The Security Implications of Data Subject Rights
Open accessAbstract
Data protection regulations give individuals rights to obtain the information that entities have on them. However, providing such information can also reveal aspects of the entity's underlying technical infrastructure and organizational processes. This article explores the security implications this raises and highlights the need to consider such in rights in fulfillment processes.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In practice, many organisations appear ill-prepared for meeting their disclosure obligations.
“Note that, in practice, many organisations appear ill-prepared for meeting their disclosure obligations [65,76]”
From Reviewable Automated Decision-Making: A Framework for Accountable Algorithmic Systems (2021) · cites this paper as [65]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Advanced social engineering attacks
Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2014.09.005 · Cited by 575 · see citing works
When data protection by design and data subject rights clash
Veale, M., Binns, R., & Ausloos, J. (2018) · International Data Privacy Law · doi:10.1093/idpl/ipy002 · Cited by 118 · see citing works
Shattering one-way mirrors – data subject access rights in practice
Ausloos, J., & Dewitte, P. (2018) · International Data Privacy Law · doi:10.1093/idpl/ipy001 · Cited by 96 · see citing works
How Portable is Portable?: Exercising the GDPR's Right to Data Portability
Wong, J., & Henderson, T. (2018) · Proceedings of the 2018 ACM International Joint Conference and 2018 International Symposium on Pervasive and Ubiquitous Computing and Wearable Computers · doi:10.1145/3267305.3274152 · Cited by 27 · see citing works
Data Protection, Privacy and Identity: Distinguishing Concepts and Articulating Rights
de Andrade, N. N. G. (2011) · IFIP International Federation for Information Processing/IFIP · doi:10.1007/978-3-642-20769-3_8 · Cited by 25 · see citing works
Kennedy, E., & Millard, C. J. (2015) · Computer law & security review · doi:10.1016/j.clsr.2015.12.004 · Cited by 24 · see citing works
Norval, C., Janssen, H., Cobbe, J., et al. (2018) · doi:10.1145/3267305.3274153 · Cited by 22 · see citing works
Self-citation
Flagged first, then by citations
Research works printed but not linked: 3
- [3]3. Nitesh Dhanjani, Billy Rios, and Brett Hardin. Hacking: The Next Generation. O'Reilly, 2009.
- [6]6. Thomas J. Holt and Alice Hutchings. A Crime Script Analysis of the Online Stolen Data Market. The British Journal of Criminology, 55(3):596-614, 12 2014.
- [11]11. Chris Norval, Heleen Janssen, Jennifer Cobbe, and Jatinder Singh. Re- claiming data: Overcoming app identification barriers for exercising data protection rights. In Proceedings of ACM Ubicomp 2018, pages 921-930. ACM, 2018.
Cited by
Sorted by citations
Reviewable Automated Decision-Making: A Framework for Accountable Algorithmic Systems
Cobbe, J., Lee, M. S. A., & Singh, J. (2021) · Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency · doi:10.1145/3442188.3445921 · Cited by 150 · see citing works
“Note that, in practice, many organisations appear ill-prepared for meeting their disclosure obligations [65, 76] Records about disclosures themselves can also be relevant – both of the processes for disclosure as well as what was actually released, how information was compiled, how it was delivered, in what format, to…”
BackgroundSelf-citationWhat lies beneath: transparency in online service supply chains
Cobbe, J., Norval, C., & Singh, J. (2020) · Journal of Cyber Policy · doi:10.1080/23738871.2020.1745860 · Cited by 13 · see citing works
Self-citation
- Authors
- Singh, J., & Cobbe, J.
- Affiliations
- University of Cambridge (GB)
- Venue
- IEEE Security & Privacy
- Published
- 2019-11
- Volume
- 17
- Issue
- 6
- Pages
- 21-30
- ISSN
- 1540-7993 (ISSN-L)
- 1558-4046
- OpenAlex
- W2944279250
- Semantic Scholar
- 10a9a688542a295d2d3d5da9284ad802e8de94f1
- Cited by
- 17
- References
- 7
- Citations by year
- 2026: 1 · 2025: 1 · 2024: 2 · 2023: 2 · 2022: 2 · 2021: 6 · 2020: 2 · 2019: 1
- FWCI
- 5.53
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Security & Privacy (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- University of Cambridge
- Engineering and Physical Sciences Research Council (EP/P024394/1)
- Topics
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Social Sciences › Law › Digitalization, Law, and Regulation
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- data subject rights, data protection regulation, access rights, information disclosure, organizational processes, security implications
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
