Most people say they care about privacy, but their everyday behavior does not always match their concerns. Now, researchers have developed a simple four-question test designed to measure how well people understand and protect their personal data.
This gap between what people say about privacy and what they actually do is sometimes called the “privacy paradox.” Someone might be worried about companies collecting personal information, for example, but still click “accept all” on a cookie banner without checking what they are agreeing to.
Part of the problem is a lack of knowledge. Websites and apps can also use complicated menus and carefully designed prompts that encourage people to share more information than they otherwise would.
And privacy is not only an online issue. People regularly provide sensitive information while completing paper forms, talking on the phone or dealing with businesses and government organizations.
Researchers from Julius-Maximilians-Universität Würzburg and Germany’s Federal Commissioner for Data Protection and Freedom of Information, or BfDI, wanted an easier way to measure people’s ability to deal with these situations.
Their solution is a short questionnaire consisting of only four questions. The researchers say this makes it much easier to include in large public surveys than previous assessments, which could be lengthy and complicated.
The questions cover four main areas. They examine whether people understand what information organizations collect and how they use it, whether people know strategies for protecting their own information, whether they understand their legal privacy rights, and whether they have factual knowledge about current privacy issues and potential risks.
For each area, participants rate their knowledge from one to five. A score of one means they have not really thought about the issue, while five means they know the subject well enough to explain it to someone else.
The four answers produce a total score between four and 20. Scores between four and 10 indicate below-average knowledge, while people scoring between 16 and 20 are considered highly competent in handling data protection issues.
To test whether the questionnaire actually works, the researchers used it in a representative survey involving 1,666 people. The survey focused on Germany’s electronic patient record system.
People who received higher scores on the four-question test also tended to demonstrate better factual knowledge about privacy issues surrounding electronic patient records, supporting the usefulness of the new measurement tool.
The researchers also discovered significant differences between groups.
People with university degrees scored higher on average than those without degrees, while men had higher average scores than women. Age produced an especially noticeable difference: People over 60 showed lower levels of data protection competence than adults aged 18 to 59.
The researchers say several factors could contribute to these differences. Older adults may feel less confident using digital technologies or putting privacy-protection measures into practice. People with less education may have fewer opportunities to access relevant information or develop these skills.
The goal is not simply to identify who knows more about privacy. The researchers hope the test will help governments, educators and other organizations understand which groups need additional support.
That could lead to better privacy education and more user-friendly digital services with stronger privacy settings enabled by default.
As more of everyday life involves sharing personal information, understanding how that information is collected, used and protected is becoming an increasingly important part of participating confidently in the digital world.
