Keywords

1 Introduction: Service Design in a Fluid Surveillance World

Design is constantly changing and growing, influenced by—and influencing at the same time—both human progress and technological advancements. Design is traditionally concerned with the creation of tangible artifacts such as objects (industrial design), clothes (fashion design), visual content (graphic design), and spaces (interior design and architecture) (Walker 2015). However, in the last decades, design expanded into the immaterial digital world (Hernández-Ramírez 2019). Redström and Wiltse grasp the complexity of modern digital tools—i.e., the everyday artefacts that combine a physical and a digital form—and call them “fluid assemblages” (2020).

For instance, a smartphone is a physical object—a product of industrial design—and a system that allows users to interact with people and information digitally. It emerges that the user, and not the designed object, is the main concern for contemporary designers. In contrast, Archer, in his 1965 definition of design and the act of designing, mentions “the formulation of a prescription or model”, “the embodiment of the design as an artifact”, and “a creative step” (Archer 1984, p. 58), with no reference whatsoever to the user of that artifact. Designers like Archer and Alexander (1963) focused more on addressing the objective needs and problems of the users rather than seeing users as individuals who interact with designed objects for their own unique and personal (and often unpredictable) reasons.

For 21st-century designers, ‘designing for people’ (Dreyfuss 2003) means being interested in shaping and improving the user and consumer experience with the designed object (Brown & Katz 2019). The role of the user experience (UX) designer has emerged as that of an expert in improving how users interact with and experience a designed object. UX design “encompasses all aspects of interacting with a product” (Blythe 2004, p. 41), including the design graphics, the interface, and the interaction with the user through touchpoints (Brown & Katz 2019).

Although UX design has advantages, we argue that it has limitations because it primarily focuses on the user’s interaction with the designed object (whether digital or not), without considering the broader context in which the interaction occurs. Service design emerged as design practice at the end of the 20th century to fill this gap. It builds on the assumption that design would be increasingly concerned with creating systems for specific purposes rather than consumer goods (Meroni & Sangiorgi 2011). Service design is naturally holistic, for it is the design of the area where the service and the user interact (Pacenti 1998), while the focus of UX design is on the interaction between the user and a specific product or service.

Since its beginning, service design has been connected to human-centered design research and methodology (Meroni & Sangiorgi 2011; Wetter Edman 2014). Human-centered design is a design approach and philosophy with a broad vision and action that considers the people involved in the relation between the designed object and the world, their desires, needs, and abilities (Norman 2013). Regardless of its limitations (Norman 2005), human-centered design should not be (completely) abandoned because it is still a powerful tool to affirm human dignity (Buchanan 2000) and is “an antidote to the cold dominance of technology and its inherent bias to replace or devaluate the contribution of people” (Brown & Katz 2019, p. 4).

Interactions nowadays often involve the digital world, regardless of whether the service or object is physical or digital. Even when the interaction between the user and the provider happens entirely offline (e.g., when a customer buys a good in a brick-and-mortar shop), an invisible part of that relationship often occurs in the digital domain. The collection and processing of consumers’ personal information is ubiquitous in the interactions between users and providers.

The practical impossibility of concealing our information justifies the claim that we live in a surveillance society (Capurro 2005) or under surveillance capitalism (Doctorow 2020; Foster & McChesney 2014; Véliz 2020; Zuboff 2019). The critical question for service design is how to deal with it: should service designers passively accept surveillance society, including its most nefarious consequences, or take a stance against it in the name of users’ and stakeholders’ interests and rights? More worryingly, surveillance society is fueled not only by corporations and governments but by end-users themselves—and serious threats to privacy may come from other users (Fukuyama 2022).

1.1 Scope and Methodology

This position paper addresses the research topic of how to build a designerly approach to privacy in service design. The methodology relies primarily on a multidisciplinary literature review to fill a gap in the design research about service design and informational privacy. When relevant, a case study from the authors’ recent research is used to sustain our findings. To our knowledge, no service design scholar has addressed the topic of privacy within and for service design. This paper answers the following research questions: 1) How can service design build a designerly understanding of informational privacy? 2) What methods can service designers use to establish a service design thinking for privacy?

