{"id":"https://openalex.org/W4416307671","doi":"https://doi.org/10.1145/3733802.3764047","title":"Compliance by Design or by Disguise? GDPR's Reshaping of Universities' Privacy Policies","display_name":"Compliance by Design or by Disguise? GDPR's Reshaping of Universities' Privacy Policies","publication_year":2025,"publication_date":"2025-10-13","ids":{"openalex":"https://openalex.org/W4416307671","doi":"https://doi.org/10.1145/3733802.3764047"},"language":null,"primary_location":{"id":"doi:10.1145/3733802.3764047","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733802.3764047","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3733802.3764047","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th Workshop on Privacy in the Electronic Society","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3733802.3764047","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120027257","display_name":"Simran Munot","orcid":"https://orcid.org/0009-0008-8359-8250"},"institutions":[{"id":"https://openalex.org/I4210109712","display_name":"Max Planck Institute for Informatics","ror":"https://ror.org/01w19ak89","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210109712"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Simran Munot","raw_affiliation_strings":["Max-Planck Institute for Informatics, Saarbr\u00fccken, Germany"],"raw_orcid":"https://orcid.org/0009-0008-8359-8250","affiliations":[{"raw_affiliation_string":"Max-Planck Institute for Informatics, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210109712"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067666349","display_name":"Tobias Fiebig","orcid":"https://orcid.org/0000-0002-0163-5134"},"institutions":[{"id":"https://openalex.org/I4210109712","display_name":"Max Planck Institute for Informatics","ror":"https://ror.org/01w19ak89","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210109712"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Tobias Fiebig","raw_affiliation_strings":["Max-Planck Institute for Informatics, Saarbr\u00fccken, Germany"],"raw_orcid":"https://orcid.org/0000-0002-0163-5134","affiliations":[{"raw_affiliation_string":"Max-Planck Institute for Informatics, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210109712"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000443839","display_name":"Mannat Kaur","orcid":"https://orcid.org/0000-0002-4717-6180"},"institutions":[{"id":"https://openalex.org/I4210109712","display_name":"Max Planck Institute for Informatics","ror":"https://ror.org/01w19ak89","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210109712"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mannat Kaur","raw_affiliation_strings":["Max-Planck-Institute for Informatics, Saarbr\u00fccken, Germany"],"raw_orcid":"https://orcid.org/0000-0002-4717-6180","affiliations":[{"raw_affiliation_string":"Max-Planck-Institute for Informatics, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210109712"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.41123195,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"183","last_page":"197"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.7656999826431274,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.7656999826431274,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.01720000058412552,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13573","display_name":"Government, Law, and Information Management","score":0.013500000350177288,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/general-data-protection-regulation","display_name":"General Data Protection Regulation","score":0.7182000279426575},{"id":"https://openalex.org/keywords/information-privacy","display_name":"Information privacy","score":0.6546000242233276},{"id":"https://openalex.org/keywords/data-protection-act-1998","display_name":"Data Protection Act 1998","score":0.6255000233650208},{"id":"https://openalex.org/keywords/framing","display_name":"Framing (construction)","score":0.5927000045776367},{"id":"https://openalex.org/keywords/outsourcing","display_name":"Outsourcing","score":0.5924000144004822},{"id":"https://openalex.org/keywords/privacy-policy","display_name":"Privacy policy","score":0.5852000117301941},{"id":"https://openalex.org/keywords/personally-identifiable-information","display_name":"Personally identifiable information","score":0.560699999332428},{"id":"https://openalex.org/keywords/european-union","display_name":"European union","score":0.5217999815940857},{"id":"https://openalex.org/keywords/privacy-by-design","display_name":"Privacy by Design","score":0.5117999911308289}],"concepts":[{"id":"https://openalex.org/C3090818","wikidata":"https://www.wikidata.org/wiki/Q1172506","display_name":"General Data Protection Regulation","level":3,"score":0.7182000279426575},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.6546000242233276},{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.6255000233650208},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.6075999736785889},{"id":"https://openalex.org/C169087156","wikidata":"https://www.wikidata.org/wiki/Q2131593","display_name":"Framing (construction)","level":2,"score":0.5927000045776367},{"id":"https://openalex.org/C46934059","wikidata":"https://www.wikidata.org/wiki/Q61515","display_name":"Outsourcing","level":2,"score":0.5924000144004822},{"id":"https://openalex.org/C102938260","wikidata":"https://www.wikidata.org/wiki/Q1999831","display_name":"Privacy policy","level":3,"score":0.5852000117301941},{"id":"https://openalex.org/C169093310","wikidata":"https://www.wikidata.org/wiki/Q3702971","display_name":"Personally identifiable information","level":2,"score":0.560699999332428},{"id":"https://openalex.org/C2910001868","wikidata":"https://www.wikidata.org/wiki/Q458","display_name":"European union","level":2,"score":0.5217999815940857},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.521399974822998},{"id":"https://openalex.org/C193934123","wikidata":"https://www.wikidata.org/wiki/Q7246028","display_name":"Privacy by Design","level":3,"score":0.5117999911308289},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.5062000155448914},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.48429998755455017},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.47209998965263367},{"id":"https://openalex.org/C141972696","wikidata":"https://www.wikidata.org/wiki/Q1247836","display_name":"Privacy