# Are We Really Informed on the Rights GDPR Guarantees?

Maria Sideri, Stefanos Gritzalis

► To cite this version:

Maria Sideri, Stefanos Gritzalis. Are We Really Informed on the Rights GDPR Guarantees?. 14th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2020, Mytilene, Lesbos, Greece. pp.315-326, 10.1007/978-3-030-57404-8_24. hal-03657716

HAL Id: hal-03657716

https://inria.hal.science/hal-03657716

Submitted on 3 May 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Are We Really Informed on the Rights GDPR Guarantees?

Maria Sideri¹[0000-0002-0170-8807] and Stefanos Gritzalis²[0000-0002-8037-2191]

¹Privacy Engineering and Social Informatics Laboratory, Department of Cultural Technology and Communication, University of the Aegean, GR 81100, Lesvos, Greece
msid@aegean.gr

² Laboratory of Systems Security, Department of Digital Systems, University of Piraeus, GR 18534, Piraeus, Greece
sgritz@unipi.gr

**Abstract.** Enhancing data subjects’ rights in order to increase control over personal data is doubtless GDPR’s priority. Though, the protection of personal data and human rights does not rely only on the legal framework, but also on data subjects’ knowledge regarding their right to data protection. This paper building upon a research having explored a group of Greek data subjects’ extent of knowledge about the rights GDPR guarantees which revealed that there is not sufficient knowledge for all the rights investigated, aims to explore factors that affect the extent of rights knowledge focusing on information sources and demographic variables. The results show that rights knowledge extent is not that much affected by respondents’ demographic characteristics, while on the contrary the sources of information on GDPR impact more. This generates the need for more awareness programs, national campaigns and educational interventions on GDPR targeted to the public, in order to prevent the emergence of a new form of inequality between data subjects as a result of rights’ knowledge gap.

**Keywords:** General Data Protection Regulation (GDPR), data subjects’ rights awareness, informative sources, demographic characteristics.

## 1 Introduction

In a data-driven economy, personal data are daily collected, processed, interlinked, transmitted and exchanged between different actors, agencies and states worldwide becoming a tradeable asset. Thus a high-risk reality emerges for social subjects and severe threats come up regarding the protection of personal data and human rights.

Despite the several legal documents for personal data protection produced in Europe since 1980s and the implementation of Directive 95/46 in all member-states of European Union (EU), countries differentiated in their legal culture and practice [1-3]. In this frame, the General Data Protection Regulation (GDPR) is expected to further harmonize data protection legislation ensuring a “coherent and uniform application of the rules on the protection of fundamental rights and of the freedoms of natural persons with regard to the processing of personal data” (recital 10) [4]. Without depart-
ing from previously established principles, GDPR aims at enhancing data subjects' rights introducing also new ones in order to increase data subjects' control over their data. Simultaneously, it sets a stricter framework regarding data controllers' and processors' obligations emphasizing on regulatory compliance monitoring measures too.

Although the strengthening of data protection legislation is considered over time very important, data subjects' knowledge about their rights is equally significant, considering that data protection and privacy preservation presuppose individual and collective responsibility, while their infringement seriously affects both persons and societies. In this context, an exploratory research [5] took place in spring 2019 aiming to investigate a group of Greek adult data subjects' knowledge about their rights as set in GDPR. This paper building upon that research aims to explore the impact of information sources (e.g. mass media, Internet) and socio-demographic characteristics on data subjects rights' knowledge. The paper is organized as follows. Section 2 provides a brief overview of the framework and the main findings of the research, while presenting the statement of interest for this paper. Section 3 records the findings regarding the impact of demographic variables and information sources on the extent of rights' knowledge. Section 4 discusses the findings and concludes the paper.

# 2 Research on Data Subjects' Knowledge regarding GDPR Rights

## 2.1 Research Framework

Data subjects often think they can control the data they share, ignoring that these are now possessed and controlled by others [6-7]. Despite concerns increase about data protection, in several cases data subjects do not adopt protective behavior [8]. This situation becomes more complicated when data subjects are unaware of data protection laws and/or believe that others protect their data (e.g. governments or service providers) [9-10, 7]. On the contrary, data subjects' knowledge of technical aspects and data collection practices used by organizations and service providers, knowledge about legislation, legal aspects of data protection and protection policies and strategies can help data subjects to make informed decisions to control their data [11-12].

