TY - JOUR A1 - Jakobi, Timo A1 - Arslan, Salih A1 - Harms, Patrick T1 - Evaluating GDPR right to information implementation in automated insurance decisions JF - i-com N2 - Automated decision-making algorithms are increasingly prevalent in consumer-facing industries, particularly in insurance risk assessments. The traceability of these decisions is crucial for trust, acceptance, and individual autonomy. While the General Data Protection Regulation (GDPR) grants individuals the right to information about such decisions, the implementation of this right remains under-researched from a usable privacy perspective. This study employs a qualitative exploratory approach with 12 participants exercising their right to be informed about automated decision-making with German household insurers. Through interviews and observations, we investigate consumer requirements and prevailing implementation practices. Our findings unveil actual process design practices that may undermine the usability and efficacy of this data subject right. By identifying these concerns and correlating them to existing deceptive patterns, our research contributes to usable security by alerting process designers, data protection authorities, and enterprises to the significance of user-centric implementations. Furthermore, this study advances research on GDPR data subject rights, emphasizing the need for secure and usable interfaces in the context of automated decision-making systems. Our work highlights the practical challenges of safeguarding usable implementation of regulatory compliance in the realm of data protection. KW - GDPR; usable privacy; empirical study; right to information Y1 - 2025 U6 - https://doi.org/10.1515/icom-2024-0071 SN - 1618-162X VL - 2025 PB - de Gruyter CY - Oldenburg ER - TY - JOUR A1 - Walther, Michelle A1 - Jakobi, Timo A1 - Watson, Steven James A1 - Stevens, Gunnar T1 - A systematic literature review about the consumers’ side of fake review detection – Which cues do consumers use to determine the veracity of online user reviews? JF - Computers in Human Behavior Reports N2 - Consumers rely heavily on online user reviews when shopping online and cybercriminals produce fake reviews to manipulate consumer opinion. Much prior research focuses on the automated detection of these fake reviews, which are far from perfect. Therefore, consumers must be able to detect fake reviews on their own. In this study we survey the research examining how consumers detect fake reviews online. Y1 - 2023 U6 - https://doi.org/10.1016/j.chbr.2023.100278 SN - 2451-9588 VL - 10 PB - Elsevier BV ER - TY - JOUR A1 - Jakobi, Timo A1 - Arslan, Salih A1 - Harms, Patrick T1 - Evaluating GDPR right to information implementation in automated insurance decisions JF - i-com N2 - Automated decision-making algorithms are increasingly prevalent in consumer-facing industries, particularly in insurance risk assessments. The traceability of these decisions is crucial for trust, acceptance, and individual autonomy. While the General Data Protection Regulation (GDPR) grants individuals the right to information about such decisions, the implementation of this right remains under-researched from a usable privacy perspective. This study employs a qualitative exploratory approach with 12 participants exercising their right to be informed about automated decision-making with German household insurers. Through interviews and observations, we investigate consumer requirements and prevailing implementation practices. Our findings unveil actual process design practices that may undermine the usability and efficacy of this data subject right. By identifying these concerns and correlating them to existing deceptive patterns, our research contributes to usable security by alerting process designers, data protection authorities, and enterprises to the significance of user-centric implementations. Furthermore, this study advances research on GDPR data subject rights, emphasizing the need for secure and usable interfaces in the context of automated decision-making systems. Our work highlights the practical challenges of safeguarding usable implementation of regulatory compliance in the realm of data protection. Y1 - 2025 U6 - https://doi.org/doi.org/10.1515/icom-2024-0071 SN - 2196-6826 VL - 24 IS - 1 SP - 145 EP - 157 PB - de Gruyter ER - TY - CHAP A1 - Freeman, Guo A1 - Zytko, Douglas A1 - Razi, Afsaneh A1 - Lampe, Cliff A1 - Candello, Heloisa A1 - Jakobi, Timo A1 - Aal, Konstantin Kosta T1 - New