Keywords

1 Introduction

Public displays are often found in public places like railway stations, airports and touristic places. This technology is typically used to provide general information about places, flights and departing trains [1]. However, public interactive displays (PIDs) are used in commercial and research places like shopping centers or university buildings [2, 3]. The purpose of the PID technology is to provide specific and individual information such as wayfinding or route planning [4, 5]. In the context of public transport, most public displays are used as a source of information about upcoming trains and connections. However, nowadays most PIDs are used in a stationary context. They are built in existing or new infrastructure and, obviously, do not change places. In public transport vehicles, PIDs become mobile, which affects the information they present. While moving, their context constantly changes. Most PIDs in vehicles therefore show contextually adapted information, referring to the next stop for example. However, situated content that might be relevant for some passengers, may not necessarily be relevant to any individual. This becomes obvious when considering the varying information needs of different passenger having different destinations, tickets and different familiarity with the public transport network. The technology of PID has the potential to go beyond simple interactive information terminals and become truly smart technology providing situated, personalized and thereby relevant content for individual passengers.

Therefore, in our research project SmartMMI we are developing an adaptive passenger information system for a mobile public display focusing on improving passenger information along their travel chain. In this project, we research model and context based mobility information on smart public displays and mobile devices in public transport. We want to improve the information provision for passengers in every situation. Depending on the situation but also depending on the passenger, the need for information changes. This can happen in the event of a disruption, plan changes, the discovery of tourist destinations or of services available along the route. Our goal is to inform passengers appropriately in their individual situation. To this purpose, we combine a variety of data sources to form a smart public transport data platform that integrates real time public transport information, information on points of interests, but also information on bike or car sharing services along the route. The integrated data is then adapted to the passenger’s context, and presented on semi-transparent public displays in public transport vehicles. These semi-transparent, multi-touch-enabled public interactive displays are built-in as windows in public transport vehicles and called “SmartWindows”. Beyond the design of the interactive SmartWindow, we also research the interplay of mobile application and SmartWindow for situational passenger information.

The SmartWindow serves as a passenger information system and provides real-time traffic information, information about traffic disturbances as well as passenger’s connections. Developing an adaptive passenger information, the passenger information system needs to be aware of the passenger’s context. In order to fulfill this requirement, we use the passenger’s personal devices like smartphones or smart watches as the context sources. In this paper, we present the results of our research evaluating a multi-device passenger information system focusing on privacy aspects. We present three different methods of pseudonyms that were used to visually link the personal information on the passenger’s smartphone with the displayed information on the public display. Finally, we report on our evaluation results from the acceptance study and the user study evaluating the intelligibility of the used visual pseudonyms.

In the next section of our paper, we will look at approaches towards passenger information in public transport and at public displays and respectively their evaluation. We will then briefly describe the scope and intended configuration of our SmartWindow. The next section introduces the conducted user study and presents their result. In the last section of this paper, we will discuss the challenges and findings of our development and evaluation process and will give an outlook on our future work, pointing out evaluation steps we are planning in the upcoming months.

2 Related Work

Interactive digital displays are becoming a ubiquitous part of urban environments [6]. The use of public interactive displays varies greatly across different situations, yet the effectiveness of all public displays relies on the assumption that they will be noticed and used [7]. However, since public displays are used very contextually in various public spaces, lab studies can often not paint the whole picture and it is difficult to determine the real effectiveness of a public interactive display [5]. A user-centered design of public displays can ensure to keep the user’s requirements in the specific application area in focus during the development process. In public transport, the user’s requirements are hard to grasp, since the user group is as wide as it can get – almost everybody uses public transport at some point.

Personalizing the content of public interactive displays in order to make it more relevant to passers-by, many researchers have focused on user profiles. The personal profiles usually require to be set up by the user through a smartphone app, which can potentially compromise privacy and may create barriers for interaction as implementations. Parker et al. describe a deviating approach. The authors explore an implicit personalization approach for public interactive displays as an alternative to user profiles. Two evaluation studies of public interactive displays, implicitly adapting the display based on user’s goals and characteristics, are presented [3]. Based on the carried-out studies, a definition of implicit personalization as well as the adaptation of the user interface of a PID is derived.

