In Part 1, we covered practical implementation of data protection principles in user interfaces. Focusing on Privacy by Default also involves designing interfaces that empower data subjects to easily exercise their rights. This article explores another important component of Privacy by Default that UX designers should consider - implementing mechanisms to exercise data subjects’ rights.
Data Subjects’ Rights
Under data privacy regulations such as the GDPR, data subjects have specific rights regarding their personal data. UX designers should consider adding a section to websites and applications with an opportunity to send Data Subjects’ Requests (DSRs) to the company. For example, it can be a dropdown list feature empowering users to choose the necessary right from the list and exercise it in a clear and accessible manner.
Your users should be able to exercise the following data subjects’ rights:
1. Right to Access: Users can request access to their personal data held by an organization.
Design Tips:
- Request Access Button: Include a prominent "Request My Data" button in the user settings or profile section.
- Clear Instructions: Provide step-by-step instructions or a wizard to guide users through the access request process.
- Progress Indicator: Add a progress indicator to show the status of the data request, giving users transparency on how long the process will take.
2. Right to Rectification: Users can request corrections to inaccurate or incomplete data.
Design Tips:
- Edit Option: Implement clear "Edit" buttons next to each data field within user profiles.
- Error Identification: Highlight data fields that need correction and provide suggestions for changes.
- Confirmation: Include a confirmation step to ensure users verify the changes before they are saved.
3. Right to Erasure (Right to be Forgotten): Users can request deletion of their personal data.
Design Tips:
- Delete Account Button: Add a clearly labeled "Delete My Account" or "Erase My Data" button in the account settings.
- Guided Process: Create a step-by-step process to guide users through the deletion request, including the implications of data erasure.
- Confirmation Dialog: Use a confirmation dialog to prevent accidental deletions and ensure users understand the consequences.
4. Right to Restrict Processing: Users can request the limitation of how their data is processed.
Design Tips:
- Restrict Processing Toggle: Add a "Restrict Processing" toggle in the privacy settings menu.
- Explanatory Tooltips: Include tooltips or help icons that explain what restricting processing means and how it affects their data use.
- Status Notification: Notify users when their processing restriction request has been successfully implemented.
5. Right to Data Portability: Users can request their data in a machine-readable format to transfer to another service.
Design Tips:
- Download Data Button: Provide a "Download My Data" button in the user settings.
- Format Options: Offer data in common formats (e.g., CSV, JSON) to ensure compatibility with other services.
- Simple Instructions: Include clear instructions on how to use the downloaded data with other services.
6. Right to Object: Users can object to data processing for specific purposes, such as marketing.
Design Tips:
- Opt-Out Links: Include clear "Opt-Out" links in all marketing communications and within the privacy settings.
- Objection Form: Provide a simple form for users to submit their objections to data processing.
- Confirmation and Feedback: Send confirmation emails or notifications once an objection has been processed.
7. Rights Related to Automated Decision Making: Users can request human intervention in automated decisions affecting them.
Design Tips:
- Explanation Section: Include a section in the privacy settings that explains how automated decisions are made and what data is used.
- Request Review Button: Add a "Request Human Review" button in relevant areas of the interface where automated decisions are displayed.
- Support Contact: Provide contact information or a support form for users to get in touch if they have concerns about automated decisions.
Final thoughts
Empowering data subjects to exercise their rights easily and transparently is essential in today’s digital environment. Through clear and accessible privacy settings, UX designers can create user experiences that respect and protect privacy, fostering a positive and trustworthy relationship between users and digital services.