VARSTVOSLOVJE, Journal of Criminal Justice and Security, year 20 no. 4 pp. 414-433 The Impact of the EU General Data Protection Regulation (GDPR) on Mobile Devices Domen Hribar, Miha Dvojmoč, Blaž Markelj Purpose: The purpose of this paper is to examine novelties introduced by the European Regulation (2016/679) on the Protection of Natural Persons with Regard to the Processing of Personal Data (GDPR) and its key impacts on mobile device users. The paper also presents some of the main changes affecting both natural persons and legal entities. Further, certain issues that might occur while implementing the Regulation are raised together with the degree of individuals' awareness of the need to protect the personal data stored on their mobile devices. Design/Methods/Approach: For the purpose of this paper, we reviewed the legislation, Slovenian and international literature, brochures and media stories in the field of personal data protection. We also used a questionnaire to determine the degree of awareness of the importance of protecting personal data among the general population. Findings: The findings show that no revolutionary changes are introduced. Nevertheless, quite a few novelties concern data controllers and processors. In particular, penalties for breaching the GDPR are now much higher. Individuals' rights are strengthened and easier to control. In contrast, data controllers and processors are subject to more stringent duties and legal obligations. These changes also apply to mobile device users. The research findings show that individuals are relatively well aware of the concept of personal data; however, the scope of their knowledge shrinks as this concept becomes increasingly complex. Familiarity with the new Regulation (2016/679) having been introduced at the EU level was claimed by 55% of the respondents (N = 195). Research Limitations/Implications: The limitations stem from the selective choice of the GDPR's impact on mobile device users. More important influences are emphasised. Originality/Value: The findings will help both individuals and legal entities understand the changes brought to the area of data protection and tackle them more successfully. UDC: 004.056:[342.7:621.391] Keywords: personal data protection, GDPR, Personal Data Protection Act, mobile devices 414 Domen Hribar, Miha Dvojmoč, Blaž Markelj Vpliv evropske Splošne uredbe o varstvu osebnih podatkov (GDPR) na mobilne naprave Namen prispevka: V prispevku smo predstavili ključni vpliv evropske uredbe (2016/679) o varstvu posameznikov pri obdelavi osebnih podatkov na uporabnike mobilnih naprav. Poleg vpliva smo predstavili ključne spremembe, ki vplivajo tako na fizične kot tudi na velik delež pravnih oseb. Poudarili smo določeno problematiko, s katero se organizacije srečujejo. Hkrati smo prikazali stanje ozaveščenosti ljudi o varstvu osebnih podatkov na mobilnih napravah. Metode: Prispevek temelji na pregledu zakonodaje ter domače in tuje literature, brošur in medijskih člankov na področju varstva osebnih podatkov. Izvedli smo tudi anketo, kjer nas je zanimala ozaveščenost o pomembnosti varstva osebnih podatkov. Ugotovitve: Na področju je prišlo do številnih novosti, ki so spremenile način upravljanja in obdelave. Predvsem se bodo povečale globe za kršitelje. Pravice posameznika bodo podkrepljene in lažje nadzorovane. Po drugi strani bodo upravljavci in obdelovalci dobili veliko novih dolžnosti. Spremembe veljajo tudi za uporabnike mobilnih naprav. Ugotovitve raziskave so pokazale, da ljudje sorazmerno dobro poznajo pojem osebni podatek, vendar se to znanje s kompleksnostjo pojma zmanjšuje. Udeleženci so v 55 % (N = 195) odgovorili, da vedo za prihod nove uredbe (2016/679). Omejitve/uporabnost raziskave: Omejitve so pri selektivni izbiri vpliva uredbe na uporabnike mobilnih naprav. Poudarjeni so pomembnejši vplivi. Izvirnost/pomembnost prispevka: Ugotovitve prispevka bodo pomagale tako posameznikom kot tudi organizacijam pri dojemanju sprememb in zato lažjem spoprijemanju z njimi. UDK: 004.056:[342.7:621.391] Ključne besede: varstvo osebnih podatkov, GDPR, Zakon o varstvu osebnih podatkov, mobilne naprave 1 INTRODUCTION The present paper focuses on mobile devices and the way in which the new personal data protection legislation affects their use. This field is extremely broad and complex, which is why the paper only concentrates on certain more significant changes. Mobile devices are placed at the forefront simply because we can hardly envisage our everyday lives without them. Further, mobile devices can hold personal data that must be protected under the GDPR. If the device is 415 The Impact of the EU General Data Protection Regulation (GDPR) on Mobile Devices lost or stolen that constitutes a data breach. While