SSI is Here to Support the Rights of Data Subjects

The General Data Protection Regulation (GDPR) provides data subjects with several rights ranging from data access to the erasure of personal data. Data subjects who want to use their rights must pose subject access requests (SARs) to the controllers. The practice has shown that controllers often do not properly authenticate subjects during requests, leading to potential disclosures of personal data to the wrong people. We propose an approach that provides strong security for SAR processes to prevent unwanted data leaks. The approach is also user-friendly, minimizing the hassles for users when posing SARs. We are the first to propose to use the Self-Sovereign Identity (SSI) paradigm for SARs.