Web users allow online organisations to collect vast amounts of information about them and their activities, often in exchange for free services. But now there is a growing expectation that this users' data, generally called consumer data, should be given back to the users who helped create them so that it can be exploited for their bene t. In addition, there is a realisation that such a release of users' data could only promote greater transparency and accountability of organisations collecting them. As with any process where data is published, there is a risk that it could potentially lead to complex privacy issues. In this paper, we focus on what we believe is a signi cant and yet least explored data type: consumer-activity data, i.e., data (Web access logs) generated by an organisation which tracks the usage and interactions of its online services and resources. We conducted an exploratory qualitative study of 12 users to investigate what might be the consequences of making such consumer-activity data available to the users who generated them, especially its privacy challenges, both from an organisation's point of view and that of individuals whose online activities were being tracked. This was achieved by exposing the study's participants to a `personal analytics' dashboard which provided access to information on their usage and interactions with online systems of a large educational organisation (The Open University in the UK). The ndings from our study showed that though there were potential bene ts for the users, there were several privacy risks which are yet to be addressed.
Organisations, both the ones which model their business around free web based
services (e.g. Google's search engine, Facebook's social networking service, etc.)
as well as more traditional institutions with a signi cant web presence, passively
collect vast amounts of data about their users and exploit them in a variety of
ways, either to indirectly bene t by improving the user experience or directly
bene t through advertising, collective ltering, etc. From users' perspective, this
self-serving exploitation of users' data is perceived to be unequally bene ting
only one party, thus new initiatives have emerged which are pushing towards
greater transparency and openness, beyond the basic data protection practices.
In the UK for example, the government is leading a consumer empowerment
strategy in collaboration with leading businesses and consumer groups to give
individuals more access to, and control over the data, companies hold about
them [
In educational institutions, many systems store data about the actions of
students, teachers and researchers. In this regard, JISC [
Following the trends and background described in the previous sections, the user study presented in this paper started with the assumption that, eventually, mechanisms will be put in place by organisations to give users access to their CA data. We therefore decided to consider our own organisation, the OU, as a testbed. From this, two main questions emerged: 1. If consumer-activity data were made available to users of an organisation such as the OU, what would be its bene ts and uses for individual users? 2. What would be the implication of deploying such a mechanism in terms of privacy risks and policies, both for the users and the organisation? We investigated the above research questions through a qualitative study which involved exposing participants to a `prototype' tool to access and visualise their CA data collected from the OU, and then using a combination of personal interviews, online questionnaires and focus group to collect reactions, opinions and concerns regarding the potential uses and implications such a tool might have if properly deployed. The study itself was therefore divided into four phases - data collection, personal interviews, focus group and analysis. 3.1
The Open University is the largest university in the UK (with approx. 250,000 enrolled students) and is based on distance learning, which means students study at a distance and interact with the university sta (associated lecturers, course team, administrator, IT help-desk, library) mainly through online systems. Thus, the information architecture of the OU consists of a large variety of systems which have web interfaces, produce logs and are centralised within the IT department of the university.
During the data collection phase, participants were recruited through adverts on the intranets, mailing-lists and word-of-mouth. Upon their written consent, the IT team of the OU was noti ed with the participant's identifying details (their computer user-name), to enable them to collect (extract) the CA data from server logs of di erent online systems for a period of 28 days.
Even though OU was collecting user's CA data on various online systems, there was neither any requirement nor any mandate for them to release these data to their users, thus signi cant e orts were required on our part to make all the stakeholders (IT security department, data protection o cer, ethics committee) understand the process of the user study, so that IT could provide us with relevant data in a usable format.
