Towards Cross-Provider Analysis of Transparency Information for Data Protection

TL;DR

This paper introduces a novel, machine-readable, graph-based platform for large-scale analysis of transparency information across data service providers, enhancing transparency and accountability in data protection.

Contribution

It presents a general approach, architecture, and open-source implementation for analyzing transparency data at scale, enabling empirical identification of data transfers and sharing clusters.

Findings

Analyzed over 70 real-world data controllers.

Identified data transfer patterns and sharing clusters.

Simulated network dynamics with synthetic transparency data.

Abstract

Transparency and accountability are indispensable principles for modern data protection, from both, legal and technical viewpoints. Regulations such as the GDPR, therefore, require specific transparency information to be provided including, e.g., purpose specifications, storage periods, or legal bases for personal data processing. However, it has repeatedly been shown that all too often, this information is practically hidden in legalese privacy policies, hindering data subjects from exercising their rights. This paper presents a novel approach to enable large-scale transparency information analysis across service providers, leveraging machine-readable formats and graph data science methods. More specifically, we propose a general approach for building a transparency analysis platform (TAP) that is used to identify data transfers empirically, provide evidence-based analyses of sharing clusters of more than 70 real-world data controllers, or even to simulate network dynamics using synthetic transparency information for large-scale data-sharing scenarios. We provide the general approach for advanced transparency information analysis, an open source architecture and implementation in the form of a queryable analysis platform, and versatile analysis examples. These contributions pave the way for more transparent data processing for data subjects, and evidence-based enforcement processes for data protection authorities. Future work can build upon our contributions to gain more insights into so-far hidden data-sharing practices.