data breaches are common, they are easier with mobile devices. This example shows that mobile devices are a weak link while trying to comply with the GDPR. Mobile devices include, among others, devices with a built-in adapted operating system. They also encompass devices able to transfer data and access the Internet wirelessly (Markelj & Bernik, 2016). Mobile device use is extremely widespread across the globe (GSMA Intelligence, 2018). The available figures are extremely high and refer to the quantity of data transferred at the global level. The need to protect such data is therefore in the interest of anyone conducting any transaction that involves any type of information. Naturally, not all pieces of information are equally important. The value of a piece of information depends on numerous factors linked to one another, thus creating or increasing the value of information. That is why the State recognises, inter alia, that information related to individuals is a fundamental element in guaranteeing human rights and freedoms. This type of information is known as personal data and denotes "any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person" (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [GDPR], 2016, Article 4). Personal data thus includes a great deal of information regarding an individual. After all, the colour of one's hair also constitutes personal data. It is also important to distinguish between protected and unprotected personal data. The 'identifiability' of natural persons plays a considerable role in making this distinction (Bolognini & Bistolfi, 2016). Information regarding natural persons not falling in the scope of the definition of personal data and, in particular, not meeting the identifiability condition does not belong to the category of protected personal data (Article 29 Data Protection Working Party, 2007). The mentioned Regulation does not apply to such information. Therefore, the Regulation only applies to information that meets the criteria listed in the personal data definition, especially the identifiability condition. With respect to identifiability, the question of who determines whether a person can be distinguished from all other individuals is crucial. Above all, the concept of identifiability must be considered in the broadest possible sense and not merely on the basis of one's own capabilities (Informacijski pooblaščenec, 2017a). The rules enshrined in the GDPR therefore apply to clearly defined cases. For instance, these rules do not need to be followed where a natural person keeps a database containing personal data for their own use. On the other hand, natural persons are not allowed to process certain types of personal data that are prescribed in other legal acts. Mobile devices and the data stored on them are crucial for our everyday lives. The fact such data may fall into the hands of unauthorised persons is 416 Domen Hribar, Miha Dvojmoč, Blaž Markelj therefore highly undesirable. The loss or unauthorised processing of any data, both conventional information as well as data stored on any information and communications technology devices (henceforth: ICT devices), is extremely unpleasant. This is particularly problematic when considering the use of ICT devices where data protection issues are even more complex. Mobile devices are exposed to various, unique risks. For instance, a mobile device is easy to lose, which potentially jeopardises all the data stored on it. Apart from external risks, individuals also tend to transfer large quantities of data whose origin, reliability and security are unknown (Hettrich, 2015). For instance, we all use various applications that are downloaded to our mobile devices, yet we are unaware or may not even care about the type of data being collected about us. Such applications often collect data they should not be collecting or may actually require less data for their normal functioning, meaning they are in full breach of the principle of minimisation (Pedro, 2016). 2 THE GDPR IN BRIEF In April 2016, the European Parliament and the Council adopted the General Data Protection Regulation (GDPR, 2016) and the Directive on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences (Informacijski pooblaščenec, n. d.). Both legal acts pay considerable attention to the processing and management of personal data. This paper focuses merely on the GDPR, which entered into force in May 2018. The fact that technological development has brought numerous changes in the past few years was one of many arguments underpinning adoption of the GDPR. In fact, the cyber world is developing, changing and spreading extremely fast, thus demanding necessary amendments to the applicable legislation. Such legislative amendments