing of personal data should be designed to serve mankind’ and that [t]he right to the protection of personal data […] must be considered in relation to its function in society’. Considering this and the fact that the GDPR aims at a high level of data subject protection, there are valid arguments to also take into account risks that go beyond merely individual ones.107

e. Risk-Based Approach and Privacy Icons in the Light of Article 12(7) GDPR

Finally, it should be examined, whether apllying such a risk-based approach as a methodological criterion for choosing data processing aspects for visualisation is consistent with Article 12(7) GDPR. Article 12(7) states that ‘[t]he information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons’ without explicitly referring to risks or to any additional information. However, there seems to be no conflict between Article 12(7) and the application of a risk-based approach in the context of privacy icons or using icons to communicate data processing aspects that go beyond the content of Articles 13, 14 (Section IV.4).

Firstly, the intended visualisation primarily focuses on aspects of personal data processing as such, for instance, the category of the data being processed (eg, ‘sensitive data’). This does not include visualisation of the underlying risks in the first place (eg, ‘discrimination’ or ‘identity theft’). The level of risk inherent in the data processing works as a criterion for deciding which aspects of the processing should be visualised and how to design and implement the icons.

Secondly, a closer inspection reveals that some of the information mentioned in Articles 13, 14 actually concern aspects of data processing that are identified as especially risky elsewhere in the GDPR. Under certain circumstances, transfers to third countries or international organisations (Articles 13(1)(f), 14(1)(f)), for instance, require the explicit consent of the data subject ‘after having been informed of the possible risks of such transfers […]’ (Article 49(1)(a)). Even more evident, automated decision-making and profiling (Articles 13(2)(f), 14(2)(g)) are clearly associated with particular risks in Recitals 71, 75, 91 and Article 35(3)(a). This interrelation between some of the information obligations pursuant to Articles 13, 14 and other references in the GDPR in the context of risk does not only mean that these aspects can be communicated in combination with privacy icons pursuant to Article 12(7), but may lead to the conclusion that there is a special need to inform the data subjects about aspects of personal data processing that entail particular risks.

Thirdly, the GDPR explicitly stresses the importance of communicating risks to data subjects several times in other places. According to Article 57(1)(b) and complemented by Recital 122, the supervisory authority should, amongst others, ‘promote public awareness and understanding of the risks […] in relation to the processing of personal data’. Even more important, Recital 39 states in respect of the principles of lawful processing that ‘[n]atural persons should be made aware of risks [...] in relation to the processing of personal data’. If privacy icons allow us to communicate risks even better, Article 12(7) should be teleologically interpreted as permitting us to visualise further aspects of data processing based on their respective level of risk in combination with privacy icons.

VI. Design and Enforcement Prospects

The icon development process as described in Section V.1 incorporates fundamental design and enforcement questions. In order to give an outlook on the future phases of the project, this section briefly discusses some of the most important aspects.

1. Design Considerations

Usability research differentiates between three basic types of icons: reference, arbitrary and resemblance icons.108 To increase memorability and recognisability, usability studies have shown the advantages of so-called resemblance icons, which reflect physical objects.109 For instance, e-commerce portals often show the shopping cart icon so that people can easily and without the need of further cognitive resource derive the meaning.

Another consideration is whether the icons should be neutral in colour, content and design, or whether they should transport an evaluation, for instance, by signalling a warning through colour-grading. An icon might, for example, warn against the non-encrypted transmission of data by displaying an open red-coloured lock, while signalling safety by displaying a closed green-coloured lock where the transfer is encrypted. Using colours in this way carries a normative choice of the designer. An obligation to implement such icons might impinge more strongly upon the processor’s rights and even be considered a form of paternalism (through nudging).110

Nevertheless, we believe that active warning signals are necessary and can be applied in a proportionate manner. The information level amongst users about the consequences of data processing is low. A risk-based approach aiming to indirectly communicate possible consequences (whilst visualising data processing aspects) can thereby reduce the information asymmetry, draw users’ attention to such aspects and increase their motivation to deal with important data protection questions. Security and privacy research based on the protection motivation theory111 show that making users aware of the severity of security threats (eg, by presenting possible risks) is one important factor that contributes to increased security protection on the levels of intentions and behaviours.112

