Privacy Policies and Users’ Trust: Does Readability Matter?

Over the years, a drastic increase in online information disclosure spurs a wave of concerns from multiple stakeholders. Among others, users resent the “behind the closed doors” processing of their personal data by companies. Privacy policies are supposed to inform users how their personal information is handled by a website. However, several studies have shown that users rarely read privacy policies for various reasons, not least because limitedly readable policy texts are difficult to understand. Based on our online survey with over 440 responses, we examine the objective and subjective readability of privacy policies and investigate their impact on users’ trust in five big Internet services. Our findings show the stronger a user believes in having understood the privacy policy, the higher he or she trusts a web site across all companies we studied. Our results call for making readability of privacy policies more accessible to an average reader

Readability of websites security privacy policies: A survey on text content and readers

The aim of website's Privacy Policies is to educate consumers of a website's practices and procedures relating to their collection, usage, exchange, control, protection and the use of technology in relation to the information collection (website beacon and cookies) and transmission of user's personal information anytime he visits Internet website. This paper discusses a readability issues in privacy policies and how privacy scholars approach the issue. The paper also compares and analyzes research results on readability measurement of privacy policies and divides them into two categories according to different perspective. The perspective includes readability measurement from reader's perspective and readability measurement from privacy policies text content’s perspective. Our finding shows that website providers should give consumers better control regarding their information and give them more freedom in privacy policies. Only then will consumers become liberated from the burden of choosing between 2 unspeakable options. A legally binding document on the privacy policy can be written, that will also be clear and simple to read

Evaluating readability as a factor in information security policies

This thesis was previously held under moratorium from 26/11/19 to 26/11/21Policies should be treated as rules or principles that individuals can readily comprehend and follow as a pre-requisite to any organisational requirement to obey and enact regulations. This dissertation attempts to highlight one of the important factors to consider before issuing any policy that staff members are required to follow. Presently, there is no ready mechanism for estimating the likely efficacy of such policies across an organisation. One factor that has a plausible impact upon the comprehensibility of policies is their readability. Researchers have designed a number of software readability metrics that evaluate how difficult a passage is to comprehend; yet, little is known about the impact of readability on the interpretation of information security policies and whether analysis of readability may prove to be a useful insight. This thesis describes the first study to investigate the feasibility of applying readability metrics as an indicator of policy comprehensibility through a mixed methods approach, with the formulation and implementation of a seven phase sequential exploratory fully mixed methods design. Each one was established in light of the outcomes from the previous phase. The methodological approach of this research study is one of the distinguishing characteristics reported in the thesis, which was as follows: * eight policies were selected (from a combination of academia and industry sector institutes); * specialists were requested their insights on key policy elements; * focus group interviews were conducted; * comprehension tests were developed (Cloze tests); * a pilot study of comprehension tests was organised (preceded by a small-scale test); * a main study of comprehension tests was performed with 600 participants and reduce that for validation to 396; * a comparison was made of comprehension results against readability metrics. The results reveal that the traditional readability metrics are ineffective in predicting human estimation. Nevertheless, readability, as measured using a bespoke readability metric, may yield useful insight upon the likely difficulty that end-users may face in comprehending a written text. Thereby, our study aims to provide an effective approach to enhancing the comprehensibility of information security policies and afford a facility for future research in this area. The research contributes to our understanding of readability in general and offering an optimal technique to measure the readability in particular. We recommend immediate corrective actions to enhance the ease of comprehension for information security policies. In part, this may reduce instances where users avoid fully reading the information security policies, and may also increase the likelihood of user compliance. We suggest that the application of appropriately selected readability assessment may assist policy makers to test their draft policies for ease of comprehension before policy release. Indeed, there may be grounds for a readability compliance test that future information security policies must satisfy.Policies should be treated as rules or principles that individuals can readily comprehend and follow as a pre-requisite to any organisational requirement to obey and enact regulations. This dissertation attempts to highlight one of the important factors to consider before issuing any policy that staff members are required to follow. Presently, there is no ready mechanism for estimating the likely efficacy of such policies across an organisation. One factor that has a plausible impact upon the comprehensibility of policies is their readability. Researchers have designed a number of software readability metrics that evaluate how difficult a passage is to comprehend; yet, little is known about the impact of readability on the interpretation of information security policies and whether analysis of readability may prove to be a useful insight. This thesis describes the first study to investigate the feasibility of applying readability metrics as an indicator of policy comprehensibility through a mixed methods approach, with the formulation and implementation of a seven phase sequential exploratory fully mixed methods design. Each one was established in light of the outcomes from the previous phase. The methodological approach of this research study is one of the distinguishing characteristics reported in the thesis, which was as follows: * eight policies were selected (from a combination of academia and industry sector institutes); * specialists were requested their insights on key policy elements; * focus group interviews were conducted; * comprehension tests were developed (Cloze tests); * a pilot study of comprehension tests was organised (preceded by a small-scale test); * a main study of comprehension tests was performed with 600 participants and reduce that for validation to 396; * a comparison was made of comprehension results against readability metrics. The results reveal that the traditional readability metrics are ineffective in predicting human estimation. Nevertheless, readability, as measured using a bespoke readability metric, may yield useful insight upon the likely difficulty that end-users may face in comprehending a written text. Thereby, our study aims to provide an effective approach to enhancing the comprehensibility of information security policies and afford a facility for future research in this area. The research contributes to our understanding of readability in general and offering an optimal technique to measure the readability in particular. We recommend immediate corrective actions to enhance the ease of comprehension for information security policies. In part, this may reduce instances where users avoid fully reading the information security policies, and may also increase the likelihood of user compliance. We suggest that the application of appropriately selected readability assessment may assist policy makers to test their draft policies for ease of comprehension before policy release. Indeed, there may be grounds for a readability compliance test that future information security policies must satisfy

