Privacy Implications of Online Consumer-Activity Data: An Empirical Study.

Web users allow online organisations to collect vast amounts of information about them and their activities, often in exchange for free services. But now there is a growing expectation that this users' data, generally called consumer data, should be given back to the users who helped create them so that it can be exploited for their benefit. In addition, there is a realisation that such a release of users' data could only promote greater transparency and accountability of organisations collecting them. As with any process where data is published, there is a risk that it could potentially lead to complex privacy issues. In this paper, we focus on what we believe is a significant and yet least explored data type: consumer-activity data, i.e., data (Web access logs) generated by an organisation which tracks the usage and interactions of its online services and resources. We conducted an exploratory qualitative study of 12 users to investigate what might be the consequences of making such consumer-activity data available to the users who generated them, especially its privacy challenges, both from an organisation's point of view and that of individuals whose online activities were being tracked. This was achieved by exposing the study's participants to a `personal analytics' dashboard which provided access to information on their usage and interactions with online systems of a large educational organisation (The Open University in the UK). The findings from our study showed that though there were potential benefits for the users, there were several privacy risks which are yet to be addressed.