TY - GEN
T1 - An empirical evaluation of GDPR compliance violations in android mhealth apps
AU - Fan, Ming
AU - Yu, Le
AU - Chen, Sen
AU - Zhou, Hao
AU - Luo, Xiapu
AU - Li, Shuyue
AU - Liu, Yang
AU - Liu, Jun
AU - Liu, Ting
N1 - Funding Information:
This work was supported by National Key R&D Program of China (2016YFB1000903), National Natural Science Foundation of China (61902306, 61632015, 61772408, U1766215, 61721002, 61532015, 61833015), Ministry of Education Innovation Research Team (IRT_17R86), China Postdoctoral Science Foundation (2019TQ0251), and the Key Research Program of State Grid Shaanxi Electric Power Company.
Publisher Copyright:
©2020 IEEE.
PY - 2020/10
Y1 - 2020/10
N2 - The purpose of the General Data Protection Regulation (GDPR) is to provide improved privacy protection. If an app controls personal data from users, it needs to be compliant with GDPR. However, GDPR lists general rules rather than exact step-by-step guidelines about how to develop an app that fulfills the requirements. Therefore, there may exist GDPR compliance violations in existing apps, which would pose severe privacy threats to app users. In this paper, we take mobile health applications (mHealth apps) as a peephole to examine the status quo of GDPR compliance in Android apps. We first propose an automated system, named HPDROID, to bridge the semantic gap between the general rules of GDPR and the app implementations by identifying the data practices declared in the app privacy policy and the data relevant behaviors in the app code. Then, based on HPDROID, we detect three kinds of GDPR compliance violations, including the incompleteness of privacy policy, the inconsistency of data collections, and the insecurity of data transmission. We perform an empirical evaluation of 796 mHealth apps. The results reveal that 189 (23.7%) of them do not provide complete privacy policies. Moreover, 59 apps collect sensitive data through different measures, but 46 (77.9%) of them contain at least one inconsistent collection behavior. Even worse, among the 59 apps, only 8 apps try to ensure the transmission security of collected data. However, all of them contain at least one encryption or SSL misuse. Our work exposes severe privacy issues to raise awareness of privacy protection for app users and developers.
AB - The purpose of the General Data Protection Regulation (GDPR) is to provide improved privacy protection. If an app controls personal data from users, it needs to be compliant with GDPR. However, GDPR lists general rules rather than exact step-by-step guidelines about how to develop an app that fulfills the requirements. Therefore, there may exist GDPR compliance violations in existing apps, which would pose severe privacy threats to app users. In this paper, we take mobile health applications (mHealth apps) as a peephole to examine the status quo of GDPR compliance in Android apps. We first propose an automated system, named HPDROID, to bridge the semantic gap between the general rules of GDPR and the app implementations by identifying the data practices declared in the app privacy policy and the data relevant behaviors in the app code. Then, based on HPDROID, we detect three kinds of GDPR compliance violations, including the incompleteness of privacy policy, the inconsistency of data collections, and the insecurity of data transmission. We perform an empirical evaluation of 796 mHealth apps. The results reveal that 189 (23.7%) of them do not provide complete privacy policies. Moreover, 59 apps collect sensitive data through different measures, but 46 (77.9%) of them contain at least one inconsistent collection behavior. Even worse, among the 59 apps, only 8 apps try to ensure the transmission security of collected data. However, all of them contain at least one encryption or SSL misuse. Our work exposes severe privacy issues to raise awareness of privacy protection for app users and developers.
KW - Data flow
KW - GDPR
KW - GUI
KW - Privacy policy
UR - http://www.scopus.com/inward/record.url?scp=85097341528&partnerID=8YFLogxK
U2 - 10.1109/ISSRE5003.2020.00032
DO - 10.1109/ISSRE5003.2020.00032
M3 - Conference article published in proceeding or book
AN - SCOPUS:85097341528
T3 - Proceedings - International Symposium on Software Reliability Engineering, ISSRE
SP - 253
EP - 264
BT - Proceedings - 2020 IEEE 31st International Symposium on Software Reliability Engineering, ISSRE 2020
A2 - Vieira, Marco
A2 - Madeira, Henrique
A2 - Antunes, Nuno
A2 - Zheng, Zheng
PB - IEEE Computer Society
T2 - 31st IEEE International Symposium on Software Reliability Engineering, ISSRE 2020
Y2 - 12 October 2020 through 15 October 2020
ER -