Automatic de-identification of data download packages

Abstract

The General Data Protection Regulation (GDPR) grants all natural persons the right to access their personal data if this is being processed by data controllers. The data controllers are obliged to share the data in an electronic format and often provide the data in a so called Data Download Package (DDP). These DDPs contain all data collected by public and private entities during the course of a citizens’ digital life and form a treasure trove for social scientists. However, the data can be deeply private. To protect the privacy of research participants while using their DDPs for scientific research, we developed a de-identification algorithm that is able to handle typical characteristics of DDPs. These include regularly changing file structures, visual and textual content, differing file formats, differing file structures and private information like usernames. We investigate the performance of the algorithm and illustrate how the algorithm can be tailored towards specific DDP structures.

Privacy-preserving local analysis of digital trace data: A proof-of-concept

“…2 and PORT, the only task that remains is for data scientists and applied researchers to collaborate to develop a high-quality extraction script in Python that is flexible in terms of handling a variety of data structures (see Boeschoten et al. 20 ). When developing such an extraction script, it is important to find a balance between ensuring on the one hand that all information relevant for answering the research question of interest is extracted, while on the other hand no sensitive data are unnecessarily collected.…”

“…An example of such a de-identification script has been developed by Boeschoten et al. 20 for Instagram DDPs, which only selects the files within the DDP that are of interest to the research and then removes all identifiers from these files. When applying the workflow in such a way, two main study principles are still applied: the privacy of research participants is protected and only the necessary data are collected.…”

Port: A software tool for digital data donation

“…However, extensive deidentification procedures were in place to guarantee participant's privacy (see e.g. Boeschoten et al (2021)). In addition, multiple apps have been developed to enable this local processing step.…”

Do you have two minutes to talk about your data? Willingness to participate and nonparticipation bias in Facebook data donation

“…legislation grants individuals the general right to receive the information held by a data controller (i.e., any data processing entity, including social media platforms) about them in a structured, commonly used, and machine-readable format and to transfer them to other data controllers. Boeschoten et al (2021) use the term Data Download Packages (DDPs) for the copies of data individuals can retrieve from data controllers. While probably not intended by the legislators, the right to data portability also includes researchers who can receive DDPs from users who have requested DDPs from the data controller.…”