law","level":4,"score":0.40059998631477356},{"id":"https://openalex.org/C78524284","wikidata":"https://www.wikidata.org/wiki/Q6031155","display_name":"Information privacy law","level":4,"score":0.3869999945163727},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.3783999979496002},{"id":"https://openalex.org/C52487910","wikidata":"https://www.wikidata.org/wiki/Q911488","display_name":"Data Protection Directive","level":4,"score":0.37540000677108765},{"id":"https://openalex.org/C39549134","wikidata":"https://www.wikidata.org/wiki/Q133080","display_name":"Public relations","level":1,"score":0.36880001425743103},{"id":"https://openalex.org/C2776680780","wikidata":"https://www.wikidata.org/wiki/Q15964604","display_name":"Guardian","level":2,"score":0.3427000045776367},{"id":"https://openalex.org/C509729295","wikidata":"https://www.wikidata.org/wiki/Q7246032","display_name":"Privacy software","level":3,"score":0.3222000002861023},{"id":"https://openalex.org/C168297262","wikidata":"https://www.wikidata.org/wiki/Q6031182","display_name":"Information protection policy","level":2,"score":0.32120001316070557},{"id":"https://openalex.org/C2775833480","wikidata":"https://www.wikidata.org/wiki/Q26084","display_name":"Freedom of information","level":2,"score":0.304500013589859},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.296999990940094},{"id":"https://openalex.org/C2777206241","wikidata":"https://www.wikidata.org/wiki/Q194431","display_name":"Paragraph","level":2,"score":0.29600000381469727},{"id":"https://openalex.org/C87156501","wikidata":"https://www.wikidata.org/wiki/Q7268708","display_name":"Qualitative property","level":2,"score":0.2903999984264374},{"id":"https://openalex.org/C2779547435","wikidata":"https://www.wikidata.org/wiki/Q1121492","display_name":"Directive","level":2,"score":0.28220000863075256},{"id":"https://openalex.org/C2777146004","wikidata":"https://www.wikidata.org/wiki/Q14949826","display_name":"CLARITY","level":2,"score":0.2793000042438507},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.271699994802475},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.2522999942302704}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3733802.3764047","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733802.3764047","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3733802.3764047","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th Workshop on Privacy in the Electronic Society","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3733802.3764047","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733802.3764047","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3733802.3764047","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 24th Workshop on Privacy in the Electronic Society","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416307671.pdf","grobid_xml":"https://content.openalex.org/works/W4416307671.grobid-xml"},"referenced_works_count":43,"referenced_works":["https://openalex.org/W1881708081","https://openalex.org/W2067404301","https://openalex.org/W2474145033","https://openalex.org/W2886646984","https://openalex.org/W2887427605","https://openalex.org/W2895782836","https://openalex.org/W2899275774","https://openalex.org/W2914733125","https://openalex.org/W2921026077","https://openalex.org/W2943725908","https://openalex.org/W2954009549","https://openalex.org/W2972410186","https://openalex.org/W2974508951","https://openalex.org/W2979796259","https://openalex.org/W2982500526","https://openalex.org/W2999830435","https://openalex.org/W3014497955","https://openalex.org/W3020871328","https://openalex.org/W3023425096","https://openalex.org/W3032324689","https://openalex.org/W3049637327","https://openalex.org/W3080917700","https://openalex.org/W3092066298","https://openalex.org/W3103666600","https://openalex.org/W3123075660","https://openalex.org/W3156874074","https://openalex.org/W3159924905","https://openalex.org/W3164790661","https://openalex.org/W3177955518","https://openalex.org/W3183843234","https://openalex.org/W3206777662","https://openalex.org/W3208754201","https://openalex.org/W4220698453","https://openalex.org/W4225117601","https://openalex.org/W4286255301","https://openalex.org/W4306406283","https://openalex.org/W4307823722","https://openalex.org/W4313563535","https://openalex.org/W4323836082","https://openalex.org/W4376626980","https://openalex.org/W4388193232","https://openalex.org/W4388867280","https://openalex.org/W4392026270"],"related_works":[],"abstract_inverted_index":{"The":[0],"General":[1],"Data":[2],"Protection":[3],"Regulation":[4],"(GDPR)":[5],"has":[6],"significantly":[7],"reshaped":[8],"how":[9],"organisations":[10],"handle":[11],"personal":[12,32],"data,":[13],"yet":[14],"its":[15],"impact":[16],"on":[17,93],"universities\u2019":[18],"privacy":[19,89],"policies":[20,90],"within":[21],"the":[22,66],"European":[23],"Union":[24],"remains":[25],"under-explored.":[26],"Universities":[27],"process":[28],"large":[29],"volumes":[30],"of":[31,68],"data":[33,101,123],"\u2013":[34,42],"from":[35],"student":[36],"records":[37],"to":[38,58,74],"research":[39],"participant":[40],"information":[41],"necessitating":[43],"strict":[44],"GDPR":[45,63,117],"compliance.":[46],"This":[47],"paper":[48],"adopts":[49],"a":[50],"mixed-methods":[51],"approach,":[52],"combining":[53],"qualitative":[54],"content":[55],"analysis":[56,73],"(QCA)":[57],"assess":[59],"transparency,":[60],"compliance":[61],"with":[62,71],"principles":[64,118],"and":[65,81,95,103,111,122],"framing":[67],"user":[69],"rights":[70],"quantitative":[72],"track":[75],"textual":[76],"modifications":[77],"across":[78],"word,":[79],"sentence,":[80],"paragraph":[82],"levels.":[83],"Our":[84],"findings":[85],"reveal":[86],"that":[87],"institutional":[88],"often":[91],"rely":[92],"vague":[94],"broad":[96],"language,":[97],"creating":[98],"ambiguity":[99],"around":[100],"purposes":[102],"retention.":[104],"Additionally,":[105],"practices":[106],"such":[107],"as":[108],"outsourcing":[109],"responsibility":[110],"embedding":[112],"third-party":[113],"tools":[114],"challenge":[115],"core":[116],"like":[119],"purpose":[120],"limitation":[121],"protection":[124],"by":[125],"design.":[126]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-11-18T00:00:00"}