# Accessibility Statements and Data Protection Notices: What Can Data Protection Law Learn from the Concept of Accessibility?

Olga Gkotsopoulou

► To cite this version:

Olga Gkotsopoulou. Accessibility Statements and Data Protection Notices: What Can Data Protection Law Learn from the Concept of Accessibility?. 17th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2022, Virtual, Germany. pp.184-197, 10.1007/978-3-031-31971-6_14. hal-05315943

HAL Id: hal-05315943

https://inria.hal.science/hal-05315943v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Accessibility Statements and Data Protection Notices: What Can Data Protection Law Learn from the Concept of Accessibility?

Olga Gkotsopoulou(✉)

Vrije Universiteit Brussel, Pleinlaan 2, 1050 Brussels, Belgium

olga.gkotsopoulou@vub.be

**Abstract.** Terms and conditions, legal notices, banners and disclaimers are not new for websites, applications and products. However, with the ambitious legislative plan in the European Union to introduce accessibility features to several websites, applications, services and products, it becomes imperative to also consider the accessibility of the information included in such statements. In my paper, I specifically investigate data protection notices as opposed to accessibility statements and aim to answer whether the concept of accessibility can help us redefine the principle of transparency in EU data protection law. I conclude that accessibility can benefit the principle of transparency, by contextualizing it. However, at the same time it introduces a number of new challenges.

**Keywords:** Accessibility · Data Protection Law · Transparency · Data Subject Rights

## 1 Introduction

Terms and conditions, legal notices, banners and disclaimers are not new for websites, applications and products. They serve diverse functions and fulfil different legal obligations. The last two decades, worldwide we observe a rise in the use of such statements given the increase in regulation and enhanced requirements for transparency and user or consumer protection, especially in the European Union (EU) [1]. Often those statements are regarded by their drafters as disclaimers aiming to guard the concerned entities from liability (by lawyers for lawyers) [2], rather than serving an informative purpose (“a public announcement of internal practices”) to the public, to the interested users and stakeholders, for the latter to be enabled to make informed choices [3, 4] or to even start a compliance investigation, if needed. In this regard, they have often been criticized for being opaque, lengthy and difficult to read, hard to locate or incomplete [3, 4, 5].

One case where such statements are used, is in the context of personal data protection law – specifically we look at the EU. The principle of transparency, as enshrined in Article 5(1)(a) of the General Data Protection Regulation (GDPR) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC), calls (a) for internal transparency with the obligation to keep a record of processing activities and (b) for external transparency with the disclosure of certain information to the data subject regarding processing operations of personal data [6]. It requires for a minimum set of information to be provided in an easily accessible form and in clear, plain and age-appropriate language. One aspect of this transparency obligation is often understood by data controllers and national supervisory authorities as the provision of a public statement in the form of a data protection notice [7]. The interpretation of the obligation for transparency, however, has been a debatable concept, including voices that the transparency and choice model has substantially failed and other approaches are needed [8].

Several sets of guidelines have been issued by numerous researchers and stakeholders as to what it entails in practice and how those notices should be designed, drafted and communicated, for instance with the help of Transparency Enhancing Tools [9] or icon sets [10]. For example, Liepina et al. [11] have analysed the language of data protection notices in order to investigate their intelligibility, looking whether the information provided was comprehensible, substantive compliance was achieved and the expression was clear. Further research has been conducted by Rossi & Palmirani with respect to the potential of visualisation tools, icons and infographics as alternative means to ‘small print’ [10]. Schaub et al. [3] introduced the four-tier privacy notice design space, looking into timing, channel, modality and control.

Many issues remain unclear and contentious though, despite suggestions for effective notice design. Such issues include but are not limited to the inability of the European legislator to enforce evidence-based effective information communication [1], allowing the current situation to lead for instance to ‘notice fatigue’ [3] or the prevalence of ‘dark patterns’ [6].

Another context where statements are used is that of accessibility. The EU Web Accessibility Directive (WAD) (Directive (EU) 2016/2102 of the European Parliament and of the Council of 26 October 2016 on the accessibility of the websites and mobile applications of public sector bodies) - transposed in all the national jurisdictions of the Member States - requires public bodies to draft and make available accessibility statements on their websites and mobile applications. Another form of accessibility statement, even though not explicitly named as such is also foreseen in the European Accessibility Act (EAA) (Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services).