must not restrict further development, but create an environment in which individuals are able to trust the already guaranteed human rights and simultaneously use modern technologies to freely conduct their business. The GDPR also increases the level of individuals' rights, thus serving the interests of the people. Personal data protection is extremely important for the protection of human rights and so must find its place among other fundamental rights in such a way that it will strike the right balance with other rights and freedoms. Slovenia is in a somewhat better position than other countries, which are still dealing with a larger number of more complex issues. It must be stressed that the new GDPR contains standardised provisions for the entire territory of the European Union (EU). Hence, the level of personal data protection in countries, such as Malta, Poland and the Czech Republic, is lower than in Slovenia since they have been facing several unresolved issues already at the level of legislative discussions (Baker McKenzie, 2017). Article 38 of the Constitution of the Republic of Slovenia (Ustava Republike Slovenije, 1991) defines certain fundamental rights of individuals concerning the protection of personal data, e.g. the right to be informed of the fact that personal data related to individuals are being collected and the right to judicial protection). Personal data protection is also regulated 417 The Impact of the EU General Data Protection Regulation (GDPR) on Mobile Devices by the current Personal Data Protection Act (Zakon o varstvu osebnih podatkov [ZVOP-1-UPB1], 2004), which has many similarities with the new GDPR (yet also several inconsistencies, which raise the problems discussed in the conclusion of this paper). The GDPR also contains provisions on the protection of children, an area not regulated until now. Children constitute a vulnerable group which is unaware of the potential consequences of personal data collection and processing. As such, they are subject to extra protection in numerous articles of the GDPR (GDPR, 2016). For instance, the GDPR defines the age limit for acquiring a child's consent for personal data processing. Organisations therefore violate the law if they process personal data of children below the defined age limit without having first obtaining the consent of the holder of parental responsibility (Ministrstvo za pravosodje RS, 2017). 3 FUNDAMENTAL CHANGES Even though some similarities between the current Personal Data Protection Act (ZVOP-1-UPB1, 2004) and the new GDPR may be observed, the latter introduces a series of fundamental changes. These impact the retention, processing and management of personal data, as well as the rights of individuals. Changes in the area of personal data protection can be divided into two distinct parts. The first encompasses the rights of individuals, while the second refers to data controllers and processors. 3.1 Changes Relating to the Rights of Individuals • Greater control and a more effective exercise of control; • Easier access to one's own personal data; • The right to be forgotten; • The right to information regarding the retention period of personal data; • The right to data portability; • The right to judicial protection and sanctions; • Individuals must not be subjected to measures based solely on profiling, analyses or predictions obtained by the means of automated processing (Informacijski pooblaščenec, 2017b). The right to be forgotten, which may be described as a novelty in the field of personal data protection, is merely an extension and a stronger version of the right of individuals who wish to withdraw their consent for the processing of personal data on the basis of a legal act. The right to erasure is defined in Article 32 of the Personal Data Protection Act (ZVOP-1-UPB1, 2004), albeit under a slightly different name. This field has now been altered so that it is easier for individuals to invoke their right to be forgotten and to implement their requests for erasure faster (GDPR, 2016). The same conclusion was reached by Mantelero (2013) who stated the right to be forgotten was not a revolutionary change in the current rules since Article 12 of Directive 95/46/CE (a predecessor of the GDPR) had already given a similar right. The changes thus mainly relate to the way in which this right can be invoked. The Personal Data Protection Act (ZVOP-1-UPB1, 2004) prescribes that individuals must prove that personal data were incomplete, inaccurate or 418 Domen Hribar, Miha Dvojmoč, Blaž Markelj obtained unlawfully. On the other hand, the GDPR (2016) does not contain the same requirement. This new aspect may be a thorn in the side of organisations not only because they are now required to prove that