The GDPR promises us that we can receive our personal data from anyone who collected it upon request. Research has already shown this does not really work as envisioned in law.

This lecture asks to dig deeper into the topic, by approaching data subject rights, in particular Article 15 GDPR, as a methodological device for studying digital infrastructures under conditions of limited access. Access rights are first a legal protection and empowerment measure, but we examine how they can be used to trace tracking practices, data flows and processes of identity formation in online advertising ecosystems. In the course of this research we bridge media studies and digital methods with legal studies. The data collection process is first an encounter with the infrastructures that exist to inform users, but also an encounter of the user with fragments of themselves.

From a legal perspective, we analyse how data protection law conceptualises different forms of identity and how identities are legally attributed to a data subject. At the same time, we interrogate the limits of this framework: while the GDPR presupposes that personal data can be linked to an identified or identifiable natural person, contemporary data practices routinely challenge these distinctions. Identities emerge from combinations of data points that individually fall below the threshold of “personal data,” yet collectively constitute a recognisable profile. The legal figure of the data subject is thus both a normative construct and an unstable one, continuously deconstructed and reassembled by digital infrastructures.

Yarden Skop & Maria Boole (University of Paderborn & Siegen / Project A07 @ SFB 1187 Media of Cooperation)