We describe the two-year-long development and evaluation of the Proportionality Method, a design method intended to aid HCI practitioners in designing advanced IT applications with complex privacy implications. The method is inspired by Data Protection Authorities' (DPA) and Courts' practice and proposes to balance the impact on privacy of IT applications with their usefulness. We discuss the results of an evaluation of the design method to verify its usability, usefulness and effectiveness vis-à-vis other design methods proposed in the HCI literature to address similar issues. Results suggest that different design methods for privacy highlight different sets of issues and a combination of methods should be employed in a comprehensive design process. We propose to judge design methods based on their overall quantitative and qualitative merits, including the type of application and technology for which they are most fit and their methodological approach. We finally propose to develop a privacy toolbox, that is, a set of heuristic methods that designers can choose from with knowledge and understanding of their relative advantages and limitations.

We developed an inquiry technique, which we called "paratype," based on experience prototyping and event-contingent experience sampling, to survey people in real-life situations about ubiquitous computing (ubicomp) technology. We used this tool to probe the opinions of the conversation partners of users of the Personal Audio Loop, a memory aid that can have a strong impact on their privacy. We present the findings of this study and their implications, specifically the need to broaden public awareness of ubicomp applications and the unfitness of traditional data protection guidelines for tackling the privacy issues of many ubicomp applications. We also point out benefits and methodological issues of paratypes and discuss why they are particularly fit for studying certain classes of mobile and ubicomp applications.

We argue that an analytic proportionality assessment balancing usefulness and burden on individual or group privacy must be conducted throughout the design process to create acceptable ubiquitous computing (ubicomp) applications and services. We introduce the principle of proportionality, which originates within the legal and data protection communities. Inspired by this principle, we develop a design method for ubicomp applications, based on our own experience, and aimed at HCI practitioners and designers. We discuss the method in relation to real-world examples, user inquiry techniques and requirements engineering models. Finally, we report a sample application of the method, involving a ubiquitous, personal memory aid tool.

In this article, we describe the design process of Reno, a location-enhanced, mobile coordination tool and person finder. The design process included three field experiments: a formative Experience Sampling Method (ESM) study, a pilot deployment and an extended user study. These studies were targeted at the significant personal security, privacy and data protection concerns caused by this application. We distil this experience into a small set of guidelines for designers of social mobile applications and show how these guidelines can be applied to a different application, called Boise. These guidelines cover issues pertaining to personal boundary definition, control, deception and denial, and group vs. individual communication. We also report on lessons learned from our evaluation experience, which might help practitioners in designing novel mobile applications, including the choice and characterization of users for testing security and privacy features of designs, the length of learning curves and their effect on evaluation and the impact of peculiar deployment circumstances on the results of these finely tuned user studies.

Compelled to improve information security by the introduction of personal data protection legislation, organizations worldwide are adopting standardized security management guidelines to inform their internal processes. We analyze whether existing security management standards support process requirements for personal data management, drawing from experience with security policies in private organizations and through an analysis of current European and US legislation. Various aspects of personal data management not commonly addressed by security standards are identified, and a number of generally applicable enhancements are proposed to one common standard, IS17799. The appropriateness of including data protection guidelines in security standards is discussed, showing how these enhancements could simplify the definition of personal data management procedures in organizations.

Early IT security evaluation criteria such as the TCSEC and the ITSEC suffered much criticism for their lack of coverage of privacy-related requirements. Recent evaluation criteria, such as the CC and the ISO-ECITS now contain components assigned to privacy. This is a step towards enhanced privacy protection, especially for non-experts. We examined the suitability and use of these components and the criteria as a whole by specifying a number of protection profiles (PPs) for remailer mix networks, as mix networks aim at user anonymity and unobservable message transfer. This contribution reports on the PPs and the experiences gained. It also introduces proposals for improving the criteria that were derived from this work.