Needle in the Haystack: Analyzing the Right of Access According to GDPR Article 15 Five Years after the Implementation

Abstract

The General Data Protection Regulation (GDPR) was implemented in 2018 to strengthen and harmonize the data protection of individuals within the European Union. One key aspect is Article 15, which gives individuals the right to access their personal data in an understandable format. Organizations offering services to Europeans had five years' time to optimize their processes and functions to comply with Article 15. This study aims to explore the process of submitting and receiving the responses of organizations to GDPR Article 15 requests. A quantitative analysis obtains data from various websites to understand the level of conformity, the data received, and the challenges faced by individuals who request their data. The study differentiates organizations operating worldwide and in Germany, browser website- and app-based usage, and different types of websites. Thereby, we conclude that some websites still compile the data manually, resulting in longer waiting times. A few exceptions did not respond with any data or deliver machine-readable data (GDRP Article 20). The findings of the study additionally reveal ten patterns individuals face when requesting and accessing their data.

References in corpus (7)

• Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites
• Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence
• Dark Patterns and the Legal Requirements of Consent Banners: An Interaction Criticism Perspective
• User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users
• Human-GDPR Interaction: Practical Experiences of Accessing Personal Data
• Characterising Third Party Cookie Usage in the EU after GDPR
• GDPR: When the Right to Access Personal Data Becomes a Threat