Active data protection with data journals

Abstract

A major privacy problem on the internet is the unrestricted sharing of user data between services and other parties. The EU privacy legislation grants the user the rights to restrict the dissemination of his personal data, but users often simply do not know which kind of data was collected by these services. In this paper we propose data journals as a new kind of privacy enhancement technology to increase the user's ability to take advantage of his rights. A data journal is a tool that records the disclosure of personal data to services and collects related information about the service provider's identity and its privacy policy. We describe how data journals work, how the user can benefit from their usage, and their relation to other privacy enhancement technologies. Two prototype implementations show that data journals can be implemented on without changes to existing services or big changes of the user's browsing experience.