Reclaiming Data: Overcoming app identification barriers for exercising data protection rights

TL;DR

This paper discusses the challenge of exercising data protection rights when apps collect personal data without user registration, and proposes design solutions to facilitate data access and control without compromising privacy.

Contribution

It introduces simple design approaches for apps and mobile platforms to help users exercise their data rights without needing to provide additional personal information.

Findings

Proposes design modifications for app data management

Highlights the importance of platform-level support for data rights

Suggests practical solutions for privacy-preserving data access

Abstract

Data protection regulations generally afford individuals certain rights over their personal data, including the rights to access, rectify, and delete the data held on them. Exercising such rights naturally requires those with data management obligations (service providers) to be able to match an individual with their data. However, many mobile apps collect personal data, without requiring user registration or collecting details of a user's identity (email address, names, phone number, and so forth). As a result, a user's ability to exercise their rights will be hindered without means for an individual to link themselves with this 'nameless' data. Current approaches often involve those seeking to exercise their legal rights having to give the app's provider more personal information, or even to register for a service; both of which seem contrary to the spirit of data protection law. This paper explores these concerns, and indicates simple means for facilitating data subject rights through both application and mobile platform (OS) design.