Data subjects' knowledge about data protection legislation, their rights and the role of public Authorities has been studied before the implementation of GDPR [11, 13-14]. However, to the best of our knowledge there was no relevant research in Greece or EU exploring data subjects' awareness of the rights GDPR guarantees up to the date our research began. Special Eurobarometer 487a is the first official survey published in June 2019 [15] exploring awareness of the rights to access, correct and have personal data deleted, object to receive direct marketing, have a say to automated decisions and data portability right. Our exploratory research, based on Trepte et al. [11] and Park [12] arguments, aimed to investigate a group of Greek data subjects' extent of knowledge regarding their GDPR rights, while also exploring other issues related to data protection. Comparing to Eurobarometer 2019, our research included several items addressing to data subjects' right to be informed and data subjects' con-
sent. The right to information fits in the first stage of processing timeline and it is
linked to consent which is valid only if it is informed [16], while consent is the very
first decision that data subjects make. A four-section questionnaire<fnref n="1" /> was used for the
research carried out from March 18 to April 18, 2019.

## 2.2 Main Findings

In order for the readers to have an overview of the research findings, these are briefly presented below. Out of the 101 people that voluntarily participated in the research, 49 are men and 51 women (one didn't respond). Half of them (49.5%) are 36-45 years old. Among respondents, 36.6% are public sector employees, 31.7% private sector employees, 42.6% hold a master and 38.6% a graduate degree (section D).

Most participants were informed on GDPR by Internet (44.6%), 13.9% by mass media, 16.8% by someone else, while 24.8% stated personal interest/engagement with the topic. Only 5% of the respondents stated that GDPR addresses to “data subjects’ rights strengthening”, while 17.8% selected the “stricter delimitation of data collection and processing procedures” reply (section A).

Participants were asked to self-assess the extent of their knowledge regarding GDPR rights (section B) using a 5-point scale (questions 1-12) and to declare the conditions for exercising the right to be forgotten and the right to data processing restriction having the option of multiple responses (questions 13-14). The results showed that respondents were more aware of the right to be informed about data processing and less of that to be informed about data transmission or data breach. They also knew very well that consent is required for data processing, but were less aware of their ability to withdraw consent. Data portability right knowledge was rather low. Almost 1/5 of the sample didn't know the conditions for exercising the right to be forgotten and 29.7% the conditions for exercise the data processing restriction right.

Although respondents showed high level of concerns and acknowledged risks (security issues and data usage for fraud) when providing personal data, only 6.9% read the whole privacy policy text. Moreover, 24.8% was unsure if providing their consent explicitly, approximately 21% stated not doing this, while 5.9% didn't know if they had information on the conditions for data processing when providing data and 10.9% stated “never”. Participants' views regarding their responsibility, the role of providers, Regulatory Authorities and governments for data protection showed that 61.4% do not agree that governments protect their data, 52.4% do not trust service providers to protect their data and only 26.7% stated aware of data protection legislation to protect themselves (section C).

## 2.3 Exploring Factors that Affect Data Subjects’ Extent of Rights Knowledge.
Statement of Interest

The first results of our research revealed fluctuations regarding data subjects’ extent of knowledge about their rights. In order to detect what affects these fluctuations, this

<footnote n="1">¹https://drive.google.com/file/d/1BXlxqMMxqOUc3gindABJf2cqNYflCY9b/view?usp=sharing</footnote>
paper seeks to identify possible relationships between rights knowledge extent and the demographic characteristics of the sample. Furthermore, assuming that the extent of knowledge may be related to some kind of expertise or the sources of information on GDPR<fnref n="2" />, the relationship between knowledge extent and information sources is also explored. Beyond the differentiations observed between EU countries regarding their legal culture and practice [1-3], differences have been also recorded “in the intensity and scope of information campaigns, media attention, and public debate” regarding data protection [3] (p.234). This argument supports our assumption that information sources may impact on data subjects’ knowledge on GDPR and the rights it sets.