the request for erasure was unjustified, but also due to the much higher fines the GDPR introduces. The impact of this change and some specific examples are presented in the following sections. A similar situation occurs with the right to judicial protection and sanctions. Article 34 of the Personal Data Protection Act (ZVOP-1-UPB1, 2004) provides for the judicial protection of individuals' rights and the possibility of instituting administrative proceedings against certain decisions taken by data controllers. In this respect, the change refers to the fact that individuals now have to right to lodge a complaint without prejudice to any other administrative or legal remedy (GDPR, 2016). Individuals have thus obtained additional remedies for invoking their rights. 3.2 Changes Relating to Data Controllers and Processors • Collecting personal data on the basis of consent - consent shall be provided in the form of a clear and plain language declaration and contain a clear affirmative action, which the processor must be able to demonstrate; • The withdrawal of consent must be as easy as giving consent; • Data controllers must consider the principles of data protection by design and by default; • Data controllers must provide individuals with transparent and easily accessible information about the processing of their personal data; • Obligatory notification of a personal data breach; • Designation of a data protection officer; • Records of processing activities; • Prior impact assessments (Informacijski pooblaščenec, 2017b). The applicable Slovenian law already contains a provision similar to that in indent four. Under Article 30 of the Personal Data Protection Act (ZVOP-1-UPB1, 2004), individuals have the right to be informed about the personal data relating to them. At the same time, they have the right to have their data erased if they are incomplete or inaccurate or were processed contrary to the ZVOP-1-UPB1 (2004). The novelty is that access to data is easier and simpler, with data having to be presented in an easily understandable manner. This will facilitate the operation of certain companies. If a company conducts business in several countries, the control over individual branches will be exercised by the headquarters. This will enable simpler and more consistent control operations. It will also lead to a decrease of administrative and other burdens (Voss, 2014), particularly because the GDPR applies to the entire EU territory. 4 MOBILE DEVICES AND THE GDPR The GDPR's impact is also observed in mobile applications, particularly in relation to consent and the right to be forgotten. As mentioned, the GDPR (2016) 419 The Impact of the EU General Data Protection Regulation (GDPR) on Mobile Devices introduces specific conditions for giving consent to the processing of personal data. Consent must be given "in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language" (GDPR, 2016, Article 7). At the same time, the GDPR stipulates that it must be as easy to withdraw as to give consent. Some applications have already been updated in order to adjust to these conditions. This is mainly shown in the numerous requests for renewed consent. Data controllers were particularly busy with verifying the existing forms of consent (GDPR, 2016). On the other hand, this change does not pose any particular challenge for individuals but enables them to obtain information more easily and facilitates their decision on whether to continue using a specific application. This change also brings advantages for data controllers and processors since they have used this opportunity to obtain an overview of data previously collected by organisations. The approval for the processing of data has been strengthened with respect to children, who are a more vulnerable group that is presumably unaware of all potential risks arising from the sharing of personal data. According to the GDPR, children below a certain age must obtain the consent of a holder of parental responsibility to use certain applications, while such consent must not be conditional on excessive conditions set by the controller (Ministrstvo za pravosodje RS, 2017), which would prevent the child's participation in or use of an application. Social media use is a case in point. Another question here is how exactly the consent based on obtaining the parental agreement is verified (Tikkinen-Piri, Rohunen, & Markkula, 2018). Significant problems also relate to verifying the age limit. Therefore, it will be neither easy nor inexpensive for organisations to determine the actual age of users. The issue of consent might become even more complex upon the merging of different databases. The collection of certain types of data does not require individuals' consent since they