Despite the varying definitions of accessibility given that accessibility can mean many different things to many different people, in this particular context, according to Recital 2 WAD, accessibility should be understood as a set of “principles and techniques to be observed when designing, constructing, maintaining, and updating websites and mobile applications in order to make them more accessible to users, in particular persons with disabilities”.

Like data protection notices, accessibility statements can vary in form and content, but they are expected to provide a mandatory minimum set of information. Again, in line with Article 7 WAD, this statement must include the specification of the applicable legislation and the clear indication of the website/application that the statement refers to, the compliance status thereof and a report about non-accessible content on the website
or the application. Moreover, it must provide information as to how the statement was prepared (methods used), contact information for feedback and complaints, as well as information about the enforcement status. The accessibility statement is in principle anticipated to be also accessible.

In my paper, I raise the following question: Can the concept of accessibility help us improve the way data protection information and communications are provided? Can accessibility ultimately help us further define transparency? I decipher the purpose (and need) of such statements and notices providing the historical overview of those practices and their societal and legal justification. I argue that the concept of accessibility and of accessibility statements can be used to further explain the principle of transparency in the context of data protection law in four ways: linguistically, procedurally, technically and finally, substantively.

Chapter 2 specifically deals with the topic of information provision in the context of EU accessibility, whereas Chapter 3 demonstrates whether (and how) accessibility is relevant for data protection law, bringing forward ways to bridge the concept of accessibility with the principle of transparency in this particular context. Chapter 4 finally provides a brief overview of benefits and challenges for accessibility in transparency, and Chapter 5 concludes with some final thoughts.

# 2 Information and Communication Provision in the Context of Accessibility

## 2.1 Accessibility in the EU

Around 100 million persons in EU (1 out of 5) live with some form and degree of disability [12]. At the same time, the population is increasingly aging, with nearly 50% of persons with a disability being over 65 years old [12]. The EU acknowledging this situation, introduced its intention for a flagship initiative in the field in 2022, named *AccessibleEU*, a cooperation platform for the exchange of knowledge and good practice among accessibility experts across the EU Member States [12].

Accessibility, however, does not constitute a new concept *per se*. Discussions around accessibility coincide with the appearance and establishment of the civil rights movement and the disability rights movement in the 60s and 70s [13]. The discussion back then was primarily focused on the removal of physical barriers and soon also developed to embrace the removal of information and communication barriers [13]. With the ascend of the internet worldwide in 1996, the Web Accessibility Initiative was established within the auspices of the World Wide Web Consortium (W3C). The members of the initiative issued in 1999 the Web Content Accessibility Guidelines (WCAG) Version 1.0 to ensure that accessibility features are embedded on websites, allowing equal participation.

In 2006, the United Nations Convention on the Rights of Persons with Disabilities (UNCRPD) was adopted and the EU acceded to it in 2010. The EC Communication 'European Disability Strategy 2010–2020: A Renewed Commitment to a Barrier-Free Europe' was released shortly after and in 2012 it was followed by the Eurobarometer on Accessibility. In 2016, the Web Accessibility Directive (WAD), with 2 years of transposition time, was adopted. The main aim of this Directive was that, by June 2021,
the websites and mobile applications of all public sector bodies are accessible to persons with disabilities and that they additionally include an accessibility statement. In 2019, the European Accessibility Act (EAA), with 3 years of transposition time, was adopted. The ambition of the latter is that by 2030 key services, products and tools to become fully accessible. Accessibility requirements can be found in other legal instruments as well, such as the European Electronic Communications Code, the Audiovisual Media Services Directive and the copyright legislation adopted under the Marrakesh Treaty.

## 2.2 What is Accessibility?

Article 9 of the UNCRPD provides a definition of accessibility: “[t]o enable persons with disabilities to live independently and participate fully in all aspects of life, States Parties shall take appropriate measures to ensure to persons with disabilities access, on an equal basis with others, to the physical environment, to transportation, to information and communications, [...]”.

