Keywords

1 Introduction

Advancements in technological capabilities are enabling cross-device interactions and the creation of complex ecosystems of Internet of Things (IoT). Such networked systems can produce valuable solutions for both individuals and communities [1]: efficient management of energy, lighting and heating systems; smart transportation; collection of data for health purposes; monitoring of physiological parameters for fitness, wellbeing and medical purposes by wearable devices and others, are just some examples of progress produced by the evolution of digital technologies. Connected objects provide the means to create responsive environments and to enable ubiquitous and seamless services: home automation solutions and others, show that IoT can and will enable new ways for people to interact with the world around them [2].

The design and development of personal services and applications based on technology ecosystems involves several different competences: from service design to technology engineering, from business planning to interaction design, UX design, communication and marketing. The design of such systems often requires the collaboration of different stakeholders and partners, each one aiming at specific goals and purposes. Indeed, the challenges of designing new digital services, very often, go way beyond rethinking interaction modalities and interfaces; as connected products and digital services evolve to produce deep modifications of individual behaviors and social organizations through the creation of new paradigms of services, [3, 4] designers face questions about the definition of new values that these connected systems offer to the users [2].

When we design a socio-technical ecosystem [2, 5] with an approach of design for experience, the roles and responsibilities of designers occur on multiple scales: beyond the straightforward requirements of acceptance, acceptability [4, 6], usability, convenience and including physical, digital, individual and social issues [7].

When designing for experiences, we have to consider the diverse levels of significance and impacts involved in our solutions. The ground and primary level refers to the aesthetical meaning: the direct, physical contact with the tangible elements of the designed system. This implies comprehension of functionalities and usability, and it includes ergonomics of the material solutions as well as their pleasantness in direct interaction. The upper level of user experience attends to the creation of the service meaning: valuable utility provided by the designed solution, through convenient modalities of use and involvement, as perceived from the user end. To this regard, an important challenge is posed to the designers concerning the consequences of their solutions. The meaning perceived by the end user, within emerging socio-technical systems, can be of a diverse nature and vary from short to longer-term effects [8]. As designers, we should be able to foresee and manage both, long and short-term consequences of design choices.

As has been pointed out by other approaches like Value Sensitive Design (VSD) [9] and Responsible Research and Innovation (RRI) [10], the design of innovative solutions can be focused on the value provided and perceived by users and the other societal actors. By foreseeing and anticipating the individual and collective consequences concerning the perturbations that the designed solution could have, we can contribute to the design process with reflections, critical thinking and discussion on the values potentially provided to individuals and communities, since in the early stages of the design process. The meanings associated by the users to an innovative solution are difficult to be measured a priori as, rather, they rely on unstable social values that vary over time. Perception of value and meanings continually evolves with the changing society. Therefore, the perception of the society within the project at the concept development phase appears quite labile.

Since the technologies embedded in the society are not neutral, designers play a role in shaping the society itself, starting from an individual level [11].

In our research, we focus on issues related to the use of personal information in the design of connected objects and digital services. Personal information is the fuel for personalized services and the by-product of human activities supported by connected products and web-based services. Digital data supports the production of new knowledge in key social sectors such as healthcare, energy management, transportation planning. Personal information obtained by the processing of raw data supports the creation of personalized services which are capable of reducing cognitive efforts on the user-end, to enhance personal knowledge, improve lifestyles, and provide seamless efficiency. Conversely, the collection and processing of personal data poses complex questions and risks for individuals and the community, that can be briefly indicated in terms of lack of safety, security and privacy, and social engineering. As an example, authors such as Rowland and Goodman highlight the challenges related to issues such as confidentiality and integrity of data and explain how data that seems innocuous can be aggregated to generate privacy breaches [2]. Beyond that, the use of personal information as a central or peripheral element in technology-based systems, can have a wider influence on individuals and communities [12]. We argue that, from the individual point of view, the use of connected products and digital services is deeply affecting not just behaviors, but also perceptions of the world and of the self. We also sustain that, on a social basis, digital services that employ personal data can modify not only organizations and communication tools, but also the codes and principles of human interactions.

