Priveasy - improving privacy infrastructure of existing web applications

Abstract

When the world gave birth to the web, privacy was not a concern. Through decades, the main principles have remained largely the same, leaving many applications on the web today with privacy and security as an afterthought. But can they be blamed? Regulations regarding privacy of personal information have just recently started to catch up with the mass amounts of personally identifiable information floating around on various places on the web. This thesis proposes two ways to improve the privacy infrastructure of those existing web applications.

First of all, a prototype was built that connects to an app’s database and enables easy handling of GDPR rights requests. Specifically, right of access and right of erasure (also known as right to be forgotten). With that, the feasibility of building such a standalone tool that does not require any alterations to the application’s source code is proven. The tool was validated by exploring an extensive example.

Secondly, when a privacy-related incident does happen (which is not a rare occurrence), this work tested the need for personalised information with the public. To do so, such a tool was built and tested for the Facebook phone number leak of April 2021, called Ben Ik Erbij?. The need for this personalised information was found to be high. The tool was reported on by national news outlets, it established a successful partnership with the Belgian Data Protection Authority on their initiative, and it performed an estimated six million look-ups in Belgium (population of 11.5 million).