The two EU Directives also provide definitions. According to Recital 2 of the WAD: “[...] accessibility should be understood as principles and techniques to be observed when designing, constructing, maintaining, and updating websites and mobile applications in order to make them more accessible to users, in particular persons with disabilities.” Moreover, according to Article 1 (2) of the Directive, the requirement for accessibility should be implemented “[...] independently of the device used for access thereto [...]”.

According to the Recital 50 of the EAA: “Accessibility should be achieved by the systematic removal and prevention of barriers, preferably through a universal design or ‘design for all’ approach, which contributes to ensuring access for persons with disabilities on an equal basis with others. According to the UNCRPD, that approach ‘means the design of products, environments, programmes and services to be usable by all people, to the greatest extent possible, without the need for adaptation or specialized design’. In line with the UNCRPD, ‘universal design’ shall not exclude assistive devices for particular groups of persons with disabilities where this is needed [...]”.

Reading jointly the above definitions leads us to some initial observations. First, accessibility is often perceived as an umbrella concept. It can be used together or interchangeably with other terms, such as usability, barrier-free, universality, inclusion or inclusiveness, adaptation, integration, reasonable accommodation and so forth. Even though those terms can be related, most of them have received distinct definitions. For example, barrier-free refers to the removal of barriers (physical or otherwise) whereas according to the Digital Accessibility Glossary by the Harvard University, usability “[r]efers to how easily, effectively, and efficiently people, including people with disabilities, can use a product or system to achieve their goals, and how satisfied they are with the experience.”[14] Universality or universal design is defined in Article 2 of the UNCRPD, as seen above and the definition is also adopted by the 2019 United Nations Disability Inclusion Strategy [15]. In Annex I of the latter report as well as in the World Health Organization policy on disability [16], (disability) inclusion is defined as “the meaningful participation of persons with disabilities in all their diversity, the promotion of their rights and the consideration of disability-related perspectives [...]” [15]. Reasonable accommodation is defined in Article 2 of the UNCRPD, as “[n]ecessary
and appropriate modification and adjustments not imposing a disproportionate or undue burden, where needed in a particular case, [...]". Integration and adaptation appear to be older terms, which nowadays are usually replaced by inclusion and accessibility. The Council of Europe for instance used integration for its report 'Rehabilitation and integration of people with disabilities: policy and legislation', which was first published in 1973 and kept the term in the subsequent editions until 2003.

Second, accessibility is a by-default intersectoral notion, as it interferes with many different sectors – if not all sectors -, in order for persons to be provided with equal opportunities and to ensure non-discrimination. This by-default intersectionality of accessibility creates challenges. For instance, when we look into law and accessibility, Rink has characterised the grouping of legal communication and accessibility as ‘oxymoron’, in other words an ‘implicit contradiction’ [17]. Legal communication depends on a common ground between experts [18]. However, legal communication may also refer to a direct expert-lay person communication. In that case, the common ground required for successful communication between the expert and the lay person is reduced and it becomes even further reduced in the context of the communication between an expert and a lay person with a communication impairment [18]. The result is texts which are inappropriate for the intended audience, creating a “strong asymmetry in the communication process”, even though the law requires that all parties stand an equal footing with respect to this information [18].

A third observation is that, technical or design accessibility of services and products cannot be complete without accessible information about those respective services and products. This information can be among others about safe use, personal data processing or the accessibility of the service or product itself.

## 2.3 Accessibility Statements

Accessibility statements were introduced with the WAD. All EU Member States appear to have transposed the Directive, whereas some of them already had relevant existing legislation (i.e. Czech Rep, Germany, Lithuania, Hungary, Austria, Portugal, Slovakia). According to Article 7 WAD:

1. "Member States shall ensure that public sector bodies provide and regularly update a detailed, comprehensive and clear accessibility statement on the compliance of their websites and mobile applications with this Directive.

2. For websites, the accessibility statement shall be provided in an accessible format, using the model accessibility statement referred to in paragraph 2, and shall be published on the relevant website."

Accessibility statements must be made available using existing or future technologies (Recital 46 WAD). In line with the above and the Commission Implementing Decision 2018/1523, the accessibility statement must include mandatory information on the following matters:

* Specification of the applicable legislation and concerned website/application

* Compliance status
* Non-accessible content on the website

- Is this lack of accessible content non-compliant?

