Toward privacy-sensitive human–robot interaction: Privacy terms and human–data interaction in the personal robot era

1 Introduction

We live in an era where collaborative robots have become an essential element of the industrial shop floor [1], and health-care robots are deployed to fight a global virus outbreak [2]. At the same time, domestic robots enter more modern households, and many users accept them as part of their everyday life [3,4]. As a result, we notice a booming increase in human–robot interactions where humans share workspaces, collaborative tasks, and, eventually, significant parts of their daily living environments with robots [5]. However, these human–robot interactions are as good as the data we feed them. Therefore, detailed records of user interactions may be crucial to uncover user needs, preferences, and expectations and develop systems that add value to the user [6]. Understanding the user’s habits and lifestyle widens the opportunities to create a deeper connection with a robot and potentially manage more reliably user expectations. A trustworthy relationship in a human–robot interaction scenario is greatly dependent on the way such expectations are managed. Nevertheless, how could those records be used in a way that respects user privacy?

As Winfield and Jirotka [7] support in their work about how ethical governance enables the build of trust in robotics, it is not enough for organizations to only claim that they are ethical. Organisations have to also show how they are ethical. A great range of ethical principles, codes, guidelines, or frameworks have been introduced very recently [8]. At the same time, privacy and data governance were prioritized as a requirement in the recent Ethics Guidelines for trustworthy AI [9] by the EU Commission. This work moves the discussion from “what” those theoretical principles may be to “how” companies interpret or implement them in a more practical setting when developing Privacy Statements and Terms and Conditions.

Privacy Policies and Terms and Conditions are developed behind the closed doors of each company. Companies take specific decisions on the information that will be included and the way to present such information to potential customers and users. As an example, some adopt the verbose and complex legal language, while others may present simple bullet points. This publicly available documentation not only provides cues signaling the level of privacy protection offered, but may also reflect part of the data governance policy along with the values of a company. For example, the way the most sensitive aspects of products are communicated to users may reflect a company’s attitude toward user empowerment. Allowing users to have clarity and an increased level of choice or control over their data may demonstrate an overall vision related not only to privacy, but also to infer an organizational culture oriented to participatory design or decision-making.

This work presents an overview of issues related to the current legal standing on data governance regarding personal or consumer robots. We explore privacy issues and discuss the definitions of personal and nonpersonal data in the EU jurisdiction and their impact on personal and consumer robots. We integrate our previous work on personal data handling and privacy in human–robot relationships [10] and introduce a rating system for data handling related to human–robot interactions.

We investigate how the privacy guidelines developed by the Organization for Economic Cooperation and Development (OECD) are reflected upon the publicly available Privacy Statements and Terms and Conditions in the consumer robotics field. These privacy guidelines are the first internationally agreed privacy principles serving as a cross-border commitment to creating a global privacy protection framework. We compare Privacy Policies and Terms and Conditions of eight consumer robotic firms to understand how different practitioners adopt the OECD privacy guidelines in the field.

Currently, there have been no known studies that shed light on understanding how privacy is reflected in publicly available Terms and Conditions or Privacy Policies. This article attempts to bridge this gap by providing a comprehensive analysis of the ways well-established privacy principles (by the OECD) are reflected in the Terms and Conditions and Privacy Policies in the field of consumer robotics. Our goal is to contribute to the academic discourse in the nascent field of privacy-sensitive robots [11,12], increase the awareness regarding the various privacy strategies used by robot companies, and ultimately create a usable way to make this information more relevant and accessible to the public.

2 Privacy, personal data, and nonpersonal data

Is our regulatory framework ready for the adoption of robots in our private lives? Before posing this question, we need to clarify the point of reference for regulation. Regarding regulating robots themselves, the question seems to be difficult to be answered at the moment, especially as robots do not (yet) have consciousness or legal capacity to act. According to the European Civil Law Rules in Robotics [13], “For the time being, many legal sectors are coping well with the current and impending emergence of autonomous robots […]”. However, does this mean additional regulation is superfluous?

Considering the technological-neutrality argument regarding regulation [14], the law serves well when abstracted from specific technologies. In this sense, regulation should provide legal certainty to enable interpretation in new technological settings in robotics as much as in any other field. Despite the fact that the European data protection framework is technology-neutral and does not block technological adoption [15], the original question remains.

Rather than regulating robots per se, scholars agree that we need to concentrate on regulating the ways that people develop and interact with robots, while at the same time regulating any potential adverse effects that may arise due to the introduction of robots in our daily lives [16]. It has been noted that requirements regarding transparency, traceability, and human oversight are not covered in the existing legal or regulatory framework [17]. At the same time, the liability of AI and robotics forms a significant part of the policy-making agenda [18,19,20].

