Obligations Management from the User Perspective Sample Clauses

Obligations Management from the User Perspective. Our work is driven by the vision that (non- expert) users of the UCPF shall be empowered to control their own personal privacy. Especially for the area of obligation management, we addressed its implementation from the perspective of normal users. The main questions were How can a non-technically- savvy user understand and manage obligations? and How can we assist such users in negotiating obligations with the providers of services used?' Our solution to the above questions was to implement an application, as part as the UCPF GUI, called “Obligations”, in which a user can specify his obligations easily. In the design stage we discarded the idea of defining new obligations at the time of adding a new rule. Mainly because it means an overload for the process of adding new permissions into the system and obligations, for us, are entities independent from access control. We believe that the natural way of thinking about obligations, from the perspective of users, is as a “set of privacy preferences to be enforced by the service provider on disclosed resources”. Thus, it follows that obligations should be specified per service and resource and not to depend on a rule specification. Therefore, we implemented a separate application where users can set up obligations per tuple (service, resource). For the development of the Obligation Manager and its application we followed the rule of providing some default setting, in a way that users do no need to take care of critical situations by themselves. Mandatory obligations, needed for keeping a proper level of privacy, were labeled as System obligations and excluded from the negotiation process. System obligations should be agreed-on by service providers during the registration process. The process is transparent to the user and only services that fulfill the registration requirements are available. Negotiable obligations were added to offer users a way to negotiate their privacy preference on secondary use. Both obligation types should be enforced by the enterprise privacy system. Hence, obligations must be defined in advance and known by both parties. A user then is limited to choose among known obligations, what means that he cannot specify new types of obligations. In our implementation, due to the lack of a standard definition of obligations, we developed our own set of negotiable obligations, listed in Figure 11. The question remaining at this point obviously is: How can a user setup his obligation policies with...