What HCI Can Do for (Data Protection) Law—Beyond Design

Abstract

AbstractUsable Privacy often works at the intersection of regulation to thrive for more usable solutions to normative provisions. The regulatory provisions themselves, or the legal standards of their implementation, however, typically remain unquestioned in the design process. This way, HCI falls short of its potential to inform regulation with insights on human expectations, attitudes, and behavior in the real world, to make law more effective. In this chapter, we present the extensive impulses that are also coming from legal sciences themselves motivating a more substantial collaboration of HCI and legal sciences. We turn to the example of data protection legislation and discuss the legislative intentions surrounding the landmark case of the European General Data Protection Regulation (GDPR). We show how GDPRs’ requirement of “effectiveness” of technical and organizational protection measures opens the door for more in-depth collaboration with HCI and provide examples of high potential for such joint research.