Abstract
The emerging digital services from domains such as smart cities, telecom, social media and entertainment, all depend on information that is traceable to individuals, the so-called Personally Identifiable Information (PII). For users privacy represents a condition for his/her trust, and for service providers it is essential to be able to claim privacy awareness as a prerequisite for their offerings. This is particularly important as the new EU privacy regulation is about to become operative, thus enforcing strict privacy requirements on the service providers and giving new rights to the users. We therefore argue that safe handling of PII is a condition for successful offering and adoption of such services. In order to increase user trust in the PII-dependent digital services and help a service provider to manage the privacy requirements, a practically usable decision support to continuously and transparently plan and follow-up privacy compliance, is needed. To this end, we have in our earlier work identified needs and requirements for decision support in the context of PII handling, and proposed an initial version of a so-called Privacy Scorecard. Results of a recent feasibility study of parts of the initial Privacy Scorecard were promising, but they also indicated needs for refinement of the Privacy Scorecard, as well as further evaluation. In this paper, we therefore propose a second version of the Privacy Scorecard, where the design and the usage guidelines are extended and further detailed. We also report on the results of a trial of the new version of Privacy Scorecard on a Mobility as a Service example. Our findings indicate feasibility and usefulness of the approach and suggest directions for further work. The future work suggestions include further refinement of the Privacy Scorecard approach with support for a cost-benefit analysis, tool support for continuous visualization of privacy goals and their achievement levels, as well as further evaluation of the approach with respect to usability and cost-effectiveness.