In Sect. 2, we position service design as a practice that involves interactions with personal information. Section 3 explores why privacy should be a service design concern. Section 4 defines the idea of designerly understanding of informational privacy for service design and discusses how designers could develop such understanding and its implications. We also identify the methods to achieve a designerly understanding of informational privacy. In particular, through design ethnography and other related qualitative research methods, service designers can observe how users react to privacy challenges and develop such designerly understanding. Section 5 shows that the designerly understanding of privacy should lead to a service design thinking for privacy, intended as a methodology to integrate privacy concerns and requirements into service design based on tests, prototypes, beta versions, and speculative and thought experiments. Finally, in the last part of the paper, we discuss the further potential developments of our research.

2 Service Design for Interactions

The quality and functionality of a design product can be gauged by assessing its UX However, a consistent assessment of a product should not only consider its intrinsic quality, functionality and usability, and its overall UX. In today’s highly interconnected world, interactions are fundamental for any complex designed object, whether a product, service, process, brand, or organization (Buchanan 2005). Interactions happen between the user and the device and its interface, but also between the user and other users and between the users and the service provider. Consumers’ data are collected, processed, and possibly manipulated in all these interactions.

Service design emerged as a field of study in the 1990s (Meroni & Sangiorgi 2011) and focuses on the design of such interactions. Interactions, however, cannot be designed: service design can only create the conditions for interactions to happen (Penin 2017). Consequently, designers have little or no control over the outcome of the interaction. In the real world, platforms created for sharing opinions and news between users have become toxic places where too many interactions involve hate speech, cyberbullying, and the spread of disinformation. Some critics, however, argue that these platforms have been designed expressly for such noxious user engagement and interactions to take place (Monteiro 2019).

Service design is the appropriate lens through which to address the topic of privacy protection in design, given its emphasis on interactions between end-users and between users and platforms. Personal information is often involved in service design practice. When service designers observe and understand user behaviors and experiences, personal data is collected and processed (Brown & Katz 2019; Meroni & Sangiorgi 2011; Tekes 2007). Service design products where users interact with a platform and other humans inescapably gather personal information, as we will discuss further in the next section.

Service design has the necessary background to deal with privacy issues because it is inevitably ethical (Penin 2017). However, we argue that the ethical approach is ineffective without a service designerly understanding of privacy, intended as the tools to comprehend the issues at stakes from different perspectives and design an action plan that leads to solutions that work. Building on Cross’ contribution (2006), a designerly understanding of privacy is problem-solving—hence it is not just an epistemological understanding but is an understanding of action—and is human-centered—it is based on research of the issues at stake and of the stakeholders’ needs, threats, worries, expectations, and desires. It is not user-focused but stakeholder-focused because it encompasses all people affected by a service design solution. It is not reactive but proactive because it should also anticipate the possible malicious uses of the service design product by some stakeholders. It is holistic and multidisciplinary since it considers the corpus of knowledge of other disciplines as part of the designerly understanding of privacy.

3 Privacy as a Service Design Concern

Service design products involve interactions between users—who are also data subjects whose personal information is collected and processed by the service provider—and digital touchpoints. Digital touchpoints collect data subjects’ information through interfaces. After data collection, the user loses control over the information and its diffusion. However, depending on the nature of personal information, sharing data with service providers and (potentially uncountable) third parties may significantly impact the data subject’s personal and social life—e.g., in health and justice-related service design scenarios.

It emerges that informational privacy must be a chief concern for service designers. Design ethicists (Bowles 2018; Falbe et al. 2020; Ngai 2020) justify this claim on ethical grounds, although the conversation about ethics and privacy in the service design field is still in embryo. Convincingly, Value Sensitive Design (VSD) advocates that privacy is a value for design (Friedman et al. 2003; Friedman & Hendry 2019). However, it is still unclear on which grounds privacy should be a design concern—and not only a legal compliance issue, and why privacy is a value for design. To find answers, one needs to go beyond the field of design and explore other fields, such as philosophy, anthropology, social sciences, economics, and the law. Should service designers be experts in all these domains?