Opportunities, Risks, and Harm of Generative AI for Fostering Safe Online Communities T2 - The 2025 ACM International Conference on Supporting Group Work N2 - Recently, there is a growing trend of using generative AI systems and tools for fostering and protecting online collaborative communities. Yet, existing AI tools may introduce new risks and even harm to diverse communities’ online safety. How to better maximize the novel opportunities of AI and mitigate its emerging risks and harm for our future online safety is a critically needed discussion for the HCI community. Featuring experts from both industry and academia, the goal for this panel is to promote interdisciplinary, community-wide discussions and collective reflections on important questions and considerations at the unique intersection of AI and online communities, including but not limited to: how the design of AI systems may discourage existing online harm but also invite new online harm in various online spaces; how different populations, cultures, and communities may perceive and experience AI’s new roles for their online safety; and what new strategies, principles, and directions can be envisioned and identified to better design future AI technologies to protect rather than harm various online communities. Y1 - 2025 U6 - https://doi.org/10.1145/3688828.3700747 SP - 2 EP - 5 PB - ACM CY - New York, NY, USA ER - TY - JOUR A1 - Alizadeh, Fatemeh A1 - Stevens, Gunnar A1 - Jakobi, Timo A1 - Krüger, Jana T1 - Catch Me if You Can : "Delaying" as a Social Engineering Technique in the Post-Attack Phase JF - Proceedings of the ACM on Human-Computer Interaction N2 - Much is known about social engineering strategies (SE) during the attack phase, but little is known about the post-attack period. To address this gap, we conducted 17 narrative interviews with victims of cyber fraud. We found that while it was seen to be important for victims to act immediately and to take countermeasures against attack, they often did not do so. In this paper, we describe this "delay" in victims' responses as entailing a period of doubt and trust in good faith. The delay in victim response is a direct consequence of various SE techniques, such as exploiting prosocial behavior with subsequent negative effects on emotional state and interpersonal relationships. Our findings contribute to shaping digital resistance by helping people identify and overcome delay techniques to combat their inaction and paralysis. Y1 - 2023 U6 - https://doi.org/10.1145/3579465 SN - 2573-0142 VL - 7 IS - CSCW1 SP - 1 EP - 25 PB - Association for Computing Machinery (ACM) ER - TY - CHAP A1 - Jakobi, Timo A1 - von Grafenstein, Maximilian T1 - What HCI Can Do for (Data Protection) Law — Beyond Design T2 - Human Factors in Privacy Research N2 - In the digital context, there are increasingly points at which users encounter data protection topics, especially to provide consent. At the same time, companies are heavily involved in handling data in a legally compliant manner and obtaining permission to process data. Entire industries have built up around “managing” user consent. However, a significant part of the added value of such solutions is to promise a high consent rate: That is, to apply designs that are lawful, but still nudge users to disclose data as much as possible. This does not have to happen through deceptive design [18, 37, 62](see also the chapter “The Hows and Whys of Dark Patterns: Categorizations and Privacy”) but can also work by achieving transparency in terms of privacy and security safeguards (low risks) and presentation of added value (large benefit)[24, 51]. Nevertheless, it is usually done in the interest of the data processor that in turn can be to the detriment of a free decision by the customer aka data subject. The data-driven economy fosters exactly such unbalanced relations between the entities that gather and process personal information and the individuals who are often unaware of the extent and the significance of the processing [20]. By large, there are three ways of influencing said imbalance: First, by the increasing business incentive for companies to collect and make use of (especially: personal) data, actors become more likely to engage in more excessive data collection practices. Second, by the increasing complexity and opaqueness of algorithms used, it is becoming more difficult to explain data processing, especially to non-tech- Y1 - 2023 SN - 978-3-031-28643-8 U6 - https://doi.org/10.1007/978-3-031-28643-8_6 