To understand the basic requirements of passengers in public transport, it helps to design personas [8]. Personas represent archetypical users and can facilitate the understanding of the user’s behavior, needs, motivations and limitations. Hörold et al. describe personas and their interaction preferences in German public transport [8]. The personas we developed in our research project were based on this work. For the UK, Oliveira et al. described the development of personas in a collaborative research project of academic institutions and industry partners in the UK [9, 10]. Based on their personas, they found that newly designed technology could improve passengers’ experience in public transport and argue for a solid understanding of the users and their needs when conceiving innovations in public transport. Oliveira et al. collected data by semi-structured face-to-face interviews and additionally used questionnaires. Questionnaires are a suitable method to have a closer look on which information passengers need in which situations. We also included a questionnaire in our design process.

Public interactive displays introduce new possibilities for transportation companies, like using less paper-based information at different stages of the journey. Hörold et al. suggest a user-centered design process and four different evaluation methods to identify where and how to apply public displays in public transport: expert workshops, comparative usability evaluations, two lab-based usability evaluations and an expert evaluation [5]. These multiple evaluation methods combine the knowledge of experts and the expectations of passengers as well as knowledge from transport companies. In our user centered design process, we also used several different evaluation methods. Public transport experts were involved in the development of our personas and requirements as well as regular passengers in lab-based evaluations. We also had the chance to evaluate our design with some media communications experts and reported on our finding in Keller et al. [26].

We argue to extend the range of evaluation methods by studies that involve public transport context, such as real public transport data up to field studies in real public transport settings, which is planned for our prototype at the beginning of next year. Ardito et al. also argue for field tests and report a certain tendency for more field tests in their survey on interaction with large displays [11].

3 Public Displays in Public Transport

Stationary public displays can be found in many places of mobility with a high density of people, such as airports, train and bus stations. Nowadays, many buses and trams are equipped with so-called mobile public displays through which the passenger information service is offered. Mobile public displays have attracted increasing attention in recent years. However, many of them do not offer any interaction possibilities but display advertising, upcoming departures or information about the current location. In future, the technology of semi-transparent public interactive displays implemented in public transport promises to improve the passenger information provision. First concepts of implementing interactive semi-transparent displays instead of usual windows and using them as passenger information systems already exist [12]. The concept of a SmartWindow as shown in Fig. 1 is interactive so that every passenger can work with it and get a variety of information, such as weather, next stops, detours and disturbances adapted to the passenger’s route and passenger’s preferences. However, challenges of visually linking the personal data with the data on the PIDs as well as data security arise.

Fig. 1.
figure 1

Graphic design study of a mobile public interactive display called SmartWindow.

Full size image

3.1 Public Displays at Stops

More and more public transport stops are being equipped with displays. The main purpose of these displays is to inform passengers about the departure times of buses and trains. Mostly, simple LED displays are used. A more sophisticated and modern technology is using LCD or plasma screens, which thanks to their significantly higher resolution are able to display information that is more complex. Three concrete examples are presented below.

TransitScreen.

TransitScreen is a software solution from Multimodal Logic for displaying various transport information [13]. It enables the departure times of a large number of US transport companies (e.g. bus and train) to be displayed, but also bike and car sharing providers that offer the TransitScreen. The software shown in Fig. 2 can be used on almost all displays. This is to always ensure that only suitable information be shown for the location. As a site of operations, the manufacturer not only provides stops but also integrates them into shops or in the entrance area of companies, so that customers or employees can approach the stop according to the departure times. TransitScreen is designed as a pure display and does not allow any interaction by the user. Only if the lines and means of transport suitable for the user are shown on the display, the user can use the display.

Fig. 2.
figure 2

Exemplar of the TransitScreen [13].

Full size image

Real-Time Departure Monitor.

Public displays at stops of public transport are digital information systems displaying relevant information for passengers in realtime. As in Fig. 3 information like departing time and track of individual lines, changes, delays and in rare cases even the occupation rate of a transport system are usually displayed.

Fig. 3.
figure 3

Point of information [14].

Full size image

On the Go! Travel Station.

Since 2011, The New York MTA (Metropolitan Transportation Authority) has operated “On the Go!” Interactive Public Displays called Travel Stations. Meanwhile, more than 25 stops are equipped with these displays [15]. In addition to calling up departure times, they also allow calling up maps of the surrounding. Furthermore, routes can be planned directly, and the appropriate lines members are presented/displayed. Via the display, the users can also access current news, information about the weather and possible disturbances as well as other means of transport. In addition, the displays are used for advertising purposes. As shown in Fig. 4 the interaction with the displays takes place via the built-in touchscreen.

