Please use this identifier to cite or link to this item: http://hdl.handle.net/1942/36934
Full metadata record
DC FieldValueLanguage
dc.contributor.authorDI MARTINO, Mariano-
dc.contributor.authorMEERS, Isaac-
dc.contributor.authorQUAX, Peter-
dc.contributor.authorANDRIES, Ken-
dc.contributor.authorLAMOTTE, Wim-
dc.date.accessioned2022-03-18T14:47:34Z-
dc.date.available2022-03-18T14:47:34Z-
dc.date.issued2022-
dc.date.submitted2022-03-08T12:55:31Z-
dc.identifier.citationProceedings on Privacy Enhancing Technologies, 2022 (2) , p. 95 -113-
dc.identifier.urihttp://hdl.handle.net/1942/36934-
dc.description.abstractSeveral data protection regulations permit individuals to request all personal information that an organization holds about them by utilizing Subject Access Requests (SARs). Prior work has observed the identification process of such requests, demonstrating weak policies that are vulnerable to potential data breaches. In this paper, we analyze and compare prior work in terms of methodologies, requested identification credentials and threat models in the context of privacy and cybersecurity. Furthermore, we have devised a longitudinal study in which we examine the impact of responsible disclosures by re-evaluating the SAR authentica-tion processes of 40 organizations after they had two years to improve their policies. Here, we demonstrate that 53% of the previously vulnerable organizations have not corrected their policy and an additional 27% of previously non-vulnerable organizations have potentially weakened their policies instead of improving them, thus leaking sensitive personal information to potential adversaries. To better understand state-of-the-art SAR policies, we interviewed several Data Protection Officers and explored the reasoning behind their processes from a viewpoint in the industry and gained insights about potential criminal abuse of weak SAR policies. Finally, we propose several technical modifications to SAR policies that reduce privacy and security risks of data controllers.-
dc.language.isoen-
dc.publisherSciendo-
dc.subject.othersubject access request-
dc.subject.otherGDPR policies-
dc.subject.otherau- thentication issues-
dc.subject.othersocial engineering-
dc.titleRevisiting Identification Issues in GDPR ‘Right Of Access’ Policies: A Technical and Longitudinal Analysis-
dc.typeJournal Contribution-
local.bibliographicCitation.conferenceplaceSydney, Australia-
dc.identifier.epage113-
dc.identifier.issue2-
dc.identifier.spage95-
dc.identifier.volume2022-
local.bibliographicCitation.jcatA2-
local.type.refereedRefereed-
local.type.specifiedArticle-
dc.identifier.doi10.2478/popets-2022-0037-
dc.identifier.eissn2299-0984-
local.provider.typePdf-
local.uhasselt.internationalno-
item.fulltextWith Fulltext-
item.accessRightsOpen Access-
item.contributorMEERS, Isaac-
item.contributorQUAX, Peter-
item.contributorLAMOTTE, Wim-
item.contributorANDRIES, Ken-
item.contributorDI MARTINO, Mariano-
item.fullcitationDI MARTINO, Mariano; MEERS, Isaac; QUAX, Peter; ANDRIES, Ken & LAMOTTE, Wim (2022) Revisiting Identification Issues in GDPR ‘Right Of Access’ Policies: A Technical and Longitudinal Analysis. In: Proceedings on Privacy Enhancing Technologies, 2022 (2) , p. 95 -113.-
crisitem.journal.eissn2299-0984-
Appears in Collections:Research publications
Files in This Item:
File Description SizeFormat 
10.2478_popets-2022-0037.pdfPublished version534.66 kBAdobe PDFView/Open
Show simple item record

Page view(s)

158
checked on Jun 20, 2022

Download(s)

80
checked on Jun 20, 2022

Google ScholarTM

Check

Altmetric


Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.