PRIvacy-aware personal data management and Value Enhancement for Leisure Travellers (PriVELT)

Lead Research Organisation: University of Kent
Department Name: Sch of Computing

Abstract

The consumption of a seamless travel experience requires travellers to share their personal data with numerous individual travel and tourism service providers. There is a general lack of guidelines on how travellers should manage their data sharing activities while travelling, which lead to two unwanted situations: 1) travellers simply share their data without understanding the privacy and security risks and consequences; 2) travellers become over-worried about such risks so that they stop sharing data, which reduce their overall travel experience and prevent organisations to provide better (more personalised) services. The wide spectrum of data sharing with many entities including on social media, instant messaging and other online social platforms makes the situations worse as travellers often cannot see a big picture of how they have shared their data in the past to adapt their data sharing behaviour.

PriVELT will address the two-sided challenges associated with offering a seamless and highly personalised end-to-end travel experience while balancing the privacy and security needs of leisure travellers. On the one hand, travel service providers need to identify effective ways to incentivise travellers to share personal data in exchange of tangible benefits such as higher quality service, personalised offers, discounts, or add-on services. On the other hand, travellers need to better manage the sharing of their personal data to minimise privacy-related risks while optimising value from a seamless travel experience. Therefore, PriVELT aims to develop an innovative user-centric and privacy-aware digital platform that will empower leisure travellers to better manage the sharing of their personal data with travel service providers and other entities and foster new business opportunities for the travel and tourism industry through encouraging better (more transparent and effective) usage of travellers' data.

PriVELT will develop the user-centric platform based on a holistic socio-technical framework of privacy-related traveller behaviour. The framework will provide intervention points to effectively nudge travellers to share their personal data more responsibly. PriVELT draws from theories in social sciences, including consumer psychology and behavioural economics, to better explain how consumers make decisions to disclose personal information in exchange for values. PriVELT also considers travellers' psychological limitation, such as limited understanding of privacy risks, which may induce irrational behaviour in privacy-related decision-making process while traveling.

In order to achieve its aim, PriVELT's research will be interdisciplinary, co-created, theory-informed, evidence-based, user-centric, and real world-facing. PriVELT will combine both social and technical methods to collect and analyse data, integrating focus groups and interviews with relevant stakeholders, a panel survey, lab-based user studies, and field studies with real domestic and international travellers (end users) to identify and apply an array of effective nudging strategies to inform travellers with risks and consequences of sharing personal data while traveling.

One of the key outcomes will be a digital platform that will be used for: 1) monitoring travellers' data sharing activities; 2) enhancing situational awareness of privacy risks related to data shared; 3) providing an innovative way of achieving dynamic consent management for participants, allowing dynamic updating of the consent while travelling; ; 4) providing better recommendations for travellers to adapt their data sharing behaviours. The digital platform will be composed of three main components: 1) tools at the traveller (user/client) side in the form of a mobile app, 2) an infrastructure and tools at the server side for anonymised data aggregation and analytics purposes, and 3) the API and user interfaces for consumers of data shared by travellers.

Planned Impact

The Je-S form's "Academic Beneficiaries" field explains the expected academic impact in detail, so here we focus on economic and societal impact.

PriVELT will benefit leisure travellers by 1) empowering them with better management of personal data through enhanced knowledge and control of the sharing of personal data with trusted stakeholders while traveling; 2) informing them about the risks and consequences of oversharing personal data; 3) providing them opportunities to obtain tangible benefits, such as personalised offers, discounts, add-on services, etc., in exchange of sharing personal data; 4) providing them with a seamless end-to-end travel experience through better service integration. In a longer term, with a continuous use of our platform, controlled personal data sharing can be habit forming. Therefore, PriVELT can help foster a more responsible personal data management behaviour and culture amongst citizens for a safer cyber-physical environment.