The core of our methodology depended on the UCIAD technology
platform [
During the personal interview, the participants made use of personal
analytics dashboard to view their past activities on various online systems of the
OU. Using these visuals as a trigger, the participants were asked questions on
how they felt with regards to data licensing, privacy and data protection policies
which apply to such information. The personal interview was unstructured and
open ended because we wanted to explore if the participant wanted to use the CA
data in other creative ways not envisaged by us. Two weeks after the interview, a
short online questionnaire (with 3 questions) was sent out to all the participants
of the study who had already given their personal interview, this was mainly
to gauge any change in their behaviour with regards to the use of OU's online
systems. The topic we were investigating had the potential to produce divergent
and con icting views, therefore we included a focus group which was designed
in a way where participants could resolve their views in relation to others. To
make the focus group interesting and challenging, its design was informed by the
initial results we obtained from the personal interview. The participants were
compensated for their time with a $30 Amazon voucher. The qualitative data
from the personal interview was analysed using Grounded Theory [
The user study had 12 participants who had enrolled on a voluntary basis and were regular users of the OU's online systems. Participants broadly fell into four categories of users: post-graduate students (3), academic sta (3), academicrelated sta (3) and administrative/management sta (3). The post-graduate students are PhD students who were located on the main campus of the university. The academic sta included both lecturers and researchers in di erent departments (i.e., Computer Science and Arts). The academic-related sta mainly consisted of technical sta who worked on IT development projects. Administrative and management sta were from di erent departments, including the university library and research school. This selection of participants was intended to re ect the di erent types of usage of the OU's online systems. However, compromises had to be made on the male to female ratio. Hence, there were 4 female participants and 8 males. The participants' age-group approximately ranged between 25 to 55 years of age. For each participant, we collected information regarding their usage of OU websites through web server logs associated with these di erent systems. This required ltering these logs to keep only the data related to the participants of the study. This data collection mechanism was run over a period of four weeks (or 28 days), leading to the 12 datasets (one per participant) that included information about access and requests to OU websites. This information is encoded in a format similar to the one of Apache logs, in a text le where each line correspond to a request to a Webserver, including the following pieces of information: <date-time> <server> <IP of client> <username> <resource accessed> <response code and size> <user agent used (browser)>
This information was collected from 9 di erent servers, which corresponded to the virtual learning environment (6 servers), the intranet, the public website and the student services website of the OU. As expected, information collected for di erent participants varied widely, depending on their roles. 3.3
To realise the study, a data processing and visualisation platform was required
to rst process and integrate the data obtained from server logs into easily
interpretable and exploitable CA datasets; and secondly, to create an interactive
interface, i.e. a personal analytics dashboard, which allowed users to visualise
and interact with their own CA data. To process and integrate server logs into
CA data, we reused and employed the principles and tools developed as part of
the UCIAD project (see [
Once the data was processed and made available through data endpoints, the personal analytics dashboard from UCIAD provided the end-user interface to visualise and access these data. Normally, the logs from Web servers are used to produce web analytics (i.e. website usage statistics) and many users are aware of such analytical tools and interfaces associated with web analytics. We were thus motivated to design the personal analytics dashboard so that it used similar visualisation methods, but showed (in an aggregated form) information about the user's visits to various websites. These visualisations include information about the types of activities performed on online systems, the resources accessed, locations of the user at the time of usage, the browsers and operating systems used, the time, etc. Figure 1 shows a screenshot of the dashboard. It is important to also mention that these visualisations are interactive, as they allow the user to de ne lters on the activities (e.g., only show activities realised at a certain location, or at a given time) by clicking on the corresponding chart elements. The core of the user study was the personal interview conducted with each participant to explore their reactions and views on consumer-activity data, rstly as a potential user of the system and secondly in relation to anything that they may discover which was either interesting or worrying as they used the tool. The interview started with a small introduction to the study, and initial questions about the participant's background, including their view on how they used OU's online services and their knowledge of web analytics. After this, each participant was given access to a computer running the UCIAD personal analytics dashboard, which accessed the data endpoint speci cally created for them. As they used and explored the tool, they were asked to answer a number of questions related to the following topics: { Usage of consumer-activity data (\Did you nd anything surprising/interesting in the data?", \Would you like to be given access to this data?") { Data gathering issues (\Where you aware such data was being collected?", \Is there anything in what you see causing you concern?") { Activity data policies (\Who owns the data and how should it be handled?")
