Researchers at the University of Würzburg and the Federal Commissioner for Data Protection and Freedom of Information have developed a questionnaire that accurately measures data protection literacy using just four questions.
The protection of personal data is now a key aspect of individual literacy in everyday life. Nevertheless, a contradiction can regularly be observed amongst the general public, which researchers describe as the 'privacy paradox'. Here, there is often a wide gap between the concerns expressed regarding the protection of personal data and people's actual behaviour when dealing with such data.
Although many people value their privacy, they nevertheless carelessly disclose information in the digital sphere - for example, by thoughtlessly accepting complex cookie banners. The reasons for this are often gaps in knowledge and targeted design strategies by platforms that steer users towards disclosing their data. However, data protection is not limited to the digital sphere. Sensitive information is also processed in everyday offline life, for example when filling in forms or making telephone calls.
The findings of a new study now help to make this phenomenon and the underlying competence easily measurable for the first time. The study is presented in a new series of publications by the Federal Commissioner for Data Protection and Freedom of Information (BfDI): the 'Data Barometer Background'. The aim of this series is to strengthen collaboration between the BfDI and the academic community.
The study was led by Professor Carolin Wienrich, Chair of Psychology of Interactive Systems at Julius-Maximilians-Universität Würzburg (JMU), and her research assistant Dr André Markus. Together with Dr Christian Groß, they have developed a short scale that can be used to assess respondents' competence in the area of 'data protection' quickly and easily. Christian Groß is an adviser on the BfDI's executive team and is the project manager for the Data Barometer.
A compact tool for practical use
"In order to promote data protection literacy on a broad scale, the academic community needs tools that are both precise and efficient," says Carolin Wienrich, explaining the background to this work. Until now, measuring data protection literacy was considered too complex for standardised population surveys; the new short scale fills this gap. It consists of just four questions and thus represents a significant innovation compared with previous, often very extensive questionnaires. This means it can be easily integrated into larger, multi-thematic studies.
The scale covers the key dimensions of data protection literacy. Respondents are asked to rate how well-versed they are in the respective areas on a scale from 1 (I haven't given this any thought at all) to 5 (I am very familiar with this and could explain it to others). The final analysis yields an overall score of between 4 and 20 points. Individual results can then be categorised using the established normative values: those scoring between 4 and 10 points are considered to be below average in terms of knowledge; those scoring 16 to 20 points are deemed to handle data protection professionally.
The four areas of data protection competence are:
- Knowledge of institutional practices: what data organisations store and what they use it for.
- Knowledge of data protection strategies: understanding the ways in which one can effectively protect one's own data.
- Knowledge of data protection law: understanding one's own rights in relation to organisations.
- Factual knowledge of data protection: an understanding of current debates and potential risks.
The research team validated the new scale using a large, representative survey on the introduction of the electronic patient record (ePA). A total of 1,666 people were surveyed as part of the study. The validity of the scale was supported, amongst other things, by the fact that individuals with higher scale scores also had a greater factual understanding of data protection-related aspects of the electronic patient record (ePA).
Digital participation is a matter of age and education
The results show clear differences: men achieved a higher mean score than women. The gap in educational attainment is significant: on average, people with a university degree achieved demonstrably higher scores than respondents without a university degree. The factor of age is particularly pronounced: the over-60s group demonstrates noticeably lower competence than the younger age groups aged 18 to 59.
"Behind these figures lie psychological and structural barriers: older people more frequently report lower digital self-efficacy and, in some cases, feel less confident when implementing protective measures," explains André Markus. For people with a lower level of education, limited access to relevant information and fewer opportunities to put these skills into practice may also play a role.
From knowledge to targeted support
The project's long-term vision is to embed knowledge of digital self-determination and the corresponding skills across society as a whole. The findings will serve as a basis for tailoring educational programmes more precisely to the needs of specific groups in future.
Furthermore, the findings can be used to make applications more user-friendly through privacy-friendly default settings. The new measurement tool provides the necessary evidence to strengthen the competent handling of data as a cornerstone of digital participation.
BfDI Data Barometer
Through the Data Barometer, the BfDI regularly conducts representative surveys to give the public a voice on current data protection issues. The research focuses on what expectations people have regarding data protection, how well-informed they are, and how they act in specific situations.
"With the Data Barometer, the BfDI contributes to an evidence-based debate on data protection and digitalisation. Increased collaboration with the academic community is intended to ensure that the Data Barometer is methodologically robust and capable of engaging with current academic discourse," says Christian Groß
Through its 'Background' series, the BfDI documents the scientific foundations of the Data Barometer and conducts in-depth analyses based on the survey results.
The publication (in German language) is available free of charge on the BfDI's website .
The short scale was developed as part of the AIL AT WORK research project. This interdisciplinary project researches and develops approaches to measuring and promoting skills in dealing with AI and digital technologies. Further information on AI and data protection skills, as well as all the scales, can be found on the project's website .
