Human-GDPR Interaction: Practical Experiences of Accessing Personal Data

Abstract

In our data-centric world, most services rely on collecting and using personal data. The EU's General Data Protection Regulation (GDPR) aims to enhance individuals' control over their data, but its practical impact is not well understood. We present a 10-participant study, where each participant filed 4-5 data access requests. Through interviews accompanying these requests and discussions scrutinising returned data, it appears that GDPR falls short of its goals due to non-compliance and low-quality responses. Participants found their hopes to understand providers' data practices or harness their own data unmet. This causes increased distrust without any subjective improvement in power, although more transparent providers do earn greater trust. We propose designing more effective, datainclusive and open policies and data access systems to improve both customer relations and individual agency, and also that wider public use of GDPR rights could help with delivering accountability and motivating providers to improve data practices. CCS CONCEPTS• Security and privacy; • Human and societal aspects of security and privacy; • Usability in security and privacy; • Social and professional topics; • Computing / technology policy; • Commerce policy; • Governmental regulations; • Surveillance; • Corporate surveillance;

Lessons in VCR Repair: Compliance of Android App Developers with the California Consumer Privacy Act (CCPA)

“…Researchers also studied the usability of subject access request and deletion mechanisms from a number of different angles, including the ease of initiating the requests as well as the extent to which the content of the responses can be understood by average users [8,24,60,64,66]. After investigating users' awareness of their rights under the GDPR in [36], researchers found that users do not have sufficient understanding of their "right to data portability."…”

“…By the same token, users do not gain much by being informed about the collection of these categories. We also identified the categories of personal information that the developers disclosed or sold, 8 as well as the categories of recipients of users' personal information. Although the CCPA requires companies to enumerate the recipients for each category of personal information, in practice we found that only a small number of policies did so.…”

SIG on Data as Human-Centered Design Material

“…Can we rely on alternative ways to access behavioral data (e.g., crowdsourcing [17], data donation [8])? How do these approaches ft and challenge existing data protection regulations and privacy considerations (e.g., the European General Data Protection Regulation [5])? To what extent do these approaches reinforce or mitigate existing inequalities [7]?…”

“…For example, looking at her activity tracker, the same participant could say "my daily steps were below my goal for two days when I was sick". In this context, design and HCI researchers support people's engagement with their behavioral data; helping them (1) navigate existing data protection regulations [5,8], (2) categorize and visualize the data and, in doing so, understand it and its implications [13,17], and (3) interpret and situate the data [8,13,18,19].…”

Diversity of News Consumption in a Digital Information Environment

“…We should learn from these experiences to improve procedures and instructions for users. Furthermore, the format and data quality of takeouts is often far from ideal, lacking crucial data sources or variables of interest (Bowyer et al, 2022). The research community must push for higher standards and the monitoring of the completeness of data take-outs, not only for its sake by also for the sake of users executing their rights to data access (Ausloos & Veale, 2020).…”