In this paper, we offer a contribution to the development of design methodologies aimed to support awareness about possible consequences of design choices suitable in different phases of the design process. The kind of projects we are focusing on are those that bring radical innovation. Anticipating aspects that could shape utopian and dystopian futuristic scenarios, is seen as a potential path for envisioning critical issues regarding consequences a design solution can bring when used long-term [8].

2 Research Background

As the progressive digitization of information [13] is intensifying the process of data production and gathering, the systems that rely on these datasets to provide meaningful services increasingly involve data as the raw material [14] for wellbeing, patterns and behaviors analysis. Data about people, their presence, activities and behaviors are directly created and collected by devices and sensors, as well as extrapolated by data crossing and analysis. While the tracking of personal data can be actively enabled by users through voluntarily logging into devices and platforms, the automatic detection of these data and the analysis performed by technologies to extract personal information is becoming a common practice for many services. The processing performed by the systems of both, voluntary and automatic creation of data about users, provides not only metadata useful to relate elements and actions to the specific users, but also to create service functionalities and provide feedback, reports and task personalization [15].

Many products, services and systems are becoming reactive and proactive according to the information collected from users. The users can access actions and performances through their biodata (e.g. Apple’s Touch ID [16]); biodata represent the nourishment of fitness tracking services to create reports and feedback about performances (e.g. Beast Sensor [17]). The voluntary sharing of data can help researchers to cure diseases [11] and the automatic detection of data can support the reduction of energy consumption [18]. Furthermore, reactive materials can use personal information to create proactive products and meaningful physical experiences in the real world [19, 20], by changing in colour, shape, opacity and so on, according to the automatic detection or voluntary input of data.

While the word datafication refers mainly on the use of Big Data as a source of service value and understanding, literature [21, 22] points out the importance of Little Data intended as “based on ‘big data’ but […] focus[ed] on individuals, using the vast computing capacity that is available today to collect and analyze what is extremely granular data – such as whether an individual is driving safely or not” [23]. “While using big data and algorithmic decision-making … this targeting can now be taken further when data are used not to predict group trends but to predict the behavior of a specific individual” [21].

The tensions in the debate on the use of big (and little) data analysis as a creator of value for the creation of services, has been framed on work-practice level, organizational level, and supra-organizational level [24]. The debate is nowadays focusing mainly on the consequences that the use of big (and little) data analysis can bring in the society [23] pointing out the perturbations that it is producing in both organization and work, identifying changes in the nature of professional work (in the practices and skills needed), and in the management of the professional workers (evidence-based management and data-driven approach to managing working). Is so indeed relevant to make efforts in the creation of critical discussion among the possible consequences that the use of data is providing to the society considering not only the possibilities in terms of creation of knowledge and development of functionalities, but also the unintended effects. Literature on information systems are so starting call for actions on this purpose [15], and authors such as Marjanovic and Cecez-Kecmenovic [25] started to identify datafication patterns and their unintended societal consequences.

Designers, researchers and educators in the field of interaction design and HCI [26, 27], are considering the evolution of digital technologies as a new challenge and opportunity to produce creative products and services based on IoT, data processing and cloud computing. On the other hand, the automatic detection of personal information by services is raising issues about data privacy, security and perception of self by the final user and designers [28].

2.1 Envisioning Design Issues Through Scenarios in HCI

From the perspective of design research and practice, the suitability of developing scenarios to envision future conditions and activities enabled by designed services and products, appears undisputed [29]. These future situations unfold and evolve during the design practice and definition phases, and designers involved in complex project processes that require co-design in multidisciplinary project teams are often entrusted to build a common language of communication and to envision the final expected results. Scenarios, therefore, are considered a suitable set of contextual contents for representing and discussing the future possibilities imagined and proposed by designers and other stakeholders. Scenarios articulate description of a design challenge in realistic contexts, and harness existing design knowledge and theoretical frameworks to propose a viable solution to this challenge [30]. A scenario is determined by a narrative, form and function, and it builds a story around target profiles (Personas) recognized for the final design proposal. Scenarios contains elements and factors related to the envisioned situation that enable designers in considering not only the setting in which their solutions will take place, but also possible issues that are worthy of discussion so to create solid and realiable solutions.