Fig. 4.
figure 4

On the Go! Travel Station in New York [15].

Full size image

3.2 Public Displays in Public Transport Vehicles

Many public transport operators equip their buses and trams with screens through which a passenger information service is offered. These mobile public displays often display the current time and date, the upcoming stops and transfer options at the next stop as sown in Fig. 5. In addition to traffic relevant information, the mobile public displays are used for advertising and entertainment purposes. However, no passenger adaptation and interaction are possible.

Fig. 5.
figure 5

Displays in a tram presenting passenger information and entertainment.

Full size image

4 Privacy in Public Transport

The visualization concepts being currently developed for the SmartWindow follow the general privacy rules. This means that personal passenger information like origin, destination and interchanges will remain in the private device while the omnipresent and big screen of a SmartWindow seems to be the proper way to visualize context-aware passenger information like a reminder to interchange. Since a public transport vehicle usually carries several passengers and many passengers can interact with the SmartWindow at the same time, the information can potentially be seen by many passengers. As shown in Fig. 6, the developed visualization concept of a SmartWindow contains publicly accessible information. Consequentially, a graphical concept that visually links personal information with the information displayed on the PID needs to be developed. Additionally, passengers have a right of data protection, which means that context-aware passenger information displayed on the SmartWindow must be anonymous and cannot be affiliated with real passengers. This reveals the requirement of developing SmartWindow visualizations that must follow the privacy regulations.

Fig. 6.
figure 6

Arrangements for interaction and information areas on the SmartWindow.

Full size image

4.1 Legal Basis

The data transfer from a private device to the SmartWindow and the subsequent visualization of the data on the large window are subject to different legal hurdles, especially data protection regulations. Data protection refers to the protection of the citizen against the impairments of passengers’ privacy by processing data, which relate to themselves. According to established case law, as an expression of human dignity as a self-determined individual, everyone must be able to decide which personal data should be accessible to whom, when and how [16]. In this specific case of using the SmartWindow, the passenger has to be able to decide independently, which data should be transferred to the service provider and which data could be visible on the SmartWindow. Like in all legal areas, these data protection principles consist of the interaction of a large number of standards and regulations.

In the international context, Article 8 of the European Convention on Human Rights (ECHR) plays a significant role. The ECHR is an international treaty signed by 47 countries [17]. The Convention binds all contracting states and, as a fundamental rights document from 1950, does not contain a particular basic data protection right. Instead, the basis for data protection is the right of respect for one’s “private and family life, his home and his correspondence” guaranteed in Art. 8 Section 1 ECHR [18]. The scope of protection of Art. 8 ECHR is broadly interpreted and the protection of personal data and telecommunications secrecy is also understood as an expression of this right to privacy [19]. As a result of this interpretation, any collection, storage, transfer or other processing of personal data or human communication constitutes an encroachment in Art. 8 ECHR and must be justified.

All 27 member states of the European Union (EU) are also the contracting states of the ECHR. However, the EU itself as an organization has not joined the ECHR yet [20]. For this reason, the EU Primary Law, which results from the Charter of Fundamental Rights of the European Union (CFR), applies within the EU and between the member states. Art. 7 CFR standardizes the right of respect for private and family life, home and communications and largely corresponds to Art. 8 ECHR in terms of wording and warranty content. The European Convention, which has formulated the text of the Charter, states that the rights of Art. 7 CFR correspond to the rights guaranteed by Art. 8 ECHR [21]. Beyond this general principle, the CFR specifies data protection even further in Art. 8. This article is a lex specialis for the processing of personal data. This shows that the CFR was formulated more recently.

These principles of the ECHR and the CFR result in further, more specific EU data protection regulations, among which the European General Data Protection Regulation (GDPR) plays a central role. The GDPR has been directly applicable within the EU since May 25, 2018. On the one hand, the GDPR is supposed to unify members across the EU and create a solid and enforceable legal framework in the area of data protection [22]. On the other hand, it should offer uniform guidelines for equal economic conditions in the union and thus strengthen the internal market [23]. This is why the GDPR is the starting point for any data protection review. As part of this work, the basic structure and basic terms contained in the regulation are presented below, which are applicable to the topic of public transport. Since there are several different legal bases for data protection law in addition to the GDPR, the role of the GDPR that is applicable in our project is shown in Fig. 7.