- Is the lack of accessible content due to disproportionate burden

- Is the lack of accessible content because the content in question is outside the scope of the Directive?

* Preparation of the document (method used to prepare the statement)

* Feedback and contact information

* Enforcement

In the European Accessibility Act on the other hand, there is no direct obligation for an accessibility statement. However, Article 13 (2) of the EAA provides for a similar information obligation for service providers. Accordingly: "Service providers shall prepare the necessary information in accordance with Annex V and shall explain how the services meet the applicable accessibility requirements. The information shall be made available to the public in written and oral format, including in a manner which is accessible to persons with disabilities. Service providers shall keep that information for as long as the service is in operation." In the Table below, I compare the characteristics of the two types of statements.

<table><caption>**Table 1.** Comparison of requirements for accessibility statements in WAD and EAA</caption><thead><tr><th>WAD</th><th>EAA</th></tr></thead><tbody><tr><td><ul><li>Obligation of public bodies</li><li>Provision of a detailed, comprehensive and clear accessibility statement on compliance</li><li>In accessible format</li><li>On the website or when downloading the app</li><li>Mandatory elements:<ul><li>Specification of the applicable legislation and concerned website/application</li><li>Compliance status</li><li>Non-accessible content on the website: non-compliant, disproportionate burden or outside the scope</li><li>Preparation of the document (method used to prepare the statement)</li><li>Feedback and contact information</li><li>Enforcement</li></ul></li></ul></td><td><ul><li>Obligation of all service providers</li><li>Provision of the necessary information and explain how the services meet the applicable accessibility requirements</li><li>In accessible format; in public and in written; for as long as the service is in operation</li><li>In the general terms and conditions, or equivalent document</li></ul></td></tr><tr><td><ul><li>Mandatory elements:<ul><li>Consumer information requirements of Directive 2011/83/EU</li><li>A general description of the service in accessible formats</li><li>Descriptions and explanations necessary for the understanding of the operation of the service</li><li>A description of how the relevant accessibility requirements are met by the service</li></ul></li></ul></td><td><ul><li>Mandatory elements:<ul><li>Consumer information requirements of Directive 2011/83/EU</li><li>A general description of the service in accessible formats</li><li>Descriptions and explanations necessary for the understanding of the operation of the service</li><li>A description of how the relevant accessibility requirements are met by the service</li></ul></li></ul></td></tr></tbody></table>
# 3 Accessibility in Transparency in Data Protection Law

## 3.1 Information and Communication Transparency in Data Protection Law

The principle of information and communication transparency is key in the EU data protection law and specifically in the General Data Protection Regulation (GDPR). According to the Article 29 Working Party Guidelines on transparency under Regulation 2016/679, “transparency is a long-established feature of the law of the EU. It is about engendering trust in the processes which affect the citizen by enabling them to understand, and if necessary, challenge those processes. It is also an expression of the principle of fairness [...]” [7] And it adds: “[t]he concept of transparency in the GDPR is user-centric rather than legalistic.” [7] This means that “the quality, accessibility [emphasis by the author] and comprehensibility of the information is as important as the actual content of the transparency information” [7].

The transparency requirements are to be found in Articles 12 - 14 of the GDPR and apply irrespectively of the legal basis for processing. A popular way for providing information is through data protection notices on websites, applications and devices. Those notices include mainly information as described in Articles 13 and 14 depending on whether the personal data have been obtained or not from the data subject.

## 3.2 Is Accessibility Relevant for Data Protection Law?

Further I examine whether the concept of accessibility is present in the text of the data protection law. Accessibility according to the Oxford Learners' Dictionary is to be understood as: *how easy something is to reach, enter, use, see, etc. / how easy something is to reach, enter, use, etc. for somebody with a disability / how easy something is to understand*. The term ‘accessibility’ and the term ‘accessible’ in the GDPR appear in different articles and recitals as seen in the table below. In this table, the meaning of the terms has been interpreted to figure relevance and non-relevance, when the term signifies a different concept than the investigated one in the present paper, based on the above definitions. Specifically, by relevance, what is meant here is whether the terms that appear in the GDPR text are used within the meaning of *how easy something is to reach, enter, use, see, etc.* or they additionally leave space for interpretation in relation to information and communication accessibility. As seen in the table below, not all terms leave space for further interpretation in that latter context. The majority of the relevant terms as they appear in the text however could be argued to present a high relevance, whereas only one could be argued to have only low relevance.

