Only platforms’ shaping of data access under the GDPR: an empirical study of the uses of data download packages

Abstract Access rights in the General Data Protection Regulation (GDPR) aim to empower individuals, but these also hold potential for lawful purposes beyond individual data protection. Researchers may for instance ask individuals to donate data they obtained from access requests to online platforms for academic research. Online platforms increasingly respond to such access requests by sending individuals a “data download package” (“DDP”), i.e., a technical file containing personal information data subjects are entitled to under the GDPR. Although these DDPs could, in theory, appropriately inform data subjects, practice shows that online platforms use DDPs to operationalise access rights, resulting in defective and constrained interpretations of their GDPR obligations. We compared eight online platform DDPs with that platform’s privacy notice. We found that none of the platform DDPs provide complete and individualised information as required under the GDPR, indicating a systematic lack of compliance in platforms’ responses to access requests. We conclude that the vaguely formulated access rights under the GDPR, at first sight, could give online platforms the impression that room for their own interpretation and implementation exists; yet regulatory guidance and case law have firmly narrowed down a data controller’s own access rights interpretations, also those through uses of DDPs. In this article, we refer to such platforms’ practices as “interpretative entrepreneurship”: practices whereby online platforms may reinterpret legal obligations applying to them, to subtly prioritise their own interests, while, often unobtrusively, sidestepping regulatory guidelines.