To fulfill the intrinsic innovative mission of design (Zurlo 2019), it emerges that curiosity about other disciplines fuels innovation and creativity, but expecting a service designer to be a proficient philosopher, anthropologist, social scientist, economist, and lawyer is unreasonable. Cooperation with other disciplines, rather than isolationism and self-reliance, is critical to good design (Brown & Katz 2019). The mission of design is to define preferable futures working in collaboration with experts from other fields (Dunne & Raby 2013).

Design, including service design, relies on other disciplines and areas of study to thrive. Service designers do not need to explain or defend the importance of the issues they work on, like protecting personal information, because it is already widely recognized as necessary. Additionally, protecting personal data against invasive and excessive processing activities by companies and governments is regulated by legislation in several countries.

However, service designers should not just do what they are told by others in charge. They must develop their designerly, practice-based understanding of privacy. The information philosopher and ethicist Floridi claims that privacy deserves protection because it refers to an ontological essence of our being: personal information. Violating that information is an act of aggression against the data subject (Floridi 2014). Data ethicists of non-Western background show how privacy has ethical relevance in Asian cultures, despite their traditional collectivist approach to life and society (Ess 2020; Mizutani et al. 2004; Nakada & Tamura 2005; Yao-Huai 2005). Some scholars conclude privacy is a universal human value (Hongladarom 2007). These contributions should nurture the awareness of privacy inside the service design community and be used as a starting point to develop a service designerly understanding of privacy.

4 First Step: Building a Service Designerly Understanding of Privacy

Though, the approach to be followed by service designers differs from those adopted by philosophers and ethicists. Service designers ultimately work with and for people—this explains the relevance of human-centered design, despite its limits. Because it is a practice-based activity, contemporary human-centered design involves observing and understanding human behaviors and needs before designing effective solutions (Norman 2011, 2013).

We argue that observing facts and establishing corresponding behavioral patterns are fundamental steppingstones to building an understanding of informational privacy for service design. In the service design literature, design ethnography emerged as a methodology to understand the users of a design, working from the perspective of these users (Stickdorn & Schneider 2011). Design ethnography is qualitative ethnographic research within a design context. Despite its potential value, design ethnography has not yet been employed in the context of privacy, either in research or practical applications. Because design ethnography aims to “make sure that the foundations for the designs are well understood and accepted” (Stickdorn & Schneider 2011, p. 93), it appears to be the proper methodology to build a service designerly understanding of privacy across multiple contexts.

Design ethnography includes ethnographic visual observation, which can provide unbiased information to the researcher (Candy 2006) and, consequently, is a valuable tool to achieve a general understanding of privacy for service design. Recently, we tested ethnographic visual observation in research about a prototype of a privacy-enhancing instant messaging app. We selected a small number of end-user participants, who were asked to simulate interactions involving the exchange of personal information in pairs and to adjust the privacy settings accordingly in the app interface. The research team recorded the workshop and the interactions between users to analyze how real people react when confronted with privacy challenges. Such assessment—which will be the object of a future ad-hoc publication—has been valuable to validate and improve the design features of the prototype.

However, it emerged from our research that ethnographic observation has limitations. In particular, we argue that ethnographic observation—a research method that is essentially qualitative—should be supported by quantitative research to achieve a proper understanding of privacy. For instance, assessing how many users installed privacy-protecting apps on their devices or refused non-essential cookies when accessing websites is helpful to complement the findings reached through a qualitative assessment of how people behave regarding their informational privacy in a specific context.

Building on these considerations, we will further test design ethnography in ongoing research about service design touchpoints, privacy, and UX to observe how users regulate the privacy settings of an interface based on the nature of the information and the relationship they have with the information recipients. Therefore, we aim to learn if and how people value their privacy in an extended set of specific contexts.

We expect to definitely validate our finding that design ethnography can provide a comprehensive understanding of privacy issues, extending our research with the involvement of more end-user participants and designers. Nevertheless, service designers must consider that design ethnography may be an appropriate tool to investigate the menaces perceived by users, but not necessarily the real ones. For instance, the fact that many corporate consultants and executives—including Mark Zuckerberg—cover the camera of their laptops with a tape reveals a diffused worry about being spied on, but it does not prove the frequency of remote camera monitoring.

