How do app vendors respond to subject access requests? A longitudinal privacy study on iOS and Android Apps

Abstract

EU data protection laws grant consumers the right to access the personal data that companies hold about them. In a first-of-itskind longitudinal study, we examine how service providers have complied with subject access requests over four years. In three iterations between 2015 and 2019, we sent subject access requests to vendors of 225 mobile apps popular in Germany. Throughout the iterations, 19 to 26 % of the vendors were unreachable or did not reply at all. Our subject access requests were fulfilled in 15 to 53 % of the cases, with an unexpected decline between the GDPR enforcement date and the end of our study. The remaining responses exhibit a long list of shortcomings, including severe violations of information security and data protection principles. Some responses even contained deceptive and misleading statements (7 to 13 %). Further, 9 % of the apps were discontinued and 27 % of the user accounts vanished during our study, mostly without proper notification about the consequences for our personal data. While we observe improvements for selected aspects over time, the results indicate that subject access request handling will be unsatisfactory as long as vendors accept such requests via email and process them manually. CCS CONCEPTS • Security and privacy → Social aspects of security and privacy; Privacy protections; • Social and professional topics → Privacy policies.

Revisiting Identification Issues in GDPR ‘Right Of Access’ Policies: A Technical and Longitudinal Analysis

“…When we followed up with a comparison of the address stated in their privacy policy and our tracking number, they proceeded to completely remove the personal data of the subject without consent, acting as if no data from the subject was available. This type of reaction is not new and is in line with prior studies [12]. Later, we discovered that some translations of the privacy policy of Ret_I had a different postal code, resulting in the letter potentially being delivered to the wrong address.…”

“…Finally, Kröger et al [12] observed the GDPR SAR policies of 225 mobile app developers over a longer period of time and point out numerous deceptive state-ments from developers along with general findings on inadequate data processing practices of some DCs. A similar study is being conducted related to the recent CCPA [19].…”

“…The DC should preferably send a verification code to the email address known to be from the DS, which must then be copied by the DS in a reply to the DC. Besides email spoofing, the authors of [12] and [3] observed that some email responses to SARs do not exhibit proper TLS encryption, making them vulnerable to other man-in-the-middle (MitM) attacks. In essence, this indicates that adversaries may potentially intercept such emails and read or alter any communication between DC and DS.…”

Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Art. 20

“…Each of these rights aims to raise the bargaining power of consumers in digital markets [18] and to increase consumers' informational self-determination in comparison to pre-GDPR privacy laws. Regrettably, prior work [19][20][21][22] demonstrated -on the basis of a previous Californian privacy law -that corporations frequently ignored or declined requests of individuals for information access or corporate information sharing practices. As such, the RtDP -and especially its subright of direct data transfer between providers -represents the right with the highest potential economic implications only if it is applied correctly [9].…”

Personal information inference from voice recordings: User awareness and privacy concerns

“…For data subjects, being able to answer the question "who knows what about me?" is a necessary precondition for exercising other data protection rights (e. g., data rectification, erasure, restriction of processing) in an informed manner [39]. The widespread lack of understanding of how personal data can be collected, inferred, and misused calls into question the notion of "informed consent" and may warrant some form of paternalistic government intervention.…”