Personal data protection: are the GDPR objectives achieved amongst information and communication students?
Research Source
Since 2018, the General Data Protection Regulation (GDPR), European Union regulation, demands transparency from companies and imposes new restrictions on data transfers (Botchorishvili, 2017). The purpose of this article is to analyze the uses and representations of information and communication science students regarding the RGPD and to compare it with that of students in the education sciences.
Executive Summary
This research paper examines a critical privacy challenge related to POWER ASYMMETRY — the collector designs the system, profits from collection, writes the rules, and lobbies for the legal framework.
anonym.legal addresses this through Chrome Extension anonymizing PII in real-time inside ChatGPT, Claude, and Gemini, plus Office Add-in for document-level protection.
This is a fundamental structural limit. anonym.legal provides targeted mitigation at the application layer rather than attempting to resolve the underlying systemic dynamic.
Root Cause: SD3 — POWER ASYMMETRY
The collector designs the system, profits from collection, writes the rules, and lobbies for the legal framework. The individual is a passenger in a vehicle they did not build, cannot inspect, and cannot exit.
Irreducible truth: This is not a technical problem. It is structural. The entity collecting PII designs the collection mechanism, the consent interface, the deletion process, and lobbies for the legal framework. No tool can fix a power imbalance that is architectural.
The Solution: How anonym.legal Addresses This
Detection Capabilities
anonym.legal identifies 260+ entity types including advertising identifiers, browsing history, purchase records, interest profiles. The 3-layer hybrid (Presidio + NLP + Stance classification) architecture uses Microsoft Presidio deterministic rules with checksum validations (Luhn, RFC-822) for structured identifiers and XLM-RoBERTa + Stanza NER with Stance classification for disambiguation for contextual references.
Anonymization Methods
Redact is recommended for this pain point: anonymizing PII before it enters advertising systems reduces personal data available for surveillance capitalism. Hash provides an alternative — hashing advertising identifiers enables aggregate analytics while breaking individual ad targeting. For scenarios requiring reversibility, Encrypt (AES-256-GCM) enables authorized recovery of original values.
Architecture & Deployment
The REST API (Basic plan+, €3/month) provides programmatic PII detection with Bearer token auth. Rate limited to 100 req/min, max 100 KB per request — the most accessible API entry point in the ecosystem.
Structural Limits
This pain point stems from POWER ASYMMETRY , a structural dynamic that no technology can fully resolve. Within these limits, anonym.legal provides targeted mitigations:
When fines equal three weeks of revenue, the economic incentive to collect PII remains. anonym.legal provides individual countermeasures — the Chrome Extension prevents PII leakage to AI platforms, the REST API enables pre-pipeline anonymization.
Compliance Mapping
This pain point intersects with GDPR Article 6 lawful basis, Article 21 right to object to direct marketing.
anonym.legal’s GDPR, HIPAA, PCI-DSS, ISO 27001 compliance coverage, combined with Hetzner Germany, ISO 27001 certified hosting, provides documented technical measures organizations can reference in their compliance documentation and regulatory submissions.
Product Specifications
| Specification | Value |
|---|---|
| Platform Version | v7.4.4 |
| Entity Types | 260+ |
| Detection Layers | 3-layer: Presidio + NLP + Stance classification |
| Accuracy | 95.5% tested (42/44 tests) |
| Languages | 48 |
| Anonymization Methods | Replace, Redact, Mask, Hash (SHA-256/512/MD5), Encrypt (AES-256-GCM) |
| Platforms | Web App, Desktop, Office Add-in, MCP Server, Chrome Extension, REST API |
| Pricing | Free €0, Basic €3, Pro €15, Business €29 |
| Hosting | Hetzner Germany, ISO 27001 |
| Compliance | GDPR, HIPAA, PCI-DSS, ISO 27001 |
Research Limitations
Academic Scope: This summary reflects findings from the original academic research paper. Implementation contexts, regulatory landscapes, and technical capabilities may have evolved since publication. Readers should verify current best practices and compliance requirements in their jurisdiction.
Generalizability: Research findings may be specific to the studied populations, geographic regions, or technical environments described in the original paper. Organizations should evaluate applicability to their specific use case before adopting recommendations.
Not a Substitute for Legal/Compliance Advice: This research summary is provided for informational and educational purposes only. It does not constitute legal, compliance, or professional consulting advice. Consult qualified privacy counsel for GDPR, HIPAA, CCPA, or other regulatory compliance guidance.