Turning to Online Forums for Legal Information: A Case Study of GDPR's Legitimate Interests

TL;DR

This study examines how practitioners use online forums for GDPR legal guidance, revealing complexities in applying legitimate interests and assessing the legal soundness of crowd-sourced responses.

Contribution

It provides an in-depth analysis of online forum usage for GDPR compliance, highlighting common confusions and evaluating the legal accuracy of forum responses.

Findings

Applying legitimate interest is complex for practitioners.

Crowdsourced legal info is generally sound but sometimes incomplete.

Recommendations to improve forum response quality.

Abstract

Practitioners building online services and tools often turn to online forums such as Reddit, Law Stack Exchange, and Stack Overflow for legal guidance to ensure compliance with the GDPR. The legal information presented in these forums directly impacts present-day industry practitioner's decisions. Online forums can serve as gateways that, depending on the accuracy and quality of the answers provided, may either support or undermine the protection of privacy and data protection fundamental rights. However, there is a need for deeper investigation into practitioners' decision-making processes and their understanding of legal compliance when seeking for legal information online. Using GDPR's ``legitimate interests'' legal ground for processing personal data as a case study, we investigate how practitioners use online forums to identify common areas of confusion in applying legitimate interests in practice, and evaluate how legally sound online forum responses are. Our analysis found that applying the legal basis of legitimate interest is complex for practitioners, with important implications for how the GDPR is implemented in practice. The legal analysis showed that crowdsourced legal information tends to be legally sound, though sometimes incomplete. We outline recommendations to improve the quality of online forums by ensuring that responses are more legally sound and comprehensive, enabling practitioners to apply legitimate interests effectively in practice and uphold the GDPR.