In the field of Human-Computer Interaction (HCI), there is a shift from abstract descriptions of computer applications towards prototyping and other interaction representations that allow users to play an active role in an iterative design process [31]. Wider role for scenarios is discussed in HCI, reflecting the idea that scenarios are seen as a basis for overall design for technical implementation. In order to provide effective support in design processes oriented toward the responsible development of radically innovative solutions, the scenarios that are produced should describe the main technological requirements and the user journeys in the best operating conditions. Scenarios should also provide the means for the investigation of worst and limit cases, and to understand all situations of use and operating conditions.

We do believe that, in dealing with services and connected products involving personal information, designers should consider critical issues at the very beginning of the design process, i.e. since the definition of the concept, and, subsequently, while developing the physical features of the systems, considering the technological solutions, the information flows and the functional requirements of the design solution. Furthermore, we believe that the investigation of limit/worst case scenarios should include the realm of possible consequences related to the collection and use of personal data in the operations of the service. In fact, the personal data involved in the service and the ways personal data are collected, managed, shared and processed to generate personalized functions determine the acceptability and desirability of products and services together with the main functionalities and the final characteristics of the interfaces and touchpoints.

In this paper, we present the results of a research aimed at the creation of a design approach (methodology and tools) to support designers in the investigation of potentialities and critical issues related to the use of personal data in digital services.

Our approach is based on a preliminary research aimed at collecting reference information about critical issues related to digital personal data in services; this ample investigation ranges in both the domains of the news about events that happened in the real world as reported in journals and media, and in the realm of imaginary situations extracted from fictions. The collection of these reference information produced the analysis and mapping of several utopian and dystopian consequences connected to the use of personal data in services or technology-based systems. The results of this preliminary research supported the development of a framework of knowledge to be used by designers in the project of services and systems; the framework of knowledge enables indication of possible critical issues that could occur in future scenarios and are related to the use of personal data. The framework and the methodology we suggest provide a method for the anticipation of critical issues, so named Impact Anticipation Method (IAM).

In the following of this paper, we report the main features of the framework and report the process that generated it. Furthermore, we report some results obtained by applying our approach to a project aimed at developing a system for safe driving.

3 Impact Anticipation Method (IAM) for Exploring Digital Utopias and Dystopias

The first activity of our research aimed at mapping the multitude of situations that could be produced by using personal data as they come in connected products, AI based agents, and digital services. Aiming at extracting updated and social validated knowledge, we focused on the use of online content as source of the creation of scenarios and related critical issues. A number of different online sources have been used in this mapping process: case study analysis of emerging products and services, news, ongoing researches, movies and literature.

Within HCI, there has been a great emphasis on the use of fictional narrative in the form of personas and scenarios, and a discussion of how it can influence the work of technology designers [32, 33]. Science fiction writer and futurist Bruce Sterling [33] considers design perspective to be used to inform the creation of fiction that can engage with issues of an imagined or desired future. For these reasons, we choose to collect both information from the real world and imaginary scenarios from fiction.

3.1 Phase 1: Collection of Potential Issues

In our investigation, we considered all the above enlisted sources, so to create the Potential Issues Database that contains the knowledge extracted from real life and fiction.

With respect to science fiction, that we take as a profitable source of meaningful scenarios, we collected and processed data from an online database (IMDb.com [34]) containing information related to movies, short-movies, TV series and games. This provided knowledge from the envisioning of the future made by storytelling and the related validation made by collective intelligence of users that contribute to the database [8].

