Personal Data is an Inalienable Representation—not a Currency

In the past decade, many services predicated on the idea that a user’s data can be exchanged as payment for said service have seen tremendous success and adoption. Businesses that have deployed such service models include tech giants such as Google and Facebook.

However, there has always been a consistent nagging from those concerned with the implications of such service models. And, in light of the Edward Snowden leaks regarding government surveillance as well as huge tech companies making increasing plays to provide the essential infrastructure for societies, this concern has become widespread and is fueling much debate and dialogue. In spite of its effectiveness in user adoption and even some legitimacy as a system that could possibly uphold the privacy of individuals, treating a user’s private data as a commodity that has transferable ownership is gaining a poor reputation.

To counteract this model of personal data processing, the thesis prototype is to be designed with a principle that shares the same spirit of the EU directives that regard human dignity and privacy as a fundamental right. In this vein, the design is to leverage any opportunities to communicate this belief—that their data is theirs—to the user to better establish trust between all parties.

Personal Data is a Democratic Mechanism

In writing about the delicate tension between privacy and transparency in society, Evgeny Morozov points out that the right to complete privacy—to withdraw oneself wholly from the public sphere, disconnected from corresponding responsibilities—poses a danger for society and begins to “undermine the very democratic regime that made the right possible” (Morozov, “The Real Privacy Problem”).

Be it a society or an organization, there is a need for some degree of transparency at the level of the individual in order for peers to mutually benefit from knowledge sharing as well as for government officials or management to make informed strategies for the organization. Morozov ultimately points to the importance of politics—the realm of dialogue and negotiation given the messy, human, often confusing nature of societies and organizations—as the medium in which personal information should be pledged or withheld.

Thus, employees should view their personal information not merely as being useful only to themselves and their own career but also as something that can be pledged toward strategies and initiatives with which they deem beneficial. Furthermore, as opposed to a UI designed with transactional metaphors, the UI of workplace surveillance software should instead seek out dialectical patterns and metaphors that are appropriate for negotiation, political discourse, and the formation and maintenance of relationships.

Effective Policies are the Product of Recourse and Negotiation

Adam Greenfield articulates the problem this design principle sets out to mitigate:

[T]he deep structural design of informatic systems—their architecture—has important implications for the degree of freedom people are allowed in using those systems, forever after. Whether consciously or not, values are encoded into a technology, in preference to others that might have been, and then enacted whenever the technology is employed. Such decisions are essentially incontestable...Even if we are eventually able to challenge the terms of the situation—whether by appealing to a human attendant who happens to be standing by, hacking into the system ourselves, complaining to the ACLU, or mounting a class-action lawsuit—the burden of time and energy invested in such activism falls squarely on our own shoulders. (Greenfield 144, 146) Everyware: The Dawning Age of Ubiquitous Computing

Systems that embody and become a platform of institutional power structures—such as a system concerned with measuring and communicating how people behave at work—are highly susceptible to the issue Greenfield is raising. Therefore, it was of primary importance to always be identifying opportunities for the UI of my prototype to afford users the ability to react against any unintended biases inherent to or acquired by a system that tracks personnel.

Transparency is an Effective Means to Trustworthiness

When doing the initial round of interviews with people that work for employers or in fields that might deploy surveillance technology for workplace analytics, one interviewee mentioned that it was really a matter of surfacing what her company wanted to do with the data gathered by such an initiative. When running some hypothetical uses by her, she claimed to have no concerns with any of them and would volunteer her data. This was true of hypothetical uses that had no benefit for her. After further discussion, she realized and communicated that it was the good faith of clearly exposing intent that helped her trust the initiative just as much if not more than fully understanding the intent.

This was echoed when facilitating the usability tests on the prototype. If the business’ intentions regarding the workplace surveillance were not stated immediately and clearly, a few participants mentioned this made them concerned. While it is important to let users know what is intended with workplace surveillance so they have an opportunity to judge if it is worthy or not, it seems there is a much deeper trustworthiness that is gained by being upfront with intentions.

Opt-In is the System Default

Dark Patterns, a website that collects examples of ethically dubious user experience design patterns, defines the dark pattern called ‘misdirection’ as follows: “[t]he attention of the user is focused on one thing in order to distract its attention from another”. This pattern is commonly applied to software installation wizards that are trying to stealthily install additional, generally unwanted software. This is often accomplished by opting the user in by default in hopes that they fail to opt out. (“Misdirection")

Users are becoming increasingly aware of this pattern and others that are used to opt in their personal information. A 2012 study showed that over half of app users have decided not to install an app when they discovered how much personal information they would be required to share in order to use it. The same study also showed that 30% of app users have uninstalled an app already on their phone upon learning it was collecting personal information that they did not wish to share. (Boyles)

Such interactions instill a lack of trust from the user towards the software and the creators thereof. These tactics that attempt to sneakily opt people into generally undesirable circumstances, or—worse yet—a lack of any interactions that allow the user to opt out can even be viewed as coercive. Coercive maneuvers made by management to surveil the workforce can actually lead to paradoxical results. “These efforts become an escalating battle of wits in which managers devise ever more sophisticated surveillance and employees use their ingenuity to circumvent it” (Sewell 939).

This means that such systems—when it comes to the processing, synthesizing, and reporting of data—should be engineered and designed under the assumption that a complete data “portrait” of the workforce—even at the level of the individual—is unlikely. Besides, this notion of the inability of embedded, data-gathering system to not paint a complete picture is not just a result of honoring active consent of those being surveilled but is a deeper, inherent reality. A complete, qualitative picture of human behavior being produced by a system is an impossibility (Greenfield 133).

A Third Party Embodies and Communicates Bipartisanship

This principle started out as very much a hypothesis at the beginning of the project. On the one hand, a third party handling the deployment and data processing of a workplace surveillance program could put employees at ease, knowing that their managers or peers would not be the ones viewing and synthesizing their information. This could result in chasms in the power structure within the organization. On the other hand, a third party could also represent an outside organization that is not necessarily beholden to the organization and its members and could seek out its own benefit when wielding employee information.

However, most usability test participants preferred the notion of a third party handling and processing the data. It represented neutrality. Thus, it would seem that a third party does indeed help establish trust between employees and the system.

Some People Care about Details—Most Don't

While it is critical for the sake of communicating trustworthiness to extend the offer for line-item consent to potential participants of a surveillance system, many users are not interested in the finer details of their consent and participation. When doing initial research interviews, it became clear that employees that trusted their employer did not feel a lot of need to control every aspect of their participation in a workforce analytics study that would involve surveillance. Therefore, software should allow an easy path for users that wish to consent quickly and completely.

This principle also has another application. As mentioned in a previous section, there is a tremendous usability issue when it comes to the lengthy, complex, legal documents that spell out the terms of agreement for software applications or other agreements. While these documents will remain necessary for legal purposes, the user experience design of workplace surveillance software should find ways to interpret the terms in a user-friendly manner.

Get Out of the Way of Work

This is a simple, obvious principle. Any such system should minimize its interruption of an employee’s workday. This concern was mentioned frequently when testing the prototype. The concern regarding privacy of such systems is rivaled by the concern of it being a nuisance to getting work done.