In order to explore the impact of the variables mentioned above on data subjects' extent of knowledge, inferential statistics are employed using SPSS v.21. Transformations in variables values are necessary in order for the statistic tests to be better applied. Firstly, the values of age, educational level and employment are re-codified in order for more coherent clusters within variables considering the small number of respondents in some clusters. Thus, regarding i) “age”, the cluster “18-25 years old” (n=6) is included in the following (26-35), while the cluster “>56 years old” (n=3) in the preceding (46-55), ii) “educational level”, the cluster of those holding a PhD (n=3) is included in that of those holding a M.Sc., iii) “employment”, teachers (n=2) are included in the cluster of public sector employees, freelancers (n=18) in the cluster of private sector employees, while students (n=9) and other (n=3) constitute one cluster. Secondly, in order for all questions in section B to be measured in the same scale, the results of questions 13-14 (nominal scale) are transformed into ordinal scale. Consequently, we assume that those having chosen i) all four replies in B.14 have accomplished a score of 5, ii) three replies a score of 4, iii) two a score of 3 and iv) one a score of 2. In question B.13, a 4-point scale is used. Thus participants who have chosen i) all three replies achieve a score of 4, ii) two a score of 3 and iii) one a score of 2. The “don’t know” answer is equivalent to “not at all” (score 1) for both questions.

## 3 Results

Having reformed the results of questions B.13-14, Table 1 presents data subjects' self-assessment regarding the extent of rights knowledge.

<table><caption>**Table 1.** Data subjects' extent of knowledge per right</caption><thead><tr><th></th><th></th><th>Not at all (1)</th><th>Little (2)</th><th> Moderate (3)</th><th>Well (4)</th><th>Very well (5)</th></tr></thead><tbody><tr><td rowspan="3">Right to be informed</td><td>for data processing and subject's rights (B.1)</td><td>9.9</td><td>10.9</td><td>23.8</td><td>28.7</td><td>25.7</td></tr><tr><td>for data used for profiling and consequences (B.7)</td><td>14.9</td><td>19.8</td><td>19.8</td><td>29.7</td><td>14.9</td></tr><tr><td>for data transmission to third party</td><td>18.8</td><td>19.8</td><td>17.8</td><td>20.8</td><td>21.8</td></tr></tbody></table>

<footnote n="2">² In Eurobarometer 2019 survey [15], participants were asked to declare if they had heard (or not) each of the six rights explored and not to state the information source.</footnote>
<table><tr><td></td><td>(B.8)</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td></td><td>for high-risk personal data breach, consequences, measures taken (B.9)</td><td>18.8</td><td>20.8</td><td>19.8</td><td>18.8</td><td>21.8</td></tr><tr><td rowspan="3">Consent</td><td>required for data use (B.3)</td><td>5.0</td><td>9.9</td><td>9.9</td><td>27.7</td><td>46.5</td></tr><tr><td>form (free, specific...) (B.4)</td><td>7.9</td><td>7.9</td><td>23.8</td><td>36.6</td><td>23.8</td></tr><tr><td>withdraw (B.5)</td><td>18.8</td><td>11.9</td><td>21.8</td><td>17.8</td><td>26.7</td></tr><tr><td></td><td>not required for service usage (unless necessary for service provision) (B.6)</td><td>16.8</td><td>16.8</td><td>28.7</td><td>20.8</td><td>15.8</td></tr><tr><td rowspan="2">Right to oppose</td><td>to data processing (incl. profiling) (B.10)</td><td>13.9</td><td>25.7</td><td>21.8</td><td>23.8</td><td>13.9</td></tr><tr><td>(not to be subjected) to automated decision (B.11)</td><td>17.8</td><td>28.7</td><td>25.7</td><td>15.8</td><td>10.9</td></tr><tr><td colspan="2">Right to data rectification (B.2)</td><td>10.9</td><td>10.9</td><td>30.7</td><td>26.7</td><td>18.8</td></tr><tr><td colspan="2">Right to data portability (B.12)</td><td>29.7</td><td>23.8</td><td>14.9</td><td>22.8</td><td>7.9</td></tr><tr><td colspan="2">Right to be forgotten (B.13)</td><td>22.8</td><td>29.7</td><td>32.7</td><td>14.9</td><td></td></tr><tr><td colspan="2">Right to data processing restriction (B.14)</td><td>29.7</td><td>19.8</td><td>21.8</td><td>18.8</td><td>9.9</td></tr></table>

To identify possible relationship between gender and rights knowledge, Mann-Whitney test was used revealing statistically significant difference (Tables 2 and 3) between men and women regarding the form of consent [U(49,51)=883.00, p=.009] with women having a higher mean (3.88) than men (3.28). The opposite was shown for the right to data processing restriction [U(49,51)=959.00, p=.040] where men had a higher mean (2.91) than women (2.33).