The queries we performed on the database were initially based on our previous knowledge about scenarios and representations of future in science-fiction storytelling artefacts; the investigation involved several automatic and manual mining of data so to collect the widest information about the science-fiction movies related to utopian and dystopian consequences of the use of technologies. We queried the database using the following keywords so to include both positive and negative narrative scenarios in the research: dystopian future; dystopia + future; future noir; utopian future; utopia + future; utopian; future utopia; utopianism; future + technology. This phase produced a First Titles Corpus (508 unique titles). For these titles, we collected both the metadata (title, genre, year, series, season, episode, type, plot, extended plot, language, country) and the data provided by the users (rating and votes). Then we filtered these results to focus our attention on the future related scenarios, and the high ratings (equal or above 6) so to take into account only the valuable results according to the opinion of the collective intelligence.

For the resulting Main Titles Corpus (281 unique titles), we collected all the keywords related to each title and their positive and total votes. The Main Keywords Corpus included more than 17 thousand keywords on which we calculated the related relevance subtracting the negative votes to the positive ones. A further selection was based on the analysis of the relevance of the movie plots; the Final Keyword Corpus, was created eliminating the keywords with negative relevance, and irrelevant references. The Final Title Corpus included 102 unique titles, while the Final Keyword Corpus counting 6.605 keywords (621 of those had positive relevance) and 481 unique keywords. For the entire Final Title Corpus, we carefully read the extended plots to categorize the storytelling settings by similarity. We identified 3 macro-similarities: Self-perception and self-reflection, Machine control and Machine decision, Alternatives. On the Final Keyword Corpus, instead, we organized the 481 unique keywords in 3 main categories: Technology & Science (containing all the words related to technological artefacts, research practices and science advancement), Life Being (containing all the words related to human social life, actions and life being), and Reality & Actual (containing the words related to objects, spaces and times). The categories were not mutually exclusive, so each keyword could fit in more than one of them.

This categorization (see Fig. 1) revealed that most keywords are related to the Life being category. Many elements are related to both Life Being and Technology and Science, showing the relevance between the technologies and people’s life. This concerns future scenarios described with technologies that affect the way people live and act as the society. We consider the knowledge produced in this mapping as an investigation of prospective futures as they are produced by collective intelligence. While creating the narration, the storyteller is actively envisioning a hypothetical world where the story will be settled. Science-fiction storytelling provides utopian and dystopian futuristic contexts that are not-yet-real. These contexts are not representing a foreseeing of the future, while they represent the actualization of the current hopes and fears about the future as a realistic projection of what is perceived by the society.

Fig. 1.
figure 1

Categories of keywords used for analysing the database of gathered titles of movies, series and games.

Full size image

The second step of the creation of the Potential Issues Database is the collection of ongoing discussion about the actual use of personal information in current technological solutions. To do so, we gathered news about technological advancement, about products and services available on the market, and about ongoing research projects that involve the use of personal data by services. The sampling of discussions (101 sources) and the extraction of issues related to the use of personal information provided the qualitative elements that were merged with those extracted from the science-fiction analysis.

To summarize our findings, we created eight different future macro-scenarios that we call Ethics-oriented-Reference-Scenarios (ERS) [28] that we describe in the following paragraph. The ERS represent a collection of possible consequences related to the use of personal information by innovative technologies as they are perceived by the society [32]. The eight ERS represent, therefore, situational paradigms linked to the present time and current technological development thanks to the analysis of the current situation extracted by the sampled news [35,36,37,38,39,40,41,42,43].

3.2 The Ethics Oriented-Reference-Scenarios (ERSs)

In this paragraph we briefly describe the eight ERS formalized as previously described. They are divided into the three macro-categories extracted from the narrative analysis [28]. These macro-scenarios point out some main issues that emerged from our analysis, and they reveal the potential two faceted (utopian and dystopian) impacts of services and products based on personal data.

The IAM method is based on the guided interrogation of the database collecting the potentially different critical issues emerged in the research phase reported above. The ERS provide a main classification of outcomes of the research, and they orient the designers using the database while searching the more suitable reference-cases for the anticipation of the impact of use of digital data with respect to their specific design purposes and goals.

Self-perfection and self-reflection:

  1. 1.