PriVELT will benefit various stakeholders, including travel service providers (airlines, hotels, tour operators, cruise, tourism marketers, travel agents, etc.), government bodies, and other related industries (insurance, banking, retail). Travel service providers will be able to take advantage of the innovative and efficient ways of improving their services from a better (more transparent and effective) use of travellers' data through intelligent personalisation solutions. Further, PriVELT will facilitate the coordination among various stakeholders to deliver a seamless end-to-end travel experience. This will create opportunities for travel service providers to enhance their service or create new service offerings for travellers. As a result, PriVELT will play a role in stimulating the growth of the travel and tourism industry in the UK and worldwide.

Additionally, travel and tourism stakeholders will benefit from serving more responsible customers, hence reducing risks of misuse of personal data, which may have future consequences on their infrastructure and other customers. This benefit can extend to relevant industries who may serve leisure travellers along their journey.

Our findings regarding user responses to incentives and dynamic consent management will inform government authorities (e.g., border control) and other stakeholders in the travel and tourism industry such as Expedia (member of our SG) to design better interfaces when obtaining travellers' personal data to enhance trust and encourage compliance. This benefit can be generalised for other designers of user interfaces involving the capturing and storage of user personal data.

Vendors and service providers offering predictive analytics and business/marketing intelligence solutions such as PredicSis.ai (member of our SG) will benefit from PriVELT's knowledge base (based on theory and empirical research) and the automated approach (based on artificial intelligence) to contextualisation and personalisation applied in the development of our software tool. These vendors will have opportunities to improve their solutions and/or create new platforms.

International and local travel and tourism organisations such as World Travel & Tourism Council (member of our SG) will benefit from PriVELT as the developed socio-technical framework will provide a more effective way to foster coordination among tourism businesses and collaboration with government to raise awareness of privacy risks and to induce responsible data management behaviour.

Economically speaking, the project can help 1) prevent or reduce costs of misuse of personal data by empowering leisure travellers to make informed decisions; 2) improve efficiency in travel service personalisation through intelligent personalisation solutions; 3) create new business opportunities that contribute directly to the economy; 4) government and communities ensure safety of citizens while traveling overseas, thus reduce costs of risk alleviation.
 
Description We have found out a new method for modelling privacy issues using a user-centric graphic model based on flows of personal data shared by a target user, which can be used to automatically detect privacy issues and provide enhanced awareness and recommendations to the user for balancing privacy and value enhanced via data sharing.

We have produced a first version of the socio-technical framework for balancing privacy and value enhancement, tailored for leisure travels but generalizable to other application areas.

Through analysis of data collected from a large panel survey of leisure travellers, we have identified a number of ways to cluster users into different profiles and a machine learning based method to automatically classify users.

Through the development of an Android app for the project, we have proved that it is feasible to implement key components of the socio-technical framework for end users.
Exploitation Route The project is currently on track and we will continue to conduct the remaining research. The Android app is expected to be ready for a number of field studies with real travellers from summer 2020, so that we can collect real world data to validate the effectiveness of the proposed socio-technical framework, different tools developed and the UI of the Android app. Research papers published and to be published will help inform other researchers and practitioners to provide better privacy-aware solutions to users. If the Android app proves a big success, we may consider setting up a spin-off to grow it into a proper commercial product. The work on the Android app can also provide insights to the OS vendors to improve their support on security and privacy critical apps.
Sectors Communities and Social Services/Policy,Creative Economy,Digital/Communication/Information Technologies (including Software),Education,Leisure Activities, including Sports, Recreation and Tourism,Culture, Heritage, Museums and Collections,Transport

URL https://privelt.ac.uk/
 
Description PhD student training - involvement in research on GDPR and blockchain
Geographic Reach Europe 
Policy Influence Type Influenced training of practitioners or researchers
Impact A PhD student funded by a non-UK source (Turkey) has been involved in the research work of the EPSRC funded project PriVELT (EP/R033749/1) since October 2019. The research is about the tension between GDPR and blockchain, as part of Task 1.4 of PriVLET. A systematic literature review is being conducted on related work. Being involved in the research has helped train the PhD student to be familiar with research methods and collaboration with a larger research team including an expert from Law. The research is also related to the PhD student's own research topic, so can help shape his research in future.
 
