UCL Discovery
UCL home » Library Services » Electronic resources » UCL Discovery

Fight to be Forgotten: Exploring the Efficacy of Data Erasure in Popular Operating Systems

Gutmann, A; Warner, M; (2019) Fight to be Forgotten: Exploring the Efficacy of Data Erasure in Popular Operating Systems. In: Proceedings of Annual Privacy Forum APF 2019: Privacy Technologies and Policy. (pp. pp. 45-58). Springer: Rome, Italy. Green open access

[thumbnail of APF_2019_-_Fight_to_be_Forgotten_accepted.pdf]
Preview
Text
APF_2019_-_Fight_to_be_Forgotten_accepted.pdf - Accepted Version

Download (1MB) | Preview

Abstract

A long history of longitudinal and intercultural research has identified decommissioned storage devices (e.g., USB memory sticks) as a serious privacy and security threat. Sensitive data deleted by previous owners have repeatedly been found on second-hand USB sticks through forensic analysis. Such data breaches are unlikely to occur when data is securely erased, rather than being deleted. Yet, research shows people confusing these two terms. In this paper, we report on an investigation of possible causes for this confusion. We analysed the user interface of two popular operating systems and found: (1) inconsistencies in the language used around delete and erase functions, (2) insecure default options, and (3) unclear or incomprehensible information around delete and erase functions. We discuss how this could result in data controllers becoming non-compliant with a legal obligation for erasure, putting data subjects at risk of accidental data breaches from the decommissioning of storage devices. Finally, we propose improvements to the design of relevant user interface elements and the development of official guidelines for best practice on GDPR compatible data erasure procedures.

Type: Proceedings paper
Title: Fight to be Forgotten: Exploring the Efficacy of Data Erasure in Popular Operating Systems
Event: Annual Privacy Forum - 2019
Dates: 13 June 2019 - 14 June 2019
Open access status: An open access version is available from UCL Discovery
Publisher version: https://doi.org/10.1007/978-3-030-21752-5_4
Language: English
Additional information: This version is the author accepted manuscript. For information on re-use, please refer to the publisher’s terms and conditions.
Keywords: Privacy evaluation, data erasure, GDPR, cognitive walkthrough
UCL classification: UCL
UCL > Provost and Vice Provost Offices > UCL BEAMS
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science
URI: https://discovery.ucl.ac.uk/id/eprint/10069549
Downloads since deposit
63Downloads
Download activity - last month
Download activity - last 12 months
Downloads by country - last 12 months

Archive Staff Only

View Item View Item