are not considered personal data. However, after a given period or after databases are merged individuals may become identifiable, demanding direct application of the GDPR (2016). Sullivan and Burger (2017) emphasise the spread of EU policy to other areas, particularly the fact EU wishes to expand its influence to third countries, thus creating a future data protection system at the international level. Users may be affected by the websites or mobile applications of providers not headquartered in the EU. Gilbert (2016) finds that the GDPR (2016) does affect companies without their headquarters in the EU when their services are used by individuals in the EU. One can thus presume that certain products or services are no longer present in the EU market or their presence has either dramatically decreased or being unlawfully provided. Irrespective of the presence of services within or outside the EU, the new GDPR provides the clearer and more transparent processing of personal data, meaning that individuals may expect fewer unwanted advertisements, unsolicited calls and e-mails (DPOrganizer, n. d.). Data controllers will have to closely monitor how the right to erasure is being implemented as it may happen that certain information that ought to have been erased will remain in databases (Voss, 2017). For instance, "Moneysupermarket", an English company, sent 7.1 million e-mails to consumers who had previously stated they no longer wished 420 Domen Hribar, Miha Dvojmoč, Blaž Markelj to receive e-mails from the company (Information Commissioner's Office, 2017). A fine of GBP 80,000 was imposed on the company. Eation (2017) claims that had the new GDPR been applicable at the time the company would have faced a fine of GBP 12.6 million for the same infringement. Apart from substantial fines, the mentioned author stresses the quality of the data, which are gradually becoming inaccurate. Users who use their mobile devices for business purposes must ensure their databases are up to date. The easiest way to achieve this is to enable remote access without the possibility of transferring personal data. In the future, remote access will become increasingly widespread. This will have a special impact on the migration of databases since data can become inaccurate quite quickly. However, if remote access is the only type of access to such databases, data controllers find it easier to update personal data, while the risk of abuse falls. Companies will mainly be obliged to check where and what type of data are stored on mobile devices, where (backup) copies of such data have been created and are being processed. Following an impact assessment, an additional level of security will have to be implemented. This is why the GDPR (2016) promotes the pseudonymisation of personal data. Additional issues relate to when smartphones used for both private and professional purposes are lost. This is acutely problematic when devices contain personal data. In this case, employees are obliged to inform their employers about the misappropriation, unauthorised access to or loss of data (Sire, n. d.). In order to avoid fines or inconvenience caused to their clients, employers are advised to erase the data remotely (Ledino, 2012). These options are regularly used in everyday practice. Voss (2017) also notes that Article 34 of the GDPR obliges data controllers to inform individuals of a personal data breach when that breach is likely to result in a high risk to the rights and freedoms of private individuals. In terms of mobile applications, it is likely the individuals informed of such a breach will lose their trust and stop using the application. De Hert and Papakonstantinou (2016) contend such notifications would be extremely rare. They believe the relevant provisions obliging that individuals be informed of data protection breaches are quite vague since they allow a great deal of leeway for data controllers to avoid such communications. Ducato (2016) stresses that some changes may also arise in relation to cloud computing. She finds that the environment surrounding cloud computing might become more complex, especially because of transparency and accountability obligations. Both data recipients and data controllers were forced to introduce certain changes. For instance, companies conducting business transactions via mobile devices and simultaneously storing the data in a cloud are a case in point. Personal data entered into the device and stored in the cloud pose a challenge to data controllers, particularly in terms of the device's security. Companies will have to conduct an impact assessment to determine whether additional security features are needed to guarantee the required level of protection (GDPR, 2016). If the data are