Notice / Informed Consent Addendum for use of study data — European Union (EU) / European Economic Area (EEA)

Investigating Expert Perspectives on Studying Threats to People in Usable Security and Privacy Research

PI: Daniel Zappala, Professor, Computer Science Department, Brigham Young University, 1-801-422-2195

Researcher: Warda Usman, Graduate Student, Computer Science Department, Brigham Young University

Study location(s): SOUPS 2024 or Zoom call, at your convenience

This research will collect data about you that can identify you, referred to as Study Data. The General Data Protection Regulation (“GDPR”) requires researchers to provide this Notice / Consent to you when we collect and use Study Data about people who are located in a State that belongs to the European Union or in the European Economic Area.

We will obtain and create Study Data directly from you so we can properly conduct this research. As we conduct research procedures with your Study Data, new Study Data may be created. The Research Team will collect and use the following types of Study Data for this research:

• An interview with you about your opinions and experiences as a researcher.
• The interview will be transcribed and redacted to preserve your anonymity, and then the original audio recording will be deleted. Only the anonymized transcript will be preserved as study data.

This research will keep your Study Data indefinitely after this research ends. The following categories of individuals may receive Study Data collected or created about you:

• Members of the research team so they properly conduct the research
• Brigham Young University Institutional Review Board for Human Subjects staff will oversee the research to see if it is conducted correctly and to protect your safety and rights
• Any additional researchers we may collaborate with to perform our research or extend our results.

The research team will transfer your Study Data to our research site in the United States. The United States does not have the same laws to protect your Study Data as States in the EU/EEA. However, the research team is committed to protecting the confidentiality of your Study Data. Additional information about the protections we will use is included in the consent document.

The GDPR gives you rights relating to your Study Data, including the right to:

• Access, correct or withdraw your Study Data; however, the research team may need to keep Study Data as long as it is necessary to achieve the purpose of this research
• Restrict the types of activities the research team can do with your Study Data
• Object to using your Study Data for specific types of activities
• Withdraw your consent to use your Study Data for the purposes outlined in the consent form and in this document

Brigham Young University located in Provo, Utah, USA, is responsible for the use of your Study Data for this research. You can contact the BYU Principal Investigator, Daniel Zappala, by phone at 1-801-422-2195 or by email at zappala@cs.byu.edu if you have:

• Questions about this Notice
• Complaints about the use of your Study Data
• If you want to make a request relating to the rights listed above.

Consent

PARTICIPATION IN RESEARCH IS VOLUNTARY. You have the right to decline to participate or to withdraw at any point in this study without penalty or loss of benefits to which you are otherwise entitled.

If you wish to participate in this study, please continue to schedule an appointment.