European General Data Protection Regulation requires organisations to request the data subject’s consent for personal data processing. Data controllers must be able to demonstrate valid consent was obtained (‘transparency’). Media often struggle to meet GDPR requirements in practice. We identified several issues with existing consent procedures amongst which a need for trustworthy approaches to record and track consent. In this article, we evaluate a specific transparency initiative: a Personal Data Receipt (PDR) for news personalisation. We investigated how European media users and media professionals evaluated the PDR. We conducted qualitative surveys and interviews to explore and describe individuals’ viewpoints on/responses to the PDR. The main strengths highlighted in this study are: GDPR compliance and improved data processing transparency which leads to more control and user trust. PDR weaknesses are mainly related to users not reading the receipt, lack/overload of information, and design issues. Based on our findings, we identified missing elements and formulated recommendations for PDR improvement to optimise consent strategies. By examining how individuals responded to this specific transparency tool, and rhetorical tactics connected to it (placation, diversion, jargon, and misnaming), our study provides informed suggestions for ways out of digital resignation (Draper & Turow, 2019).
BarthS., & De JongM. D. (2017). The privacy paradox – Investigating discrepancies between expressed privacy concerns and actual online behavior – A systematic literature review. Telematics and Informatics, 34(7), 1038-1058.
2.
BoscoF.CroceV.DanezisC.De RuyckZ.GeritsD.JennesI.KisselmannO.MattheijssensJ., & Van BuggenhoutN. (2018, February, 28). D6.2: Data Management Plan. CPN. https://www.projectcpn.eu/work-packages-and-deliverables.
BlumD. (2017, November 1). Digital Identity – Will the New Oil Create Fuel or Fire in Today’s Economy. ISACA Journal, 6, 1-3. https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/digital-identitywill-the-new-oil-create-fuel-or-fire-in-todays-economy.
5.
ButarbutarR. (2020, March). Initiating New Regulations on Personal Data Protection: Challenges for Personal Data Protection in Indonesia. In 3rd International Conference on Law and Governance (ICLAVE 2019), Atlantis Press, pp. 154-163.
6.
CooperC. (2017, November 21). Why Consent Receipts are Important. Consentua. https://consentua.com/blog/2017/11/21/why-consent-receipts-are-important/.
7.
CPN Consortium (2019, August 19). How CPN puts users in control of their personal data. https://www.projectcpn.eu/news-3/2019/8/19/how-cpn-puts-users-in-control-of-their-personal-data.
8.
DraperN. A., & TurowJ. (2019). The corporate cultivation of digital resignation. New Media & Society, 21(8), 1824-1839.
9.
GlaserB. G., & StraussA. L. (2017). The Discovery of Grounded Theory: strategies for qualitative research. Routledge.
10.
GreigS. (2017, June 20). Kantara Initiative Releases the First Open, Global Consent Receipt Specification; Meets GDPR Requirements, Free for Download [Press release]. https://kantarainitiative.org/kantara-initiative-releases-first-open-global-consent-receipt-specification/.
11.
Grigore (2020, March 5). What is a Good Net Promoter Score? (2020 NPS Benchmark). Retently. https://www.retently.com/blog/.
12.
HarawayD. (1988). Situated knowledges: The science question in feminism and the privilege of partial perspective. Feminist Studies, 14(3), 575-599.
13.
HardjonoT., & MalerE. (2017, June 5). Report from the Blockchain and Smart Contracts Discussion Group to the Kantara Initiative. Kantara Initiative. https://kantarainitiative.org/file-downloads/report-from-the-blockchain-and-smart-contracts-discussion-group-to-the-kantara-initiative-v1/.
14.
HardjonoT.MalerE.MachulakM., & CatalanoD. (2015, December 28). User-Managed Access (UMA) Profile of OAuth 2.0. Kantara Initiative. https://docs.kantarainitiative.org/uma/rec-uma-core.html.
15.
HardjonoT., & PentlandA. (2019). Data Cooperatives: Towards a Foundation for Decentralized Personal Data Management. arXiv, 1905.08819, 1-12. https://arxiv.org/abs/1905.08819.