Description PhD student training - involvement in research on personal data management platforms
Geographic Reach Europe 
Policy Influence Type Influenced training of practitioners or researchers
Impact A PhD student at the University of Kent has been involved in part-time research of the EPSRC funded project PriVELT (EP/R033749/1, EP/R033609/1), recruited by the University of Warwick but also working with other project members at the University of Kent. His main research is on developing software libraries for a research prototype of the PriVELT project. He started in 2019 and his work is expected to continue until the end of the project.
 
Description Student project "Algorithms and tools for protecting privacy of leisure travellers"
Geographic Reach Europe 
Policy Influence Type Influenced training of practitioners or researchers
Impact The student project was defined as part of the EPSRC funded research project PriVELT (EP/R033749/1). Two MSc students at the University of Kent have been working on the projects from December 2019 as paid part-time student research assistants, and a third one joined in Feb 2020 to form a MSc dissertation project. The project involves development and usability testing of an Android app for WP3 of PriVELT and implementation of some algorithms in WP2. The students are supervised by the PI of PriVELT, and working closely with some other researchers of PriVELT. The project will finish by early September when all the students will submit their dissertations. The work conducted by the two first MSc student also helped support software development of another EPSRC funded project ACCEPT (EP/P011896/2).
 
Description Student projects on GDPR vs blockchain
Geographic Reach Multiple continents/international 
Policy Influence Type Influenced training of practitioners or researchers
Impact A number of Turkish students have been involved in two MSc dissertation projects that were inspired by research in the EPSRC funded project PriVELT (EP/R033749/1). The projects are still ongoing but the training impact has been produced as the students learned how to conduct research on an interdisciplinary topic and with overseas researchers from the UK.
 
Title A User-Centric Semantic Model for Representing and Discovering Privacy Issues 
Description A computational model for representing and discovering privacy issues related to data sharing activities of a target user was developed and two papers have been published (http://hdl.handle.net/10125/64541 and https://doi.org/10.1007/978-981-15-1304-6_21). Two research presentations have been given to advocate the method to the research community. 
Type Of Material Computer model/algorithm 
Year Produced 2019 
Provided To Others? No  
Impact This is still the early stage of the method being made public, so its scientific impact is still to be seen. Some researcher have discussed with the authors on the proposed method. 
 
Title Cyber Securtiy Taxonomy 
Description As part of a research paper (https://doi.org/10.1145/3339252.3339282), we produced a data-driven general taxonomy to cover many different aspects of cyber security information online. The whole taxonomy has been released as open data and a website is set up to allow interactive visualisation of the taxonomy. 
Type Of Material Computer model/algorithm 
Year Produced 2020 
Provided To Others? Yes  
Impact The taxonomy was just released a few weeks ago now, so its impact is still to be seen. We will disseminate it more widely and plan to add support to allow other researchers to co-evolve the taxonomy. The taxonomy is hosted on the website of Kent Interdisciplinary Research Centre in Cyber Security (KirCCS), EPSRC funded Kent ACE-CSR (EP/S018964/1), and will be maintained as part of core open data from KirCCS. 
URL https://cyber.kent.ac.uk/research/cyber_taxonomy/
 
Description Partnership with WMG Accelerator 
Organisation University of Warwick
Department WMG Accelerator
Country United Kingdom 
Sector Academic/University 
PI Contribution a working group with the WMG Accelerator, to embed findings and software toolsets into their cohort and maximize impact.
Collaborator Contribution making cohort businesses available to pilot findings from the research project.
Impact see software section.
Start Year 2019
 
Title Android libraries for personal data management paltforms 
Description As part of the EPSRC funded project PriVELT (EP/R033749/1), a number of Android software libraries have been developed to allow easy access from Android apps to a couple of personal data management platforms (DataBox and HAT, both were outcomes from EPSRC funded projects). The software is still in its early stage of development and will be made open source later. The development started in 2019 and the more stable versions of the libraries were made available in 2020. 
Type Of Technology Software 
Year Produced 2020 
Impact They are still in its early stage, but other team members of the PriVELT project have been looking at using the libraries for developing a research prototype for the project. 
 