Fig. 7.
figure 7

Arrangement of the GDPR in the international context [24,25,26,27].

Full size image

4.2 GDPR

As mentioned above, the user of the SmartMMI system should be able to decide which data, when, to whom and how he wants to make accessible. However, this does not affect all types of data, but only certain data that is protected in the GDPR. According to Art. 2 Para. 1 GDPR, the regulation applies to the wholly or partially automated processing of personal data […]. Thus, only personal data are protected. According to Art. 4 No. a GDPR, personal data means any information relating to an identified or identifiable natural person. The identifiability of a person is particularly to be assumed, if it can be determined by association with an identifier such as a name, a location or one or more special characteristics, the expression of their physical, physiological, genetic, psychological, economic, cultural or social identity [28]. Therefore, personal information such as name, address, date of birth, age, origin, gender, education, marital status, eye color, fingerprints, X-rays, photos and video recordings, preference or attitude is to be regarded as personal data [29]. However, special personal data or sensitive data which according to Art. 9 Para. 1 GDPR enjoy higher protection requirements are defined more precisely. The reason for the increased need for protection is an increased risk of discrimination. Sensitive data includes information on:

  • racial or ethical origin,

  • political opinions,

  • religious or philosophical beliefs,

  • trade union membership,

  • genetic & biometric data for the purpose of uniquely identifying of a natural person,

  • health data and

  • data on the sex life or sexual orientation of a natural person.

The data processed by the SmartMMI system can be classified into the following categories based on the above definitions:

The data from (1) can be displayed on the SmartWindow in the area of public information, which is shown in Fig. 6, regardless of the user requirements. Data from (2) and (3) can only be processed with the consent of the user.

Independent of the consent regulation, the SmartWindow must not become a source of crimes. Therefore, measures must be taken that the sensitive data is not accidentally transmitted and/or displayed. For example, the walkways to the destination must not be displayed on the SmartWindow, in any case with or without consent, so that the possible address of the user can not be seen by other passengers. If there is a possibility to buy tickets via the system, then security measures must assure that the personal data of the customer, e.g. bank details, are not processed unprotected. One of the suitable technical and organizational measures for the purpose of data processing security, which is also mentioned in Art. 3 GDPR, is pseudonymization. The SmartMMI system also uses this method to ensure the required protection. The pseudonymization is explained in more detail in the following paragraph.

5 Pseudonymization of Passenger Data on Mobile Public Displays

Natural persons have the right of personal data protection. One way to ensure that the publicly displayed information cannot be assigned to a single person is the method of pseudonymization. Only the individual passenger knows which specific pseudonym represents the information on the SmartWindow that is intended for him or her. The method of pseudonymization applies the processing and alteration of personal data that cannot be traced back to the identity of a natural person without the inclusion of additional information and thus helps protecting a passenger’s identity [3, 4]. Pseudonyms are widely used in programs that are used by several users simultaneously, such as GitHub, shown in or GoogleDocs.

Pseudonymization is mostly realized through different colors, symbols, avatars, signs or abstractions. The context awareness of the PID system is realized by the details-on-demand principle described by Shneiderman [30]. For this purpose, the passenger establishes a connection between the application installed on the mobile device and the PID displaying the passenger information service. This connection allows the system to track whether the previously planned trip and the planned connections are still feasible. In case of upcoming interchanges, delays or disruptions the system will inform the passenger on the omnipresent PID calling for action. Thereby, the pseudonymization will serve as an identification feature for the specific passenger. In the use case of SmartWindow, a pseudonym is assigned to a passenger when the personal smartphone and public SmartWindow are coupled to exchange those traffic relevant data. Since only the individual passenger knows which pseudonym is used by the coupled devices, the risk of publicly displayed data being traced back to the individual subject is minimized.

6 User Study

After analyzing the legal requirements, we conducted an experimental user study to evaluate the usefulness and intelligibility of the visual links between personal passenger data on passengers’ smartphone and publicly visible data on the mobile PID called SmartWindow. Considering the multi-device evaluation approach, we designed paper mockups representing passengers’ smartphone, as shown in Fig. 8.

