{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T09:15:38Z","timestamp":1781169338788,"version":"3.54.1"},"reference-count":62,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2021,10,15]],"date-time":"2021-10-15T00:00:00Z","timestamp":1634256000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-sa\/4.0\/"}],"funder":[{"name":"National Science Foundation","award":["CNS-1548779, CNS-1727574, DGE-1821782 and DGE-1821822"],"award-info":[{"award-number":["CNS-1548779, CNS-1727574, DGE-1821782 and DGE-1821822"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Comput. Educ."],"published-print":{"date-parts":[[2021,12,31]]},"abstract":"<jats:p>Nearly all software built today impinges upon end-user privacy and needs to comply with relevant regulations. Therefore, there have been increasing calls for integrating considerations of compliance with privacy regulations throughout the software engineering lifecycle. However, software engineers are typically trained in the technical fields and lack sufficient knowledge and support for sociotechnical considerations of privacy. Privacy ideation cards attempt to address this issue by making privacy compliance understandable and actionable for software developers. However, the application of privacy ideation cards in real-world software projects has not yet been systemically investigated. The effectiveness of ideation cards as a pedagogical tool has not yet been examined either. We address these gaps by studying how teams of undergraduate students applied privacy ideation cards in capstone projects that involved building real-world software for industry sponsors. We found that privacy ideation cards fostered greater consideration and understanding of the extent to which the projects aligned with privacy regulations. We identified three main themes from student discussions of privacy compliance: (i)\u00a0defining personal data; (ii)\u00a0assigning responsibility for privacy compliance; and (iii)\u00a0determining and exercising autonomy. The results suggest that application of the cards for real-world projects requires careful consideration of intersecting factors such as the stage at which the cards are used and the autonomy available to the developers. Pedagogically, ideation cards can facilitate low-level cognitive engagement (especially the cognitive processes of meaning construction and interpretation) for specific components within a project. Higher-level cognitive processes were comparatively rare in ideation sessions. These findings provide important insight to help enhance capstone instruction and to improve privacy ideation cards to increase their impact on the privacy properties of the developed software.<\/jats:p>","DOI":"10.1145\/3458038","type":"journal-article","created":{"date-parts":[[2021,10,17]],"date-time":"2021-10-17T01:24:17Z","timestamp":1634433857000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Promoting Privacy Considerations in Real-World Projects in Capstone Courses with Ideation Cards"],"prefix":"10.1145","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4757-1604","authenticated-orcid":false,"given":"Ying","family":"Tang","sequence":"first","affiliation":[{"name":"Indiana University Bloomington, Indiana, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Morgan L.","family":"Brockman","sequence":"additional","affiliation":[{"name":"Indiana University Bloomington, Indiana, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8214-0765","authenticated-orcid":false,"given":"Sameer","family":"Patil","sequence":"additional","affiliation":[{"name":"Indiana University Bloomington, Indiana, United States"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,10,15]]},"reference":[{"key":"e_1_3_3_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/2591062.2591201"},{"key":"e_1_3_3_3_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00766-003-0183-z"},{"key":"e_1_3_3_4_2","unstructured":"Brooke Auxier Lee Rainie Monica Anderson Andrew Perrin Madhu Kumar and Erica Turner. 2019. Americans and Privacy: Concerned Confused and Feeling Lack of Control Over Their Personal Information. Retrieved June 14 2021 from https:\/\/www.pewresearch.org\/internet\/2019\/11\/15\/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information\/."},{"key":"e_1_3_3_5_2","doi-asserted-by":"publisher","DOI":"10.5555\/2208940.2208951"},{"key":"e_1_3_3_6_2","doi-asserted-by":"publisher","DOI":"10.4324\/9781315059051"},{"key":"e_1_3_3_7_2","doi-asserted-by":"publisher","DOI":"10.1177\/0022167883232011"},{"key":"e_1_3_3_8_2","unstructured":"California Civil Code. 2018. TITLE 1.81.5. California Consumer Privacy Act of 2018 [1798.100-1798.199.100]. Retrieved June 30 2021 from https:\/\/leginfo.legislature.ca.gov\/faces\/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5."},{"key":"e_1_3_3_9_2","unstructured":"Ann Cavoukian. 2011. Privacy by Design: The 7 Foundational Principles. Retrieved June 14 2021 from https:\/\/iapp.org\/media\/pdf\/resource_center\/pbd_implement_7found_principles.pdf."