16.
HedbomH. (2008, September). A survey on transparency tools for enhancing privacy. In IFIP Summer School on the Future of Identity in the Information Society. Springer, Berlin, Heidelberg, pp. 67-82.
17.
HughesA. (2018, November 11). Consent Receipt. IDIM Musings. https://idimmusings.com/tag/consent-receipt/.
18.
ICO (s.d.). Principle (a): Lawfulness, fairness and transparency. ICO.org.uk. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/lawfulness-fairness-and-transparency/.
19.
JesusV. (2020). Towards an Accountable Web of Personal Information: The Web-of-Receipts. IEEE Access, 8, 25383-25394.
20.
KomorowskiM.CoppensP.Van den BroeckW., & BraetO. (2016). Lowering the barriers for online cross-media usage: Scenarios for a Belgian single sign-on solution. Telematics and Informatics, 33(4), 916-924.
21.
KunevaM. European Consumer Commissioner (2009, March 31). Keynote Speech Roundtable on Online Data Collection, Targeting and Profiling [Press release]. http://europa.eu/rapid/press-release_SPEECH-09-156_en.htm.
22.
LeuE. (2019, January 10). What Is A Consent Receipt And Why It Matters. Clym. https://www.clym.io/articles/what-is-a-consent-receipt-and-why-it-matters.
23.
LeVasseurL., & MalerE. (2019). Beyond Consent: A Right-to-Use License for Mutual Agency. IEEE Communications Standards Magazine, 3(4), 52-59.
24.
LizarM. (2016, February 1). MVCR v0.7.1. Kantara Initiative. https://github.com/KI-CISWG/MVCR.
25.
LizarM., & HodderM. (2014). Usable consents: tracking and managing use of personal data with a consent transaction receipt. In Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing: Adjunct Publication pp. 647-652.
26.
LizarM., & PanditH. J. (2019). OPN: Open Notice Receipt Schema, Semantics, Berlin, Germany, pp. 1-5.
LizarM., & WunderlichJ. (2014). Consent Receipts [presentation]. Open Notice. https://kantarainitiative.org/wp-content/uploads/2014/10/Kantara-Consent-Receipt-Presentation.pdf.
29.
MalerE.MachulakM., & RicherJ. (2018, January 7). User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization. Kantara Initiative. https://kantarainitiative.org/file-downloads/rec-oauth-uma-grant-2-0-pdf/.
30.
MalgieriG., & CustersB. (2018). Pricing privacy – the right to know the value of your personal data. Computer Law & Security Review, 34(2), 289-303.
31.
MeadowsM., & HatzakisT. (2018). Getting to know you? New business models for privacy and the quantified self. Social Business, 8(1), 13-20.
32.
MillerF., & WertheimerA. (2010). The Ethics of Consent: Theory and Practice. Oxford University Press.
33.
MorrowS. (2017, September 25). Identity data in the world of GDPR. CSOonline.com. https://www.csoonline.com/article/3227912/identity-data-in-the-world-of-gdpr.html.
34.
NatiM. (2018, March). Personal Data Receipts: How transparency increases consumer trust. Digital Catapult. https://www.digicatapult.org.uk/news-and-insights/publication/pdr-report.
35.
NatiM.MayerS.CaposseleA., & MissierP. (2019). Toward trusted open data and services. Internet Technology Letters, 2(1), 1-5. https://onlinelibrary.wiley.com/doi/full/10.1002/itl2.69.
36.
NissenbaumH. (2009). Privacy in Context: Technology, Policy, and the Integrity of Social Life. Palo Alto: Stanford Law Books.
37.
PanditH. J.DebruyneC.O’SullivanD., & LewisD. (2019a). Gconsent – A Consent Ontology based on the GDPR. In European Semantic Web Conference, Springer, Cham, pp. 270-282.
38.
