Data subject rights in online social networks - personal data protection and problematic aspects

Abstract

Online social networks have become an important part of the online activities on the web and one of the most influencing media. Online social networks should be compliant with the GDPR, international and EU data protection law and the laws of each country in which they provide their services. However, given the extensive legal framework for the protection of personal data, there have been multiple personal data breaches on the world’s largest online social network providers. The goal of this paper is to find legal imperfections of the European legal framework about personal data in online Social Networks and propose theoretical solutions. The resulting research question to be addressed is: “Does the EU’s GDPR provide for an effective system of guaranteeing users of social media networks’ constitutional right to data protection?” The main findings of this research are as follows. Analysis of data policies of major online social network providers has shown that social network providers process personal data in violation of data processing principles stipulated in the GDPR: the large amount of data processed by social networks is contrary to the principle of data minimization; mainly online social networking privacy policies state that all personal data is stored until the user deletes their profile, data storage without specifying a time limit is contrary to the principle of storage limitation; in some cases in data policies The purpose of personal data processing is not specified. The research carried out in the master’s thesis has shown that even huge administrative fines do not guarantee the full lawfulness of the processing of personal data in accordance with the GDPR in online social networks.