to be uploaded and stored directly in the cloud, individuals will have to be informed about the location of data storage. If devices are used for both private and professional purposes, individual files must be protected through additional means and unauthorised access to personal data by third parties 421 The Impact of the EU General Data Protection Regulation (GDPR) on Mobile Devices prevented. Even though the Personal Data Protection Act (ZVOP-1-UPB1, 2004) already required this level of security, the new GDPR imposes much higher fines for infringements. Therefore, violation of the GDPR may result in a maximum fine of EUR 20 million or 4% of the total worldwide annual turnover for the preceding financial year (GDPR, 2016). High fines will thus 'encourage' data controllers to handle personal data much more cautiously. 5 RESEARCH RESULTS The research study presented here relied on a questionnaire available via the www.1ka.com online application. Respondents could provide answers between 9 January 2018 and 10 March 2018. A total of 246 questionnaires was partially completed. Not all respondents provided answers to all questions, which is why the N figure for individual answers varies and is presented below the respective results. Table 1: Overview of answers related to the concept of personal data Answer No. of answers N (%) 1 (No, I have never heard of that) 0 0% 2 (It sounds familiar) 29 12% 3 (I have heard about it) 21 9% 4 (I know what personal data are) 195 79% Total N = 245 100% Table 1 shows the respondents' perception of the concept of personal data. The question was answered by 245 respondents. All respondents claim to be familiar with the 'personal data' concept in one way or another. No one indicated being unfamiliar with this concept. In fact, the overwhelming majority of respondents (79%) stated they knew the exact meaning of the concept of personal data. Table 2: Overview of answers related to personal data YES NO Not sure N (%) Tax identification no.? 196 6 1 203 97% 3% 0% 100% Height? 90 94 15 199 45% 47% 8% 100% Name and surname? 181 15 4 200 91% 8% 2% 100% Facial image? 147 33 17 197 75% 17% 9% 100% DNA? 186 6 9 201 93% 3% 4% 100% Today's weather? 1 187 7 195 1% 96% 4% 100% 422 Domen Hribar, Miha Dvojmoč, Blaž Markelj YES NO Not sure N (%) Fingerprints? 190 6 5 201 95% 3% 2% 100% Username for an online forum? 84 87 26 197 43% 44% 13% 100% No. of inhabitants in a country? 2 188 5 195 1% 96% 3% 100% Dental X-ray image? 155 29 13 197 79% 15% 7% 100% Religious belief together with eye colour and the status of a city councillor (in Ljubljana)? 89 76 33 198 45% 38% 17% 100% Table 2: Continuation Table 2 shows answers to the question of whether the specific information described above constitute personal data. The differences in the number of answers are relatively small. The biggest difference amounts to 8 answers, which is negligible given the highest number of answers, i.e. 203. The responses show that all data with the exception of "today's weather" and the "number of inhabitants in a country" constitute personal data. A large majority of respondents (90%) thus recognised the two types of data that are not considered personal data and marked them accordingly. The name and surname category actually consists of two separate items of personal data since any information related to an identified individual is considered personal data. This category should therefore be split into two parts. The majority of respondents, i.e. more than 90%, provided correct answers to the more unambiguous questions such as "tax identification number", "name and surname", "DNA" and "fingerprints". They were slightly more hesitant with "dental X-ray image" and "facial image", however, three-quarters or more of the respondents answered correctly. Respondents' opinions diverged more with respect to an individual's "height", "username for an online forum" and "religious belief together with eye colour and the status of a city councillor (in Ljubljana)". All three categories attracted the highest number of "not sure" answers. At the same time, respondents' opinions on whether this type of information constitutes personal data seem to be split. Most respondents gave correct answers with respect to the last category, yet this question also had the biggest share (17%) of "not sure". Table 3: Overview of answers regarding special categories of personal data YES NO N (%) Personal identification no. 152 48 200 76% 24% 100% Information on sexual orientation 142 57 199 71% 29% 100% Vehicle registration plate details 60 136 196 31% 69% 100% 423 The Impact of the EU General Data Protection Regulation (GDPR) on Mobile Devices Table 3: Continuation YES NO N (%) Tax identification no. CO 52 200 74% 26% 100% Year of