    Perfect Humanity: the use of technologies shapes the ‘perfection’ of the people thanks to the analysis of bio and medical data, and to behavioral analysis on human actions. At the same time, it raises problems related to marginalization, increase of inequalities and suppression of differences.

  2. 2.

    Pervasive Awareness: the surrounding systems and services track people’s activities thanks to sensors and self-logging. The generated feedback loop [3] make the users more aware of self-state and their activities in the digital and physical environments while it raises overload of information and increase of cognitive effort related to new and possibly useless worries.

  3. 3.

    Mnemonic: the use of digital storage solutions enlarges human brain capability, granting ubiquitous access to the memories in real-time. However, the opportunity of ubiquitous and infinite storage raises worries about the permanently available and indelible records.

A. Machine control and machine decision

  1. 4.

    Super Monitor: the analysis of activities and behaviors made by technological system prevents problems and increase safety while promotes constant surveillance and impossibility to hide.

  2. 5.

    Automation Box: AI and proactive systems automatically collect and analyse data to provide services that lower cognitive load and help people in their activities. At the same time they act and react without provide answers and explanation about their decision-making processes, so increasing the perception of a machine-authority that decides on behalf of humans.

  3. 6.

    Human Behavior Computer: AI systems learn from people behavior to provide services that are more valuable, human and of natural understanding. However, while they learn from human actions, they also assimilate and use humans’ biases and bad behavioral characteristics.

B. Alternatives

  1. 7.

    Stargate: the use of digital spaces to reduce the distances and time difference helps people to interact each other in ubiquitous ways. At the same time it creates alienation from the reality and the physical world.

  2. 8.

    Avatar: the use of alternative identities shapes the experiences and the representation of the self in digital words allowing also a fragmentation of the identity and give people the possibility to voluntarily and involuntarily misrepresent themselves.

The Impact Anticipation Method, employs ERS as a reference to be used during the whole design process. It is intended as an integration of the user-centered design approach; it provides the means to support discussion and awareness about the positive and negative consequences of technology-based innovation with respect to the use of personal data. The envisioning of a scenario in a project process is a creative act that usually leans towards the creation of an ideal world. It aims to explore possibilities, solve problems, identify critical issues and avoid negative and unexpected side effects. The name utopia itself (no place) suggests “impossibility” and the utopian scenarios envisioned by storytellers can reveal how narrow the line that divides utopia from dystopia is. Utopias can be impressive at first, but they can bring problems and implications not always easy to predict. Furthermore, when we consider future scenarios, we should always take into account the variety of needs and attitudes of human beings. As an instance, wellbeing is a subjective dimension [44] - what is a utopian vision for someone may be completely dystopian for someone else.

The design of a new service or product should always be fueled by motivation and effort toward the definition of a convenient and desirable solution; on the other hand, the conscious, instrumented and open discussion of possible critical issues within appears as convenient for both the effectiveness and efficiency of the design process [45].

Starting from the eight ERS, we move to the phase 2 of the Impacts Anticipation Methods: its application on design processes. To illustrate our approach, in the following paragraph we present a case study.

4 Phase 2: Application of the IAM in a Design Process

In this section we report a case study about the application of IAM, so to explain the main feature of the method. The Impact Anticipation Method could be applied in different phases of the design process: analytical phase, creative phase, definition phase, and assessment phase. However, we focus here on its application during the assessment phase; the project we refer to is called MEMoSa and we applied the IAM to inform future iteration of the design process with critical thinking on individual and societal possible impacts of the use of personal information in the service.

