The Effect of the GDPR on Privacy Policies

Abstract

The General Data Protection Regulation (GDPR) is considered by some to be the most important change in data privacy regulation in 20 years. Effective May 2018, the European Union GDPR privacy law applies to any organization that collects and processes the personal information of EU citizens within or outside the EU. In this work, we seek to quantify the progress the GDPR has made in improving privacy policies around the globe. We leverage our data mining tool, PrivacyCheck, to automatically compare three corpora (totaling 550) of privacy policies, pre- and post-GDPR. In addition, to evaluate the current level of compliance with the GDPR around the globe, we manually studied the policies within two corpora (450 policies). We find that the GDPR has made progress in protecting user data, but more progress is necessary—particularly in the area of giving users the right to edit and delete their information—to entirely fulfill the GDPR’s promise. We also observe that the GDPR encourages sharing user data with law enforcement, and as a result, many policies have facilitated such sharing after the GDPR. Finally, we see that when there is non-compliance with the GDPR, it is often in the form of failing to explicitly indicate compliance, which in turn speaks to an organization’s lack of transparency and disclosure regarding their processing and protection of personal information. If Personally Identifiable Information (PII) is the “currency of the Internet,” these findings mark continued alarm regarding an individual’s agency to protect and secure their PII assets.

Cybersecurity, Data Privacy and Blockchain: A Review

“…Although GDPR compliance has significantly enhanced personal data protection (e.g. PII, PII sharing via add and marketing, collecting and sharing location data, child PII sharing, law enforcement, and data aggregation), more research is needed in facilitating a users right to erasure, to update and delete data and to completely satisfy the GDPR promise [ 25 ].…”

Analyzing GDPR compliance in Cloud Services' privacy policies using Textual Fuzzy Interpretive Structural Modeling (TFISM)

“…They were able to highlight the changes in the privacy policies before and after the GDPR release. Zaeem et al [10] employed Natural Language Processing (NLP) techniques to automatically analyze the privacy policy content from three corpora. They manually labeled the data with pre-and-post-GDPR and compared the results with GDPR to identify the role of GDPR.…”

“…We considered the GDPR document to be the authoritative document that is referenced by the privacy policies. For our study, we included privacy policies from articles that are referred by studies and other companies [9], [10], [11], [12], and [13].…”

Dark Patterns and the Legal Requirements of Consent Banners: An Interaction Criticism Perspective

“…Within the HCI community, there has been a long history of engagement with ethical impact, including important revisions of the ACM Code of Ethics in the 1990s [7,45] and 2010s [46,72,101], development and propagation of ethics-and value-focused methods to encourage awareness of potential social impact [31,41,86], and the development of methodologies that seek to center the voices of citizens and everyday users [10,34,78]. In the past few years, everyday users have begun to become more aware of the ethical character of everyday technologies as well, with recent public calls to ban facial recognition technologies [2] and further regulate privacy and data collection provisions [100,102], alongside critiques and boycotts of major social media and technology companies by employees and users alike [40,93]. These kinds of technology ethics issues have also been foregrounded by new and proposed laws and regulationsin particular, the General Data Protection Regulation (GDPR) in the European Union [44] and the California Consumer Privacy Act (CCPA) in the United States [23].…”