A Stakeholder-Based Framework to Highlight Tensions when Implementing Privacy Features

Preparing university students to build privacy-preserving systems requires preparing them to design around societal contexts and stakeholders. While legislation such as GDPR and CCPA provide regulatory frameworks for such design, discussions of privacy and stakeholder values can be fairly abstract for students. From an educational perspective, teaching abstract concepts such as the "right to be forgotten" in the concrete context of technical implementation can help students grapple with what these concepts mean in practice.

This paper proposes a framework for designing technical assignments that ask students to resolve tensions between conflicting stakeholders while implementing a specific technical feature. We describe a privacy-facing assignment for a second-year introductory computer systems course, and explore its efficacy. We find that students make different design choices and implement for different values based on the specific stakeholder conflict with which they work. We also find that the assignment design engages students in thinking about how abstract values affect technical design decisions in the context of privacy.