In this work, we specifically focus on issues related to privacy, data protection, and data governance that seem to be at an infant stage in the field of robotics. However, before considering the implications of privacy in robotics, it is worth highlighting the difference between data governance, data protection, and privacy, which are different but tightly linked constructs.

Data governance is a term related to the ways data are managed as a resource. At a company level, a data governance scheme or policy is based on organizational structures and details on how all data are created, collected, shared, protected, archived, and treated at their end of life. Part of this may relate to customer or user data and is usually publicly communicated to consumers through publicly available Terms and Conditions/Privacy Policies/Privacy Notices.

3 Is privacy important? The privacy — personalization paradox

Personal robots are highly personalized products adapted to fit user needs, behaviors, and preferences. For example, in the context of therapy, robots can uniquely adapt their personality to create deep engagement with the individual while being both predictive and repetitive [52,53,54].

In essence, personalization is impossible without sharing personal data at some level. However, disclosing private data and information raises privacy concerns. On the one hand, there is a higher perceived quality of a personalized product or service and, on the other, the loss of privacy. This dilemma, known as the privacy-personalization paradox, is a special subcategory of what is widely referred to as the privacy paradox [55]. According to the privacy paradox, on the one hand, individuals perceive their privacy and personal data – in theory – as very important while responding to surveys (e.g., the Eurobarometer [56]^[1]). On the other hand, individuals demonstrate privacy-compromising behavior and easily trade privacy for short-term benefits in practice. The privacy-personalization paradox refers explicitly to this discrepancy when the willingness to give away personal information refers to benefits related to personalized goods or services [57,58,59,60,61].

4 Building trust in human–robot interactions

The cooperative nature of humans appears to originate from the unique motivation to form a shared mental model of mutual goals and intentions with other users [62,63]. To achieve a task, we need to (i) share a common goal (e.g., assemble a part), (ii) agree on the task distribution (who will do what), (iii) be capable of identifying which task the colleague will do next (e.g., they now plan to screw two parts together), and (iv) be able to anticipate where they will move next (so we can hand over a screwdriver). Without such mutual intention understanding, genuine collaboration cannot be achieved, e.g., we would collide with our colleague and we would place an object in a poor position for them to pick it up.

Lewis et al. [64] mention system intelligibility and transparency as one of the core factors affecting trust in automation. At the same time, Hancock et al. [65] demonstrated in his meta-analysis that one of the critical factors related to the robots’ general performance in human–robot interaction scenarios included transparency of interaction and, consequently, establishing trust with the robot.

In cases where the user of a personal or a consumer robot is not aware of what kind of data is shared and for what specific purpose, the intentions of the interaction could be misleading. Therefore, the trust between the user and the robot suffers [66,67,68,69]. In human–robot interaction, the whole is greater than the sum of its parts. The social interaction adds an extra layer to the quality of the relationship between the human and the machine. It is crucial to understand how users built such trust and whether it is trust in the software, the robot itself, the manufacturer, the service provided, or the robot’s brand. The recently established field of privacy-sensitive robotics started to investigate these matters in greater detail [11].

In our work, we look into the context of trust and transparency in human–robot interaction. More specifically, we examine the clarity level and communication of intentions regarding privacy formed as part of the Privacy Policy. It is a well-known idea that the vast majority of users rarely read digital contractual agreements, Terms and Conditions, or Privacy Policy documents [70]. In the past, it has also been observed that firms might take steps to make such documents less comprehensible [71] deliberately. Trust is certainly an issue when “take-it or leave-it” approach or boilerplate contractual agreements is the norm.

Here we concentrate on the role and impact of Privacy Policies in defining the transparency of the human–robot interaction in terms of the data collected or utilized by the robot. In this sense, we are interested in how they may affect the trust that the user builds with the robot through the ways the company has communicated them.

5 OECD privacy guidelines

The OECD is an intergovernmental economic organization founded to stimulate economic progress and world trade. To assist the development of a global privacy protection framework and support digital trade, in 2013, the OECD released the Guidelines Governing the Protection of Privacy and Trans-Border Flows of Personal Data [72] also known as the OECD Privacy Framework,^[2] which was based on the original version initially released in 1980.

This work utilizes the OECD principles as it is considered a globally accepted standard that formed the basis for privacy regulation in a number of jurisdictions [73]. Therefore, our analysis takes a universal perspective and is not tied to one jurisdiction. The EU approach to privacy (and the GDPR) may be considered one of the most comprehensive ones [31]. Nevertheless, global (regulatory) convergence around the GDPR standards for all jurisdictions is unlikely [74]. We adopt the OECD principles as a global standard for our analysis, rather than other domestic laws or standards, to create a more inclusive methodology independent of trading relationships with the European Economic Area. As a result, the analysis in this study is relevant not only in a European context but in a more global context. In the future, this work can be expanded to a discussion more tailored to the EU context by drawing closer attention to the overlap and differences between the OECD principles and the GDPR, as discussed by legal scholars [73,75].

