2.5 Formal methods
3.1.2 EnCoRe focus groups
For the EnCoRe focus groups, the decision was made to conduct a series of sessions with experts in the field of privacy and consent. Thus, the participants chosen were individuals who had already a good understanding of the complexities and challenges of the concepts to be explored. This design of focus groups is providing access into
views of professionals whose business activities shape and challenge privacy and consent policies in real life.
Finding the appropriate expert participants for each focus group was rather challenging. For the first focus group that took place in November 2008 and was held at the University of Warwick, eight participants who were representatives from civil society organisations were chosen. These participants were members of the EnCoRe’s User Advisory Group. Different members of the same group participated in the second focus group that took place in January 2009. Eleven people who were data protection professionals accepted the invitation to participate. Regarding the last two focus groups, participants were selected based on recommendations and contacts known to members of the User Advisory Group and project participants. The third focus group, held also at LSE, contained nine public-sector representatives and took place on February 2009. The last focus group, was held at the University of Warwick and was part of a networking event organised by the university for a Warwickshire SME technology cluster. As a result, twenty three people participated in this focus group, whereas many of the participants knew each other well, leading to a common sharing of beliefs.
Regarding the expected outcome from the four different focus groups, the data collected from the data protection professionals was intended to provide an insight on consent practices and the various issues that organisations, in which partici- pants work, face every day. Participants from civil society organisations sought to highlight problems that individuals are faced with and potential misuse of consent policies by organisations. The third focus group, where participants worked for the public sector, sought to investigate how one of the largest users of personal data in the UK handle data and whether consent has a key role in their practices or is complete absent (sometimes providing data to government services could be oblig- atory). Finally, the last focus group where employees were working for companies with limited resources, explored whether consent was considered a trivial issue or liability for these SMEs and potential problems that the implementation of a system able to provide revocation mechanisms may cause to their business.
The EnCoRe project decided to hire Tim Morley from KnowInnovation to or- ganise and facilitate the focus group discussions. Through out the sessions Tim mentioned to the participants that he was an expert on organising focus groups rather than an expert on the concept of privacy and consent. Dr Edgar Whitley was also present as a note-taker in all focus groups, whereas Dr Nadja Kanellopoulou attended the last focus group to assist in note-taking due to the large number of
participants. Both Dr. Whitley and Dr. Kanellopoulou had minimal impact on the discussion.
The invitation sent to all participants provided information of the EnCoRe project and details of the process of focus groups. Typically, the focus groups would start with lunch where participants would meet each other and Tim. Then the session would begin with a small description of what the EnCoRe project en- deavoured to achieve and a statement that there were no right or wrong answers in this process. Participants were asked to sign a consent form and were informed that the sessions were audio and video recorded (only to facilitate the transcription of the sessions) and the data generated would be available to all research staff of the project with the obligation that the transcripts created by these recordings would be anonymised. More specifically, participants were informed that:
“the data from their session will be available to all researchers working on the project but the transcripts will be kept anonymous. The data may also be used in reports and publications and direct anonymised quotations from the transcript may be used in published output” [183].
In addition, for all focus groups a break for coffee was provided halfway through the session.
The discussion in focus groups started with an open question introduced by Tim regarding what could keep people awake at night in terms of consent issues. To ensure a flow in the conversation, participants in all focus groups were presented with various realistic scenarios in which they needed to grant and might wish subsequently to revoke consent to better control the handling of their personal data. They were asked to discuss their rational for consent and revocation achievements. More detail on the focus-groups regarding the chronological order that these took place, the number of participants attending and their background, can be found in Table 3.1. Finally, a commercial transcription company was hired to produce the transcripts of all the focus groups. They were provided with copies of the audio and video recordings which, upon completion of the task, were destroyed. The transcripts were stored securely on the project’s Twiki page, where access to all EnCoRe’s members was provided. It is worth mention that the data used for the analysis in this chapter was not processed by anyone other than the author in any manner. Rather, I downloaded the transcripts from the Twiki page and used my own intuition and methods to process and analyse the transcripts.
Date Participants Duration Transcript Size Civil society organisations Nov 2008 8 People 3 Hours 25,500 (Words) Data protection professionals Jan 2009 11 People 3 Hours 27,000 (Words) Public sector organisations Feb 2009 9 People 3 Hours 22,000 (Words) Regional technology cluster: SMEs Feb 2009 23 People 1 Hour 16,000 (Words)
Total 10 Hours 90.000 (Words)
Table 3.1: Focus-groups
In the analysis section 3.3, I include relevant excerpts from transcripts in quo- tations. The themes that guided the discussion in the focus groups were crafted at the EnCoRe meetings. These are:
• Privacy policies
– Are data subjects adequately informed by the privacy policies regarding the actions they are giving consent to?
– Are privacy policies explanatory regarding the aims and procedures of the data controller?
• Controls for personal data
– What controls the data subjects may have regarding the usage of data? – What do data subjects expect to happen when they refuse to give con-
sent?
• Regulation and consent
– How can on-going consent be achieved?
– How can the existing regulation in UK protect the process of giving consent?