{"id":"https://openalex.org/W4415830362","doi":"https://doi.org/10.1007/s10664-025-10742-x","title":"The whos, whats, and whys of issues related to personal data and data protection in open-source projects on GitHub","display_name":"The whos, whats, and whys of issues related to personal data and data protection in open-source projects on GitHub","publication_year":2025,"publication_date":"2025-11-04","ids":{"openalex":"https://openalex.org/W4415830362","doi":"https://doi.org/10.1007/s10664-025-10742-x"},"language":"en","primary_location":{"id":"doi:10.1007/s10664-025-10742-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-025-10742-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-025-10742-x.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10664-025-10742-x.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5069244869","display_name":"Anne Hennig","orcid":"https://orcid.org/0000-0002-6964-589X"},"institutions":[{"id":"https://openalex.org/I102335020","display_name":"Karlsruhe Institute of Technology","ror":"https://ror.org/04t3en479","country_code":"DE","type":"education","lineage":["https://openalex.org/I102335020","https://openalex.org/I1305996414"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Anne Hennig","raw_affiliation_strings":["Karlsruhe Institute of Technology, Karlsruhe, Germany"],"raw_orcid":"https://orcid.org/0000-0002-6964-589X","affiliations":[{"raw_affiliation_string":"Karlsruhe Institute of Technology, Karlsruhe, Germany","institution_ids":["https://openalex.org/I102335020"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5099119904","display_name":"Lukas Schulte","orcid":"https://orcid.org/0000-0001-9336-2075"},"institutions":[{"id":"https://openalex.org/I186354981","display_name":"University of Passau","ror":"https://ror.org/05ydjnb78","country_code":"DE","type":"education","lineage":["https://openalex.org/I186354981"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Lukas Schulte","raw_affiliation_strings":["University of Passau, Passau, Germany"],"raw_orcid":"https://orcid.org/0000-0001-9336-2075","affiliations":[{"raw_affiliation_string":"University of Passau, Passau, Germany","institution_ids":["https://openalex.org/I186354981"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027032646","display_name":"Steffen Herbold","orcid":"https://orcid.org/0000-0001-9765-2803"},"institutions":[{"id":"https://openalex.org/I186354981","display_name":"University of Passau","ror":"https://ror.org/05ydjnb78","country_code":"DE","type":"education","lineage":["https://openalex.org/I186354981"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Steffen Herbold","raw_affiliation_strings":["University of Passau, Passau, Germany"],"raw_orcid":"https://orcid.org/0000-0001-9765-2803","affiliations":[{"raw_affiliation_string":"University of Passau, Passau, Germany","institution_ids":["https://openalex.org/I186354981"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084706535","display_name":"Oksana Kulyk","orcid":"https://orcid.org/0000-0003-4218-1658"},"institutions":[{"id":"https://openalex.org/I83467386","display_name":"IT University of Copenhagen","ror":"https://ror.org/02309jg23","country_code":"DK","type":"education","lineage":["https://openalex.org/I83467386"]}],"countries":["DK"],"is_corresponding":false,"raw_author_name":"Oksana Kulyk","raw_affiliation_strings":["IT University of Copenhagen, Copenhagen, Denmark"],"raw_orcid":"https://orcid.org/0000-0003-4218-1658","affiliations":[{"raw_affiliation_string":"IT University of Copenhagen, Copenhagen, Denmark","institution_ids":["https://openalex.org/I83467386"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033826310","display_name":"Peter Mayer","orcid":"https://orcid.org/0000-0002-6267-4874"},"institutions":[{"id":"https://openalex.org/I102335020","display_name":"Karlsruhe Institute of Technology","ror":"https://ror.org/04t3en479","country_code":"DE","type":"education","lineage":["https://openalex.org/I102335020","https://openalex.org/I1305996414"]},{"id":"https://openalex.org/I177969490","display_name":"University of Southern Denmark","ror":"https://ror.org/03yrrjy16","country_code":"DK","type":"education","lineage":["https://openalex.org/I177969490"]}],"countries":["DE","DK"],"is_corresponding":false,"raw_author_name":"Peter Mayer","raw_affiliation_strings":["Karlsruhe Institute of Technology, Karlsruhe, Germany","University of Southern Denmark, Odense, Denmark"],"raw_orcid":"https://orcid.org/0000-0002-6267-4874","affiliations":[{"raw_affiliation_string":"Karlsruhe Institute of Technology, Karlsruhe, Germany","institution_ids":["https://openalex.org/I102335020"]},{"raw_affiliation_string":"University of Southern Denmark, Odense, Denmark","institution_ids":["https://openalex.org/I177969490"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5069244869"],"corresponding_institution_ids":["https://openalex.org/I102335020"],"apc_list":{"value":2290,"currency":"EUR","value_usd":2890},"apc_paid":{"value":2290,"currency":"EUR","value_usd":2890},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.3940185,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"31","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.6712999939918518,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.6712999939918518,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.06560000032186508,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11675","display_name":"Open