Chronicling GDPR Transparency Rights in Practice: The Good, the Bad and the Challenges Ahead

Abstract

Transparency provisions, and the right of access in particular, have been an integral part of data protection law since the seventies but received a much-needed refresh with the General Data Protection Regulation (GDPR). Throughout the past few years, judicial and administrative authorities have clarified the scope and modalities of access, and a number of empirical studies have shed light the right has (not) been complied with in different contexts. So far, that empirical work has remained relatively disparate and hard to compare. This article presents and compares the results of two legal-empirical studies conducted in 2020 and 2022 that were designed to gather quantitative and qualitative findings on how a selection of Online Service Providers (OSPs) have complied with their transparency obligations, and have answered access requests in practice. In doing so, it also provides a comprehensive overview of the most relevant soft law instruments and provides all the supplementary materials necessary to replicate the research in an academic or educational context. These studies show that, while there have been substantial improvements on how OSPs handle access requests ('the good'), fundamental issues remain to be addressed ('the bad'). These include the widespread reliance on boilerplate answers, the routinization of the process, the generic rather than specific nature of the information provided, and the lack of compliance with the default one-month time limit. Addressing these shortcomings, we argue, is critical in ensuring that controllers do not progressively erode the scope of Article 15 GDPR ('the challenges ahead').