Caring about Sharing: User Perceptions of Multiparty Data Sharing

Data sharing between companies is typically regarded as one-size-fits-all in practice and in research. For instance, the main source of information available to users about how a company shares their data is privacy policies. Privacy policies use ambiguous terms such as 'third-parties' and 'partners' with regard to who data is shared with. In the real-world, data sharing has more nuance than is captured by these overarching terms. We investigate whether users perceive different data sharing scenarios differently through an online survey with scenarios that describe specific types of multiparty data sharing practices. We determine users' perceptions when explicitly presented with how their data is shared, who it is shared with, and why. We show that users have preferences and that variations in acceptability exist which depend on the nature of the data sharing collaboration. Users caring about sharing, necessitates more transparent sharing practices and regulations. on their perceptions of it. Research Questions. We study users' perceptions of multiparty data sharing via an online survey. We analyze users' perceptions of various data sharing events (termed as scenarios), what potential controls users want, and identify avenues for improving regulations and engineering better systems to meet those needs. To this end we address the following research questions (with salient results emphasized): RQ1: How does the overall acceptability vary across different types of multiparty collaborations? How do the types of companies involved further impact it? The overall acceptability of multiparty data sharing is lower for collaborations that are not reciprocal. The inclusion of a health company in nonreciprocal collaborations is even less acceptable. (Section 4.2). RQ2: How does acceptability vary in multiparty data sharing for different user controls (consent, purpose, retention)? Across user controls, preferences for consent vary the most between collaboration types, however, optin consent is, generally speaking, the most acceptable. (Section 4.1 and 4.2)