Standard

Collectively exercising the right of access: individual effort, societal effect. / Asghari, Hadi; Mahieu, René; van Eeten, Michel.

In: Internet Policy Review, Vol. 7, No. 3, 13.07.2018.

Research output: Contribution to journalArticleScientificpeer-review

Harvard

APA

Vancouver

Author

BibTeX

@article{9a7b6817ea044dbdacc223f4afff0b8e,
title = "Collectively exercising the right of access: individual effort, societal effect",
abstract = "The debate about how to govern personal data has intensified in recent years. The European Union’s General Data Protection Regulation, which came into effect in May 2018, relies on transparency mechanisms codified through obligations for organisations and citizen rights. While some of these rights have existed for decades, their effectiveness is rarely tested in practice. This paper reports on the exercise of the so-called right of access, which gives citizens the right to get access to their personal data. We study this by working with articipants—citizens for whom the law is written—who collectively sent over a hundred data access requests and shared the responses with us. We analyse the replies to the access requests, as well as the participant's evaluation of them. We find that non-compliance with the law's obligations is widespread. Participants were critical of many responses, though they also reported a large variation in quality. They did not find them effective for getting transparency into the processing of their own personal data. We did find a way forward emerging from their responses, namely by looking at the requests as a collective endeavour, rather than an individual one. Comparing the responses to similar access requests creates a context to judge the quality of a reply and the lawfulness of the data practices it reveals. Moreover, collective use of the right of access can help shift the power imbalance between individual citizens and organisations in favour of the citizen, which may incentivise organisations to deal with data in a more transparent way.",
keywords = "Access rights, Privacy measurement, General Data Protection Regulation, Data governance",
author = "Hadi Asghari and Ren{\'e} Mahieu and {van Eeten}, Michel",
year = "2018",
month = "7",
day = "13",
doi = "10.14763/2018.3.927",
language = "English",
volume = "7",
journal = "Internet Policy Review",
issn = "2197-6775",
publisher = "Alexander von Humboldt Institute for Internet and Society",
number = "3",

}

RIS

TY - JOUR

T1 - Collectively exercising the right of access: individual effort, societal effect

AU - Asghari, Hadi

AU - Mahieu, René

AU - van Eeten, Michel

PY - 2018/7/13

Y1 - 2018/7/13

N2 - The debate about how to govern personal data has intensified in recent years. The European Union’s General Data Protection Regulation, which came into effect in May 2018, relies on transparency mechanisms codified through obligations for organisations and citizen rights. While some of these rights have existed for decades, their effectiveness is rarely tested in practice. This paper reports on the exercise of the so-called right of access, which gives citizens the right to get access to their personal data. We study this by working with articipants—citizens for whom the law is written—who collectively sent over a hundred data access requests and shared the responses with us. We analyse the replies to the access requests, as well as the participant's evaluation of them. We find that non-compliance with the law's obligations is widespread. Participants were critical of many responses, though they also reported a large variation in quality. They did not find them effective for getting transparency into the processing of their own personal data. We did find a way forward emerging from their responses, namely by looking at the requests as a collective endeavour, rather than an individual one. Comparing the responses to similar access requests creates a context to judge the quality of a reply and the lawfulness of the data practices it reveals. Moreover, collective use of the right of access can help shift the power imbalance between individual citizens and organisations in favour of the citizen, which may incentivise organisations to deal with data in a more transparent way.

AB - The debate about how to govern personal data has intensified in recent years. The European Union’s General Data Protection Regulation, which came into effect in May 2018, relies on transparency mechanisms codified through obligations for organisations and citizen rights. While some of these rights have existed for decades, their effectiveness is rarely tested in practice. This paper reports on the exercise of the so-called right of access, which gives citizens the right to get access to their personal data. We study this by working with articipants—citizens for whom the law is written—who collectively sent over a hundred data access requests and shared the responses with us. We analyse the replies to the access requests, as well as the participant's evaluation of them. We find that non-compliance with the law's obligations is widespread. Participants were critical of many responses, though they also reported a large variation in quality. They did not find them effective for getting transparency into the processing of their own personal data. We did find a way forward emerging from their responses, namely by looking at the requests as a collective endeavour, rather than an individual one. Comparing the responses to similar access requests creates a context to judge the quality of a reply and the lawfulness of the data practices it reveals. Moreover, collective use of the right of access can help shift the power imbalance between individual citizens and organisations in favour of the citizen, which may incentivise organisations to deal with data in a more transparent way.

KW - Access rights

KW - Privacy measurement

KW - General Data Protection Regulation

KW - Data governance

U2 - 10.14763/2018.3.927

DO - 10.14763/2018.3.927

M3 - Article

VL - 7

JO - Internet Policy Review

T2 - Internet Policy Review

JF - Internet Policy Review

SN - 2197-6775

IS - 3

ER -

ID: 47907937