Fig. 8.
figure 8

Paper prototypes of a smartphone.

Full size image

For the SmartWindow we developed a high fidelity prototype based on HTML and JavaScript that implemented interfaces to our smart public transport data platform. The HTML prototype is shown in Fig. 9. In the design of this high fidelity prototype, we applied the results of all prior evaluation phases that were described in [31].

Fig. 9.
figure 9

HTML prototype of a SmartWindow.

Full size image

The SmartWindow prototype runs on our 98-inch multi-touch display and can adapt its transparency as well as brightness. In our research project, we mainly research the configuration of a SmartWindow besides two rows of two seats facing each other. In order to reflect reality in our study, we arranged the seats correspondingly and adapted the size of the prototype to the exact size of vehicle windows in local trams. As shown in Fig. 10, test subjects will interact with the SmartWindow while seated.

Fig. 10.
figure 10

Study participant interacting with the SmartWindow.

Full size image

6.1 Study Design

Based on public transport personae previously presented by Hörold et al. [8] and further developed by Keller et al. [32], we developed two typical passenger scenarios involving the commuter and the tourist persona. The study participants were given a short introduction covering the purposes and interaction concepts of the SmartWindow. Afterwards, the test persons read the scenarios and successively took on the roles of the personae of the commuter and the tourist. The tasks performed applying the SmartWindow prototype were set in rotation in order to be able to assess the conspicuousness of the individual pseudonyms. The subjects had the prototype of the SmartWindow on the display as well as a smartphone at their disposal. Applying the wizard-of-Oz method the smartphone was presented to the study participants in paper form at the appropriate time. Thus, the information needed to complete the tasks was passed on just in time. Throughout the study, the recorded sound of a tram ride is played in the background to make the scenario as realistic as possible. Subsequently, all test persons answered a questionnaire on general information, technological affinity, and knowledge of local public transport as well as rating the mockups and pseudonyms. It is ensured that no persons participate in the study who are familiar with the SmartWindow prototype, since prior knowledge may distort the results.

6.2 Study Procedure

The procedure of the study is organized in two parts, the study itself and the questionnaire at the end. In the first part, study participants are given paper prototypes of smartphone interfaces to obtain the necessary information. The smartphone contains personal data that legally may not be displayed on the SmartWindow such as origin or destination of a passenger. Applying the wizard-of-Oz method means that by designing mockups, a finished system can be simulated without being completely developed.

In addition to the wizard-of-Oz method, the thinking-aloud method was used to determine impressions and feelings of the participant during the user study. This enables the study director to make observations and record them. With the thoughts of the test persons, improvements or changes can be made after the study if necessary, and it becomes clear why the test persons act the way they act. This tool is often used in software development. It ensures that prototypes can be tested for user-friendliness and usability during the development phase helping to eliminate malfunctions [33].

During the study, each test subjects sit individually in a window seat in front of the display, as shown in Fig. 11. After a short introduction, they subjects are given tasks that need to be performed by interacting with the SmartWindow. These tasks include buying a suitable ticket or planning a route using the available devices SmartWindow and smartphone. The screens of the smartphone are available as paper prototypes and handed to the subjects as shown in Fig. 12.

Fig. 11.
figure 11

Study participant receives a scenario.

Full size image
Fig. 12.
figure 12

Participant receives a paper prototype.

Full size image

The test subjects were not informed in advance about the fact that pseudonyms are used in the mockups in order to be able to assess the conspicuousness of these. All study participants, even those who did not notice any of the pseudonyms, were given the opportunity afterwards to familiarize themselves with the types of pseudonymization used on the SmartWindow as well as on the smartphone in order to be able to consciously answer the corresponding questions in the questionnaire. By utilizing the thinking-aloud method during the study, it became visible whether the method of pseudonymization was recognized by the test persons or whether they completed the tasks without the pseudonyms.

Once a study participant completed both scenarios, the questionnaire was answered online on a tablet computer. The questionnaire was divided into two parts. The first section contained general questions about the person, technology affinity and the knowledge of public transport. The second part asked questions about the study, such as the conspicuousness of the used pseudonyms as well as an assessment which of the pseudonyms the test subjects preferred for the SmartWindow in public transport.

