Amplifying Privacy: Scaling Up Transparency Research Through Delegated Access Requests

Abstract

In recent years, numerous studies have used 'data subject access requests' in a collective manner, to tackle information asymmetries and shed light on data collection and privacy practices of organizations. While successful at increasing transparency, such studies are quite hard to conduct for the simple fact that right of access is an individual right. This means that researchers have to recruit participants and guide them through the often-cumbersome process of access. In this paper, we present an alternative method: to ask participants to delegate their right of access to the researchers. We discuss the legal grounds for doing this, the advantages it can bring to both researchers and data subjects, and present a procedural and technical design to execute it in a manner that ensures data subjects stay informed and in charge during the process. We tested our method in a pilot study in the Netherlands, and found that it creates a win-win for both the researchers and the participants. We also noted differences in how data controllers from various sectors react to such requests and discuss some remaining challenges.