Evaluating the Effectiveness of Privacy and Security Promotion Strategies

Privacy and security concerns are one of the relevant action fields of regulators. The rise of privacy concerns is, due to the capabilities of computing systems to aggregate information to generate profiles or other aggregates that impact the personal life of people. This has led to regulations like the UE General Data Protection Regulation (GDPR) and to the spread of initiatives aiming to raise awareness in people. Data show that privacy problems are known to people; however, practice of privacy and security aware behavior seems to be oddly not part of the habits of the same population. In this paper we propose a model of privacy and security effectiveness promotion strategies and a related evaluation method. The strategies we are interested in aim at aligning actual behavior to awareness levels. We derive an example of strategy starting from literature data and propose an analysis method that is based on Pythia, a tool for the analysis of graph-based probabilistic cause-and-effect models.