When using design ethnography, it is vital to consider the unique characteristics, culture, and values of each place and also to look at its cultural output, such as books, magazines, newspapers, films, and interviews. Further, design ethnography—and ethnographic research in general—shall not be ethically neutral: when users share their personal information recklessly because of their age or lack of privacy awareness, service designers should not jump to the conclusion that no privacy issues exist in that context. On the contrary, observing how users misbehave regarding privacy can strengthen the service designer’s understanding of privacy and reinforce the importance of creating service design solutions that prioritize privacy and security.

Users’ careless attitude toward their informational privacy takes place in the context of interactions with other consumers or with the service provider. Service designers work to make interactions possible and are never morally neutral. Service design creative process involves forecasting the possible consequences of those interactions and their acceptance. Penin claims that: “The main role of service designers is therefore being able to define what are the interactions contained in a service; what needs to happen in these interactions; what they enable; and how a digital platform, system, or interface behaves with a user.” (2017, pos. 3812).

These choices have ethical implications. Therefore, service designers are called to act morally and to make ethical decisions based on their general designerly understanding of privacy (Bowles 2018; Falbe et al. 2020; Monteiro 2019; Papanek 2019). However, this is not necessarily a straightforward process. A design choice can be ethical because it protects the users’ informational privacy, but it can be unethical because it hinders other values or users’ rights. For instance, if a digital platform does not allow users to take screenshots of messages and media, it will make it harder for victims of online harassment to provide evidence and report the harassment to the police. Additionally, a platform that bans the private sharing of intimate photos and videos on ethical grounds would unreasonably limit the users’ personal freedom and agency.

5 Second Step: Developing a Service Design Thinking for Privacy

Ethical dilemmas can only be solved by considering the specificities of every service design project. When designing a product or solution, service designers should build a project-specific designerly action plan for privacy since design is pragmatic (Dorst 2019b). In complex situations, solutions are best achieved through design thinking methods.

We build on Brown’s definition of design thinking to sustain service design thinking for privacy: “The mission of design thinking is to translate observations into insights and insights into products and services that will improve lives.” (2019, p. 49) The purpose of service design thinking for privacy is to translate the understanding of privacy into services and solutions that will improve lives. Service designers must apply the knowledge and insights that form their designerly understanding into project-based action plans to create privacy-enhancing products through an effective problem-centered methodology.

The solution to problems is a key concern in design thinking. Brown claims that the first step of any human-centered design process is to comprehend the range of the problem to solve (Brown & Katz 2019). According to Dorst the designer is called to find a design solution to a design problem in a design context through a design process (Dorst 2019a). This prescription works efficiently when the designer is confronted with an actual identifiable problem, but it has loopholes when a service designer creates a service with countless and unpredictable interactions but not with a single specific problem to solve. The problem-solution paradigm is troublesome also when the issue to solve is what Rittel and Webber call a “wicked problem”—informational privacy is an example of a wicked problem because solutions to privacy problems are not true-or-false, but good-or-bad with different conclusions depending on the chosen point of view (1973).

However, the fact that service designers do not necessarily have an immediate problem to solve or that the issue will not lead to a definite solution does not mean that the problem-solution approach should be abandoned. An effective methodology of service design thinking for privacy relies on the immersion into both real and imaginary design problems to understand how to improve the quality of the designed products.

When researching service design solutions, designers typically use a range of tools and techniques to immerse themselves in the context of the problem. Tests, prototypes, and beta versions help service designers to observe the potential consequences of their work in the real world (Stickdorn & Schneider 2011). In our research briefly discussed in the previous section, we used a prototype of an instant messaging app to assess how it could potentially work in reality when users are confronted with pressing privacy challenges. These tools are built—or refined and adjusted, like we did in our investigation—based on the service designer’s understanding of privacy—therefore, they are, at least at an abstract level, privacy-protecting and privacy-enhancing. They allow to refine the designer’s understanding and, more importantly, to improve the designed solution in an iterative design process (Gould & Lewis 1983). Tests, prototypes, and beta versions, commonly used to test the security of digital solutions, reveal how users behave regarding their information: are they willing to provide the requested personal data? Do they consciously or recklessly share sensitive information with the service and other users?

