This design pattern is part of the LINC’s research initiative focusing on interface design. It comes from frequent proposals made by participants of the Data & Design workshops to implement the principle of transparency provided in the GDPR. It can be used and adapted to the specific context of your services and products. However, its reuse as such do not guarantee compliance with the GDPR in general and the principle of transparency in particular.
This pattern is intended to draw the individual’s attention to a new or important issue concerning their personal data, such as an update to the site’s privacy policy or the extended activation of a feature such as the use of geolocation. Notifications can thus act as an alert, a reminder or a simple communication of information. They actively bring specific information to people and potentially suggest actions to them accordingly.
Using the pattern in the user journey
► When signing-up : when a notification system relating to personal data is set up on a service, it may be interesting to allow people to set their preferences at the time of registration, for example during the onboarding process. The person can thus select the notifications they wish to receive or not, as well as their frequency and medium (email, SMS, web). For example, they can choose to receive a notification reminding them of the use of their geolocation after three months, as is implemented in Instap.
► When using, actively or passively, the service: notifications can be sent to people either directly in the service or application, or on the device used to access the service (push notification). The modality is to be chosen according to the context of use and they can be combined. For example, to inform about the update of the privacy policy of the service, an email can be sent as well as a notification in the service, accessible to the person when he/she opens the service or the application. In the case of access to an account from a new device, a push notification can be sent to the main device as well as an email or SMS. Finally, certain events can be notified through the use of icons appearing in the interface that remind the person of the background use of a particular data by the service or application. For example, when using a navigation assistance application based on geolocation, a potentially sensitive data, an icon may appear in the application or device to indicate its use.
► In case of a problem with the data or its use: Notification is a particularly effective way of informing people about adverse events involving their data, such as a data breach resulting in publication on other sites or compromised account security due to leaked credentials (e.g. email and password). For these types of events, which are completely invisible to people, notification allows them to be quickly informed of the problem and the potential things they can do to protect themselves and minimise any risk to personal information. For example, in the case of a login leak, people can be advised to change their passwords. Notification can be implemented in addition to a fixed element or other means of communicating the issue (e.g. email).
► When setting one’s preferences : notifications can be integrated as feedback following a setting action. Thus, the notification can appear one month later to remind the person of their choice and use examples to illustrate the consequences of the setting in concrete terms. For example, one month after consenting to the use of one’s data for personalised advertising purposes, a notification appears reminding the individual of this consent and giving a “personalised” example of the purpose thus accepted: “We have determined that you like music and hard rock, so we have offered you an advertisement for the Greatplay concert”. This delayed association between information and action allows the person to have a concrete feedback on the choice they have made.
Tips
► Care should be taken not to overburden people with too many notifications, as this can lead to a form of cognitive overload. Apart from being irritating to use, this could ultimately have a counterproductive effect on people, leading them to ignore notifications altogether. Furthermore, some operating systems manage “notification budgets”: if your application tries to send too many notifications, some will be ignored. Be careful in this case to ensure that data protection notifications are received and prioritised.
► It is important to ensure that notifications are delivered through the right channel and at the right time for the person to ensure that they are aware of the information and potentially have time to take action if necessary or desired;
► It is important to choose an appropriate notification channel: some notifications are persistent (email, account alert) and others ephemeral (mobile notification). The choice must take into account the context of use, the need for the user to perform an action or to keep a record.
► Notifications are commonly used to alert the user to new content or an alert. There is a risk that notifications related to data protection and privacy to be drowned out by them, as the person will not identify them as addressing specifically personal data matters. It is therefore preferable to use a distinctive style for such notifications. This is particularly the case in mobile environments where operating system providers offer push notification services. Again, a distinction should be made between notifications related to data management and those related to the use of the service (e.g. a news alert). Some mobile operating systems allow applications to have different notification channels. In this context, it may be useful to have a channel dedicated to “Security and Privacy” information.
► While, depending on the case, a notification alone does not always meet the information obligation under the RGPD, it can act as an initial alert to access the full information.
► Alerts should not prompt the sharing of more data or the changing of settings that would impact the privacy of the individual.
Examples
Possible approach (animation)
Attention point (animation)
Related patterns
