Gutmann, A;
Warner, M;
(2019)
Fight to be Forgotten: Exploring the Efficacy of Data Erasure in Popular Operating Systems.
In:
Proceedings of Annual Privacy Forum APF 2019: Privacy Technologies and Policy.
(pp. pp. 45-58).
Springer: Rome, Italy.
Preview |
Text
APF_2019_-_Fight_to_be_Forgotten_accepted.pdf - Accepted Version Download (1MB) | Preview |
Abstract
A long history of longitudinal and intercultural research has identified decommissioned storage devices (e.g., USB memory sticks) as a serious privacy and security threat. Sensitive data deleted by previous owners have repeatedly been found on second-hand USB sticks through forensic analysis. Such data breaches are unlikely to occur when data is securely erased, rather than being deleted. Yet, research shows people confusing these two terms. In this paper, we report on an investigation of possible causes for this confusion. We analysed the user interface of two popular operating systems and found: (1) inconsistencies in the language used around delete and erase functions, (2) insecure default options, and (3) unclear or incomprehensible information around delete and erase functions. We discuss how this could result in data controllers becoming non-compliant with a legal obligation for erasure, putting data subjects at risk of accidental data breaches from the decommissioning of storage devices. Finally, we propose improvements to the design of relevant user interface elements and the development of official guidelines for best practice on GDPR compatible data erasure procedures.
| Type: | Proceedings paper |
|---|---|
| Title: | Fight to be Forgotten: Exploring the Efficacy of Data Erasure in Popular Operating Systems |
| Event: | Annual Privacy Forum - 2019 |
| Dates: | 13 June 2019 - 14 June 2019 |
| Open access status: | An open access version is available from UCL Discovery |
| Publisher version: | https://doi.org/10.1007/978-3-030-21752-5_4 |
| Language: | English |
| Additional information: | This version is the author accepted manuscript. For information on re-use, please refer to the publisher’s terms and conditions. |
| Keywords: | Privacy evaluation, data erasure, GDPR, cognitive walkthrough |
| UCL classification: | UCL UCL > Provost and Vice Provost Offices > UCL BEAMS UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science |
| URI: | https://discovery.ucl.ac.uk/id/eprint/10069549 |
Archive Staff Only
 |
View Item |
