Promoting Privacy Considerations in Real-World Projects in Capstone Courses with Ideation Cards
Promoting Privacy Considerations in Real-World Projects in Capstone Courses with Ideation Cards
复制标题
DOI：
10.1145/3458038
复制
发表时间：
2021-10
期刊：
影响因子：
--
通讯作者：
Y. Tang;Morgan L. Brockman;S. Patil
中科院分区：
文献类型：
--
作者：
Y. Tang;Morgan L. Brockman;S. Patil
今天开发的几乎所有软件都侵犯了最终用户的隐私，需要遵守相关法规。因此，越来越多的人呼吁将遵守隐私法规的考虑纳入整个软件工程生命周期。然而，软件工程师通常在技术领域接受培训，在隐私的社会技术考虑方面缺乏足够的知识和支持。隐私构思卡试图通过使软件开发人员可以理解和操作隐私遵从性来解决这个问题。然而，隐私构思卡在现实世界软件项目中的应用还没有得到系统的研究。构思卡片作为一种教学工具的有效性也尚未得到检验。我们通过研究本科生团队如何在Capstone项目中应用隐私构思卡来解决这些差距，这些项目涉及为行业赞助商构建真实世界的软件。我们发现，隐私构思卡促进了对项目与隐私法规一致程度的更大考虑和理解。我们从学生关于遵守隐私的讨论中确定了三个主要主题：(I)定义个人数据；(Ii)分配遵守隐私的责任；以及(Iii)确定和行使自主权。结果表明，在现实世界的项目中应用卡片需要仔细考虑交叉因素，例如卡片使用的阶段和开发人员可以获得的自主权。在教学上，构思卡片可以促进对项目中特定组成部分的低水平认知参与(特别是意义构建和解释的认知过程)。在构思阶段，较高水平的认知过程相对较少。这些发现提供了重要的见解，有助于加强顶石指导和改进隐私构思卡，以增加它们对所开发软件的隐私属性的影响。
Nearly all software built today impinges upon end-user privacy and needs to comply with relevant regulations. Therefore, there have been increasing calls for integrating considerations of compliance with privacy regulations throughout the software engineering lifecycle. However, software engineers are typically trained in the technical fields and lack sufficient knowledge and support for sociotechnical considerations of privacy. Privacy ideation cards attempt to address this issue by making privacy compliance understandable and actionable for software developers. However, the application of privacy ideation cards in real-world software projects has not yet been systemically investigated. The effectiveness of ideation cards as a pedagogical tool has not yet been examined either. We address these gaps by studying how teams of undergraduate students applied privacy ideation cards in capstone projects that involved building real-world software for industry sponsors. We found that privacy ideation cards fostered greater consideration and understanding of the extent to which the projects aligned with privacy regulations. We identified three main themes from student discussions of privacy compliance: (i) defining personal data; (ii) assigning responsibility for privacy compliance; and (iii) determining and exercising autonomy. The results suggest that application of the cards for real-world projects requires careful consideration of intersecting factors such as the stage at which the cards are used and the autonomy available to the developers. Pedagogically, ideation cards can facilitate low-level cognitive engagement (especially the cognitive processes of meaning construction and interpretation) for specific components within a project. Higher-level cognitive processes were comparatively rare in ideation sessions. These findings provide important insight to help enhance capstone instruction and to improve privacy ideation cards to increase their impact on the privacy properties of the developed software.