The interview was conducted by two project team members: while one member asked the questions (guided/prompted by the usage and exploration of the personal analytics dashboard), the other team member took notes of the interview. Interviews generally lasted between 45 minutes and 2 hours. Each interview was audio recorded and stored in encrypted containers (to protect privacy) and later transcribed for analysis (the transcripts were anonymised before use). 3.5
An online questionnaire was sent to participants two weeks after the initial interviews in order to check whether additional thoughts and reactions would have emerged after the interviews. These questionnaires did not lead to additional insight, except to con rm that the participants had not changed either their views or their behaviour with regards to how they perceived and used OU's online systems. The last phase of the study was the focus group. We included a focus group because all participants were from diverse backgrounds, roles and views, there was value in letting them debate their positions and viewpoints with others in a controlled setting such as a group discussion. To be e ective and yet nish within the allotted time of 90 minutes, the focus group was constructed around a speci c task: the group members had to collaborate with each other and contribute towards writing a business case supporting the deployment of a CA data service at the OU. This business case included two main sections: (i) bene ts of CA data and (ii) obstacles to the deployment of CA data services (which indirectly pointed to privacy and security issues). During the focus group discussion, participants were asked to identify points to add to both these sections, and to react to the points made by others. Each point raised was recorded on a common document (the \draft business case"), which was being projected on a screen for all the participants to see, as a member of the UCIAD team was adding notes to it, so that it was corrected and validated collectively at the time the notes were made. 4
In this section, we summarise the main results of the study, as a set of general ndings, mainly regarding the bene ts, privacy risks and challenges relating to potential users of CA data within an organisation such as the OU. These observations were obtained through analysing the transcripts of the recordings made during the individual interviews, together with the results of the discussions summarised from the focus group.
As previously described, CA data is a by-product of the user's interaction with the organisation's online systems. Therefore, one of the fundamental question the user study aimed to answer is whether users will be su ciently interested to request a copy of the data and put it to any use. It was interesting to note that the participants came up with several innovative suggestions as to how they may be able to use their activity data to better themselves:
Self re ection: Some participants of the study saw value in simply being
able to re ect on what they do daily, it was more of a self assurance tool to
indicate if they were on track with their actions or not: \yeah...it is for self
re ection, it can show you if you are on track...that you are not deluding yourself
as to what you are actually working on" [P3]. This notion of self-re ection on
one's own activities is generally related to the one of lifelogging [
Self improvement: Another interesting bene t for CA data the participants suggested was to improve their use of online resources. This is very closely related to self-re ection and it is an outcome of what they see as \ine ciencies" in their use of the resources. For example, users nd it frustrating not to have bookmarked certain pages they use quite frequently and to have to search for them: \I kind of realised this is not very e ective and every time I need that information about the poster...[I want to] bookmark it, you know...to myself and then I never do...but when you look at something like this...you go like...put some e ort and bookmark it" [P5].
Trace anomalies: Very similar to how application logs have long served the purpose for analyses and tracing error conditions in the software, users nd the CA data useful to trace anomalies in their work pattern. For example, they can trace back their online activities to speci c websites whose security had been compromised: \I can think of an impact around sort of data security and personal security and it being able to ag up... doing something on a browser that might not be so secure as you might want or looking at websites that are actually security risks...to actually be able to go back and track back to say actually did I use that website at that particular time...that's the type of thing that will be useful" [P7].
Promote transparency: In the context of the organisation (the Open University), participants felt that the very act of releasing the CA data to the users would signi cantly improve the organisation's reputation: \if you have a view of the data who is holding, I think it makes...it reassures the users I suppose, this is what the OU [organisation] knows, this is what you know...that in a way quite equal" [P10]. Participants also feel that CA data can provide transparency on a personal level, for example, the users are able to justify or deny their actions using the CA data as evidence: \as long as I am doing my job I don't think its a problem...but I suppose...I am trying to think...my time in Berlin is accounted for so I am quite happy that people know that I was in Berlin" [P4] and \I am not...you know...I am not doing anything that I wouldn't be able to stand up and defend in court if I had to" [P9].
