With the increasing size and complexity of personal information and data landscapes, there is a need for guidance and support in the appropriate management of a deceased person’s postmortem privacy and digital legacy. However, most people engage poorly with existing mechanisms for specifying and planning for access and suitable usage of their own data. We report on two studies exploring the ways in which contextual factors such as the accessor and the data type may affect the appropriateness of personal data flows differently during life and after death. Our findings indicate that suitable data access after death is highly individual and contextual, with differences in appropriateness between during-life and after-death data flows significantly affected by the accessor and the data type in question. We identify that ambiguous accessor motivation, failure to communicate intent, changing temporal context and latent data values further complicate the act of digital legacy planning. Our findings also provide further evidence for the existence of a postmortem privacy paradox in which reported user behaviors do not reflect intent. With this in mind, we offer design recommendations for the integration of digital legacy planning functionality within Personal Information Management (PIM) and Group Information Management (GIM) systems.

Older adults are often subjected to online attacks and can be vulnerable to social engineering. In addition to direct harms, this may contribute towards lower rates of technology use and digital literacy in older populations. Since September 2019, we have worked with older adult volunteers to create a peer-to-peer cybersecurity advocacy initiative. We present a thematic analysis of longitudinal qualitative data that explores links between cybersecurity and digital literacy. Our findings highlight a technical ceiling that limited some proactive changes for peer advocates and for those they reached. We suggest that overcoming such issues requires significant practical familiarity, aided by the provision of repeat practice in a safe environment and with longitudinal support. This, we position as part of a need for the integration of cybersecurity training within digital literacy education for older learners. Finally, we elaborate on the structure of our engagement in terms of layered and distributed scaffolding.

In our data-centric world, most services rely on collecting and using personal data. The EU's General Data Protection Regulation (GDPR) aims to enhance individuals’ control over their data, but its practical impact is not well understood. We present a 10-participant study, where each participant filed 4-5 data access requests. Through interviews accompanying these requests and discussions scrutinising returned data, it appears that GDPR falls short of its goals due to non-compliance and low-quality responses. Participants found their hopes to understand providers’ data practices or harness their own data unmet. This causes increased distrust without any subjective improvement in power, although more transparent providers do earn greater trust. We propose designing more effective, data-inclusive and open policies and data access systems to improve both customer relations and individual agency, and also that wider public use of GDPR rights could help with delivering accountability and motivating providers to improve data practices.

Older adults can struggle to access relevant community expertise when faced with new situations. One such situation is the number of cyberattacks they may face when interacting online. This paper reports on an initiative which recruited, trained, and supported older adults to become community cybersecurity educators (CyberGuardians), tasked with promoting cybersecurity best practice within their communities to prevent older adults falling victim to opportunistic cyberattacks. This initiative utilised an embedded peer-to-peer information dissemination strategy, rather than expert-to-citizen, facilitating the inclusion of individuals who would ordinarily be unlikely to seek cybersecurity information and thus may be vulnerable to cyberattacks. We report on ways the CyberGuardians used informal methods to create more aware communities, served as role models for behaviour change and indirectly improved their personal wellbeing. We discuss considerations for supporting CyberGuardians, including implications for sustainability and for replicating this model in other digital contexts, e.g., recognising misinformation or improving mental health.

As digital technologies become more prevalent there is a growing awareness of the importance of good security and privacy practices. The tools and techniques used to achieve this are typically designed with the living user in mind, with little consideration of how they should or will perform after the user has died. We report on two workshops carried out with users of password managers to explore their views on the post-mortem sharing, security and privacy of a range of common digital assets. We discuss a post-mortem privacy paradox where users recognise value in planning for their digital legacy, yet avoid actively doing so. Importantly, our findings highlight a tension between the use of recommended security tools during life and facilitating appropriate post-mortem access to chosen assets. We offer design recommendations to facilitate and encourage digital legacy planning while promoting good security habits during life.