How to Drill Into Silos: Creating a Free-to-Use Dataset of Data Subject Access Packages

TL;DR

This paper introduces a publicly available dataset of data subject access packages (SARPs) from multiple services to facilitate research on practical data usage under GDPR rights.

Contribution

It presents a novel method for generating and using SARPs and provides the first dataset of SARPs from five services for research purposes.

Findings

Created a dataset of SARPs from five services

Established a method for processing and analyzing SARPs

Facilitates future research on data subject rights

Abstract

The European Union's General Data Protection Regulation (GDPR) strengthened several rights for individuals (data subjects). One of these is the data subjects' right to access their personal data being collected by services (data controllers), complemented with a new right to data portability. Based on these, data controllers are obliged to provide respective data and allow data subjects to use them at their own discretion. However, the subjects' possibilities for actually using and harnessing said data are severely limited so far. Among other reasons, this can be attributed to a lack of research dedicated to the actual use of controller-provided subject access request packages (SARPs). To open up and facilitate such research, we outline a general, high-level method for generating, pre-processing, publishing, and finally using SARPs of different providers. Furthermore, we establish a realistic dataset comprising two users' SARPs from five services. This dataset is publicly provided and shall, in the future, serve as a starting and reference point for researching and comparing novel approaches for the practically viable use of SARPs.