How do app vendors respond to subject access requests? A longitudinal privacy study on iOS and Android Apps

摘要: EU data protection laws grant consumers the right to access personal that companies hold about them. In a first-of-its-kind longitudinal study, we examine how service providers have complied with subject requests over four years. three iterations between 2015 and 2019, sent vendors of 225 mobile apps popular in Germany. Throughout iterations, 19 26% were unreachable or did not reply at all. Our fulfilled 15 53% cases, an unexpected decline GDPR enforcement date end our study. The remaining responses exhibit long list shortcomings, including severe violations information security principles. Some even contained deceptive misleading statements (7 13%). Further, 9% discontinued 27% user accounts vanished during mostly without proper notification consequences for data. While observe improvements selected aspects time, results indicate request handling will be unsatisfactory as accept such via email process them manually.