<table><caption>**Table 2.** Gender differences regarding knowledge about the form of consent</caption><thead><tr><td>Gender</td><td>N</td><td>Mean Rank</td><td>Median</td><td>Range</td><td>Mean</td></tr></thead><tbody><tr><td>Man</td><td>49</td><td>43,02</td><td>3,0000</td><td>4,00</td><td>3,2857</td></tr><tr><td>Woman</td><td>51</td><td>57,69</td><td>4,0000</td><td>4,00</td><td>3,8824</td></tr></tbody></table>

<table><caption>**Table 3.** Gender differences regarding knowledge about data processing restriction right</caption><thead><tr><td>Gender</td><td>N</td><td>Mean Rank</td><td>Median</td><td>Range</td><td>Mean</td></tr></thead><tbody><tr><td>Man</td><td>49</td><td>56,43</td><td>3,0000</td><td>4,00</td><td>2,9184</td></tr><tr><td>Woman</td><td>51</td><td>44,80</td><td>2,0000</td><td>4,00</td><td>2,3333</td></tr></tbody></table>

Spearman rho was used to explore the correlation between age and educational level variables with rights knowledge extent. The results showed that age was negatively related at low degree to the extent of knowledge regarding the right to be forgotten (rho= -.269, p=.007), revealing that as age increases the knowledge regarding all or most of the conditions for the exercise of the right decreases. In other words, younger people are more familiar with all the conditions for the exercise of this right. Educational level was shown to be positively related at a low degree also to consent withdraw (rho= .229, p=.023) and the right to data processing restriction (rho=.217, p=.029). Specifically, those holding a M.Sc./Ph.D. have a higher extent of knowledge for these rights. Regarding employment, Kruskal-Wallis test showed that employment affects the extent of knowledge regarding the form of consent only [H(2)=7.071, p=.029] (Table 4).
<table><caption>**Table 4.** Employment differences regarding knowledge about the form of consent</caption><thead><tr><th>Employment</th><th>N</th><th>Mean Rank</th><th>Median</th><th>Range</th><th>Mean</th></tr></thead><tbody><tr><td>Public sector employee/teacher</td><td>39</td><td>53,74</td><td>4,0000</td><td>4,00</td><td>3,6923</td></tr><tr><td>Private sector employee/freelancer</td><td>50</td><td>44,82</td><td>4,0000</td><td>4,00</td><td>3,3800</td></tr><tr><td>Students/other</td><td>12</td><td>67,83</td><td>4,5000</td><td>3,00</td><td>4,2500</td></tr></tbody></table>

Up to this point it can be concluded that demographic variables do not generally affect the extent of knowledge regarding data subjects' rights or their consent. Table 5 presents the results of the impact of information sources on knowledge extent for each right (non-parametric Kruskal-Wallis was used in this case too).

