Amplifying Privacy: Scaling Up Transparency Research Through Delegated Access Requests

TL;DR

This paper introduces a delegated access request method to enhance transparency research by allowing researchers to obtain data on behalf of participants, simplifying the process and ensuring participant control.

Contribution

It proposes a novel delegated access approach, including legal, procedural, and technical frameworks, tested in a pilot study to improve transparency research methods.

Findings

Delegated access requests are effective and participant-friendly.

Different sectors respond variably to delegated requests.

The method maintains participant control and information during data access.

Abstract

In recent years, numerous studies have used 'data subject access requests' in a collective manner, to tackle information asymmetries and shed light on data collection and privacy practices of organizations. While successful at increasing transparency, such studies are quite hard to conduct for the simple fact that right of access is an individual right. This means that researchers have to recruit participants and guide them through the often-cumbersome process of access. In this paper, we present an alternative method: to ask participants to delegate their right of access to the researchers. We discuss the legal grounds for doing this, the advantages it can bring to both researchers and data subjects, and present a procedural and technical design to execute it in a manner that ensures data subjects stay informed and in charge during the process. We tested our method in a pilot study in the Netherlands, and found that it creates a win-win for both the researchers and the participants. We also noted differences in how data controllers from various sectors react to such requests and discuss some remaining challenges.