There are a number of reasons why feature adoption rates are so low. They may not be widely useful. They may not be easy to find. But they may also not be trusted, and that is the issue we will explore in this report.<\/p>\n
The trust gap in consumer data behaviour<\/h3>\n
In 2018, consumer organisation Which? published its policy paper \u2018Ctrl, Alt or Delete? The Future of Consumer Data\u2019<\/em>, a survey with more than 2,000 UK participants, created to allow adults to understand their attitudes to the way in which their data is used. The survey highlighted that people generally fall into four categories.<\/p>\n Which? found that:<\/p>\n \u201c19% of the population are taking considerably more action than others to restrict what data can be observed about them and \u2018dirtying\u2019 their data by putting incorrect information in forms and using separate email addresses for organisations they do not want to receive communications from.\u201d<\/p>\n \u201c24% of the population are characterised by how much more they take advantage of the shortcuts afforded to them online than others (for example saving their bank details in forms and logging into other services using their social media.\u201d<\/p>\n Perhaps surprisingly, Which? noted that \u201cthere is a relative lack of a relationship between attitudes and behaviour.\u201d In other words \u2013 those choosing to lock down their data are not necessarily those who are considered \u2018anxious\u2019 and those who use shortcuts are not necessarily \u2018liberal\u2019.<\/p>\n Innovators who want to improve feature adoption and consumer data behaviour should take this very seriously. User-centred privacy is an approach that organisations can apply to understand how different groups of users feel about features, address any concerns they may have, and recognise the potential impact of user behaviour such as providing dirty data.<\/p>\n User-centred privacy is an approach to design that recognises that different individuals will be affected in different ways by the same processing activity. It is an approach that is at the heart of data protection laws such as the General Data Protection Regulation (GDPR).<\/p>\n The GDPR requires organisations to behave in certain ways when designing and improving processing activities. It requires them to carry out data protection impact assessments (DPIAs) to analyse the risks to individuals and design controls to mitigate those risks. It gives individuals the right to explain the impact of a processing activity to them, and to prevent the processing taking place or having their data removed from a dataset. It requires organisations to provide user-friendly information to help users understand how and why the organisations want to process their data so that they can make informed choices.<\/p>\n However, at present few organisations have a mature approach to this. Issues we see include treating DPIAs as a form to fill in just before launch, and after all the design decisions have already been taken. Data Protection Officers (DPOs) rarely have direct access to product and service users, with any focus groups and research typically managed by marketing or customer service teams. Privacy information is provided as a \u2018one size fits all\u2019 notice that is rarely drafted in the brand\u2019s tone of voice and even more rarely takes into consideration the questions users might have about how their personal data is processed.<\/p>\n By contrast, applying a user-centred privacy approach means improving the project team\u2019s understanding of the user\u2019s hopes and fears in respect of the processing, ensuring that they are addressed throughout the build, to communicate with them in a way that is clear and builds trust. Doing this is not simply a more effective approach to compliance \u2013 it is also likely to improve feature adoption rates.<\/p>\n Applying a user-centred privacy approach requires project teams to consider four pillars.<\/p>\n The goal for the user-centred privacy approach is to ensure that users and organisations understand the risks arising from the processing, the choices users want to make, and the controls that need to be available to help them to do that.<\/p>\n There are two pillars to this approach: information flows and operational delivery.<\/p>\n There are two core information flows required for user-centred privacy. First, user insights need to be received by the organisation. Project teams should consider how they can capture user insights. These may be surprising. At a recent Gemserv<\/a> webinar discussing user-centred privacy in practice, Philippa Harvey of the Cabinet Office described how she sought user insights from participants at the recent COP26 climate change<\/a> conference, to ensure individuals felt safe to participate in person.<\/p>\n Harvey ran a series of Q&A sessions, and uncovered a range of concerns – such as fears that Covid tests amounted to providing DNA samples to the government – that were not anticipated by the project team. She was clear that had she not taken such a structured approach to capturing user insights, participation rates would likely have been lower and therefore the impact of the conference could have been reduced.<\/p>\n The other core information flow follows naturally from the user insights. Having identified the hopes and concerns of individuals, organisations then need to address them in a transparent manner, so that users can see how their hopes and fears are taken into consideration. This may require more than simply updating the privacy notice, and we would recommend considering how the \u20187 Ps of Marketing\u20192<\/sup> might contribute to a consistent and transparent message. These are:<\/p>\n At the same webinar, Beverley Adams-Reynolds, the Data Protection Officer for homelessness charity Crisis, described how they built in privacy while trialling the use of targeted online advertising as part of their Christmas fundraising campaign. Crisis considered the different ways their service users might be affected by the use of tracking cookies in comparison with their donors. They decided to ensure that cookies were only dropped from appropriate pages that were unlikely to result in detriment to visitors and tracked metrics to test whether the intrusion was justified by the outcomes, in order to improve consumer data behaviour.<\/p>\n The goal for operational delivery is to ensure that the design of the service or feature incorporates data protection by design and default, as required under the GDPR. There are two aspects to this. First, the foundational design needs to address the user insights gathered through the project development phase. Then, organisations need to review user complaints and requests to identify any further user insights and make adjustments where appropriate. In order to do this, organisations must have appropriate processes in place to identify, capture and escalate complaints and requests relating to data privacy.<\/p>\n We recommend that organisations consider:<\/p>\n Organisations that understand how to make data privacy an innovation enabler have a competitive advantage at present. There are clear actions that organisations need to take in order to do this, and if truly incorporated into programme management methodologies, there is likely to be very low or no incremental cost associated with it. If your organisation is looking at how it can improve feature adoption, we recommend including this approach within your strategy. To find out more about how Gemserv can support you with this then please get in touch.<\/p>\n Camilla is an experienced leader of data privacy consultancy teams. Key achievements include winning Best Privacy by Design at the DMA Awards, and Best Privacy and Data Ethics Initiative at the DataIQ awards, both for work with WarnerMedia and DQM GRC.<\/p>\n She is a regular media commentator noted for her commercial, pragmatic, and strategic view of data privacy issues. Prior to moving into data privacy, she was a senior marketer and part of the leadership teams that launched three new financial services brands to market in response to regulatory change. Camilla has almost a decade of experience of commercialising regulatory change, including as part of the leadership team, developing and launching three new financial services businesses. She specialises in data protection, privacy by design, compliance and regulation as well as marketing, financial services and professional services compliance.<\/p>\n","protected":false},"excerpt":{"rendered":" Camilla Winlo, Head of Data Privacy at Gemserv, discusses consumer data behaviour, and why putting people at the heart of innovation is the key to success in digital feature adoption rates. Regarding consumer data behaviour, a frequently asked question is – why do people not use the features innovators create? A 2019 Pendo report1\u00a0found that […]<\/p>\n","protected":false},"author":9,"featured_media":18561,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[596],"tags":[24128,530,885],"acf":[],"yoast_head":"\n![\"\"](\"https:\/\/www.innovationnewsnetwork.com\/wp-content\/uploads\/2022\/02\/FIG-1-Re-draw-scaled.jpg\")
<\/a>What is user-centred privacy?<\/h3>\n
User-centred privacy in practice<\/h3>\n
<\/a>Information flows<\/h3>\n
\n
Operational delivery<\/h3>\n
\n
User-centred privacy could be your source of competitive advantage<\/h3>\n
References<\/h4>\n
\n
<\/a>About the Author:<\/h4>\n