Edinburgh Napier University

  The concept of risk is widely misunderstood because of the different contexts in which it is used. This paper describes the development of an ontology of risk as a way of better understanding the nature of the potential harms individuals are exposed to when they disclose personal data online. The ontology was designed to be compatible with BFO, the Basic Formal Ontology (Arp, Smith, and Spear 2015). BFO is a top-level ontology which is intended to promote interoperability. Ontologies from domains such as genetics and medical research are in many instances designed to conform to BFO. An initial exercise to monitor the online activity of six participants from the library and information services community helped to identify the points at which personal data is disclosed during online activity. It also explored the motivations for these disclosures, by questioning participants about their perceptions of risk. The resulting analysis suggested that an ontology would be better than a typology to represent the complex relationships between risk concepts. Rosenblum (2007) developed a typology of risks associated with online social networking services (SNSs). Haynes and Robinson (2015) looked at personal risk derived from generic risk categories (Swedlow et al. 2009, 237). Terms were also extracted from existing terminologies (Sophos Ltd 2014; NIST 2019; Daniel J. Solove 2006). Risk scenarios were developed and tested during a formative seminar and incorporated into the ontology. Potential applications of the ontology include its use as a tool for interrogating large data sets about online activity, to identify when individuals may be exposed to privacy risk. This could be used to identify clusters of risk and map the factors that contribute to specific risks.