Mapping Winners – An examination of the requirements posed and the privacy icons selected as part of the 2021 design contest held by the Italian DPA

written by Lukas Seiling

This blog post is mainly concerned with mapping both requirements and winning visualisations. A second blog post provides an close inspection of selected icons and concepts while also offering suggestions for future competitions.

In March of last year, the Italian Data Protection Authority (Garante per la protezione dei dati personali) called upon “software developers, tech professionals, experts, lawyers, designers, university students, and anyone interested in this topic, to send a set of symbols or icons that can represent all the items that must be contained in an information notice under Articles 13 and 14 of the GDPR.”

This competition marked the first (and fortunately not the last) time a Data Protection Authority in Europe had held a public competition for the design of privacy icons and thus offered an outstanding possibility to take a closer look at the requirements, the selection process, and the winning icon sets.

Information contained in Article 13 and 14 of the GDPR

The only requirement given by the Garante was that the set of symbols should cover “all the items that must be contained in an information notice under Articles 13 and 14 of the GDPR”. While this seems like a rather straightforward task, a look into both Article 13 (Information to be provided where personal data are collected from the data subject) and Article 14 (Information to be provided where personal data have not been obtained from the data subject) reveals more than 20 different concepts with varying levels of abstraction:

• identity and the contact details of
  • the controller
  • the controller’s representative
  • the data protection officer
• purposes of the processing for which the personal data are intended
• legal basis for the processing
• legitimate interests pursued by the controller or by a third party
• (categories of) recipients of the personal data
• transfer of personal data to a third country or international
• storage period
• the rights
  • to request access
  • to rectification
  • to erasure of personal data
  • to restriction of processing
  • to objection of processing
  • to data portability
  • to withdraw consent at any time
  • to lodge a complaint with a supervisory authority
• whether the provision of personal data is statutory/contractual requirement or necessary to enter into a contract
• automated decision-making, including profiling

With regard to Automated Decision Making (ADM), Article 13 also states that “meaningful information about the logic involved, significance and envisaged consequences of such processing for the data subject” should be part of the information provided to data subjects.
Additionally to the aspects named above, Article 14 requires information about “categories of personal data” as well as the “source of data”.

So far, so complex.

Challenge Accepted

The participants had a little more than two weeks to come up with a set of icons for the aforementioned aspects. During that time, the Garante received an impressive total of 59 entries and appointed an Evaluation Group to select the icon sets that “most met the criteria of completeness and compliance with the content of the regulations”. Afterwards, the remaining entries were ranked based on four criteria:

• concept (which includes the aspects of effectiveness and conciseness)
• visual (graphics, readability, clarity)
• originality
• inclusiveness (gender equality, non-discrimination)

The four winners were announced in December of last year, with two icon sets – by the origanisational compliance consultancy Athlantic Srl and Design Student Sara Vagni – sharing the first place; followed by the ones created by an association of information security auditors, trainers, and privacy experts, called Osservatorio 679, and the Maastricht European Centre on Privacy and Cybersecurity (ECPC).

The winning icons were made accessible through the Italian Data Protection Authority’s website to be used by anyone under the CreativeCommons license.

Comparing the Winning Sets

Unfortunately, the Garante provides only download links to the various icon sets and pdf documents for an overview individually and no global overview of any sort. To remedy this lack of information, I downloaded all icon sets, which left me with exactly 100 unique icons (35 by Sara Vagni, 32 by Athlantic Srl, 17 by Osservatorio 679 and 16 by the ECPC).

With no additional information provided except for the image file names (which were exclusively in Italian), I translated the individual file names to determine which concepts were pictured by the different icon sets and how their visualisations might differ.

The result is summarised in the table below, showing the winning icons for all concepts from Articles 13 and 14 identified above. Icons that showed only slight deviations from the same underlying concept were excluded to reduce visual clutter.

Category	Athlantic Srl	Sara Vagni	Observatory 679	ECPC
identity and the contact details of the controller
identity and the contact details of the controller‘s representative
identity and the contact details of the data protection officer
processing purposes
legal basis
personal data
categories of personal data
source of data
legitimate interests
(categories of) recipients of the personal data
transfer of personal data to a third country or internationally
storage period
rights
to request access
to rectification
to erasure of personal data
to restriction of processing
to withdraw consent at any time
to lodge a complaint with a supervisory authority
to object to processing
to portability of personal data
provision of personal data is statutory/ contractual requirement or necessary to enter into a contract
automated decision-making,
including profiling

Still, all icon sets included at least two 2 icons not covered by Articles 13 and 14. For the sake of a complete analysis, these “surplus concepts” and their corresponding visualisations are shown below.

Category	Athlantic Srl	Sara Vagni	Observatory 679	ECPC
Consent
Data Subject
Data Processor
Data Recipients
EU Representative
Supervisory Authority
Common Data
Sensitive Data
Judicial Data
Optional Data
Necessary Data
Indirect Source of Data
Dissemination
Communication
Further Purposes
Ongoing Generic Data Processing
Balancing Interests

So, what do we make of this?

At first glance, it is obvious that no icon set is complete in the sense that it covers all aspects named in Articles 13 and 14. It is also apparent that the different icon sets use varying visual styles, influencing their legibility and comprehensibility. When comparing icons for the same concept, visualisations and symbols shared between icon sets can point us to areas of conceptual agreement. In contrast, different visualisations might reveal concepts that are especially difficult to visualise or not clearly defined.

You can use these ideas to look at the icons above and make up your mind about their effectiveness and possible limitations. Alternatively, you can take a look at this follow-up blog post in which I apply different evaluation criteria to closely examine the winning icons regarding the concepts they refer to and propose some suggestions for future contests.

Either way, I’ll leave you with an icon set that has thus far gone unmentioned: Antonio Ravenna (in cooperation with LT42) received a special mention for their icon set “because of its informational efficacy and the originality of its graphic solutions”. For me, it’s a reminder that digital infrastructures are not exclusively used by consenting adults but children also.
It is therefore crucial to communicate information about digital actors, processes and rights in ways that take the recipients’ experience into account and provide them with applicable concepts that allow for a better understanding and thus more autonomous decisions.