2023/05/05 by Nicola Leschke, Leschke, Nicola, Florian Kirsten +5
Computer Science · Social Sciences · #Access Control and Trust #Computers and Society (cs.CY) #FOS: Computer and information sciences #Privacy, Security, and Data Protection #Privacy-Preserving Technologies in Data
paper · pdf · doi:10.48550/arxiv.2305.03471
openalex publication_date 2023/05/05 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Transparency and data portability are two core principles of modern privacy legislations such as the GDPR. From the regulatory perspective, providing individuals (data subjects) with access to their data is a main building block for implementing these. Different from other privacy principles and respective regulatory provisions, however, this right to data access has so far only seen marginal technical reflection. Processes related to performing data subject access requests (DSARs) are thus still to be executed manually, hindering the concept of data access from unfolding its full potential. To tackle this problem, we present an automated approach to the execution of DSARs, employing modern techniques of web automation. In particular, we propose a generic DSAR workflow model, a corresponding formal language for representing the particular workflows of different service providers (controllers), a publicly accessible and extendable workflow repository, and a browser-based execution engine, altogether providing ``one-click'' DSARs. To validate our approach and technical concepts, we examine, formalize and make publicly available the DSAR workflows of 15 widely used service providers and implement the execution engine in a publicly available browser extension. Altogether, we thereby pave the way for automated data subject access requests and lay the groundwork for a broad variety of subsequent technical means helping web users to better understand their privacy-related exposure to different service providers.