VL - Human Factors in Privacy Research SP - 115 EP - 136 PB - Springer International Publishing ER - TY - JOUR A1 - Stevens, Gunnar A1 - von Grafenstein, Max A1 - Jakobi, Timo T1 - Effective data protection by design through interdisciplinary research methods: The example of effective purpose specification by applying user-Centred UX-design methods JF - Computer Law & Security Review, N2 - While the recent discussion on Art. 25 GDPR often considers the approach of data protection by design as an innovative idea, the notion of making data protection law more effective through requiring the data controller to implement the legal norms into the processing design is almost as old as the data protection debate. However, there is another, more recent shift in establishing the data protection by design approach through law, which is not yet understood to its fullest extent in the debate. Art. 25 GDPR requires the controller to not only implement the legal norms into the processing design but to do so in an effective manner. By explicitly declaring the effectiveness of the protection measures to be the legally required result, the legislator inevitably raises the question of which methods can be used to test and assure such efficacy. In our opinion, extending the legal compatibility assessment to the real effects of the required measures opens this approach to interdisciplinary methodologies. In this paper, we first summarise the current state of research on the methodology established in Art. 25 sect. 1 GDPR, and pinpoint some of the challenges of incorporating interdisciplinary research methodologies. On this premise, we present an empirical research methodology and first findings which offer one approach to answering the question on how to specify processing purposes effectively. Lastly, we discuss the implications of these findings for the legal interpretation of Art. 25 GDPR and related provisions, especially with respect to a more effective implementation of transparency and consent, and provide an outlook on possible next research steps. Y1 - 2022 U6 - https://doi.org/10.1016/j.clsr.2022.105722 VL - 46 IS - Computer Law & Security Review PB - Elsevier Advanced Technology ER - TY - CHAP A1 - Jakobi, Timo A1 - Gerber, Nina A1 - Balthasar, Mandy T1 - Crafting Usable Security: Enhancing Public Understanding of Security and Privacy N2 - Gaps in knowledge lead to misunderstandings and uncertainty, including when dealing with IT. However, existing security and data protection advice has not yet been able to resolve these uncertainties. Even experts sometimes find it difficult to assess what is actually relevant for users. In order to raise awareness and understanding, relevant content from security and data protection advice materials should be identified and prioritized for users, take away uncertainties and thus enable successful usable security & privacy. Y1 - 2024 U6 - https://doi.org/10.18420/muc2024-mci-ws17-131 SP - 1 EP - 2 PB - Gesellschaft für Informatik eV ER - TY - JOUR A1 - Jakobi, Timo A1 - von Grafenstein, Maximilian A1 - Smieskol, Patrick A1 - Stevens, Gunnar T1 - A Taxonomy of user-perceived privacy risks to foster accountability of data-based services JF - Journal of Responsible Technology N2 - Data protection risks play a major role in data protection laws and have shown to be suitable means for accountability in designing for usable privacy. Especially in the legal realm, risks are typically collected heuristically or deductively, e.g., by referring to fundamental right violations. Following a user-centered design credo, research on usable privacy has shown that a user-perspective on privacy risks can enhance system intelligibility and accountability. However, research on mapping the landscape of user-perceived privacy risks is still in its infancy. To extend the corpus of privacy risks as users perceive them in their daily use of technology, we conducted 9 workshops collecting 91 risks in the fields of web browsing, voice assistants and connected mobility. The body of risks was then categorized by 11 experts from the legal and HCI-domain. We find that, while existing taxonomies generally fit well, a societal … Y1 - 2022 U6 - https://doi.org/10.1016/j.jrt.2022.100029 VL - 10 PB - Elsevier ER - TY - CHAP A1 - Freeman, Guo A1 - Zytko, Douglas A1 - Razi, Afsaneh A1 - Lampe, Cliff A1 - Candello, Heloisa A1 - Jakobi, Timo A1 - Aal, Konstantin Kosta T1 - New Opportunities, Risks, and Harm of Generative AI for Fostering