PanditH. J.PolleresA.BosB.BrennanR.BrueggerB.EkaputraF. J.Gachpaz HamedR.KieslingE.LizarM.SchlehanE.SteyskalS., & WenningR. (2019b, October). Creating a Vocabulary for Data Privacy. In OTM Confederated International Conferences: On the Move to Meaningful Internet Systems, Springer, Cham, pp. 714-730.
39.
PatachiM. (2018, December 12). How Big Companies Should Behave Under Europe’s New Cookie Regulations. CPO Magazine. https://www.cpomagazine.com/data-protection/how-big-companies-should-behave-under-europes-new-cookie-regulations/.
40.
PolitouE.AlepisE., & PatsakisC. (2018). Forgetting personal data and revoking consent under the GDPR: Challenges and proposed solutions. Journal of Cybersecurity, 4(1), 1-20. https://academic.oup.com/cybersecurity/article/4/1/tyy001/4954056.
41.
PötzschS. (2008, September). Privacy awareness: A means to solve the privacy paradox? In IFIP Summer School on the Future of Identity in the Information Society, Springer, Berlin, Heidelberg, pp. 226-236.
42.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Retrieved from https://eur-lex.europa.eu/eli/reg/2016/679/oj.
43.
RobinsonS. C. (2018). Factors predicting attitude toward disclosing personal data online. Journal of Organizational Computing and Electronic Commerce, 28(3), 214-233.
44.
SantolallaO. (2018, March 21). What is Consent Receipt. Ubisecure. https://www.ubisecure.com/data-protection/what-is-consent-receipt/. aaa(000) Simmons, A. (1998). Consent. The Routledge Encyclopedia of Philosophy. Taylor and Francis. doi: 10.4324/9780415249126-S011-1.s aaa(000) Styliari, T. C., & Nati, M. (2016, September). Researching the transparency of personal data sharing: Designing a consent receipt. Digital Catapult. https://nottingham-repository.worktribe.com/output/833415. aaa(000) Su, X., Hyysalo, J., Rautiainen, M., Riekki, J., Sauvola, J., Maarala, A. I., & Honko, H. (2016). Privacy as a Service in Digital Health. arXiv, 1605.00833, 1-6. https://arxiv.org/abs/1605.00833.
45.
Van BuggenhoutN., & Van den BroeckW. (2020). Dark patterns or informed consent, PI disclosure decision and trade-off? A study exploring the value of sharing personal information (PI) with media companies in Flanders, Belgium. NEM Summit 2020. https://nem-initiative.org/nem-summit-2020-program/.
46.
Van BuggenhoutN., & Van ZeelandI. (2020, June). Tussenrapportage expertbevraging reflectie 2: Relevantie, noodzaak en risico’s van data delen met mediaorganisaties. p. 27. https://smit.vub.ac.be/studie-naar-waardepropositie-van-data-delen-in-online-media.
47.
Van BuggenhoutN.Van den BroeckW., & BallonP. (2020). Exploring the Value of Media Users’ Personal Information (PI) Disclosure to Media Companies in Flanders, Belgium. Mediální Studia, 14(1), 75-103.
48.
Van ZeelandI.Van BuggenhoutN., & PiersonJ. (2019). Personal data protection in the media sector: Roundtable report: for Chair ‘Data Protection on the Ground’. Brussels. p. 12. https://www.vub.be/foundation/leerstoel/dataprotection-on-the-ground#publications.
49.
VanhaelewynB., & De MarezL. (2018). Imec Digimeter, 2017. https://www.imec-int.com/nl/digimeter.
50.
VargasJ. C. (2019). Blockchain-based consent manager for GDPR compliance. Open Identity Summit. https://dl.gi.de/handle/20.500.12116/20985.
51.
VialaV. (2018, October 7). Businesses collect more data than they can handle, reveals Gemalto [Press release]. https://www.thalesgroup.com/en/markets/digital-identity-and-security/press-release/businesses-collect-more-data-than-they-can-handle-reveals-gemalto.
WP29 (2018, April 11). Guidelines on transparency under Regulation 2016/679. Article 29 Working Party EU Directive 95/46/EC. https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227.