In addition, including an (objective) assessment of the visualised data processing aspects would compensate for differing knowledge levels. The knowledge necessary to evaluate the risk-level induced by a data processing aspect can be highly influenced by media coverage. This can lead to systematic biases due to the occurrence of the availability heuristic113. In order to assess the significance of pseudonymisation, for example, users would need to know that there is also the possibility of anonymisation and have a basic understanding of the differences between anonymisation and pseudonymisation. Here, users' decisions could be facilitated by colour-grading. A red-coloured icon for regular data, an orange icon for pseudonymised data and a green icon for anonymised data would hopefully signal to the user that processing of fully anonymised data entails less risk than processing of pseudonymised data.114

Similarly, from a design perspective, coloured icons could improve comprehensibility. Colours would transport additional information and therefore help users to better understand the meaning. Keeping cultural differences and personal limitations in mind, we expect that a green closed lock, for example, will transport the intended meaning (encrypted transmission) more reliably than a black-and-white closed lock, which would have to be situated in relation to its counterpart (an open lock). In conclusion, the design of the icons does not necessarily have to be neutral but should transport additional evaluation information, where reasonable.

Another important design question concerns the number of icons to be displayed in each individual scenario. The number of icons displayed should be rather small in order to avoid any information overload. Therefore, icons that would have to be displayed in all cases are excluded in the selection process. For example, users’ rights (such as the right to data portability) apply in a similar way to every data procession. Informing users of such rights should therefore be performed via channels of public education rather than via icons.

2. Enforcement Outlook

Once a set of icons has been designed, it is critical for the success of privacy icons that there is an enforcement strategy in place – a strategy that many of the projects so far seem to have lacked. Paradigmatically, the Mozilla Privacy Icons Project seems to have hoped that companies would see the icons as a ‘competitive differentiator’ and implement them voluntarily for strategic reasons.115 Such a bottom-up implementation of privacy icons proved overly optimistic, as the usage of icons creates a level of transparency that is not necessarily in line with the data processing strategies of many companies.

Therefore, a more normative approach is required. As an amendment of the GDPR cannot be expected any time soon, the most direct116 regulatory approach would be a delegated act by the Commission in accordance with Article 12(7) and (8) GDPR.117 A finalised set of icons based on scientific findings could hopefully encourage the European Commission to favourably consider and promote this solution.

Alternatively, the EDPB and/or national supervisory authorities may encourage the use of icons by determining that the (non-)usage of a specific icons set could positively or negatively be considered when determining a fine. According to Article 83(2)(k) GDPR, the supervisory authority, ‘[w]hen deciding whether to impose an administrative fine and deciding on the amount of the administrative fine’ shall give due regard to ‘any other aggravating or mitigating factor applicable to the circumstances of the case’. This would allow supervisory authorities to take into account the (non-)usage of icons by the data controller when determining a fine. Such practice, in order to be proportionate and in accordance with higher-ranking law, would have to be determined and predictable ex ante.118 This could be achieved in cooperation with the EDPB, which has the power to ‘draw up guidelines for supervisory authorities concerning (…) the setting of administrative fines pursuant to Article 83’ (Article 70(1)(k) GDPR). Alternatively, supervisory authorities could individually launch lighthouse projects, promoting a specific icons set and its consideration in the fine setting process, hopefully leading to a widespread use of the icons across Europe.

VII. Conclusion

The development of privacy icons for improving privacy decisions is premised on the importance of consent as a key instrument within data protection law that enables the exercise of self-determined choices. If personal autonomy as an underlying normative value is to be taken seriously also within the realm of data protection law, the institution of consent should be preserved and ameliorated. Reports on the ‘death’ of consent (or rather, of its hopeless systemic and operational failure) are greatly exaggerated.119 Critics tend to overstate the deficiencies and overlook possible ways to improve the instrument of consent in data protection law.

Before we entirely surrender decisions about the use of personal data to regulators, administrative authorities and courts, it is advisable to invest more efforts in improving self-determined privacy choices. This article attempts to take one step in this direction by sketching a risk-based approach to the development and implementation of privacy icons as a partial answer to the practical challenges the institution of informed consent must face. The next steps of the project include, inter alia, the development of a comprehensive risk catalogue, conducting empirical research on the effect of visualisation on information asymmetry and on its capacity to elicit a behavioural change, and ultimately, developing an icons set for further testing and discussion.