Title PriVELT Android app and data extraction libraries 
Description As part of the EPSRC funded projects PriVELT (EP/R033749/1) and ACCEPT (EP/P011896/2), work on WP3 aims at producing an Android app that will allow leisure travellers to monitor how their personal data are shared with different entities before, during and after travels and provide personalised recommendations on how to better balance their privacy and travel experience. At the time of this submission (03/2020), a number of Android libraries for automatically logging into different online services and extracting data have been produced, and a first prototype of the Android app has been produced. The app has not been released under an open source license or made publicly available, but the project plans to do so at a later time of the project or after the project's end. A number of student developers have contributed to the development of the software. The development work started in 2019 but the first prototypes were released internally in 2020. 
Type Of Technology Software 
Year Produced 2020 
Impact Since the software has not been publicly released, it has not produced impact out of the project team yet. It however helped train a number of MSc students to learn how to conduct applied research. 
 
Description Cyber cecurity activity sheet for school pupils 
Form Of Engagement Activity A magazine, newsletter or online publication
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Schools
Results and Impact Shujun Li and Jason Nurse, "How to Beat the Cybercriminals and Stay Safe Online," Futurum Careers, Issue 4, pages 32-33, March 2020, DOI:10.33424/FUTURUM43. This article is published both in press and online, and the EPSRC funded Kent ACE-CSR (EP/S018964/1) is planning to run a number of workshops to engage with local school pupils. The article covers research done in EPSRC funded projects ACCEPT (EP/P011896/2) and PriVELT (EP/R033749/1), and other wider research at the Kent ACE-CSR.
Year(s) Of Engagement Activity 2020
URL https://doi.org/10.33424/FUTURUM43
 
Description Kent Cyber Security Forum (KCSF) 2019 
Form Of Engagement Activity Participation in an activity, workshop or similar
Part Of Official Scheme? No
Geographic Reach Regional
Primary Audience Industry/Business
Results and Impact KCSF 2019 is the 2nd annual public engagement event of the Kent ACE-CSR, and this event had a special focus on serving local businesses and university students. It was attended by a good range of people from universities, industry and government. A number of research projects and external organisations supported this event and some public media sent journalists to the event. A marketing video was made for the event which has been used to help advertise the work of Kent ACE-CSR provides to the general public. A more detailed explanation of the event can be found at the event's web page.
Year(s) Of Engagement Activity 2019
URL https://cyber.kent.ac.uk/events.html#KCSF2019
 
Description Panel discussion "Data Privacy and Cyber Security" at ENTER 2020 conference 
Form Of Engagement Activity A formal working group, expert panel or dialogue
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Other audiences
Results and Impact This is a panel chaired by PI of the EPSRC funded project PriVELT (EP/R033749/1), which involved a researcher and two industrial panelists to talk about cyber security and privacy in the e-tourism context. The panel was part of the ENTER 2020 (International eTourism Conference), the 27th Annual Conference Organized by IFITT, University of Surrey, UK, which is co-sponsored by the PriVELT project and chaired by PriVELT's Surrey PI. The audience was a mixture of researchers and practitioners from both HEIs and industry. There were some research students as well.
Year(s) Of Engagement Activity 2020
URL https://enter2020.ifitt.org/speaker/shujun-li/
 
Description Poster presentation at a Machine Learning workshop 
Form Of Engagement Activity Participation in an activity, workshop or similar
Part Of Official Scheme? No
Geographic Reach Regional
Primary Audience Industry/Business
Results and Impact This is a workshop organised jointly by the Kent Innovation and Enterprise with School of Computing, where posters about EPSRC funded project ACCEPT, PriVELT and the Kent ACE-CSR were displayed. The main audience of the event was businesses from local regions.
Year(s) Of Engagement Activity 2019