GDPR Reality Check - Claiming and Investigating Personally Identifiable Data from Companies

Alizadeh, Fatemeh; Jakobi, Timo; Boden, Alexander; Stevens, Gunnar; Boldt, Jens

doi:10.1109/eurospw51379.2020.00025

Cited by 24 publications

(28 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…We therefore assume that the legal framework itself does not appear to be problematic. Rather our findings coincide with other work, suggesting that people generally appear to be unaware of their rights towards ex-post control and transparency because of ignorance and false expectations about privacy legislation [4]. Since our sample includes office workers skilled in both security engineering and data processing, our results are likely to include more advanced mental models.…”

Section: Discussionsupporting

confidence: 85%

Exploring mental models of the right to informational self-determination of office workers in Germany

Tolsdorf

Dehling

Reinhardt

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Applied privacy research has so far focused mainly on consumer relations in private life. Privacy in the context of employment relationships is less well studied, although it is subject to the same legal privacy framework in Europe. The European General Data Protection Regulation (GDPR) has strengthened employees’ right to privacy by obliging that employers provide transparency and intervention mechanisms. For such mechanisms to be effective, employees must have a sound understanding of their functions and value. We explored possible boundaries by conducting a semi-structured interview study with 27 office workers in Germany and elicited mental models of the right to informational self-determination, which is the European proxy for the right to privacy. We provide insights into (1) perceptions of different categories of data, (2) familiarity with the legal framework regarding expectations for privacy controls, and (3) awareness of data processing, data flow, safeguards, and threat models. We found that legal terms often used in privacy policies used to describe categories of data are misleading. We further identified three groups of mental models that differ in their privacy control requirements and willingness to accept restrictions on their privacy rights. We also found ignorance about actual data flow, processing, and safeguard implementation. Participants’ mindsets were shaped by their faith in organizational and technical measures to protect privacy. Employers and developers may benefit from our contributions by understanding the types of privacy controls desired by office workers and the challenges to be considered when conceptualizing and designing usable privacy protections in the workplace.

show abstract

Section: Discussionsupporting

confidence: 85%

Exploring mental models of the right to informational self-determination of office workers in Germany

Tolsdorf

Dehling

Reinhardt

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…On the individual level, likewise, the need for interpretation is high: The newly provided rights of the data subject are being studied, e.g., from a HCI perspective (De Hert et al 2018;Alizadeh et al 2019). At the same time, GDPR has also given new drive to almost traditional research topics such as privacy policies as well as the issue of ''informed consent'' (Politou et al 2018;Utz et al 2019) and how to design for transparency (Jakobi et al 2019a).…”

Section: Introductionmentioning

confidence: 99%

The Role of IS in the Conflicting Interests Regarding GDPR

et al. 2020

Self Cite

View full text Add to dashboard Cite

“…Topmost visited sites by internet surfer are online social networks 3 . Surfing social media is the fourth most popular activity on the internet nowadays 4 . Socializing with friends and family across the globe via online social networks is a cost-effective mechanism for the masses.…”

Section: Online Social Networkmentioning

confidence: 99%

“…OSNs are not fully prepared to comply. And when they attempt to comply, there are often major gaps [4]. GDPR recognizes data subjects' consent as a legitimate ground for data processing.…”

Section: Introductionmentioning

confidence: 99%

Towards Blockchain-Based GDPR-Compliant Online Social Networks: Challenges, Opportunities and Way Forward

Ahmed

Yayilgan

Nowostawski

et al. 2020

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

Online Social Networks (OSNs) are very popular and widely adopted by the vast majority of Internet users across the globe. Recent scandals on the abuse of users' personal information via these platforms have raised serious concerns about the trustworthiness of OSN service providers. The unprecedented collection of personal data by OSN service providers poses one of the greatest threats to users privacy and their right to be left alone. The recent approval of the GDPR (General Data Protection Regulation) presents OSN service providers with great compliance challenges. A set of new data protection requirements are imposed on data controllers (OSN service providers) by GDPR that offer greater control to data subjects (OSN users) over their personal data. This position paper investigates the link between GDPR provisions and the use of blockchain technology for solving the consent management problem in online social networks. We also describe challenges and opportunities in designing a GDPR-compliant consent management mechanism for online social networks. Key characteristics of blockchain technology that facilitate regulatory compliance were identified. The legal and technological state of play of the blockchain-GDPR relationship is reviewed and possible ways to reconcile blockchain technology with the GDPR requirements are demonstrated. This paper opens up new research directions on the use of the disruptive innovation of blockchain to achieve regulatory compliance in the application domain of online social networks.

show abstract

GDPR Reality Check - Claiming and Investigating Personally Identifiable Data from Companies

Cited by 24 publications

References 13 publications

Exploring mental models of the right to informational self-determination of office workers in Germany

Exploring mental models of the right to informational self-determination of office workers in Germany

The Role of IS in the Conflicting Interests Regarding GDPR

Towards Blockchain-Based GDPR-Compliant Online Social Networks: Challenges, Opportunities and Way Forward

Contact Info

Product

Resources

About