Source Software Innovations","score":0.02319999970495701,"subfield":{"id":"https://openalex.org/subfields/1706","display_name":"Computer Science Applications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/data-protection-act-1998","display_name":"Data Protection Act 1998","score":0.7773000001907349},{"id":"https://openalex.org/keywords/general-data-protection-regulation","display_name":"General Data Protection Regulation","score":0.6733999848365784},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5702000260353088},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.4828999936580658},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.448199987411499},{"id":"https://openalex.org/keywords/privacy-by-design","display_name":"Privacy by Design","score":0.4133000075817108},{"id":"https://openalex.org/keywords/european-union","display_name":"European union","score":0.4032000005245209},{"id":"https://openalex.org/keywords/relation","display_name":"Relation (database)","score":0.4007999897003174},{"id":"https://openalex.org/keywords/data-anonymization","display_name":"Data anonymization","score":0.3952000141143799}],"concepts":[{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.7773000001907349},{"id":"https://openalex.org/C3090818","wikidata":"https://www.wikidata.org/wiki/Q1172506","display_name":"General Data Protection Regulation","level":3,"score":0.6733999848365784},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5702000260353088},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5699999928474426},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.4828999936580658},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46320000290870667},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.448199987411499},{"id":"https://openalex.org/C193934123","wikidata":"https://www.wikidata.org/wiki/Q7246028","display_name":"Privacy by Design","level":3,"score":0.4133000075817108},{"id":"https://openalex.org/C2910001868","wikidata":"https://www.wikidata.org/wiki/Q458","display_name":"European union","level":2,"score":0.4032000005245209},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.4007999897003174},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.40070000290870667},{"id":"https://openalex.org/C2776945810","wikidata":"https://www.wikidata.org/wiki/Q17006654","display_name":"Data anonymization","level":3,"score":0.3952000141143799},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.3864000141620636},{"id":"https://openalex.org/C2780866740","wikidata":"https://www.wikidata.org/wiki/Q5227345","display_name":"Data retention","level":2,"score":0.3813000023365021},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.3792000114917755},{"id":"https://openalex.org/C169093310","wikidata":"https://www.wikidata.org/wiki/Q3702971","display_name":"Personally identifiable information","level":2,"score":0.3774000108242035},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.34779998660087585},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3456999957561493},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.3357999920845032},{"id":"https://openalex.org/C52487910","wikidata":"https://www.wikidata.org/wiki/Q911488","display_name":"Data Protection Directive","level":4,"score":0.3246999979019165},{"id":"https://openalex.org/C509729295","wikidata":"https://www.wikidata.org/wiki/Q7246032","display_name":"Privacy software","level":3,"score":0.3246000111103058},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3199000060558319},{"id":"https://openalex.org/C3017597292","wikidata":"https://www.wikidata.org/wiki/Q25052250","display_name":"Privacy protection","level":2,"score":0.3034999966621399},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.3001999855041504},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.29589998722076416},{"id":"https://openalex.org/C141972696","wikidata":"https://www.wikidata.org/wiki/Q1247836","display_name":"Privacy law","level":4,"score":0.2915000021457672},{"id":"https://openalex.org/C102938260","wikidata":"https://www.wikidata.org/wiki/Q1999831","display_name":"Privacy policy","level":3,"score":0.28380000591278076},{"id":"https://openalex.org/C180152950","wikidata":"https://www.wikidata.org/wiki/Q2904257","display_name":"Software development process","level":4,"score":0.2678000032901764},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.2630999982357025}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s10664-025-10742-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-025-10742-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-025-10742-x.