},{"key":"e_1_3_3_10_2","doi-asserted-by":"publisher","DOI":"10.4018\/978-1-61350-501-4.ch007"},{"key":"e_1_3_3_11_2","first-page":"12","article-title":"The impact of the EU general data protection regulation on scientific research","volume":"11","author":"Chassang Gauthier","year":"2017","unstructured":"Gauthier Chassang. 2017. The impact of the EU general data protection regulation on scientific research. ecancermedicalscience 11, 709 (2017), 12 pages. DOI:https:\/\/doi.org\/10.3332\/ecancer.2017.709","journal-title":"ecancermedicalscience"},{"key":"e_1_3_3_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/2335356.2335358"},{"key":"e_1_3_3_13_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10506-008-9067-3"},{"key":"e_1_3_3_14_2","volume-title":"Basics of Qualitative Research: Techniques and Procedures for Developing Grounded Theory (4th ed.)","author":"Corbin Juliet","year":"2014","unstructured":"Juliet Corbin and Anselm Strauss. 2014. Basics of Qualitative Research: Techniques and Procedures for Developing Grounded Theory (4th ed.). SAGE Publications, Inc."},{"key":"e_1_3_3_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2013.25"},{"key":"e_1_3_3_16_2","unstructured":"Tamara Denning Batya Friedman and Tadayoshi Kohno. 2013. The Security Cards: A Security Threat Brainstorming Toolkit. Retrieved June 30 2021 from https:\/\/securitycards.cs.washington.edu\/index.html."},{"key":"e_1_3_3_17_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jsis.2007.09.002"},{"key":"e_1_3_3_18_2","volume-title":"Learning To Think: Disciplinary Perspectives. The Jossey-Bass Higher and Adult Education Series (1st ed.)","author":"Donald Janet Gail","year":"2002","unstructured":"Janet Gail Donald. 2002. Learning To Think: Disciplinary Perspectives. The Jossey-Bass Higher and Adult Education Series (1st ed.). Jossey-Bass Inc., San Francisco, CA."},{"key":"e_1_3_3_19_2","unstructured":"Brian Eno and Peter Schmidt. 1975. Oblique Strategies. Retrieved June 30 2021 from http:\/\/www.rtqe.net\/ObliqueStrategies\/."},{"key":"e_1_3_3_20_2","unstructured":"European Parliament and Council of the European Union. 2016. Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data and Repealing Directive 95\/46\/EC (General Data Protection Regulation). Retrieved June 30 2021 from https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj."},{"key":"e_1_3_3_21_2","unstructured":"Federal Trade Commission (FTC) Division of Financial Practices Bureau of Consumer Protection. 2000. Privacy Online: Fair Information Practices in the Electronic Marketplace: A Report to Congress. Retrieved June 30 2021 from https:\/\/www.ftc.gov\/sites\/default\/files\/documents\/reports\/privacy-online-fair-information-practices-electronic-marketplace-federal-trade-commission-report\/privacy2000.pdf."},{"key":"e_1_3_3_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/2207676.2208562"},{"issue":"1","key":"e_1_3_3_23_2","first-page":"6","article-title":"Benefits of industry involvement in multidisciplinary capstone design courses","volume":"30","author":"Goldberg Jay R.","year":"2014","unstructured":"Jay R. Goldberg, Vikram Cariapa, George Corliss, and Kate Kaiser. 2014. Benefits of industry involvement in multidisciplinary capstone design courses. International Journal of Engineering Education 30, 1 (2014), 6\u201313.","journal-title":"International Journal of Engineering Education"},{"key":"e_1_3_3_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/1858171.1858189"},{"key":"e_1_3_3_25_2","first-page":"25","volume-title":"Conference on Privacy & Data Protection","author":"G\u00fcrses Seda","unstructured":"Seda G\u00fcrses, Carmela Troncoso, and Claudia Diaz. [n.d.]. Engineering privacy by design. In Conference on Privacy & Data Protection, Vol. 14. 25 pages. Issue 3."},{"key":"e_1_3_3_26_2","doi-asserted-by":"publisher","DOI":"10.53761\/1.13.2.2"},{"key":"e_1_3_3_27_2","doi-asserted-by":"publisher","DOI":"10.1016\/S0164-1212(02)00012-2"},{"key":"e_1_3_3_28_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-55415-5_38"},{"key":"e_1_3_3_29_2","doi-asserted-by":"publisher","DOI":"10.14742\/ajet.1091"},{"key":"e_1_3_3_30_2","doi-asserted-by":"publisher","DOI":"10.1177\/1049732305276687"},{"key":"e_1_3_3_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3152893"},{"key":"e_1_3_3_32_2","doi-asserted-by":"publisher","DOI":"10.1177\/0741713610380439"},{"key":"e_1_3_3_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2011.179"},{"key":"e_1_3_3_34_2","doi-asserted-by":"publisher","DOI":"10.1002\/chp.20063"},{"key":"e_1_3_3_35_2","doi-asserted-by":"publisher","DOI":"10.1002\/poi3.183"},{"key":"e_1_3_3_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3289238"},{"key":"e_1_3_3_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/2702123.2702142"},{"key":"e_1_3_3_38_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10459-007-9090-2"},{"key":"e_1_3_3_39_2","doi-asserted-by":"publisher","DOI":"10.1080\/00405849309543591"},{"key":"e_1_3_3_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/RE.2011.6051647"},{"key":"e_1_3_3_41_2","unstructured":"Roger McNamee. 2019. A Brief History of How Your Privacy Was Stolen. Retrieved June 6 2021 from https:\/\/www.nytimes.com\/2019\/06\/03\/opinion\/google-facebook-data-privacy.html."