Although these bene ts may not be extraordinary in themselves, it shows that users when given an opportunity to access their CA data, they are likely to nd innovative and creative means to bene t themselves. Given that users are likely to exploit their CA data, we focus on the potential privacy and security risks, both the users and the organisation, are likely to face especially with regards to key questions such as: (1) In what ways will the user's privacy be harmed by this data? (e.g. in case of data leakage); (2) Can the organisation su er any privacy harm? (e.g. if the user voluntarily shares the data on social media) and; (3) What must be done to avoid harms from (1) and (2)? 4.2
First, we describe the privacy risks. While these privacy risks may not be completely new, it does underline and con rm that even in a trusted producerconsumer relationship (as in this case), such privacy threats exist, and it must be addressed.
Image distortion: Distortion seems to be a major concern. Distortion refers
to disseminating false or misleading information about an individual [
Unwanted disclosure: Disclosure involves the revelation of an individual's
true information to others impacting her reputation [
Re-identi cation: Identi cation refers to linking information to particular
individuals [
Opaqueness of passive data collection: Exclusion is failure to provide
individuals with notice and input about their records [
Insecurity from compromised infrastructure: Insecurity is failure to
protect personal data [
Breach of personal and organisation's con dentiality: Breach of
condentiality is unauthorised revelation of con dential information resulting in loss
of trust [
3rd party exploitation of data: Secondary use is the use of data for
purposes unrelated to the purposes for which it is collected [
At a higher level, organisational privacy policies govern how the data is collected, processed and to what use it will be put to. It relates to ownership and licensing of data, here ownership is concerned with controlling who can change the access permissions and usage rights on the data. The owner who holds the ownership rights may allow other entities to access and use the data by issuing a license (i.e. terms and conditions for use). The CA data may reside in the organisation or the user's domain (or both) and privacy risks apply di erently depending on who has control over the data. For an e ective access control policy, the access rights and ownership rights have to be clearly de ned. However, in the study we found that users have no clear consensus on ownership rights that should be applied to CA data. Here we brie y describe the three potential models participants relate to:
(1) The organisation owns the data: Currently, this is seen as the default model. The organisation create the data, therefore they retain the rights and exploit the data as their own asset, and some user's acknowledge and support this position: \I think the OU owns it...its the University's data, its information about me but University compiled it and they must own it...as an individual I don't own the data, I am in that camp...some people may say they generated the data, no [they] didn't, the University happened to collect the data of my usage, I didn't create the data" [P8]. Since the organisations are constrained by the DPA which speci es under what conditions the data can be used without having to obtain consent from the user, delivering CA data would e ectively mean issuing a license to the user to not only access their own data but also use it in ways they deem t. The CA data not only contains details about the user but also of the organisation. Assuming organisations redact the CA data before releasing it, there is always the risk that some con dential information can be triangulated through other means. It is therefore in the interest of the organisation to impose restricted licensing conditions that make it di cult for the CA data to be aggregated and used in ways that are determental to its reputation. This of course raises an important question - what type of restrictions should the organisation be allowed to impose on the released CA data, given that users will want to exploit its bene ts? The majority of study participants indicated that they would expect the organisation to impose strong limitations on the use of the data (e.g., it could not be shared or it could only be accessed through the tools provided by the organisation).
(2) The user owns the data: The second model represents a radical shift from the default model described above. In this model, the participant's suggestion is for the users to have full rights over the CA data once it is transferred to the individual: \if the data is given back to me then I'd expect I am the owner of it...that the people who had originally collected that data have passed the ownership to me to do what I like" [P7]. The participants reason that, since the CA data represents personal information, it is only natural for the individual to be in control of its use. One major implication of this approach is that the organisations by default will not have the right to either access or exploit the CA data in any form, unless it has been explicitly licensed by the user. Therefore, the important question here is - what type of restrictions should the user be allowed to impose on the organisation's use of CA data? Allowing users to impose conditions could make it more complex for organisations to genuinely use the CA data to improve their online services and, as a consequence, make the collection of CA data irrelevant and counter-productive for organisations.