4.1 Case Study: MEMoSa

The MEMoSa project aimed at developing a mobile and cloud service to support safe driving and involved several partners and stakeholders, including TIM, the Italian company for telecommunication, some insurance companies, and local shops. The final service is based on personal data about the behaviors (driving and other activities) and the health-state of final users; furthermore, the system also collects and uses data about the vehicle and planning of the trip, offering context-based functions. The service provides feedbacks about the convenience of driving and of the suitable driving-style, in real-time and based on personal information. Insurance companies, selling health and car insurance services, have the opportunity to offer flexible low-cost solutions on-the-spot, and to collect information so to build a better, more comprehensive profiling of their customers. Expected impacts are the reduction of risks connected to driving in unsafe conditions due to lifestyles, health conditions or specific circumstances. Furthermore, the service should reduce insurance costs, and offer additional value based on contextualized needs. The designed system helps users to be more aware of their physiological conditions, increasing health, road safety and reducing insurance and healthcare costs. The development of MEMoSa required the collaboration of several partners, including sociologists, computer scientists, insurance companies, and designers. The authors of the paper participated in the project as designers, contributing to the definition of use-case scenarios, to prototyping and testing, to the communication of the final concept, and the development of the final mobile application.

The MEMoSa system tracks vehicles during use, collecting data about driving styles through an On-Board Diagnostic unit (OBD) in the car; the mobile application collects personal data in regard to health-conditions and users’ sleep quality via a wearable device; the cloud platform provides the driver and passengers several value-added services such as on-the-spot insurances, technical assistance, notifications on drowsiness, etc. As it is presumed that a vehicle is used by more than one single driver, the system provides features for creating a community of drivers of the same vehicles for keeping track of the members’ activities and vehicle performance.

For its features, MEMoSa is an innovative system concept, and its development required several iterations involving testing with final users’. During the testing activities, several critical situations emerged related to the use of personal data, and the design was progressively refined in order to sync with them [46]. As an example, some issues concern the privacy rights of users sharing the same car: as the application reports on vehicle usage and driving styles, some participants stated that they would use the service only if they could select the exact information to be shared with each particular profile in the community. All in all, the system functions by employing personal data that widely and deeply describe personal characteristics, activities and status. This situation does encourage the creation of useful services, however, possibly accompanied by certain risks that require deep investigation.

For this reason, we consider this project as a suitable test for IAM.

4.2 Application of IAM on the MEMoSa Project

We consider data as the raw material that is detected and processed by the system to extract the knowledge about the individual that is then used to create the service [1]; in the IAM, we classify the data by type, and we cluster type of data under information categories. The categories of information have been defined as following:

  • Identity information: the information related to physical, biological, medical and biographical aspects of the person;

  • Access information: the information related to the personal interconnection with the technology-based systems;

  • Behavioral information: the information related to the actions performed and to the habits of the person;

  • Social information: the information related to the social representation of the self and to the activities performed in the social life.

As shown in the following table (Table 1), some of the data types appear in more than one information category.

Table 1. Clusters of data types placed inside of information categories.
Full size table

As a first step for the application of IAM in MEMoSa, we identified the specific personal information and data that are involved in this service and neglected the type of data not used by the MEMoSa system (user contents and conversations) (Table 2).

Table 2. MEMoSa system related classification of data types.
Full size table

We took this classification as a reference to analyze all the different types of data that are collected, exchanged, processed and employed in MEMoSa; we also made explicit the source of each data type, and its ‘destiny’ within the system, (see Fig. 2) from the initial data gathering to the final provision of functionalities including insurance paybacks (offers and deals of personalized insurance policy), knowledge for users and stakeholders (car performance, driver’s ability analysis, personal performances, community activities) and access modes.

Fig. 2.
figure 2

Map of personal information flows within the MEMoSa system.

Full size image

The map shows that, in some cases, not all the collected data are used to create the payback to the final users. Some information is collected and stored but it is not actually useful for a specific feedback or functionality.

As a following step in the application of IAM to MEMoSa, we developed a critical analysis of the service based on the cross and comparative checking of different types of data and information flows involved in MEMoSa, compared with the general-purpose knowledge provided by the ERS and the related issues. The analysis revealed which of the main reference scenarios introduced above are potentially relevant for the specific goals of the service: Perfect Humanity, Pervasive Awareness, Mnemonic, Super Monitor. Furthermore, we extracted from the database the reference issues and mapped them on the specific elements of the features identified in the information-flows diagram generated for MEMoSa (see Fig. 3); the analysis pointed out some potentially critical issues related to four over eight ERS.

Fig. 3.
figure 3

Relation map between issues, elements and features.