<table><caption>**Table 2.** The term ‘accessibility’ in the GDPR</caption><thead><tr><td>Accessibility</td><td>Level of Relevance</td></tr></thead><tbody><tr><td>Recital 23 GDPR – mere accessibility of website/contact details</td><td>Non-relevance</td></tr><tr><td>Article 25(2) GDPR – accessibility of personal data</td><td>Non-relevance</td></tr></tbody></table>
<table><caption>**Table 3.** The term ‘accessible’ in the GDPR</caption><thead><tr><td>Accessible</td><td>Level of Relevance</td></tr></thead><tbody><tr><td>Recital 39 GDPR: any information and communication be easily accessible</td><td>Relevance (High)</td></tr><tr><td>Recital 42 GDPR: declaration of consent in easily accessible form</td><td>Relevance (High)</td></tr><tr><td>Recital 49 GDPR: services offered or accessible</td><td>Non-relevance</td></tr><tr><td>Recital 58 GDPR GDPR: any information addressed to the public or to the data subject be easily accessible</td><td>Relevance (High)</td></tr><tr><td>Recital 91 GDPR: monitoring publicly accessible areas</td><td>Non-relevance</td></tr><tr><td>Recital 154 GDPR: parts of documents accessible</td><td>Non-relevance</td></tr><tr><td>Article 4(6) GDPR: personal data which are accessible</td><td>Non-relevance</td></tr><tr><td>Article 7(2) GDPR: conditions for consent - easily accessible form</td><td>Relevance (High)</td></tr><tr><td>Article 12(1) GDPR: any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 in easily accessible form</td><td>Relevance (High)</td></tr><tr><td>Article 14(2)(f) GDPR: publicly accessible sources</td><td>Non-relevance</td></tr><tr><td>Article 25(2) GDPR: personal data made accessible</td><td>Non-relevance</td></tr><tr><td>Article 35(2)(c) GDPR: monitoring of a publicly accessible area</td><td>Non-relevance</td></tr><tr><td>Article 37(2) GDPR: a data protection officer is easily accessible</td><td>Non-relevance</td></tr><tr><td>Article 43(6) GDPR: certification requirements and mechanisms in easily accessible form</td><td>Relevance (Low)</td></tr><tr><td>Article 70(1)(y) GDPR: a publicly accessible electronic register of decisions</td><td>Non-relevance</td></tr></tbody></table>

Recitals 39 and 58 as well as Article 12(1) GDPR are of particularly high relevance for the present paper. Recital 58 GDPR specifically states: “The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. [...] Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.”

Recital 39 GDPR also states that “[t]he principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used.” Article 12(1) GDPR further provides that “any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a
child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.”

From the text above, it is noteworthy that the concept of accessibility goes beyond the reference to the term ‘accessible’. Indeed, information and communication accessibility may also be present in the terms ‘concise’, ‘easy-to-understand’, ‘clear language’, ‘plain language’, ‘visualisation’, and so forth. All these terms interpreted under the light of the accessibility concept can take very specific meanings and become less vague and ambiguous. In other words, the concept of accessibility shows potential to help contextualise transparency under data protection law [19]. Further discussion and analysis on that is included in another forthcoming paper.

## 3.3 Is Accessibility Relevant for Transparency?

Consequently, the three sub-questions that arise next are to which extent accessibility is relevant for the principle of transparency:

- When is accessibility in transparency relevant?

- For what is accessibility in transparency relevant?

- For whom is accessibility in transparency relevant?

