THEIA-XR: Identifications of Privacy Requirements (D2.3)

This document provides provide outcomes from Task T2.3, which extends the privacy-related work of Task T2.2. It focuses on identifying additional privacy requirements and relates to Task T3.1’s objective of analysing users’ perceptions of privacy and fair data use in the context of Extended Reality (XR) -enhanced technology. As one of the inputs, the document uses user-related findings of the Deliverable D3.1. The outcomes of the document will be used to formulate the guiding design principles of the Deliverable D7.4. The document begins by reviewing various privacy frameworks applicable in the XR technology domain. It highlights existing approaches to privacy in XR and emphasizes the importance of user-centred features in the design of privacy-respecting XR technologies. The summary then introduces the current European Union privacy approach, particularly the General Data Protection Regulation (GDPR), and describes the practical privacy-engineering methodology used to gather stakeholder requirements. This section also details the development and use of a questionnaire within a contextual inquiry. The questionnaire aimed to understand the balance between privacy concerns and expected data usage by participants. In the subsequent chapter, the summary outlines the elicited usable privacy requirements that should be integrated into the project. As the project follows the 'privacy by design' paradigm, the continuous work on further specifying and applying these high-level privacy requirements will follow within the framework of Work Package 3 (which includes the work on the privacy-related surveys Deliverable D3.3 and D3.8) and Work Package 7 (which encompasses Deliverable D7.3 and D7.6, the design guidelines and validation reports for privacy in both the first and final versions). The requirements will be incorporated in Deliverable D2.5 (Technology Analysis and Requirements Specification, final version).