Decentralised Data Processing: Personal Data Stores and the GDPR

Personal information management systems: a user-centric privacy utopia?

“…There will be a range of platforms that differ in their offerings. Often a platform's core offering is equipping a user with a device; though this could vary from merely providing the codebase for users to compile and self-manage the operation of their devices, to providing the entire operational infrastructure-perhaps including hardware, managed cloud services for backup, and so forth (Janssen et al, 2020). Moreover, some platforms envisage hosting 'app stores' or 'data marketplaces' that broker between users and the organisations seeking to process their 6.…”

“…However, due to the ePrivacy Directive, where the PDS entails a physical (hardware) device, consent will generally be required for app developers to process any data (Art. 5(3) ePrivacy Directive; Janssen et al, 2020). In this context, for such devices the only available basis for processing on these devices will be consent (Arts.…”

“…6(1)(c) and (e) GDPR). These grounds for processing that are not based on specific and active user involvement or agreement are rarely considered in PDS architectures, and at present it is unclear how PDS architectures would support or reconcile with these grounds where they may apply (Janssen et al, 2020).…”

“…This has implications not only for app developers, but also for PDS platforms, who could provide mechanisms that specifically and more holistically facilitate users in exercising their rights. Though there may be questions as to whether this is legally obliged-for instance in light of the complexities regarding a platform's roles and responsibilities given that Art 25(1) applies to controllers (see Chen et al, 2020;Janssen et al, 2020). Indeed, these considerations are exacerbated as some PDSs represent ' open source' projects, potentially involving a wide range of entities in the development, deployment and operation of the platform and/or device functionality.…”

“…There is already work, for instance, on how PDSs might facilitate better accountability (Crabtree, 2018;Urquhart, 2019), and on the legal uncertainties surrounding the technology, particularly concerning data protection (Janssen et al, 2020;Chen et al, 2020).…”