As for the first question, accessibility in transparency is relevant for information and communications. As seen earlier, Articles 13 and 14 cover the concept of information whereas Articles 15 to 22 and 34 the concept of communications. As to the second question, one could claim that accessibility is relevant as long as transparency itself is relevant. The A29WP confirms that transparency applies at the following stages of the data processing cycle:

- “before or at the start of the data processing cycle, i.e. when the personal data is being collected either from the data subject or otherwise obtained;

- throughout the whole processing period, i.e. when communicating with data subjects about their rights; and

- at specific points while processing is ongoing, for example when data breaches occur or in the case of material changes to the processing” [7]

Particularly, the first stage raises concerns. ‘Before the data processing cycle’ could also cover cases where an interested individual (not a data subject) is concerned. For instance, when an individual wishes to inform themselves before subscribing to a service or download an app (prospective transparency [20]). However, a recent decision from the Belgian data protection authority suggests that if one is not a data subject, does not have a direct interest to complain about the intelligibility of a data protection notice [21]. This decision seems to an extent in line with Recital 39 GDPR, “[i]t should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed.” However, it appears to disregard the possibility that a person may be discouraged of using
a service if they are not able to access the data protection notice or fully understand it before they contractually adhere to the service.

Concerning the third question, A29WP argues that: "[..] an accountable data controller will have knowledge about the people they collect information about and it can use this knowledge to determine what that audience would likely understand. For example, a controller collecting the personal data of working professionals can assume its audience has a higher level of understanding than a controller that obtains the personal data of children. If controllers are uncertain about the level of intelligibility and transparency of the information and effectiveness of user interfaces/ notices/ policies etc., they can test these, for example, through mechanisms such as user panels, readability testing, formal and informal interactions and dialogue with industry groups, consumer advocacy groups and regulatory bodies, where appropriate, amongst other things." [2] It also states that: [t]he requirement that information is "intelligible" means that it should be understood by an average member of the intended audience." [7].

The accessibility directives and the respective transposed law broaden by default the scope of the so-called ‘intended audience’ of all devices, services and applications – controllers/manufacturers cannot argue anymore that they do not know that their products or services are used by a wider audience. This will entail a fundamental redefinition of the ‘average data subject’ and enforcement of accessibility including in data protection related information and communication, to render the latter inclusive, taking into account definitions included in the two accessibility directives. Specifically, Article 3 (1) of the EAA states that: “persons with disabilities’ means persons who have long-term physical, mental, intellectual or sensory impairments which in interaction with various barriers may hinder their full and effective participation in society on an equal basis with others;” And, Recital 4 EAA provides that: “‘persons with functional limitations’ [...] includes persons who have any physical, mental, intellectual or sensory impairments, age related impairments, or other human body performance related causes, permanent or temporary, which, in interaction with various barriers, result in their reduced access to products and services, leading to a situation that requires those products and services to be adapted to their particular needs.”

# 4 Benefits and Challenges of Mainstreaming Accessibility in Data Protection Law

## 4.1 What is Currently Missing?

Several studies have shown that data protection notices are lengthy, difficult to locate or to understand. Some of those studies refer to this kind of problematic information representation as ‘deceptive design patterns’ which aim to interfere with a data subject’s ability to make informed decisions about their personal data or be nudged into unwanted behavior [22]. There are even ‘dark pattern tip lines’, where a user can report dark patterns they come along [23]. In the accessibility context, this could mean that for instance, sections included in the footer of a website may not be always readable by screen readers, including links to data protection notices. The same could be also said for cookie banners for example in the form of pop-up windows.
A29WP appears to have grasped to an extent the potential and value of accessibility in the context of transparency. When comparing the first version of its guidelines on transparency for the public consultation as opposed to the final adopted version, there is an additional reference (paragraph 16) to ‘other vulnerable members of society, including people with disabilities or people who have difficulties accessing information’[7]. The data controller is expected to assess its audience’s likely level of understanding in combination with the vulnerabilities of such data subjects. However, condition for that remained that the data controller is aware that their product or service is used or is targeted to such audiences.

Acknowledging the complexity of the issue, the EDPB adopted for public consultation more recently in March 2022 the Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them [6], which include a taxonomy and checklist of such patterns. Albeit in their current form, the EDPB seems to miss the opportunity to further discuss accessibility in data protection law using results of broader accessibility studies and evidence in legal communication. This would have been particularly beneficial, given that even though there are some exceptions, data protection notices appear to rarely follow accessibility requirements, not only content related but also technically speaking.

## 4.2 How Does Accessibility Benefit and Challenge EU Data Protection Law?

The concept of accessibility both benefits and challenges the EU data protection law. Existing and emerging accessibility principles can actually complement transparency, including for instance the POUR principles of digital transparency [24] standing for perceivable, operable, understandable and robust content and procedures.

