The Landscape of Data Subject Access Rights: Expectations, Corporate Implementations, and Novel Mechanisms For User Exploration

Since the General Data Protection Regulation (GDPR) became enforceable in 2018, dozens of federal and regional governments have passed laws granting millions of people the right to request their personal data from online platforms. Despite how widespread this right has become, the details about how it should be implemented are loosely defined. This dissertation defines how consumers experience invoking this right of access nearly a decade after it has become widespread. I tackled the problem in three studies: (1) a user study to understand consumers' experiences making requests and interacting with their data; (2) a measurement study in which I analyzed and defined a taxonomy for the DSAR mechanisms for 250 online platforms; and (3) a final measurement study in which I collected personal data exports from 69 platforms and analyzed their formats and content. The findings of the three studies show that every stage of the DSAR, from request to interaction with the data exports, lacked standardization and varied by platform and business type (e.g., travel, finance), as well as across consumers of the same platform. The DSAR mechanisms varied in their complexity (e.g., the number of check-boxes in a form), ease of access and availability (e.g., number of clicks from a privacy policy page to the DSAR), and configurability (e.g., request for data within a date range). In the user studies in this work, I found that lack of clarity and organization leads consumers to be dissatisfied with their personal data exports. While study participants hoped to learn either about their own usage of the platform or how the company collects and uses their personal data, these questions were often left unanswered. I found similar evidence for the barriers to the usability of exports in the export measurement study. In particular, these data exports vary across and within platforms in number of bytes, amount and complexity of file and directory structures, and in the types of records within them. In addition to describing the intellectual findings from these studies, I release open-source resources and tools for making use of DSARs and data exports in the form of code to process data exports in a privacy-preserving way, a repository of summarized and generalized data export file schemas from 69 platforms, and library to facilitate data transfers.