},{"key":"e_1_3_3_42_2","first-page":"5","volume-title":"New Directions for Adult and Continuing Education","author":"Mezirow Jack","year":"1997","unstructured":"Jack Mezirow. 1997. Transformative learning: Theory to practice. In New Directions for Adult and Continuing Education. Number 74. Jossey-Bass Publishers, 5\u201312."},{"key":"e_1_3_3_43_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11165-006-9029-2"},{"key":"e_1_3_3_44_2","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2013.18"},{"key":"e_1_3_3_45_2","unstructured":"Organisation for Economic Co-operation and Development (OECD). 2013. The OECD Privacy Framework. Retrieved June 30 2021 from https:\/\/www.oecd.org\/sti\/ieconomy\/oecd_privacy_framework.pdf."},{"key":"e_1_3_3_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/RE.2007.65"},{"key":"e_1_3_3_47_2","unstructured":"Lauren B. Resnick and Committee on Research in Mathematics Science and Education in the Commission on Behavioral and Social Sciences and Education of the National Research Council. 1987. Education and learning to think. (1987) 72 pages."},{"key":"e_1_3_3_48_2","first-page":"1333","article-title":"Privacy by design: A counterfactual analysis of Google and Facebook privacy incidents","volume":"28","author":"Rubinstein Ira S.","year":"2013","unstructured":"Ira S. Rubinstein and Nathaniel Good. 2013. Privacy by design: A counterfactual analysis of Google and Facebook privacy incidents. Berkeley Technology Law Journal 28 (2013), 1333\u20131414.","journal-title":"Berkeley Technology Law Journal"},{"key":"e_1_3_3_49_2","volume-title":"Educating the Reflective Practitioner: Toward a New Design for Teaching and Learning in the Professions (1st ed.)","author":"Sch\u00f6n Donald A.","year":"1990","unstructured":"Donald A. Sch\u00f6n. 1990. Educating the Reflective Practitioner: Toward a New Design for Teaching and Learning in the Professions (1st ed.). Jossey-Bass Inc., San Francisco, CA."},{"key":"e_1_3_3_50_2","doi-asserted-by":"publisher","DOI":"10.1145\/1743546.1743559"},{"key":"e_1_3_3_51_2","doi-asserted-by":"publisher","DOI":"10.1145\/2901790.2901836"},{"key":"e_1_3_3_52_2","volume-title":"Privacy at Risk: The New Government Surveillance and the Fourth Amendment","author":"Slobogin Christopher","year":"2008","unstructured":"Christopher Slobogin. 2008. Privacy at Risk: The New Government Surveillance and the Fourth Amendment. University of Chicago Press."},{"key":"e_1_3_3_53_2","first-page":"4","volume-title":"Workshop on Bridging the Gap between Privacy by Design and Privacy in Practice at the 2016 CHI Conference on Human Factors in Computing Systems","author":"Spalding Kerry","year":"2016","unstructured":"Kerry Spalding and Tsai Janice Y.2016. Practical strategies for integrating privacy by design throughout product development process. In Workshop on Bridging the Gap between Privacy by Design and Privacy in Practice at the 2016 CHI Conference on Human Factors in Computing Systems. New York, NY, 4 pages. Retrieved June 30, 2021 from https:\/\/networkedprivacy2016.files.wordpress.com\/2015\/11\/practicalstrategiespbd_cameraready.pdf."},{"key":"e_1_3_3_54_2","doi-asserted-by":"publisher","DOI":"10.1145\/2209249.2209263"},{"key":"e_1_3_3_55_2","doi-asserted-by":"publisher","DOI":"10.1145\/2851581.2856503"},{"key":"e_1_3_3_56_2","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884833"},{"key":"e_1_3_3_57_2","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568240"},{"key":"e_1_3_3_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/3152715"},{"key":"e_1_3_3_59_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-54069-1_4"},{"key":"e_1_3_3_60_2","doi-asserted-by":"publisher","DOI":"10.5555\/2663678.2663686"},{"key":"e_1_3_3_61_2","volume-title":"Critical & Creative Thinking: Strategies for Classroom Inquiry","author":"Wilks Susan","year":"1995","unstructured":"Susan Wilks. 1995. Critical & Creative Thinking: Strategies for Classroom Inquiry. Heinemann."},{"key":"e_1_3_3_62_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2016.09.006"},{"key":"e_1_3_3_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/1978542.1978568"}],"container-title":["ACM Transactions on Computing Education"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3458038","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3458038","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:24:39Z","timestamp":1750195479000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3458038"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,10,15]]},"references-count":62,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2021,12,31]]}},"alternative-id":["10.1145\/3458038"],"URL":"https:\/\/doi.org\/10.1145\/3458038","relation":{},"ISSN":["1946-6226","1946-6226"],"issn-type":[{"value":"1946-6226","type":"print"},{"value":"1946-6226","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,10,15]]},"assertion":[{"value":"2020-09-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-05-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-10-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}