The OECD privacy framework involves eight principles: (P1) the Collection Limitation Principle, (P2) the Data Quality Principle, (P3) the Purpose Specification Principle, (P4) the Use Limitation Principle, (P5) the Security Safeguards Principle, (P6) the Openness Principle, (P7) the Individual Participation Principle, and (P8) the Accountability Principle. According to the framework, the principles are defined as follows:

(P1) Collection Limitation Principle: There should be limits to the collection of personal data, and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.

(P2) Data Quality Principle: Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete, and kept up to date.

(P3) Purpose Specification Principle: The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.

(P4) Use Limitation Principle: Personal data should not be disclosed, made available, or otherwise used for purposes other than those specified in accordance with (the Purpose Specification Principle) except: (a) with the consent of the data subject or (b) by the authority of law.

(P5) Security Safeguards Principle: Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification, or disclosure of data.

(P6) Openness Principle: There should be a general policy of openness about developments, practices, and policies concerning personal data. Means should be readily available for establishing the existence and nature of personal data and the primary purposes of their use, and the identity and usual residence of the data controller.

(P7) Individual Participation Principle: Individuals should have the right to (a) obtain from a data controller, or otherwise, confirmation of whether the data controller has data relating to them; (b) have communicated to them, data relating to them within a reasonable time; at a charge, if any, that is not excessive; in a reasonable manner; and in a form that is readily intelligible to him; (c) be given reasons if a request made under subparagraphs (a) and (b) is denied and be able to challenge such denial; and (d) challenge data relating to him and if the challenge is successful in having the data erased, rectified, completed, or amended.

(P8) Accountability Principle: A data controller should be accountable for complying with measures that give effect to the principles stated above.

In the present study, we directly utilized the above principles to assess the Privacy Policy documentation of personal and consumer robotic companies. The interpretation of these principles and the rating scheme is described in Section 6.

6 Methodology

Here we shed some light on how privacy terms are formed and utilize the OECD principles as a unifying framework and a tool to draw comparisons between approaches of different companies in the field of consumer robotics. The goal is to determine the part of the policy that captures the essence of each principle.

The methodology background rests on prior literature examining Privacy Policies based on objective or subjective standards in fields other than robotics. For example, Khalil et al. [76] review Massive Open Online Courses (MOOC) and explore how consent to collect and use data is described to potential users. Nokhbeh Zaeem and Barber [77] study Privacy Policies of 600 companies across industries to reveal trends in user data collection, while Das et al. [78] and O’Loughlin et al. [79] examine the Privacy Policies of mobile apps.

To assess the extent to which the OECD privacy principles are considered in a Privacy Policy of personal and consumer robotic products (see Table 1), each Privacy Policy was reviewed four times by the researchers, and each review had a distinct scope;

Review 1 – Determine the supporting text guidelines for each principle: The first of the four reviews required every policy to be read and common themes of text to be recorded. Once the review was completed, these themes were then assigned to the most relevant principle.

Review 2 – Extraction of relevant text: Having identified the text that would support a principle, each policy was then reviewed a second time for all relevant text to be extracted and recorded against the relevant principle.

Review 3 – Scoring of the extracted text according to each OECD principle: The third review enabled a rating from 0 to 3 based on the degree to which the extracted text within the policy supported the specific principle. The decision to use a 0–3 scale allowed a scoring mechanism that can demonstrate the level of detail in each of the Privacy Policies while providing a simplified measure that focuses on the main points of each principle (see Table 2). Privacy Policies that did not cover a certain principle scored 0 for the specific principle; policies that refer to issues associated with a principle vaguely scored 1 for that principle; policies that support the principle in reasonable detail related to a principle scored 2; while policies that support a principle in a detailed and explicit manner scored 3 in that principle.

Review 4 – Comparative review of scores and text: This final review was to directly compare the text of policies with matching scores for a specific principle to identify and remove any anomalies and ensure consistent, noncontradicting scores across the results set.

One of the coauthors identified the Privacy Policies and the Terms and Conditions by searching for the most popular consumer robotic firms and their publicly available documentation in their proprietary web pages. All the policies and Terms and Conditions were then independently reviewed by two of the authors, and the scores assigned by each author were compared. There was a lack of substantial deviation in the rating, and it was easy to reach a consensus on the final ranking. The third author was also consulted in terms of the rating strategy to ensure the rating strategy’s robustness.