<table><caption>**Table 5.** Effect of information source on the extent of knowledge rights</caption><thead><tr><th rowspan="2">Rights</th><th rowspan="2"></th><th colspan="5">Information sources</th></tr><tr><th>N</th><th>Mean Rank</th><th>Mean</th><th>Median</th><th>Range</th></tr></thead><tbody><tr><td rowspan="4">B.1</td><td rowspan="4">H(3)=10.543, p=.014</td><td>MM<sup>3</sup></td><td>14</td><td>42,18</td><td>3,0714</td><td>3,5000</td><td>4,00</td></tr><tr><td>Int</td><td>45</td><td>54,16</td><td>3,6889</td><td>4,0000</td><td>4,00</td></tr><tr><td>PIn</td><td>25</td><td>59,58</td><td>3,8800</td><td>4,0000</td><td>4,00</td></tr><tr><td>InSb</td><td>16</td><td>33,31</td><td>2,7500</td><td>3,0000</td><td>4,00</td></tr><tr><td rowspan="4">B.7</td><td rowspan="4">H(3)=10.425, p=.015</td><td>MM</td><td>14</td><td>42,11</td><td>2,7143</td><td>2,5000</td><td>4,00</td></tr><tr><td>Int</td><td>44</td><td>51,92</td><td>3,1591</td><td>3,0000</td><td>4,00</td></tr><tr><td>PIn</td><td>25</td><td>62,60</td><td>3,6800</td><td>4,0000</td><td>3,00</td></tr><tr><td>InSb</td><td>17</td><td>35,94</td><td>2,4118</td><td>2,0000</td><td>3,00</td></tr><tr><td>B.8</td><td>H(3)=4.116 ns</td><td colspan="5">No statistically significant differences found</td></tr><tr><td>B.9</td><td>H(3)=7.484 ns</td><td colspan="5">No statistically significant differences found</td></tr><tr><td rowspan="4">B.3</td><td rowspan="4">H(3)=8.206, p=.042</td><td>MM</td><td>14</td><td>41,46</td><td>3,7143</td><td>4,0000</td><td>4,00</td></tr><tr><td>Int</td><td>44</td><td>52,89</td><td>4,1364</td><td>4,5000</td><td>4,00</td></tr><tr><td>PIn</td><td>25</td><td>59,66</td><td>4,4000</td><td>5,0000</td><td>3,00</td></tr><tr><td>InSb</td><td>17</td><td>38,29</td><td>3,4118</td><td>4,0000</td><td>4,00</td></tr><tr><td>B.4</td><td>H(3)=7.083 ns</td><td colspan="5">No statistically significant differences found</td></tr><tr><td>B.5</td><td>H(3)=4.581 ns</td><td colspan="5">No statistically significant differences found</td></tr><tr><td rowspan="4">B.6</td><td rowspan="4">H(3)=16.360, p=.001</td><td>MM</td><td>14</td><td>35,64</td><td>2,3571</td><td>2,5000</td><td>3,00</td></tr><tr><td>Int</td><td>44</td><td>53,40</td><td>3,1591</td><td>3,0000</td><td>4,00</td></tr><tr><td>PIn</td><td>25</td><td>64,82</td><td>3,6800</td><td>4,0000</td><td>4,00</td></tr><tr><td>InSb</td><td>17</td><td>34,18</td><td>2,2353</td><td>2,0000</td><td>4,00</td></tr><tr><td rowspan="4">B.10</td><td rowspan="4">H(3)=8.845, p=.031</td><td>MM</td><td>14</td><td>40,07</td><td>2,5000</td><td>2,5000</td><td>4,00</td></tr><tr><td>Int</td><td>45</td><td>48,54</td><td>2,8889</td><td>3,0000</td><td>4,00</td></tr><tr><td>PIn</td><td>24</td><td>64,58</td><td>3,6250</td><td>4,0000</td><td>3,00</td></tr><tr><td>InSb</td><td>17</td><td>44,38</td><td>2,7059</td><td>3,0000</td><td>4,00</td></tr><tr><td rowspan="4">B.11</td><td rowspan="4">H(3)=10.285, p=.016</td><td>MM</td><td>14</td><td>42,21</td><td>2,3571</td><td>2,0000</td><td>4,00</td></tr><tr><td>Int</td><td>45</td><td>49,07</td><td>2,6667</td><td>2,0000</td><td>4,00</td></tr><tr><td>PIn</td><td>24</td><td>65,38</td><td>3,4167</td><td>3,5000</td><td>4,00</td></tr><tr><td>InSb</td><td>17</td><td>40,12</td><td>2,2353</td><td>2,0000</td><td>3,00</td></tr><tr><td>B.2</td><td>H(3)=16.075, p=.001</td><td>MM</td><td>14</td><td>32,93</td><td>2,5000</td><td>3,0000</td><td>4,00</td></tr></tbody></table>

