When data protection by design and data subject rights clash

Veale, Michael; Binns, Reuben; Ausloos, Jef

doi:10.1093/idpl/ipy002

Cited by 47 publications

(19 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As a GDPR requirement, DPbD may be restrictive in practice, emphasising privacy-as-control over privacy-as-confidentiality when no data protection frameworks guide DPbD employment. 79 The privacy-protective Right to Be Forgotten (RtBF) may override the RtDP as a result of 'multiple linking', where two or more data subjects can be easily linked by same datasets. 80 More generally, it has been argued that the GDPR should not be considered as a one-size-fits-all piece of legislation for technology law.…”

Section: Data Portability Within the Gdprmentioning

confidence: 99%

The right to data portability in practice: exploring the implications of the technologically neutral GDPR

Wong

Henderson

2019

International Data Privacy Law

View full text Add to dashboard Cite

The European General Data Protection Regulation (GDPR) introduces one new data subject right, Article 20's right to data portability (RtDP). The RtDP aims to allow data subjects to obtain and reuse their personal data for their own purposes across different services. • We investigate the RtDP by making 230 real-world data portability requests across a wide range of data controllers. The RtDP is interesting to study as it operates under a framework that aims to be technologically neutral while requiring specific technologies for implementation. Our objective is to assess the ease of the RtDP process from the perspective of the data subject and to examine the file formats returned by data controllers. • From our results, including responses indicating that no personal data were stored, only 172 (74.8%) of RtDP requests were successfully completed. However, compliance with the GDPR varied where not all file formats meet the GDPR requirements. There was also confusion amongst data controllers about data subject rights more generally. • Based on our observations, we revisit the current guidance for data portability. We suggest new technical definitions to clarify how data should be made portable and determine the appropriateness of certain file formats for different data types. • We suggest recommendations and future work for various stakeholders to address the legal implications derived from our study. This includes discussing possibilities for new data portability standards and codes, conducting further empirical research, and building technological solutions to ensure that the RtDP can be better understood in theory and exercised in practice.

show abstract

Section: Data Portability Within the Gdprmentioning

confidence: 99%

The right to data portability in practice: exploring the implications of the technologically neutral GDPR

Wong

Henderson

2019

International Data Privacy Law

View full text Add to dashboard Cite

show abstract

“…The rush to design and implement technologies in tracking the virus to limit its spread was seen worldwide (Ada Lovelace, 2020). Many of the designs for mobile applications and wearables to track citizens or the use of AI and IoT did not take fully into account issues such as privacy, data protection or ethics by design, an area that has received significant attention in various areas of design research in recent years (Lindley et al 2018;Veale et al, 2018).…”

Section: Stage 1 Reactionmentioning

confidence: 99%

Designing for a pandemic: towards recovery and resilience

Mullagh

Cooper

Thomas

et al. 2021

SDRJ

View full text Add to dashboard Cite

Design is recognized as a discipline that is ideally placed to work across boundaries to tackle wicked problems and help cope with uncertainty. As humanity continues to become more interconnected it is thought that we are becoming more exposed to viruses such as COVID-19. Therefore, the current pandemic offers us opportunities to re-think and re-design many of our practices to ensure we are resilient in future similar crises . Through the creation and analysis of a database that captures design interventions that have emerged during the pandemic, the paper considers the role design can play in collectively recovering from the current pandemic and building resilience for the future. Whilst the findings represent the beginning of this process, (from late March until June 2020) we find that design has been deployed in a wide range of ways and on all scales, from the personal, communal, organizational, national and international. However, as we live through and emerge from the pandemic we should reflect, within the realm of design research and beyond, on how we might harness design to enable recovery and build resilience for the future.

show abstract

“…A striking example is genetic data: giving rights to a data controller to process your genetic data not only affects you and your privacy, but also potentially countless individuals to whom you are related-knowingly or unknowingly (Chadwick et al, 2014;Olejnik et al, 2014;Hallinan and De 11. For a discussion of privacy issues and related risks brought about by voice assistants, see Veale et al, 2018. Their discussion of privacy harms, rights and data protection by-design for Apple's Siri is applicable to the risks and harms highlighted here for third-party subjects.…”

Section: Four Different Kinds Of Disclosurementioning

confidence: 99%

Privacy self-management and the issue of privacy externalities: of thwarted expectations, and harmful exploitation

Brouwer¹

2020

Internet Policy Review

View full text Add to dashboard Cite

This article argues that the self-management of one's privacy is impossible due to privacy externalities. Privacy externalities are the negative by-product of the services offered by some data controllers, whereby the price to 'pay' for a service includes not just the provision of the user's own personal data, but also that of others. This term, related to similar concepts from the literature on privacy such as 'networked privacy' or 'data pollution' , is used here to bring to light the incentives and exploitative dynamics behind a phenomenon which, I demonstrate, benefits both the user and the data controller to the detriment of third-party data subjects. Building on these novel elements and on the relevant concepts and examples found in the existing literature, this article draws a comprehensive picture of the phenomenon, and offers two promising paths to address it-better enforcing the principle of data protection by design and by default, and relying on the framework of joint controllership.

show abstract

When data protection by design and data subject rights clash

Cited by 47 publications

References 0 publications

The right to data portability in practice: exploring the implications of the technologically neutral GDPR

The right to data portability in practice: exploring the implications of the technologically neutral GDPR

Designing for a pandemic: towards recovery and resilience

Privacy self-management and the issue of privacy externalities: of thwarted expectations, and harmful exploitation

Contact Info

Product

Resources

About