Full size image

We report here the results of our analysis summarized as a list of “attention points”; these points require further thinking and accurate investigation in order to create a suitable awareness of the impact of the use of personal data in the service and orient the design toward the development of an acceptable and desirable solutions for users on short and long terms.

  • Quality of life (Perfect Humanity). The system collects biodata to identify behavior patterns and anomalies in the user health. The service creates a payback in terms of awareness of driver’s ability and personal performances. This use of personal data involves issues related to the user’s awareness about personal health and life-style, with possible changes in the sense of self and in the behaviors to perfection activities and state.

  • Access and Control (Perfect Humanity, Mnemonic, Super Monitor). The service offers tailored driving itineraries and insurance policies, so inducing choices and behaviors about ways of access to places. The analysis also considers possible exclusion and/or discrimination based on privileged or peculiar service conditions related to the personal data. Data gathered by the system give to the user timeless access to information, but it can also produce information overload; it is important to verify a suitable accessibility to data for different types of users. The delicacy of data managed by the service and the complex system of stakeholders and partners involved in service provision require strict control of the access to the personal data; users should be allowed to understand the destiny of their personal information. The system collects personal data of different types; the processing of these data can produce information far beyond those strictly related to the production of value for users.

  • Processes (Perfect Humanity, Pervasive Awareness, Super Monitor). The service is based on a continuous monitoring of users, with high sampling of behaviors and personal state in order to produce effective feedbacks and suggest convenient behaviors. The tailoring of functionalities requires a deep monitoring of personal information. The algorithms employed for personalization and the system of insurance incentive could reduce or alter the personal instinctive ability to judge a personal physical state due to transferring the judgement power to the system.

  • Self-perception (Perfect Humanity, Pervasive Awareness). The system is supposed to provide suggestions about driving styles based on driving behaviors and health (wellness) conditions, so introducing perturbation of the self-perception. Furthermore, the system provides notification of changes in the personal or car conditions and it reveals possible emerged anomalies. This can create concerns in the user, producing stress in some circumstances; it can produce rejection for the excess of information or can lead to over-awareness. The presence of economic incentives offered by insurances can amply these effects.

  • Human Behavior (Perfect Humanity, Pervasive Awareness, Super Monitor). The awareness about wellness status, performances and behaviors can alter the user’s behavior or mental state in a positive or negative way. The pervasive and continuous monitoring can improve and optimize behaviors thanks to the enhancement derived from the possible perfection of actions. It can eventually lead to changes that are not convenient for the users due to the distorted perception of their own behavior. Pervasive monitoring can also create impossibility for the user to hide presence and behaviors.

  • Tracking (Perfect Humanity, Pervasive Awareness). Biodata and activities tracking are compared by the system with averages or optimal thresholds. This is meant for improving safety and behavior. On the other hand, the awareness of comparative performances and status can have impacts on the perception of self.

  • Memory (Mnemonic). The storage of information and the knowledge extractable from historical data can enhance the memory ability of the user, enabling him to retrieve detailed information from old memories, but it can also lead to the impossibility to forget information that are useless or even unwanted.

  • Collection (Mnemonic). The storage of information supports storage information in a non-defined range of time. The storage of the data could be accessible over time for different further purposes even if the user is not aware of its use.

The outcomes of this analysis can be employed for different purposes within the design process. The above reported list of issues can be used to orient the research activities to be performed with users, so to verify the perceived importance of the possible critical impacts of the service. As different clusters of target users can show different attitudes and dispositions with respect to the critical issues and to the costs/benefits features of MEMoSa, the IAM analysis can also support a better definition of the opportunities related to the personalization of services. Furthermore, the issues emerged by the application of IAM provide an overview of aspects that should be taken into account in the physical design of the application as well as in the final communication of it.

5 Assessing IAM: A Comparison of the Method Application Outcomes with the Results of User Studies

Addressing identified issues of MEMoSa system’s elements and outcomes, the reflective anticipation directed us to formulate questions related to design principles for supporting designers in developing awareness about the possible consequences in regard to how information is managed.