<footnote n="3">³ MM (Mass Media), Int (Internet), Pin (Personal Interest), InSb (Informed by Somebody)</footnote>
<table><tr><td></td><td></td><td>Int</td><td>44</td><td>52,41</td><td>3,4545</td><td>3,0000</td><td>4,00</td></tr><tr><td></td><td></td><td>PIn</td><td>25</td><td>64,20</td><td>3,9200</td><td>4,0000</td><td>4,00</td></tr><tr><td></td><td></td><td>InSb</td><td>16</td><td>36,13</td><td>2,7500</td><td>3,0000</td><td>4,00</td></tr><tr><td rowspan="4">B.12</td><td rowspan="4">H(3)=11.156, p=.011</td><td>MM</td><td>13</td><td>37,19</td><td>1,9231</td><td>2,0000</td><td>4,00</td></tr><tr><td>Int</td><td>45</td><td>49,70</td><td>2,5111</td><td>2,0000</td><td>4,00</td></tr><tr><td>PIn</td><td>25</td><td>64,90</td><td>3,2400</td><td>3,0000</td><td>4,00</td></tr><tr><td>InSb</td><td>17</td><td>41,62</td><td>2,1176</td><td>2,0000</td><td>3,00</td></tr><tr><td rowspan="4">B.13</td><td rowspan="4">H(3)=11.312, p=.010</td><td>MM</td><td>14</td><td>36,50</td><td>1,8571</td><td>1,5000</td><td>2,00</td></tr><tr><td>Int</td><td>45</td><td>50,34</td><td>2,3778</td><td>2,0000</td><td>3,00</td></tr><tr><td>PInt</td><td>25</td><td>65,28</td><td>2,9200</td><td>3,0000</td><td>3,00</td></tr><tr><td>InSb</td><td>17</td><td>43,68</td><td>2,1176</td><td>2,0000</td><td>2,00</td></tr><tr><td rowspan="4">B.14</td><td rowspan="4">H(3)=12.698, p=.005</td><td>MM</td><td>14</td><td>43,82</td><td>2,2857</td><td>2,0000</td><td>4,00</td></tr><tr><td>Int</td><td>45</td><td>54,73</td><td>2,7556</td><td>3,0000</td><td>4,00</td></tr><tr><td>PInt</td><td>25</td><td>61,38</td><td>3,1200</td><td>3,0000</td><td>4,00</td></tr><tr><td>InSb</td><td>17</td><td>31,76</td><td>1,7059</td><td>1,0000</td><td>3,00</td></tr></table>

According to Table 5, those personally interested or engaged with GDPR showed unsurprisingly higher extent of knowledge regarding their rights, followed in all cases by those informed by Internet. The ones informed by mass media are in the 3rd mean rank with the exception of B.10 (right to object to data processing), B.2 (right to data rectification), B.12 (right to data portability) and B.13 (right to have data deleted) where those informed by someone else precede. No statistically significant relationships were shown in the cases of consent form (B.4), consent withdraw (B.5), right to be informed for data transmission to third party (B.8) and for high-risk personal data breach (B.9). It can be thus concluded that those informed by mass media or someone else lag regarding the extent of rights knowledge.

Considering that a) mass media as an information source were stated more by women (71.4%), more by those aged 36-45 years old (71.4%), equally by university graduates and M.Sc/Ph.D. (42.9% each) and more by private sector employees and freelancers (50%) and b) information by someone else was stated more by women (58.8%), more by those over 46 years old (41.2%), equally by primary/secondary education graduates and M.Sc/Ph.D. graduates (35.3% each) and equally by public and private sector employees (41.2% each), a generalized need is recorded for more targeted and systematic information in order for data subjects to have better insight to the provisions of GDPR and their rights and be able to make informed decisions to protect their data.

## 4 Discussion and Conclusions

The results above reveal that the source of information on GDPR is related to rights knowledge supporting thus that some kind of expertise or acquaintance with GDPR contributes positively to rights knowledge extent. Consequently, those informed on GDPR due to personal interest were better informed than others. This is valid also for those informed by Internet though in lower degree and it can be explained considering that they had probably read websites information regarding the new GDPR compliance policy. Obviously there are other factors that contribute to the extent of rights
knowledge. For example, educational level had a positive effect on knowledge regard-
ing both consent withdraw and data processing restriction right, while age was nega-
tively related to knowledge extent regarding the right to be forgotten.

Evaluating the results regarding the extent of data subjects’ rights knowledge (Ta-
ble 1) it is clear that awareness increase is required for several rights in order for data
subjects to make informed decisions to optimize control over their data and ultimately
to be protected. For instance, half of the respondents have little or no knowledge at all
regarding the rights to data portability, to have their data deleted or to data processing
restriction. These control rights are very important. Data portability right constitutes a
first step towards "preselected ownership" of personal data [17], while the right to
have data deleted effectively eliminates the possibility of uncontrolled digital repro-
duction of personal data [16]. Data processing restriction right is also of significance
especially in cases when the right to be forgotten can’t be applied for legal reasons.
Even in the cases where data subjects showed high extent of knowledge (e.g. for the
form of consent) differentiations were recorded that need to be eliminated.

