Dude, where's my data? The GDPR in practice, from a consumer's point of view

Abstract

<jats:sec><jats:title content-type="abstract-subheading">Purpose</jats:title><jats:p>This paper investigates the European Union's General Data Protection Regulation (GDPR) in information systems (ISs). The GDPR consists of 99 articles, and two articles are emphasised – namely Article 15, which deals with rights of access by the data subject, and Article 20, which deals with the right to data portability.</jats:p></jats:sec><jats:sec><jats:title content-type="abstract-subheading">Design/methodology/approach</jats:title><jats:p>15 companies operating in the Norwegian consumer market were randomly selected. Each company received an inquiry pertaining to rights of access by the data subject (Article 15) and the right to data portability (Article 20). The research team carefully analysed the answers received and categorised the responses according to the two articles emphasised.</jats:p></jats:sec><jats:sec><jats:title content-type="abstract-subheading">Findings</jats:title><jats:p>The findings show extensive variations among the companies in terms of response time, quality of feedback and how companies handle requests concerning rights of access by the data subject (Article 15) and the right to data portability (Article 20). Differences are also pertaining to the types of files, along with the content of these files. It should be noted, however, that most of the companies replied to the inquiry before the deadline. The findings show that companies comply better with Article 20 than Article 15. However, it appears that they do not differentiate between the two articles.</jats:p></jats:sec><jats:sec><jats:title content-type="abstract-subheading">Originality/value</jats:title><jats:p>This study explores a research topic that is relatively new. It addresses a gap in the extant research by highlighting how the GDPR works in practice from a consumer's perspective. In addition, guidelines are offered to the consumers and companies affected by the GDPR.</jats:p></jats:sec>

Explaining automated decision-making: a multinational study of the GDPR right to meaningful information

“…Though the time elapsed has been relatively short, the empirical GDPR literature is steadily growing. A study similar to both our present and previous study is Sørum and Presthus (2020), where consumer rights stipulated in article 15 and 20 of the GDPR are used to approach 15 companies on the consumer market. They analyse the time to receive responses, the quality of feedback and compliance with the different paragraphs in articles 15 and 20.…”

“…To conclude, while the number of empirical studies on the effects of the GDPR in general are growing, the right to meaningful information about the logic involved in insurance has not, to our knowledge, been investigated before, with the exception of our previous article (Dexe et al 2020) and Sørum and Presthus (2020).…”

“…The paper showed that while it was hard to determine if any company failed to follow the legislation (except in one case, where the response failed to meet the 'undue delay' requirement), there was also no company that ticked all the boxes and provided an answer that could be deemed 'complete'. Thus, while previous research has found large differences in how companies handle article 15 requests (Sørum and Presthus 2020;Dexe et al 2020) these studies are conducted in single countries. In order to get a broader and more reliable view of how article 15 works throughout the EU, additional studies such as the one presented here are called for.…”

A Three-Year Study of the GDPR and the Consumer

“…Article 20: Right to Data Portability, allows the data subject to get selected data that the company has acquired about him or her in a machine-readable format (Jarbekk & Sommerfeldt, 2019). For example, Facebook and Google have created an automated service (Sørum & Presthus, 2020). The trend and interest have declined somewhat over the years.…”

Derechos digitales del ciudadano en la gestión de la información

“…La referencia a las cookies como dispositivos que instalan en los terminales del usuario consta en la Directiva 2002/58/CE del Parlamento Europeo y del Consejo, de 12 de julio de 2002, relativa al tratamiento de los datos personales y a la protección de la intimidad en el sector de las comunicaciones electrónicas (Unión Europea 2002), que si bien constituye un instrumento legítimo y de gran utilidad en algunos casos, como analizar la efectividad de la publicidad de un sitio web o para verificar la identidad de usuarios partícipes en una transacción en línea, en otros casos supone acceder a una información personal, tras el rastreo de las actividades del usuario o los usuarios de un mismo terminal, que puede suponer una grave intrusión en la intimidad. La instalación de las cookies de los sitios web en el hardware personal requiere el consentimiento informado de los usuarios, y sin embargo muchas empresas no ofrecen a los consumidores la posibilidad de optar por no participar (Sørum, Presthus, 2021). La Directiva 2002/58/CE dejó en manos de los estados miembros la legislación para proteger la confidencialidad de las comunicaciones y de los datos de tráfico asociados a ellas (art.…”