Data subject access requests as an interdisciplinary learning tool

The General Data Protection Regulation (GDPR) gives data subjects the right to obtain a copy of their data, as well as information regarding the purposes of the processing, categories of personal data collected, recipients to whom this data has been disclosed, data retention periods and whether automated decision-making or profiling have been undertaken. This article describes our experience using data subject access requests (DSARs) as a learning tool in an international higher education setting. Our pedagogical practice centred around a group-based assignment in which students performed DSARs, recorded the fulfilment process, and examined the received data. This format enabled the deployment of DSARs for practice-based learning by students from different disciplinary backgrounds. In the three years during which we have used DSARs in this manner, we have established that they provide a starting point for fruitful discussions regarding the legal and technical aspects of personal data processing. The pedagogical value of DSARs derives from their ability to motivate the students to navigate the complexities of obtaining and understanding data about them held by various platforms. This radically transforms the discussion about data rights from potentially fairly abstract into a tangible, close and relevant exploration of complex categories and concepts.