Dude, where's my data? The GDPR in practice, from a consumer's point of view
Information Technology & People
Article publication date: 18 June 2020
Issue publication date: 24 May 2021
This paper investigates the European Union's General Data Protection Regulation (GDPR) in information systems (ISs). The GDPR consists of 99 articles, and two articles are emphasised – namely Article 15, which deals with rights of access by the data subject, and Article 20, which deals with the right to data portability.
15 companies operating in the Norwegian consumer market were randomly selected. Each company received an inquiry pertaining to rights of access by the data subject (Article 15) and the right to data portability (Article 20). The research team carefully analysed the answers received and categorised the responses according to the two articles emphasised.
The findings show extensive variations among the companies in terms of response time, quality of feedback and how companies handle requests concerning rights of access by the data subject (Article 15) and the right to data portability (Article 20). Differences are also pertaining to the types of files, along with the content of these files. It should be noted, however, that most of the companies replied to the inquiry before the deadline. The findings show that companies comply better with Article 20 than Article 15. However, it appears that they do not differentiate between the two articles.
This study explores a research topic that is relatively new. It addresses a gap in the extant research by highlighting how the GDPR works in practice from a consumer's perspective. In addition, guidelines are offered to the consumers and companies affected by the GDPR.
The title is based on the movie, Dude, Where's My Car? from 2000 and the book Dude, Where's My Country? by Michael Moore, from 2003. The authors thank Eva Jarbekk for her juridical advice and Bogdan Marculescu for his technological advice. The authors are also grateful to Knut Erik Gaustad for comments. In addition, the authors would like to thank the reviewers and editors at the Information Technology and People journal for raising the quality of this study.
Sørum, H. and Presthus, W. (2021), "Dude, where's my data? The GDPR in practice, from a consumer's point of view", Information Technology & People, Vol. 34 No. 3, pp. 912-929. https://doi.org/10.1108/ITP-08-2019-0433
Emerald Publishing Limited
Copyright © 2020, Emerald Publishing Limited