Since GDPR implementation, emphasis has been given to organizations to become
GDPR compliant. In this frame, data protection awareness training programs are ad-
dressed to their staff [18]. But what about data subjects awareness increase?

In Greece, the Hellenic Data Protection Authority provides in its website<fnref n="4" /> useful
information on data protection legislation, including specific information about data
subjects’ GDPR rights both in textual and audiovisual form and guidelines on submit-
ting complaints. Moreover, the European Data Protection Board<fnref n="5" /> website has useful
content for data subjects’ rights, while there are also other websites with relevant
information (e.g. European Commission). So theoretically, data subjects have a range
of sources to be informed on their rights. Considering, though, that some individuals
may not be able to find this information or ignore it exists, national information cam-
paigns and information via mass media are very important. To the best of our
knowledge, there was no national information campaign on GDPR in Greece previ-
ously to its implementation. Regarding information on GDPR via mass media and
specifically newspapers, during the period from March 2018 to March 2019, approx-
imately 20 articles referring to GDPR were published to seven newspapers with high
circulation at national level. Only four articles refer exclusively to data subjects’
rights, while the rest focus on the obligations of data controllers, organizations’ nec-
essary changes to their processing activities, country’s readiness to implement GDPR
or fines imposed (e.g. Google). This reveals that national media paid less attention to
data subjects’ rights which obviously impacts on information availability.

Considering that digital literacy is a basic life-skill, measures that “directly aim to
strengthen users’ awareness about the extent of their knowledge” should be taken [19]
(p. 218). In this frame, public informational campaigns have been shown to improve
users’ knowledge and to provide skills to combat cyber threats [20], while educational
programs and interventions involving knowledge about data collection and processing
procedures, data usage and data accessibility by others are also crucial [21]. These

<footnote n="4">⁴ http://www.dpa.gr/</footnote>

<footnote n="5">⁵ https://edpb.europa.eu/</footnote>
awareness measures should obviously include information regarding current legisla-
tion [22] in an understandable way using, for instance, examples and icons for the
rights GDPR guarantees as well as instructions for the exercise of these rights.

Although the results of this research can't be generalized due to the small sample
and the sampling method, they reveal the need for a more thorough investigation of
data subjects' awareness regarding each right GDPR guarantees and the factors affect-
ing awareness, considering that "just because respondents in a country have a high
level of awareness of GDPR and what it is does, it does not automatically follow they
have heard of all the rights GDPR guarantees" [15] (p. 27). Researches should not
focus only on demographic characteristics (e.g. gender, education, employment) but
also explore how information provision by governmental agencies, Data Protection
Authorities, mass media and social media, as well as data subjects' access to infor-
mation sources, social inequalities or digital illiteracy impact on the extent of rights'
knowledge. In this frame, researches in EU member states such as Netherlands, Swe-
den, Bulgaria and Malta, which were shown to have different level of awareness for
the rights explored [15] would be helpful for decision makers to take the appropriate
actions in order to increase European citizens awareness on the rights GDPR sets.

GDPR aims to empower individuals in order to have more control over personal
data and its implementation involves equally people, organizations and processes. The
actual protection of personal data and data subjects' freedoms doesn't depend only on
the legal framework, the procedures it sets and the organizations that have the obliga-
tion to become GDPR compliant and protect personal data, but also on data subjects'
rights knowledge highlighting thus the individual responsibility for personal data
protection. In this frame, data subjects need to be better informed, to become more
aware of their rights and understand them fully. If this doesn't happen, it is rather
probable that Custers et al. [3] forecast that -despite GDPR's aim to harmonize law
and practice- differences may continue to exist between EU countries, will be verified
on an individual (data subjects) level, as some will know and exert their rights to data
protection and others not, leading thus to a reality of data protection rights inequality
between EU citizens.

References

1. Mitrou, L.: Law in the Information Society. Sakkoulas Publ., Athens (2002) (in Greek).

2. Sobolewski, M., Mazur, J., Paliński, M.: GDPR: A Step Towards a User-centric Internet?. *Intereconomics* 4, 207-213 (2017).