Safe Online Communities T2 - The 2025 ACM International Conference on Supporting Group Work N2 - Recently, there is a growing trend of using generative AI systems and tools for fostering and protecting online collaborative communities. Yet, existing AI tools may introduce new risks and even harm to diverse communities’ online safety. How to better maximize the novel opportunities of AI and mitigate its emerging risks and harm for our future online safety is a critically needed discussion for the HCI community. Featuring experts from both industry and academia, the goal for this panel is to promote interdisciplinary, community-wide discussions and collective reflections on important questions and considerations at the unique intersection of AI and online communities, including but not limited to: how the design of AI systems may discourage existing online harm but also invite new online harm in various online spaces; how different populations, cultures, and communities may perceive and experience AI’s new roles for their online safety; and what new strategies, principles, and directions can be envisioned and identified to better design future AI technologies to protect rather than harm various online communities. Y1 - 2025 U6 - https://doi.org/10.1145/3688828.3700747 SP - 2 EP - 5 PB - ACM CY - New York, NY, USA ER - TY - CHAP A1 - Stevens, Gunnar A1 - Boden, Alexander A1 - Alizadeh, Fatemeh A1 - Walther, Michelle A1 - Krüger, Jana A1 - Jakobi, Timo T1 - Wie gehen Verbraucher: innen mit Onlinebetrug um? – Eine Literaturübersicht T2 - Handbuch Cyberkriminologie N2 - Die Lebenswelt von Verbraucher:innen wird zunehmend digitalisiert. Ein wachsendes Problem ist dabei die Online-Kriminalität. Der vorliegende Beitrag gibt einen Überblick über die Literatur zu Onlinebetrug. Dabei beschreiben wir verschiedene Formen des Onlinebetrugs und legen dar, welche Verbraucher:innen besonders von dieser Form der Kriminalität betroffen sind. Desweitern gehen wir in diesem Beitrag auf mögliche Auswirkungen für Betroffene ein und skizzieren Bewältigungsstrategien sowie mögliche Ansatzpunkte für Hilfsangebote für Verbraucher:innen. Y1 - 2022 SN - 978-3-658-35450-3 U6 - https://doi.org/10.1007/978-3-658-35450-3_42-1 SP - 1 EP - 22 PB - Springer CY - Wiesbaden ER - TY - JOUR A1 - Jakobi, Timo A1 - Pins, Dominik A1 - Stevens, Gunnar A1 - Alizadeh, Fatemeh A1 - Krüger, Jana T1 - Finding, getting and understanding: the user journey for the GDPR’S right to access N2 - In both data protection law and research of usable privacy, awareness and control over the collection and use of personal data are understood to be cornerstones of digital sovereignty. For example, the European General Data Protection Regulation (GDPR) provides data subjects with the right to access data collected by organisations but remains unclear on the concrete process design. However, the design of data subject rights is crucial when it comes to the ability of customers to exercise their right and fulfil regulatory aims such as transparency. To learn more about user needs in implementing the right to access as per GDPR, we conducted a two-step study. First, we defined a five-phase user experience journey regarding the right to access: finding, authentication, request, access and data use. Second, and based on this model, 59 participants exercised their right to access and evaluated the usability of each phase. Drawing on 422 datasets spanning 139 organisations, our results show several interdependencies of process design and user satisfaction. Thereby, our insights inform the community of usable privacy and especially the design of the right to access with a first, yet robust, empirical body. Y1 - 2022 U6 - https://doi.org/10.1080/0144929X.2022.2074894 VL - 41 IS - 10 SP - 2174 EP - 2200 PB - Taylor & Francis ER - TY - JOUR A1 - Hahn, Alexander A1 - Jakobi, Timo T1 - Strategic Privacy: Building Brand Equity Through Data Protection JF - DIGITALE WELT Magazin N2 - Privacy is no longer just a compliance requirement but a driver of trust, differentiation, and brand equity. This article explores how organizations can leverage privacy as a strategic asset by building favorable, unique, and strong brand associations. It outlines theoretical foundations, strategic implications for emerging and established brands, and future challenges such as the EU AI Act and evolving consumer expectations. Y1 - 2025 UR - https://digitaleweltmagazin.de/strategic-privacy-building-brand-equity-through-data-protection/ ER -