  • Can the solution provide the right transparency on the type of data collected and who is accessing and managing them?

  • Can the solution guarantee to the user the complete withdrawal of the consent and the deletion of account, data and information any time?

  • Can the solution evaluate the values created for the users by the use of their data, in order to guarantee that it is exceeding the discomfort caused by the collection and use of personal information?

  • Can the solution provide freedom in giving and denying the consent on the use of each data and information?

  • Can the solution guarantee fairness between users, avoiding discrimination that can emerge from personal information?

For confirming the validity of the outcome of application of the Impact Anticipation Method (IAM) on the MEMoSa system, we refer to the publication of results of user studies conducted during the MEMoSa project [46]. Namely, Pavlovic et al. [46] specified a “need for a social consensus to be considered and directly employed during the design and evaluation process, in order to target and support the area of user values that deal with data and information exchange”. The authors have pointed out that in the conducted user studies it resulted that such systems, that rely on the use of personal sensitive data, are desirable, but acceptable under certain conditions.

The issues identified during these user studies mainly overlap with the issues deriving from the application of IAM on the same design concept. In overall, there is a high interest in providing certain personal data for receiving elaborated useful information and features in exchange. This refers to willingness of sharing data with different entities, such as other drivers using the same car, insurance companies, and MEMoSa system agent in general. When it comes to transparency issues, the research of Pavlovic et al. showed that overall transparency in evaluation of a driver’s profile, as well as clarity of back-end processes for how the evaluation is conducted, are quite desirable. The freedom of giving and denying consent on the use of each data and information emerged in few observations as well. An example are the situations in which the users pointed out that they would share data on driving style and routes, as well as stops and positioning, only selectively, i.e. only with certain drivers from their community. Fairness and discrimination that can emerge from personal information usage were also addressed in considerations of using sensitive bio-data on behavior, alertness and sleep quality for ratings from the side of the insurance company. Participants of the study “expressed willingness to be familiar with the back-end operations of the system and understand in which way gathered data is being translated into an information, and who has access to such information”.

Furthermore, after the final, third, phase of conducted user studies, the participants confirmed that for majority it was clear the purpose of using data collected from cars, smartwatch and smartphone, and that it is also clear who has access to their personal data. After this phase participants were also asked to evaluate the proposed use cases from the initial testing phase once again, and now they evaluated them with higher scores in terms of acceptability and desirability. This directly showed that data treatment is an inevitable factor for assessing design concepts of such nature.

As there is an evident overlap of considerations derived from user studies from Pavlovic et al. [46] and application of IAM in the same project, we can confirm the validity of IAM for anticipating socially acceptable issues, i.e. achieving a social consensus within a design process for complex intelligent systems that employ personal data.

6 Conclusion

We proposed an Impact Anticipation Method for supporting design processes that deal with the use of personal data for creating services of certain user’s values. We applied the method to a project of corresponding nature in order to identify potential critical issues. IAM is an approach based on the knowledge of things that have happened in the past and also on “projections” that are imaginary scenarios reflecting fears and hopes that people put into technological innovation. This knowledge is the reference to draw from in order to learn from past mistakes.

IAM does not serve for shutting down ideas related to data usage, rather its purpose is to strengthen the design concepts and values they propose. Therefore, it permits a creation of initial mapping of potential critical issues and aims to channel user studies towards particular aspects that require peculiar attention.

Merging the identification of possible critical issues and with a ‘questioning’ method to address the emerged design issues from a user-centered point of view, we can stimulate designers’ creativity aiming to support them reflect on possible long-term consequences of their choices in use of personal data in the concept generation phase of the design process. The questions that emerge from the application of the proposed approach, aimed to support designers in anticipating issues, are in our opinion relevant and important, being involved as designers and as researchers in different design processes, and as teachers and teaching assistants in design courses.

In conclusion, we believe in the importance of rising and developing a discussion focused on the consequences of design choices within the communities of designers and people engaged in the development of digital infrastructures of our world, and, with our research, we hope to give a contribution to this goal.