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:sdu.dk:openaire/71a46546-9679-4311-8198-2fe14b22ec23","is_oa":true,"landing_page_url":"https://portal.findresearcher.sdu.dk/da/publications/71a46546-9679-4311-8198-2fe14b22ec23","pdf_url":null,"source":{"id":"https://openalex.org/S4306400424","display_name":"University of Southern Denmark Research Portal (University of Southern Denmark)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I177969490","host_organization_name":"University of Southern Denmark","host_organization_lineage":["https://openalex.org/I177969490"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Hennig, A, Schulte, L, Herbold, S, Kulyk, O & Mayer, P 2026, 'The whos, whats, and whys of issues related to personal data and data protection in open-source projects on GitHub', Empirical Software Engineering, vol. 31, no. 1, 9. https://doi.org/10.1007/s10664-025-10742-x","raw_type":"info:eu-repo/semantics/publishedVersion"}],"best_oa_location":{"id":"doi:10.1007/s10664-025-10742-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-025-10742-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-025-10742-x.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415830362.pdf","grobid_xml":"https://content.openalex.org/works/W4415830362.grobid-xml"},"referenced_works_count":44,"referenced_works":["https://openalex.org/W1914969610","https://openalex.org/W1966769823","https://openalex.org/W2056894403","https://openalex.org/W2117233102","https://openalex.org/W2122210511","https://openalex.org/W2146649871","https://openalex.org/W2150104072","https://openalex.org/W2162739315","https://openalex.org/W2339077968","https://openalex.org/W2486156687","https://openalex.org/W2514185481","https://openalex.org/W2545778708","https://openalex.org/W2603990485","https://openalex.org/W2608119921","https://openalex.org/W2608457654","https://openalex.org/W2753975962","https://openalex.org/W2810627707","https://openalex.org/W2889396982","https://openalex.org/W2908104737","https://openalex.org/W2911964244","https://openalex.org/W2963278782","https://openalex.org/W3015767612","https://openalex.org/W3018447383","https://openalex.org/W3032324689","https://openalex.org/W3032791547","https://openalex.org/W3083459739","https://openalex.org/W3100240544","https://openalex.org/W3120130861","https://openalex.org/W3150137677","https://openalex.org/W3169282496","https://openalex.org/W3175550992","https://openalex.org/W3213259750","https://openalex.org/W4220887515","https://openalex.org/W4225908028","https://openalex.org/W4226096114","https://openalex.org/W4254194321","https://openalex.org/W4286255938","https://openalex.org/W4291213652","https://openalex.org/W4300963145","https://openalex.org/W4312384302","https://openalex.org/W4318811767","https://openalex.org/W4319999786","https://openalex.org/W4390848134","https://openalex.org/W7115170450"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"Data":[1,8],"protection":[2,43,154,231],"regulations":[3,44,78,232],"such":[4,77],"as":[5],"the":[6,13,17,24,31,62,74,80,96,141,146,149,216,239],"General":[7],"Protection":[9],"Regulation":[10],"(GDPR)":[11],"in":[12,23,49,57,171,224],"European":[14],"Union":[15],"and":[16,91,106,113,116,139,152,159,193,198],"California":[18],"Consumer":[19],"Privacy":[20],"Act":[21],"(CCPA)":[22],"US":[25],"affect":[26],"how":[27,41,52,93,117],"software":[28,48,63,81,99,240],"may":[29],"handle":[30],"personal":[32,111],"data":[33,42,112,114,153,230],"of":[34,61,76,98,162,215],"its":[35],"users.":[36],"Prior":[37],"literature":[38],"focused":[39],"on":[40,73,79],"are":[45,100],"discussed":[46,56,194],"for":[47,186],"operation,":[50],"or":[51],"this":[53,89],"topic":[54],"is":[55,68,70],"various":[58],"channels":[59],"outside":[60],"development":[64,82,97,241],"process.":[65,83],"Yet,":[66],"what":[67],"missing,":[69],"a":[71,168],"perspective":[72],"impact":[75],"In":[84],"our":[85,226],"work,":[86],"we":[87,126,166],"address":[88],"gap,":[90],"explore":[92],"discussions":[94,235],"during":[95],"impacted":[101],"by":[102,195,211],"regulations,":[103],"who":[104],"reports":[105],"discusses":[107],"issues":[108,133,155,203],"related":[109],"to":[110,120,130,143,156],"protection,":[115],"developers":[118],"react":[119],"those":[121],"issues.":[122,163],"To":[123],"that":[124,229],"end,":[125],"used":[127,140],"inductive":[128],"coding":[129],"analyze":[131,145],"652":[132],"from":[134],"Open":[135],"Source":[136],"GitHub":[137],"projects":[138],"codes":[142],"quantitatively":[144],"relation":[147],"between":[148],"roles,":[150],"resolutions,":[151],"understand":[157],"correlations":[158],"predict":[160],"resolutions":[161],"Most":[164,214],"notably":[165],"observed":[167],"significant":[169],"increase":[170],"reporting":[172],"when":[173],"GDPR":[174],"came":[175],"into":[176],"effect.":[177],"The":[178],"most":[179],"common":[180],"issue":[181],"types":[182],"were":[183,190,207,218],"feature":[184],"requests":[185,217],"privacy":[187,205,237],"enhancement,":[188],"which":[189],"mainly":[191],"reported":[192,210],"frequent":[196,199],"reporters":[197],"committers.":[200],"But":[201],"especially":[202],"regarding":[204],"enhancement":[206],"also":[208],"frequently":[209],"one-time":[212],"reporters.":[213],"solved":[219],"without":[220],"opposing":[221],"votes.":[222],"All":[223],"all,":[225],"findings":[227],"indicate":[228],"effectively":[233],"start":[234],"about":[236],"within":[238],"community.":[242]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-11-04T00:00:00"}