Conference paper Open Access

Personal Data Stores and the GDPR's lawful grounds for processing personal data

Janssen, Heleen; Cobbe, Jennifer; Norval, Chris; Singh, Jatinder

Personal Data Stores (‘PDSs’) entail users having a (physical or virtual) device within which they themselves can, in theory, capture, aggregate, and control the access to and the transfer of personal data. Their aim is to empower users in relation to their personal data, strengthening their opportunities for data protection, privacy, and/or to facilitate trade and monetisation. As PDS technologies develop, it is important to consider their role in relation to issues of data protection. The General Data Protection Regulation requires that the processing of user data be predicated on one of its defined lawful bases, whereby the Regulation does not favour any one basis over another. We explore how PDS architectures relate to these lawful bases, and observe that they tend to favour the bases that require direct user involvement. This paper considers issues that the envisaged architectural choices surrounding the lawful grounds may entail. 

Files (186.8 kB)
Name Size
Personal Data Stores and the GDPR’s lawful grounds for processing personal data.pdf
186.8 kB Download
All versions This version
Views 8878
Downloads 6662
Data volume 11.8 MB11.6 MB
Unique views 7371
Unique downloads 5352


Cite as