Human-GDPR Interaction: Practical Experiences of Accessing Personal Data

Abstract

In our data-centric world, most services rely on collecting and using personal data. The EU's General Data Protection Regulation (GDPR) aims to enhance individuals' control over their data, but its practical impact is not well understood. We present a 10-participant study, where each participant filed 4-5 data access requests. Through interviews accompanying these requests and discussions scrutinising returned data, it appears that GDPR falls short of its goals due to non-compliance and low-quality responses. Participants found their hopes to understand providers' data practices or harness their own data unmet. This causes increased distrust without any subjective improvement in power, although more transparent providers do earn greater trust. We propose designing more effective, data-inclusive and open policies and data access systems to improve both customer relations and individual agency, and also that wider public use of GDPR rights could help with delivering accountability and motivating providers to improve data practices.

arXiv comment19 pages, to be published in CHI Conference on Human Factors in Computing Systems (CHI '22), April 29 - May 05, 2022, New Orleans, LA, USA

References in corpus (3)

• The European Union general data protection regulation: what it is and what it means
• GDPR: When the Right to Access Personal Data Becomes a Threat
• From social netizens to data citizens: variations of GDPR awareness in 28 European countries

Cited by in corpus (4)

• Defending Against the Dark Arts: Recognising Dark Patterns in Social Media
• Needle in the Haystack: Analyzing the Right of Access According to GDPR Article 15 Five Years after the Implementation
• AccessShare: Co-designing Data Access and Sharing with Blind People
• Short paper: Models in the dark -- Rectification and erasure under GDPR in ML supply chains