3. Custers, B., Dechesne, F., Sears, A. M., Tani, T., van der Hof, S.: A comparison of data protection legislation and policies across the EU. Computer Law and Security Review 34(2), 234–243 (2018).

4. European Council: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2016).

5. Sideri, M., Fontaras, A. & Gritzalis, S.: What Do We Know about our Rights to Data Pro-tection? A Greek Case Study. In: Katsikas, S., Zorkadis, V., (eds). Proceedings of the 8th
International Conference on e-Democracy: Safeguarding Democracy and Human Rights in the Digital Age, CCIS 1111, pp. 18-33. Springer Nature, Switzerland (2020).

6. Conger, S., Pratt, J.H., Loch, K.D.: Personal information privacy and emerging technologies. Information Systems Journal 23(5), 401–417 (2013).

7. Mantelero, A.: The future of consumer data protection in the EU Re-thinking the “notice and consent” paradigm in the new era of predictive analytics. Computer Law and Security Review 30(6), 643–660 (2014)

8. Baek, Y.M.: Solving the privacy paradox: a counter-argument experimental approach. Computers on Human Behavior 38, 33–42 (2014)

9. Surveillance Project: The Globalization of Personal Data Project: An International Survey on Privacy and Surveillance, Summary of Findings. Queen's University, Kingston (2008). https://qspace.library.queensu.ca/bitstream/handle/1974/7660/2008_Surveillance Project International_Survey Findings Summary.pdf?sequence=1&isAllowed=y last accessed 2020/4/21

10. Kelley, P.G., Cranor, L.F., Sadeh, N.: Privacy as part of the app decision-making process. In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 3393–3402. ACM, Paris (2013)

11. Trepte, S., Teutsch, D., Masur, P.K., Eicher, C., Fischer, M., Hennhöfer, A., Lind, F.: Do people know about privacy and data protection strategies? Towards the “online privacy literacy scale” (OPLIS). In: Gutwirth, S., Leenes, R., de Hert, P. (eds.) Reforming European Data Protection Law. LGTS, vol. 20, pp. 333–365. Springer, Dordrecht (2015).

12. Park, Y.J.: Digital literacy and privacy behavior online. Communication Research 40(2), 215–236 (2011)

13. Miltgen, C.L., Peyrat-Guillard, D.: Cultural and generational influences on privacy concerns: a qualitative study in seven European countries. European Journal of Information Systems 23, 103–125 (2014).

14. European Commission: Special Eurobarometer 431. Data Protection Report (2015). http://ec.europa.eu/commfrontoffice/publicopinion/archives/ebs/ebs_431_en.pdf, last accessed 2020/4/25

15. European Commission: Special Eurobarometer 487a. The GDPR. Report (2019). https://www.privacy-web.nl/cms/files/2019-06/ebs487a-en.pdf, last accessed 2020/4/25

16. van Ooijen, I., Vrabec, H.U.: Does the GDPR enhance consumers’ control over personal data? An analysis from a behavioral perspective. Journal of Consumer Policy 42, 91–107 (2019).

17. De Hert, P., Papakonstantinou, V., Malgieri, G., Beslay, L., Sanchez, I.: The right to data portability in the GDPR: towards user-centric interoperability of digital services. Computer Law and Security Review 34(2), 193–203 (2018).

18. Perry, R.: GDPR-project or permanent reality? Computer Fraud & Security 1, 9-11 (2019).

19. Moll, R., Pieschl, St., Bromme, R.: Competent or clueless? Users’ knowledge and misconceptions about their online privacy management. Computers on Human Behavior 41, 212–219 (2014).

20. Marcolin, B.L., Compeau, D.R., Munro, M.C., Huff, S.L.: Assessing user competence: conceptualization and measurement. Information Systems Research 11(1), 37-60 (2000).

21. Lawler, J.P., Molluzzo, J.C.: A study of the perceptions of students on privacy and security on social networking sites (SNS), on the internet. Journal of Information Systems Applied Research 3(12), 3-18 (2010).

22. Sideri, M., Kitsiou, A., Tzortzaki, E., Kalloniatis, C., Gritzalis, S.: Enhancing University students' privacy literacy through an educational intervention. A Greek case-study. International Journal of Electronic Governance 11 (3/4), 333-360 (2019).