GDPR: When the Right to Access Personal Data Becomes a Threat

Bufalieri, Luca; Morgia, Massimo La; Mei, Alessandro; Stefa, Julinda

doi:10.1109/icws49710.2020.00017

Cited by 30 publications

(38 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…First, we observe that there is a statistically significant correlation between unique visitors counts and Tranco rank (Pearson's r = −0.042 *** ). 16 This is expected, given that the Tranco ranking includes data from underlying sources like Alexa, 17 which are themselves compiled from web browsing history data. We also observe that the correlation between unique visitors and Tranco rank is stronger for websites that include DNSMPI links (r = −0.16 *** ) than those without (r = −0.033 *** ).…”

Section: Unique Visitorsmentioning

confidence: 99%

“…The rights granted to Californians under the CCPA are similar to those granted to European citizens under the GDPR, including the right to access and delete data that has been collected about them. Unfortunately, researchers have identified problems with the processes that data collectors have adopted to implement these rights, including: interface designs that are hard for people to locate and use effectively [3,42]; data processors that ignore or are slow to respond to data access requests [72]; and systems that rely on weak authentication methods and thus leak sensitive data to unauthorized parties [17,55].…”

Section: Data Access Deletion and Opt-outmentioning

confidence: 99%

See 1 more Smart Citation

Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Nortwick

Wilson

2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

On June 28, 2018, the California State Legislature passed the California Consumer Privacy Act (CCPA), arguably the most comprehensive piece of online privacy legislation in the United States. Online services covered by the CCPA are required to provide a hyperlink on their homepage with the text “Do Not Sell My Personal Information” (DNSMPI). The CCPA went into effect on January 1, 2020, a date that was chosen to give data collectors time to study the new law and bring themselves into compliance. In this study, we begin the process of investigating whether websites are complying with the CCPA by focusing on DNSMPI links. Using longitudinal data crawled from the top 1M websites in the Tranco ranking, we examine which websites are including DNSMPI links, whether the websites without DNSMPI links are out of compliance with the law, whether websites are using geofences to dynamically hide DNSMPI links from non-Californians, how DNSMPI adoption has changed over time, and how websites are choosing to present DNSMPI links (e.g., in terms of font size, color, and placement). We argue that the answers to these questions are critical for spurring enforcement actions under the law, and helping to shape future privacy laws and regulations, e.g., rule making that will soon commence around the successor to the CCPA, known as the CPRA.

show abstract

Section: Unique Visitorsmentioning

confidence: 99%

Section: Data Access Deletion and Opt-outmentioning

confidence: 99%

Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Nortwick

Wilson

2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…Several prior works have researched the potential authentication issues in relation to verifying the identity of the data subject (DS) when performing a SAR. In these scientific experiments, the researchers simulate a potential adversary that attempts to perform a SAR under the name of another individual, essentially stealing their personal data [3,8]. Malevolent attackers can use this technique to gain access to sensitive data related to individuals and abuse it for identity fraud or highly targeted phishing attacks, demonstrating a real threat to the privacy of data subjects.…”

Section: Introductionmentioning

confidence: 99%

Revisiting Identification Issues in GDPR ‘Right Of Access’ Policies: A Technical and Longitudinal Analysis

Martino

Meers

Quax

et al. 2022

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Several data protection regulations permit individuals to request all personal information that an organization holds about them by utilizing Subject Access Requests (SARs). Prior work has observed the identification process of such requests, demonstrating weak policies that are vulnerable to potential data breaches. In this paper, we analyze and compare prior work in terms of methodologies, requested identification credentials and threat models in the context of privacy and cybersecurity. Furthermore, we have devised a longitudinal study in which we examine the impact of responsible disclosures by re-evaluating the SAR authentication processes of 40 organizations after they had two years to improve their policies. Here, we demonstrate that 53% of the previously vulnerable organizations have not corrected their policy and an additional 27% of previously non-vulnerable organizations have potentially weakened their policies instead of improving them, thus leaking sensitive personal information to potential adversaries. To better understand state-of-the-art SAR policies, we interviewed several Data Protection Officers and explored the reasoning behind their processes from a viewpoint in the industry and gained insights about potential criminal abuse of weak SAR policies. Finally, we propose several technical modifications to SAR policies that reduce privacy and security risks of data controllers.

show abstract

“…In cases where users are indeed able to exercise their rights, user data is poorly handled. For example, online services often ignore or respond late to data access requests [66] and even leak sensitive user data to unauthorized users because of weak authentication mechanisms [42,49]. While some negligence could be attributed to the complexity of the regulations, unpreparedness, or oversights of online services, a lot of it could be due to blatant inconsideration towards data protection regulations from online services.…”

Section: Introductionmentioning

confidence: 99%

Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?

Liu¹,

Iqbal²,

Saxena³

2022

Preprint

View full text Add to dashboard Cite

Data protection regulations, such as GDPR and CCPA, require websites and embedded third-parties, especially advertisers, to seek user consent before they can collect and process user data. Only when the users opt in, can these entities collect, process, and share user data. Websites typically incorporate Consent Management Platforms (CMPs), such as OneTrust and CookieBot, to solicit and convey user consent to the embedded advertisers, with the expectation that the consent will be respected. However, neither the websites nor the regulators currently have any mechanism to audit advertisers' compliance with the user consent, i.e., to determine if advertisers indeed do not collect, process, and share user data when the user opts out.In this paper, we propose an auditing framework that leverages advertisers' bidding behavior to empirically assess the violations of data protection regulations. Using our framework, we conduct a measurement study to evaluate two of the most widely deployed CMPs, i.e., OneTrust and CookieBot, as well as advertiser-offered opt-out controls, i.e., National Advertising Initiative's opt-out, under GDPR and CCPA -arguably two of the most mature data protection regulations.Our results indicate that user data is unfortunately still being collected, processed, and shared even when users opt-out. Our findings suggest that several prominent advertisers (e.g., App-Nexus, PubMatic) might be in potential violation of GDPR and CCPA. Overall, our work casts a doubt if regulations are effective at protecting users' online privacy.

show abstract

GDPR: When the Right to Access Personal Data Becomes a Threat

Cited by 30 publications

References 7 publications

Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Revisiting Identification Issues in GDPR ‘Right Of Access’ Policies: A Technical and Longitudinal Analysis

Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?

Contact Info

Product

Resources

About