Privacy Champions in Software Teams: Understanding Their Motivations, Strategies, and Challenges
Abstract
Software development teams are responsible for making and implementing software design decisions that directly impact end-user privacy, a challenging task to do well. Privacy Champions—people who strongly care about advocating privacy—play a useful role in supporting privacy-respecting development cultures. To understand their motivations, challenges, and strategies for protecting end-user privacy, we conducted 12 interviews with Privacy Champions in software development teams. We find that common barriers to implementing privacy in software design include negative privacy culture, internal prioritisation tensions, limited tool support, unclear evaluation metrics, and technical complexity. To promote privacy, Privacy Champions regularly use informal discussions, management support, communication among stakeholders, and documentation and guidelines. They perceive code reviews and practical training as more instructive than general privacy awareness and on-boarding training. Our study is a first step towards understanding how Privacy Champions work to improve their organisation’s privacy approaches and improve the privacy of end-user products.
Type
Publication
In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems
Authors
Kami Vaniea
(she/her)
Associate Professor
I am an Associate Professor at the University of Waterloo’s Department of Electrical and Computer Engineering (ECE) where I head the Technology Usability Lab in Privacy and Security (TULiPS). The goal of my research is to make security and privacy technologies more accessible for a wide range of users including end users, developers, and system administrators. I believe that technology should support people in their activities. My recent projects include topics like patch management, developer-centered privacy, phishing, online anonymity, smart speaker privacy, and privacy on social media.