Therefore, testing, prototyping, and making beta versions of the service design solutions should be the privileged approach to follow whenever it is possible or feasible. However, these tools are fundamental but may have loopholes. In particular, users can act consciously regarding their personal information because they know they are interacting with a prototype; or, in the case of A/B testing, the results can be biased due to the limited number of participating users or other factors.

Through imagination and abstraction, service designers should solve fictional, speculative problems that users and other stakeholders may encounter when the designed solutions are implemented. Designers cannot prevent users from doing what they want with the designed solutions (Brown & Katz 2019), unless they rely on invasive surveillance tools to monitor that users adhere to the intended use of the product—which would be frankly unacceptable. However, the freedom granted to users does not exonerate service designers from considering the potential misuse of their designed solutions.

Even if no problems are discovered during testing, when designing for interactions between users, designers should imagine potential problems and devise solutions to prevent or fix them. Thought experiments can help to facilitate understanding and promote critical thinking and have been successfully applied in the field of ethics to evaluate alternatives and scenarios (Ihde 1990; Kovács 2021). In our research where the privacy features of a privacy-enhancing instant messaging app have been tested, real-user participants were confronted with thought scenarios—ranging from the request to share intimate pictures with a virtual date to the need to sending sensitive information to a doctor and real estate agent—and asked to interact and adjust the privacy settings of the app for each thought case.

Speculation helps to improve the quality of the service being created or to abandon the project altogether if the potential consequences are negative. For instance, service designers should wonder whether a communication platform can become a tool for harassment and persecution; or whether a personal data-driven service design solution favors social integration or exclusion. Thought experiments can be generated and discussed in brainstorming sessions (Stickdorn & Schneider 2011). Brainstorming, a traditional design thinking method, fosters imaging probable, possible, and improbable privacy threats of the service. After an expansive phase, a synthesis and mapping of risks are necessary to focus attention and energies on threats that are more acute, frequent, or difficult to mitigate. Other valuable techniques that could meaningfully applied in the field of privacy and service design are the future workshop method (Jungk & Müllert 1996) and design fiction (Bleecker et al. 2022).

Ultimately, the application of service design thinking for privacy and its insights prompts service designers to propose privacy-oriented solutions, make better products, and improve lives.

6 Conclusions: The Role of Design Education

Service design must aspire to create solutions that are much more than just usable, engaging, and aesthetically appealing. Service designers are called to design solutions that enhance the well-being and integrity of consumers and communities. Informational privacy is one of the most pressing issues of our time. In this paper, we assessed on which grounds privacy is a concern for service design, and we set the grounds to build a service designerly understanding of privacy.

Although these considerations reflect common sense, perhaps surprisingly service design literature has been seldom concerned about informational privacy. Through this paper, we firmly put privacy in the service design map. We also identified a fundamental conceptual and practical tool for service designers confronted with (potential) privacy issues: the designerly understanding of privacy for service design.

In particular, we commented on one specific method for building an understanding of privacy for service design—design ethnography—and we established an overview of potential methods of service design thinking for privacy. Our research reveals that design ethnography is suitable to comprehend the privacy issues at stake in a service design project and to design—and further validate and improve—privacy-oriented products and solutions. Again, our research is pioneering because, to our best knowledge, design ethnography has never been used in the field of privacy and service design.

Some of the most advanced design companies know that protecting users’ information is equivalent to securing and expanding their business. Apple’s customers accept to pay a premium price to ensure that their personal data will be treated with respect. However, privacy should not be a luxury. It is a fundamental right, and all design solutions should be at least privacy-protecting. Dark patterns, tracking pixels, and similar design tricks and technologies aimed at stealing consumers’ personal data go exactly in the opposite direction.

Nevertheless, being privacy-protecting is not enough. Service design solutions must be privacy-enhancing to guarantee that they go beyond users’ expectations and that they can protect consumers even when they do not feel that their data is in danger. Better products result from better designers who deeply understand privacy issues, both at the abstract and project-specific levels. This can be achieved through better design education that teaches future designers to know and interpret the world, work in close cooperation with scientists and experts from other disciplines, and understand that making good products results from a holistic and challenging mindset. The discussion of how design education can achieve these targets goes beyond this contribution’s scope: we plan to explore this topic through future research.