Priv-C : une politique de confidentialité personnalisable

Les politiques de confidentialité définissent comment les services en ligne collectent, utilisent et partagent les données des utilisateurs. Bien qu’étant le principal moyen pour informer les usagers de l’utilisation de leurs données privées, les politiques de confidentialité sont en général ignorées par ces derniers. Pour cause, les utilisateurs les trouvent trop longues et trop vagues, elles utilisent un vocabulaire souvent difficile et n’ont pas de format standard. Les politiques de confidentialité confrontent également les utilisateurs à un dilemme : celui d’accepter obligatoirement tout le contenu en vue d’utiliser le service ou refuser le contenu sous peine de ne pas y avoir accès. Aucune autre option n’est accordée à l’utilisateur. Les données collectées des utilisateurs permettent aux services en ligne de leur fournir un service, mais aussi de les exploiter à des fins économiques (publicités ciblées, revente, etc). Selon diverses études, permettre aux utilisateurs de bénéficier de cette économie de la vie privée pourrait restaurer leur confiance et faciliter une continuité des échanges sur Internet. Dans ce mémoire, nous proposons un modèle de politique de confidentialité, inspiré du P3P (une recommandation du W3C, World Wide Web Consortium), en élargissant ses fonctionnalités et en réduisant sa complexité. Ce modèle suit un format bien défini permettant aux utilisateurs et aux services en ligne de définir leurs préférences et besoins. Les utilisateurs ont la possibilité de décider de l’usage spécifique et des conditions de partage de chacune de leurs données privées. Une phase de négociation permettra une analyse des besoins du service en ligne et des préférences de l’utilisateur afin d’établir un contrat de confidentialité. La valeur des données personnelles est un aspect important de notre étude. Alors que les compagnies disposent de moyens leur permettant d’évaluer cette valeur, nous appliquons dans ce mémoire, une méthode hiérarchique multicritères. Cette méthode va permettre également à chaque utilisateur de donner une valeur à ses données personnelles en fonction de l’importance qu’il y accorde. Dans ce modèle, nous intégrons également une autorité de régulation en charge de mener les négociations entre utilisateurs et services en ligne, et de générer des recommandations aux usagers en fonction de leur profil et des tendances.Privacy policies define the way online services collect, use and share users’ data. Although they are the main channel through which users are informed about the use of their private data, privacy policies are generally ignored by them. This is due to their long and vague content, their difficult vocabulary and their no standard format. Privacy policies also confront users to a dilemma. Indeed, they must agree to all their content in order to use the service or reject it, and in this case they do not have access to the service. No other alternative is given to the user. Online services process data collected from users to provide them a service, but they also exploit those data for economic purposes (targeted advertising, resale, etc.). According to various studies, allowing users to benefit from the use of their data could restore their trust towards online services and facilitate data exchanges on the Internet. In this work, we propose a new model of privacy policy, inspired by the P3P (a World Wide Web Consortium - W3C Recommendation) but increasing its functionalities and reducing its complexity. This model defines a specific structure allowing users and online services to define their preferences and needs. Users have the opportunity to decide for each of their private data, specifying how it will be used and shared. A negotiation phase will allow a needs analysis of the online service and preferences of the user to establish a confidentiality agreement. The value of personal data is also an important aspect of our study. While companies have resources allowing them to rate this value, we apply in this thesis, a hierarchical multi-criteria method. This method will allow each user to give value to his personal data according to the importance he attaches to it. In this model, we also integrate a regulation authority. It is in charge of conducting negotiations between users and online services, and generate recommendations to users based on their profile and current trends

A multiphase mixed-methods analysis of UK e-commerce privacy policies

Database technology and advanced statistical processes have rendered it possible to process unprecedented volumes of personal data. However, tension exists between the rights of those that are the subject of personal data processing and the interests of commercial organisations and governments. Privacy policies are supposed to describe how and why personal data is processed. The aim of this research was to explore how these statements could be improved in the context of UK e-commerce. A novel, mixed method phased approach was adopted to address the research aim. In phase one a content analysis of UK e-commerce privacy policies was carried out. Findings showed UK e-commerce privacy policies do not consistently follow good practice guidelines. Moreover, results revealed several information gaps that need to be addressed considering the transparency obligations outlined in the General Data Protection Regulation. Phase two explored user attitudes towards UK e-commerce privacy policies. Barriers to readership and heuristics are outlined along with perceived positive and negative characteristics of UK e-commerce privacy policies. Phase three examined user attitudes towards a layered prototype privacy policy revealing preferences for summary and full layered notices. Phase four demonstrated perceived ease of use and perceived efficiency differences in support of the prototype layered privacy policy compared to a typical privacy. In addition, findings highlighted user support for privacy policy standardisation. Findings from phases one to four are synthesised and evidence-based recommendations are made that are aimed at improving UK e-commerce privacy policies in the short and long term