Assessing an app's GDPR compliance needs legal, privacy and technical experts to work together, yet the evidence sits in source code that most assessors cannot read. These papers study how privacy assessments work in practice and present Assessor View, a tool that extracts privacy-relevant information from Android apps and presents it in terms DPOs and legal experts can work with.
Assessor View generates a first draft of the Record of Processing Activities (RoPA, GDPR Art. 30) directly from an app, and adds a shared dashboard where privacy experts and developers can discuss findings. In interviews, six privacy experts said the RoPA gave them a good overview of the data being processed and made it easier to communicate with technical teams.
We interviewed 16 experts about how privacy assessments work in practice. They described knowledge and communication gaps between legal and technical experts, the trade-off between privacy and innovation, privacy professionals being brought in too late, and a lack of tools that analyse source code. In a user study with Assessor View, DPOs and privacy experts found its GDPR warnings and guidance valuable.
Privacy assessments depend on legal experts, privacy experts and developers understanding each other. This paper argues that automation can close that gap and introduces Assessor View, which extracts privacy-relevant information from an app and presents it to assessors who do not read code.