Cybersecurity Policy Report, Social Network Responses to Access Requests Studied in France, (Jan 31, 2025)

By Tony Foley

The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), yesterday outlined the results of a study conducted by the agency’s Digital Innovation Laboratory (LINC) on the access paths to copies of personal data implemented by 10 social media networks.

For each social network that was part of its study, two access requests were made, and the network’s actions were reviewed according to an analysis grid consisting of 30 questions designed to identify the good practices put into place and to display a score for each network, CNIL said in a news release.

After its initial analysis, LINC engaged in discussions with each network at the end of 2024, making it possible to readjust a few points in LINC’s methodology.

The study outlines the path of each network’s access practices and extracts average indicators from current practices. According to the results, all 10 networks established an automated path specific to the right of access, with an average of 3.8 clicks (for computers) to 4 clicks (for mobile phones) to access the procedure. Users waited an average of about 19 minutes to receive a copy of their data, with an average of 12 days (ranging from 3 to 30 days) for users to download the data.

The objective of the study was to highlight good practices and to encourage improvement of the user experience based on the main principles of the European Union’s General Data Protection Regulation (GDPR). LINC concluded, among other findings, that between 44% and 76.5% of the good practices identified in the analysis grid had been implement in the pathways of the social networks studied.

News: InternationalLegislation DataPrivacy GDPR