birth 83 114 197 42% 58% 100% Political opinion 105 89 194 54% 46% 100% Table 3 presents answers concerning certain types of sensitive personal data now, i.e. after the entry into force of the new GDPR, referred to as special categories of personal data. Again, the difference in answers is relatively small, whereas the largest difference is six answers. Among the listed personal data types, only "information about sexual orientation" and "political opinion" are considered special categories of personal data, while the remaining data types are classified as conventional personal data. With respect to sexual orientation, 71% of the respondents answered correctly while 54% of them gave correct answers for political opinion. Interestingly, 42% of the respondents believe that year of birth falls in the special category of personal data. Table 4: Overview of answers regarding the question of risks to security Table 5: Overview of answers regarding the collection of personal data Unlikely Less likely Neither likely nor unlikely Likely Highly likely Total: [N] 0 31 40 92 32 195 0% 16% 21% 47% 16% 100% Table 4 shows whether the abuse of personal data may result in a serious risk to individuals' security. The question itself was not specified in any further detail, leaving the interpretation up to individual respondents. Almost 50% of the respondents believe the abuse of personal data would likely lead to a serious risk with regard to individuals' security. All 195 respondents agree that such events are likely to some degree. 1 - I do not know 2 3 4 5 - I know very well Total Who collects your personal data? 12 31 85 53 17 9 GO 6% 16% 43% 27% 9% 100% Which personal data are collected? 9 27 75 57 17 195 5% 14% 38% 28% 9% 100% What is the purpose of the data collection and processing? 15 51 58 54 17 194 8% 26% 30% 28% 9% 100% What is the extent of the data collection? 17 51 76 37 13 194 9% 26% 39% 19% 7% 100% Can your data can be transferred to a third party? 22 31 65 48 28 194 11% 16% 39% 25% 14% 100% 424 Domen Hribar, Miha Dvojmoč, Blaž Markelj Table 5 shows how well the respondents are informed of the above elements when downloading mobile applications to their mobile devices. We were particularly interested in whether they knew who collected their personal data, which personal data were collected, what was the purpose of processing that data, what was the extent of the data being collected and whether their data could be transferred to a third party. Respondents were asked to provide their answers on a 5-point Likert scale. The table shows that the distribution of answers concentrates somewhat around average values. The opinions of the respondents were not extremely divergent, meaning they either did not know the answers to the above questions or knew them very well. Nevertheless, a slight tendency towards more affirmative responses, particularly with respect to "who collects your personal data", may be observed. The answers in Table 5 correspond to those shown in Table 6, which contains information regarding the respondents' awareness of the statements below. No two questions in the table actually appeared alongside each other in the questionnaire. I am aware I am not aware N % Who collects your personal data? 124 70 194 64% 36% 100% Which personal data are collected? 130 66 196 66% 34% 100% What is the purpose of the data collection and processing? 105 89 194 54% 46% 100% What is the extent of the data collection? 73 119 192 38% 62% 100% Can your data be transferred to a third party? 122 68 190 64% 36% 100% Table 6: Overview of answers regarding the awareness of the collection of personal data Tables 5 and 6 provide the same choice of possible answers, with the only difference being in the answers. In Table 6, respondents could answer by selecting "I am aware" or "I am not aware". The results show strong correlations with the answers in Table 5 for each question posed. When an answer in Table 5 lent towards "I don't know", the answer in Table 6 fell into the "I am not aware" category. For instance, with respect to the question "What is the extent of the data collection?", 62% of the respondents stated they were unaware of the extent of the data being collected, as presented in Table 6. Most respondents answered the same question by choosing answers closer to the "I don't know" category, as shown in Table 5. We were also interested in determining what respondents were willing to do to ensure additional protection of their mobile devices. The results are given in Table 7. 425 The Impact of the EU General Data Protection Regulation (GDPR) on Mobile Devices Table 7: Overview of answers regarding respondents' willingness to adopt additional measures M .¡a TS 6B M .¡a nor unwil M in M in 'J S "o e 6B