Another reason to transfer the ownership to the user is that the DPA indicates that personal data might not be kept by an organisation for longer than necessary for the intended purpose. Since organisations keep CA data for a short period (at the OU, the data is kept for 7 consecutive days) and then deleted, one possible approach would therefore be to transfer the data together with its associated rights to the user after this retention period. From a practical perspective, this would also represent a convenient arrangement, as users could simply `opt-in' for their CA data to be sent to them at the time it is deleted from the organisation's systems. Of course, this would still imply that the organisation would lose control once the data has been transferred to the user, and \non detrimental use/con dentiality" clauses might be attached to the delivery of CA data.
(3) Shared data ownership: The third suggestion is for a hybrid approach where both the organisation and the user are considered as co-owners of CA data. This means that both will have full access to the data, but would be prevented from using them in ways that could be detrimental to each other. Study participants proposed this to be an appropriate model: \it is shared data almost isn't it, like pay scales and salaries and things...that is OU data as well...as to what they pay their sta , so its not just mine to do whatever I want...its like a shared ownership" [P3]. The legal implementation of such an arrangement could be rather complex, or on the contrary it might be simpler than anticipated. For example, the organisation can comply with the DPA just as they do when the CA data in their domain, while at the same time, the users can be bound to con dentiality agreements with the organisation, thus preventing them from widely distributing these data. In any case, new terms and conditions will have to be drawn, so the important questions are: what are these joint terms and conditions? Will there be any exibility in negotiating them? How will con icts be resolved?
We found that there was no clear consensus among the participants on any of these ownership and licensing models described above. We also found that participants were not in position to articulate and elaborate on the terms and conditions that might entail in each of the three models so that both, users and organisations, can mutually bene t from the use of CA data. 5
The user study had a sample size of 12 participants and as such it was not expected to be representative of all CA data users, instead, the aim was to explore and provide initial insights on the potential impact the releasing of CA data will have on both the users and the organisations. In this regard, our study showed how users, when given an opportunity, can come up with ingenious ways to exploit and bene t from CA data. Further, the study uncovered several potential privacy risks which are applicable to both the users and the organisation. Although the discovered privacy risks are not new, the study showed that these risks were dormant even in datasets generally not visible to the users. More importantly the privacy risks relates to both the user and the organisation and here we brie y discuss the impact of these ndings with respect legislation and data protection principles. DPA controls how organisations, businesses and the government process data and it primarily applies to personal data. This throws open an important question: should CA data be considered as personal data? In our study, CA data contained traces of the user's identity, for example, the online system's user-name but this in itself was insu cient to link to any individual within the organisation (without having access to other directory systems within the OU). Everything in the DPA pertaining to data access rights of both the users and the organisations then hinges over this classi cation. Considering CA data as personal data can have far reaching implications under the DPA: (a) users will be allowed to demand a copy of their data unlike the current situation where organisations are encouraged to release CA data voluntarily, (b) organisations will be forced to make explicit how they process the data and for what purposes it is being used, and (c) organisations will be unable to allow 3rd party use without explicit consent from the user. Current ambiguity attached to the nature of CA data means organisations are not obliged to provide notice and obtain the user's consent regarding (b) and (c). For other implications, the DPA in its current form appears to be inadequate. For example, the CA data, in addition to containing traces of user's identity, also contains con dential information about the organisation's internal structure, therefore the question arises: what data access rights do organisations have after the data has been transferred to the user's domain?, which of course requires further debate and legislation. One limitation of our study relates to generalisability - the OU, like many other educational organisations, collects CA data on di erent systems to improve its services but we were not aware of it integrating these data and employing analytics to derive bene ts from it to the extent it was done in the study.
In conclusion, it's important to not only understand and anticipate the benets of releasing consumer-activity data but crucially its privacy implications. To this end, we conducted an exploratory qualitative study in the context of a large educational institution in which users were exposed to a novel `personal analytics' dashboard designed to provide access and visualise their consumer-activity data. From observing the reactions of the study participants, we not only uncovered several privacy risks applicable to both the users and the organisation but also highlighted several challenges relating to data ownership and licensing models which must be addressed if consumer-activity data is to be released.
Thanks to Dr. Mathieu D'Aquin for his signi cant contribution in realising the user study and his useful insights on post study analysis. The study was partly achieved thanks to funding from JISC for the UCIAD (User Centric Integration of Activity Data) project { see http://uciad.info for details.