ExPD: Semi-automated Web Extraction of Personal Data

Abstract

According to the GDPR, data subjects can issue a Subject Access Request (SAR) to obtain all personal data concerning them from a data controller. Data controllers are interested to automate the handling of SARs, which is challenging for legacy applications and services that lack suitable export functionality. This challenge is addressed by the ExPD prototype, a tool that automates the task of collecting personal data from the pages of web applications. The ExPD operator specifies extraction rules interactively in the browser using a small set of pages. After extraction, a tool-assisted refinement stage allows to fine-tune the exported data. Besides automating the processing of SARs, ExPD may also be useful for citizens who want to obtain an overview of their public data footprint on sites that share user contributions, which is demonstrated in a case study.