Accordingly, the concept of accessibility and of accessibility statements can be used to further explain the principle of transparency in the context of data protection law in four ways: linguistically, procedurally, technically and at the end of the day, substantially. Linguistically, by taking into account diverse requirements, such as provision of easy-to-read versions, simple language versions, age-appropriate versions, sign language versions and so forth. Procedurally, because it ascertains that the different versions are user friendly and actually correspond to the needs of the addressees, through for instance evaluation mechanisms or the provision of contacts for feedback and requests. And technically, since data protection notices have to be compatible with different devices and applications, such as screen readers.

The structure of accessibility statements, can help improve intelligibility of data protection notices, by (a) establishing additional safeguards and mechanisms to request intelligible information or communication in data protection law, especially when not possible in the latter case due to lack of specific interest, for instance when the addressee of the information is not a data subject; (b) providing accessible information on accessibility statements about the data protection notice and in general the data protection features of the service or product, including compliance status (i.e. fully compliant, partially compliant, non-compliant) and audit info (i.e. how they verify the accuracy of their statement and consequently notice) and (c) inspiring or re-shaping the content of data protection notices.
Lastly, the concept of accessibility can substantively benefit data protection law, by ensuring that fundamental rights are taken into account in all phases of its implementation and that all data subjects are truly informed or at least have the chance to be informed about their rights and the respective obligations of the data controllers.

How does accessibility challenge data protection law? Below a non-exhaustive list of some considerations. First, accessibility is not one-size-fits-all. There is a wide ('infinitude') concept of accessibility communities users [19], which means that achieving a fully compliant status may be very difficult in practice, given that the drafters or designers have to understand the requirements for each community and provide accordingly. This must also take into account the variance within each community, for instance [19]. Second, accessibility is always under construction. This is the so-called 'churn' effect [25]. It entails that accessibility features are often initially implemented but they do not remain maintained, sustained or updated, rendering them through time practically unusable. Third, any accessibility features implemented must be themselves privacy-friendly [19]. This is an explicit requirement envisaged in the Annex of the EAA. Fourth, in the specific case where accessibility is merely interpreted as reshaping data protection notices to correspond to accessibility statements, there is a risk to end up with an even larger information load for the user. Thus, intertwining the two types of notices/statements, requires utmost caution, to either completely replace the current design or to create a holistically new. Fifth, accessibility studies have emerged as a stand-alone, interdisciplinary field of research the last few decades, and accessibility in law is under-investigated.

# 5 Concluding Remarks

In a nutshell, in the previous chapters, we discussed the development of the concept of accessibility in the EU, as well as the adoption of respective legislation in the form of directives, which redefine the notion of the average consumer to include a wider audience. The requirement for different types of accessibility statements, as a form of notice describing the accessibility features of a website, product or service were analysed and their characteristics were compared. Consequently, it was examined whether the concept of accessibility has a place in the EU data protection law. The answer was yes, through the prism of transparency.

The concept of accessibility can help improve transparency in four ways: linguistically, procedurally, technically and ultimately, substantively. Nevertheless, it imposes further and new challenges to a data protection principle which has received a lot of criticism with respect to its practical implementation.

Concluding, it is argued that further research is needed to investigate practical ways in which accessibility can have a positive effect on the principle of transparency, empowering data subjects and enhancing equality.

# References

1. Seizov, O., Wulf, A.J., Luzak, J.: The Transparent trap: a multidisciplinary perspective on the design of transparent online disclosures in the EU. J. Consum. Policy 42(1), 149–173 (2018). https://doi.org/10.1007/s10603-018-9393-0
2. Anne Josephine Flanagan: Jen King, Sheila Warren: White Paper: Redesigning Data Privacy: Reimagining Notice & Consent for human-technology interaction. World Economic Forum, Geneva (2020)

3. Schaub, F., Balebako, R., Durity, A.L., Cranor, L.F.: A Design Space for Effective Privacy Notices*. In: Selinger, E., Polonetsky, J., and Tene, O. (eds.) The Cambridge Handbook of Consumer Privacy. pp. 365–393. Cambridge University Press (2018). https://doi.org/10.1017/9781316831960.021

