Data rights have been present in Europe for more than fifty years, starting regionally with the Datenschutzgesetz in Hessen (1970), nationally with the French Loi Informatique et Libertés (1978), at a European level through Convention 108 of the European Convention of Human Rights (1981), and finally harmonised through the General Data Protection Regulation (GDPR) (2016). Despite these strong rights, study after study shows that data controllers (those who are responsible for the processing of personal data) fail to live up to them. The majority of controllers show a lack of understanding and awareness of the rights (Ausloos and Dewitte, 2018), the majority do not respond within the 30 day time limit (Mahieu et al., 2017), and (if they do respond) the majority do not include the required information (Norris et al, 2017). These statistics are troubling by themselves, but even more so when we remember that the European Commission's explicit objective with the GDPR has been to "strengthen individual's rights" and "enhance control over one's own data" (EC, 2010). The GDPR is designed with the idea that official institutions (i.e., Data Protection Authorities) will work together with empowered individuals to enforce the regulation. In other words, the poor success rates around data rights are not just a problematic side-note, but a weakness in the fundamental intent and functioning of the law.

In this project, we will build a digital service that helps Danish residents exercise their right to access, right to be forgotten, and right to rectification. The service – datarettigheder.dk – will help people create the text of their request, contact the data controllers, verify the compliance of the response, and report the data controller to the data protection authority if they fail to meet their obligations. datarettigheder.dk consists of two core elements: 1) the user-to-regulation interface, and 2) the controller correspondence.