Overall, 16 participants of different age groups, different experiences with public transport and affinity towards new technologies participated in our user study. The ages of the participants ranged from 23 to 34-years. 14 participants were students of different majors and two participants employed. Ten participants stated to use public transport regularly, four subjects stated one to three times a month and two respondent use public transport less frequently than once a month. All subjects stated to have a high technical affinity, were familiar with the operating technology, and could participate in the study without extensive technical introduction. The results give a good insight into the varying preferences of different passengers.

7 Results

All test subjects were able to empathize into the personae and the given scenarios. Some participants noted the typical background noise of a tram, which tried to make the scenario even more realistic. In general, the possibility of pseudonymization was stated as positive by all study participants in the context of being implemented in public transport on SmartWindow and smartphone in order to protect the data from unauthorized access. Only two out of sixteen study participants did not see any of the three different types of pseudonyms used during the study. Those subjects still were able to successfully complete the tasks.

Twelve out of sixteen participants (75%) chose the symbols as shown in Fig. 13a as their favorite pseudonymization tool. The subjects described the symbol as most likeable, easy to understand and recognize, as well as most conspicuous. One participant rated the pseudonymization tool of abstractions as shown in Fig. 13b as appropriate. The benefits were stated as easily recognizable to a person through the colors and applicable through prior knowledge of the type of pseudonymization. Others criticized the abstraction as requiring getting used to, strange and not easily recognizable. Equally, one participant rated the pseudonymization tool of numbers as shown in Fig. 13c as the best option. Other subjects mentioned the possibility of confusion with the numbers of lines seen on the departure monitor. However, the number as a pseudonym is described as most unobtrusive and thereby increasing the feeling of personal data security.

Fig. 13.
figure 13

Pseudonymization tools: a) symbols [left], b) abstractions [center], c) numbers [right].

Full size image
Fig. 14.
figure 14

Study participant participating in our multi device evaluation study.

Full size image

The evaluation of the questionnaire shows that the respondents, who do not wish to display the sensitive data listed in Table 1, do not wish to do so on their own initiative. In addition, it becomes apparent that the subjects are reluctant to show sensitive, personal information in front of other persons. Subjects were more willing and likely to display data marked as insensitive on the SmartWindow than data marked as sensitive. One person stated to not hesitate in revealing the destination address. Another three subjects saw no problem revealing their ticket information.

Table 1. Categories of the data used in the SmartMMI-System.
Full size table

Ninety percent of the study participants would use the combination of SmartWindow and smartphone, shown in Fig. 14, in real life including pseudonymization and evaluated this concept extremely positively.

Summarizing the results, the study showed that most participants (83%) favored the pseudonymization method using symbols over the ones featuring abstractions and numbers, which both have been rated less noticeable on the big screen. Reasons for the preference of the symbols were their simplicity, readability, sympathy and abnormality. The idea of pseudonyms on the big screen was unanimously seen as a good way of keeping personal information private as most participants mentioned a malaise to the idea of their sensitive data being visible for other passengers.

8 Discussion, Outlook and Limitations

Since the pseudonym can be found on both the smartphone and the SmartWindow, it is easy to find and recognize as a personal symbol. The disadvantage of this method is that only smartphone owners can use it. Potentially in future smartphone users may be able to determine what is displayed on the mobile PID themselves by setting the parameters in the application. Data actively released by self-determination is not covered by the EU data protection basic regulation. However, our study shows that participating subjects would not make sensitive data available for display on a SmartWindow. This shows that in the age of digitization, many people are more sensitive to how they handle their personal data and information.

Continuing this work, we are planning to carry out evaluations for other methods of pseudonymization, such as different color elements. Furthermore, we are planning on developing a real application and testing the pseudonymization with subjects who have prior knowledge of the pseudonyms. In this case, the information which pseudonym is dynamically assigned will be provided to the passenger while starting the application.

By using the thinking-aloud method, it was observed that the rotation of the tasks led to a recognition and understanding of the first pseudonym only when it was repeatedly displayed on the available devices. The corresponding question in the questionnaire revealed that some participants did not notice the use of pseudonyms at all. Since the symbol was the most conspicuous pseudonymization tool according to the majority of respondents, none of the other pseudonyms was recognized when the task began with the symbolization. In the other cases, when the pseudonyms number or abstraction were used first, all participants identified the pseudonyms.