Our initial sampling strategy was to include the most popular consumer robotic firms in the field in this review. However, due to the small number of active companies in the field, we broadened the scope of research to include companies that offer products directly available to consumers. As a result, we reviewed the Privacy Policies of eight robotic companies in this study. The Privacy Policies were publicly available, and there was no requirement to purchase the product to access them. Initially, 15 consumer robotic companies were identified as potentially subject to the study (SoftBank, Ubtech, ANKI, Bluefrog, Dyson, Ecovacs, Intuition Robotics, Qihan Sanbot, iRobot, Reach Robotics, Wonder Workshop, Promobot, Aeleous, Avatarmind, and iLife). However, five of those companies did not have publicly available Privacy Policies (Bluefrog, Qihan Sanbot, Aeleous, Avatarmind, and iLife) while two of them (Intuition Robotics and Promobot) had publicly available Privacy Policies that were only related to the use of their website, which was independent of the product or the service the robot provided.

At this point, it is worthwhile noting that some of the largest humanoid companies do not have publicly available Privacy Policies related to the service or the robotic device. The reason may be that consumers are not expected to order a humanoid without prior communication with the company. A humanoid may be considered a product for a more specialized audience, and, therefore, detailed privacy information is not publicly available.

Table 3 presents the companies selected for this study, along with the size and the country in which each company’s headquarters are located. Some of those companies specialize in robots, while others, for example, Dyson, develop various products, including consumer robots. The size was estimated according to the turnover. The size of the company based on the turnover was categorized as follows – small (<10M USD), medium (<1B USD), and large (<10B USD). We provide a brief description of each company in Section 7. Due to copyright restrictions, we refrain from referring to extracts from each policy here.

7 A comparative analysis of Privacy Policies

8 Analysis of Privacy Policies according to the OECD privacy principles

Following the four-stage review process, each Privacy Policy was rated according to each OECD principle (see Table 4). This section provides an analysis of each principle and the practical recommendations that would bridge the gaps revealed in the way such Terms and Conditions are communicated.

9 Concluding remarks

Privacy, transparency, and trust are fundamental concepts that the human–robot interaction community recently started exploring. To the best of the authors’ knowledge, this is one of the earliest works in the field, which adds a practical dimension to the gray areas of user privacy rights. This work provides some interesting insights into the structure and context of privacy terms and conditions of personal and consumer robots. This analysis of privacy terms and conditions revealed gaps in the ways such conditions are communicated to the users.

Despite the limitations in our analysis in terms of the extensiveness of this study, the trend appears to be that consumer robotic companies do not uniformly consider privacy. It would be important to understand the extent to which this is a design choice in the robot architecture, an actual functional requirement for the robot’s operation, or a legal requirement depending on the jurisdiction the company operates. In this study, for example, the jurisdiction did not appear to play a significant role.

The size of the policy and word count also do not seem to play significant roles in the specific ranking. A lengthy policy does not necessarily mean that all principles are covered to a greater extent. Nevertheless, a broad trend is evident, as the average word count for the top performers was higher than the average word count of the bottom performers. This means that a large word count does not necessarily mean that all principles will be better covered, but it may hint at the level of detail comprising each policy.

A way forward to improve a Privacy Policy would be to clearly define the information that a robot can process locally and the information necessary to be sent back to the company (e.g., troubleshooting to improve specific features and data for training an algorithm).

In the policy agenda, the absence of technical tools and standards to simplify and empower users to exercise their rights has been noted [81]. Some interesting points have been suggested on consent, reducing complexity and tailoring privacy notices by one of the leading European bodies on data privacy, the Article 29 Working Party (also known as WP29^[13]) which acted as an advisory body comprising representatives from the European Commission, each EU Member State data protection authority and the European Data Protection Supervisor. Rather than displaying all information in a single notice or document, the WP29 suggested that privacy documents can present information in a layered manner, so users can access only information relevant to them each time [82]. This includes a “just-in-time” approach where privacy notices are “pushed” before a user makes a specific decision to share data or additional information is “pulled” upon the user’s request [83]. Another interesting idea mentioned in the opinion 3/2020 on the European strategy for data would be to provide information through standardized and machine-readable icons [83], which could facilitate not only users but also algorithms to interpret the main points of a privacy notice quickly.

Another concept to explore is whether a firm’s business scope is a predictor of its level of privacy. For example, a service-orientated firm might justify collecting personal data differently than a product-orientated firm providing hardware. Similarly, it is important to clearly define user rights separate from consumer rights, especially when the consumer and the user are different. In general, many open questions need to be answered from a business perspective, and more in-depth research is required into the inner workings of a company to understand how organizations take privacy decisions and how they choose to communicate them.

This study was the first step to develop a rating scheme based on the preexisting privacy principles. One of the main limitations may lay on the qualitative and subjective nature of rating by the researchers. Future research will focus on creating a more robust methodology and rating scheme.

To drive more transparency and flexibility in the human–robot interaction, this work needs to expand on the user-friendliness and customizable aspects of digital agreements. It is also important to open such a discussion and incorporate a user-centered research approach to develop novel ways that privacy and user rights accommodate user needs. The final goal is to create more transparency in data governance during user interactions and accommodate a stronger perception of trust and a symbiotic relationship with robots.