The exercisability of the right to data portability in the emerging Internet of Things (IoT) environment

Turner, Sarah; Quintero, July Galindo; Turner, Simon; Lis, Jessica; Tanczer, Leonie Maria

doi:10.1177/1461444820934033

Cited by 17 publications

(10 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Unfortunately the latter data controller, Nike Run Club, interpreted the incoming transmission as an Article 17 (erasure) request and asked for confirmation that the data subject wished to have all of their data erased. This reiterates the findings of others [19,20] that Article 20(2) is not widely understood.…”

Section: Resultssupporting

confidence: 87%

“…In a smaller-scale study, Li compares a set of portability requests with another right, the right to erasure [13]. Two recent studies are most similar to our work in that they focus on the Internet of Things [5,20] -their aim, however, is more on examining whether portability can be exercised, rather than the accuracy of the data that we study here.…”

Section: Background and Related Workmentioning

confidence: 93%

See 1 more Smart Citation

Data Portability as a Tool for Audit

Zwiebelmann

Henderson

2021

Adjunct Proceedings of the 2021 ACM International Joint Conference on Pervasive and Ubiquitous Computing and Proceedings of The

View full text Add to dashboard Cite

Pervasive systems are almost omnipresent in their collection and processing of personal data. Understanding what these systems are doing is essential for trust, and to ensure that data being collected are accurate. Auditing these systems can help to determine the accuracy of these data. Such audit may take place internally by systems designers, but external audit is important for accountability.In this paper we explore whether users can conduct their own external audit of the systems with which they interact. In particular, we use the Right to Data Portability afforded to data subjects through the General Data Protection Regulation. Using fitness trackers, we collect and upload running data to a set of data controllers. By using data portability to then obtain a copy of our data, we compare the data held by the controllers with our groundtruth data. We find some inaccuracies in the data, but also that audit can be impeded by insufficient explanations from data controllers. CCS CONCEPTS• Applied computing → Law; • Social and professional topics → Technology audits; • Hardware → Sensor applications and deployments.

show abstract

Section: Resultssupporting

confidence: 87%

Section: Background and Related Workmentioning

confidence: 93%

Data Portability as a Tool for Audit

Zwiebelmann

Henderson

2021

Adjunct Proceedings of the 2021 ACM International Joint Conference on Pervasive and Ubiquitous Computing and Proceedings of The

View full text Add to dashboard Cite

show abstract

“…This main research question of our study will be examined through a series of subquestions: firstly, in the absence of a functioning and comprehensive infrastructure for direct data transfer between data controlling services 1 [12], we examine the question of whether online services provide individuals with an option to easily export data and furthermore with the possibility to import data. If yes, which options do they offer?…”

Section: Introductionmentioning

confidence: 99%

Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Art. 20

Syrmoudis

Mager

Kuebler-Wachendorff

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Data portability regulation has promised that individuals will be easily able to transfer their personal data between online service providers. Yet, after more than two years of an active privacy regulation regime in the European Union, this promise is far from being fulfilled. Given the lack of a functioning infrastructure for direct data portability between multiple providers, we investigate in our study how easily an individual could currently make use of an indirect data transfer between providers. We define such porting as a two-step transfer: firstly, requesting a data export from one provider, followed secondly by the import of the obtained data to another provider. To answer this question, we examine the data export practices of 182 online services, including the top one hundred visited websites in Germany according to the Alexa ranking, as well as their data import capabilities. Our main results show that high-ranking services, which primarily represent incumbents of key online markets, provide significantly larger data export scope and increased import possibilities than their lower-ranking competitors. Moreover, they establish more thorough authentication of individuals before export. These first empirical results challenge the theoretical literature on data portability, according to which, it would be expected that incumbents only complied with the minimal possible export scope in order to not lose exclusive consumer data to market competitors free-of-charge. We attribute the practices of incumbents observed in our study to the absence of an infrastructure realizing direct data portability.

show abstract

“…While regulations, such as GDPR, provide protection for individuals, the responsibility to actively monitor personal data trails still lies with the data subject, who may be unaware of their exposure to data processing risks, and unaware of their digital rights or how to exercise them. Organizations controlling data create significant procedural hindrances for individuals to access or delete their own data (Turner et al, 2020;Myrstad and Kaldestad, 2021). Owing to territoriality, victims of data protection violations, such as revenge porn, fail to get harmful content removed if hosted on servers in jurisdictions that are not signatories to data protection agreements (Cater, 2021).…”

Section: Regulatory Frameworkmentioning

confidence: 99%

Responsible innovation for digital identity systems

Anand

Brass

2021

Data & Policy

View full text Add to dashboard Cite

Digital identity (eID) systems are a crucial piece in the digital services ecosystem. They connect individuals to a variety of socioeconomic opportunities but can also reinforce power asymmetries between organizations and individuals. Data collection practices can negatively impact an individual’s right to privacy, autonomy, and self-determination. Protecting individual rights, however, may be at odds with imperatives of profit maximization or national security. The use of eID technologies is hence highly contested. Current approaches to governing eID systems have been unable to fully address the trade-offs between the opportunities and risks associated with these systems. The responsible innovation (RI) literature provides a set of principles to govern disruptive innovations, such as eID systems, toward societally desirable outcomes. This article uses RI principles to develop a framework to govern eID systems in a more inclusive, responsible, and user-centered manner. The proposed framework seeks to complement existing practices for eID system governance by bringing forth principles of deliberation and democratic engagement to build trust amongst stakeholders of the eID system and deliver shared socioeconomic benefits.

show abstract

The exercisability of the right to data portability in the emerging Internet of Things (IoT) environment

Cited by 17 publications

References 29 publications

Data Portability as a Tool for Audit

Data Portability as a Tool for Audit

Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Art. 20

Responsible innovation for digital identity systems

Contact Info

Product

Resources

About