To read the full version of this content please select one of the options below:

Dude, where's my data? The GDPR in practice, from a consumer's point of view

Hanne Sørum (School of Economics, Innovation, and Technology, Kristiania University College, Oslo, Norway)
Wanda Presthus (School of Economics, Innovation, and Technology, Kristiania University College, Oslo, Norway)

Information Technology & People

ISSN: 0959-3845

Article publication date: 18 June 2020

Issue publication date: 24 May 2021

685

Abstract

Purpose

This paper investigates the European Union's General Data Protection Regulation (GDPR) in information systems (ISs). The GDPR consists of 99 articles, and two articles are emphasised – namely Article 15, which deals with rights of access by the data subject, and Article 20, which deals with the right to data portability.

Design/methodology/approach

15 companies operating in the Norwegian consumer market were randomly selected. Each company received an inquiry pertaining to rights of access by the data subject (Article 15) and the right to data portability (Article 20). The research team carefully analysed the answers received and categorised the responses according to the two articles emphasised.

Findings

The findings show extensive variations among the companies in terms of response time, quality of feedback and how companies handle requests concerning rights of access by the data subject (Article 15) and the right to data portability (Article 20). Differences are also pertaining to the types of files, along with the content of these files. It should be noted, however, that most of the companies replied to the inquiry before the deadline. The findings show that companies comply better with Article 20 than Article 15. However, it appears that they do not differentiate between the two articles.

Originality/value

This study explores a research topic that is relatively new. It addresses a gap in the extant research by highlighting how the GDPR works in practice from a consumer's perspective. In addition, guidelines are offered to the consumers and companies affected by the GDPR.

Keywords

Acknowledgements

The title is based on the movie, Dude, Where's My Car? from 2000 and the book Dude, Where's My Country? by Michael Moore, from 2003. The authors thank Eva Jarbekk for her juridical advice and Bogdan Marculescu for his technological advice. The authors are also grateful to Knut Erik Gaustad for comments. In addition, the authors would like to thank the reviewers and editors at the Information Technology and People journal for raising the quality of this study.

Citation

Sørum, H. and Presthus, W. (2021), "Dude, where's my data? The GDPR in practice, from a consumer's point of view", Information Technology & People, Vol. 34 No. 3, pp. 912-929. https://doi.org/10.1108/ITP-08-2019-0433

Publisher

:

Emerald Publishing Limited

Copyright © 2020, Emerald Publishing Limited

Related articles