4. Wulf, A.J., Seizov, O.: How to improve consumers’ understanding of online legal information: insights from a behavioral experiment. Eur J Law Econ. (2022). https://doi.org/10.1007/s10657-022-09755-4

5. Oehler, A., Wendt, S.: Good consumer information: the information paradigm at its (Dead) end? J. Consum. Policy **40**(2), 179–191 (2016). https://doi.org/10.1007/s10603-016-9337-5

6. European Data Protection Board: Guidelines 03/2022 on dark patterns in social media platform interfaces: How to recognise and avoid them (Version 1.0). (2022)

7. Article 29 Data Protection Working Party: Guidelines on transparency under Regulation 2016/679, (2018)

8. Nissenbaum, H.: A Contextual approach to privacy online. Daedalus **140**, 32–48 (2011). https://doi.org/10.1162/DAED_a_00113

9. Spagnuelo, D., Ferreira, A., Lenzini, G.: Accomplishing Transparency within the General Data Protection Regulation: In: Proceedings of the 5th International Conference on Information Systems Security and Privacy. pp. 114–125. SCITEPRESS - Science and Technology Publications, Prague, Czech Republic (2019). https://doi.org/10.5220/0007366501140125

10. Rossi, A., Palmirani, M.: Can visual design provide legal transparency? the challenges for successful implementation of icons for data protection. Des. Issues **36**, 82–96 (2020). https://doi.org/10.1162/desi_a_00605

11. Liepina, R., et al.: GDPR Privacy Policies in CLAUDETTE: Challenges of Omission, Context and Multilingualism. Proceedings of the Third Workshop on Automated Semantic Analysis of Information in Legal Text (ASAIL 2019). 7 (2019)

12. European Commission: Union of Equality: Strategy for the Rights of Persons with Disabilities 2021–2030. Brussels (2021)

13. Lazar, J., Goldstein, D., Taylor, A.: Chapter 2 - The history of access technology. In: Lazar, J., Goldstein, D., and Taylor, A. (eds.) Ensuring Digital Accessibility Through Process and Policy, pp. 21–40. Morgan Kaufmann, Boston (2015). https://doi.org/10.1016/B978-0-12-800646-7.00002-2

14. Digital Accessibility Glossary, https://accessibility.huit.harvard.edu/glossary, Accessed Dec 12 2022

15. Disability Inclusion Strategy. United Nations (2019)

16. World Health Organization: WHO policy on disability. World Health Organization, Geneva (2021)

17. Gutermuth, S.: Book review: Rink, I. (2020). Rechtskommunikation und Barrierefreiheit. Zur Übersetzung juristischer Informations- und Interaktionstexte in Leichter Sprache. Frank & Timme. Parallèles. 174–177 (2021). https://doi.org/10.17462/para.2021.01.11

18. Maaß, C., Rink, I.: Translating legal texts into easy language. J. Open Access Law. **9**, 10 (2021)

19. Wang, Y., et al.: Modern Socio-Technical Perspectives on Privacy. pp. 293–313. Springer International Publishing, Cham (2022). https://doi.org/10.1007/978-3-030-82786-1_13

20. Felzmann, H., Villaronga, E.F., Lutz, C., Tamò-Larrieux, A.: Transparency you can trust: transparency requirements for artificial intelligence between legal norms and contextual concerns. Big Data Soc. **6**, 2053951719860542 (2019). https://doi.org/10.1177/2053951719860542
21. Gegevensbeschermingsautoriteit: Beslissing ten gronde 106/2022 van 27 juni 2022. (2022)

22. Norwegian Consumer Council: Deceived by Design: How tech companies use dark patterns to discourage us from exercising our rights to privacy. (2018)

23. Welcome to the Dark Patterns Tip Line, https://darkpatternstipline.digitalimpact.io, Last Accessed 24 Dec 2022

24. Web Content Accessibility Guidelines (WCAG) 2.1, https://www.w3.org/TR/WCAG21/, Accessed Dec 24 2022

25. Cullen, K., Kubitschke, L.: Study on “Web accessibility in European countries: level of compliance with latest international accessibility specifications, notably WCAG 2.0, and approaches or plans to implement those specifications.” European Commission (2009)