  After one year since the entry into force of the GDPR, all web sites and data
controllers have updated their procedures to store users' data. The GDPR does
not only cover how and what data should be saved by the service providers, but
it also guarantees an easy way to know what data are collected and the freedom
to export them.
  In this paper, we carry out a comprehensive study on the right to access data
provided by Article 15 of the GDPR. We examined more than 300 data controllers,
performing for each of them a request to access personal data. We found that
almost each data controller has a slightly different procedure to fulfill the
request and several ways to provide data back to the user, from a structured
file like CSV to a screenshot of the monitor. We measure the time needed to
complete the access data request and the completeness of the information
provided. After this phase of data gathering, we analyze the authentication
process followed by the data controllers to establish the identity of the
requester. We find that 50.4\% of the data controllers that handled the
request, even if they store the data in compliance with the GDPR, have flaws in
the procedure of identifying the users or in the phase of sending the data,
exposing the users to new threats. With the undesired and surprising result
that the GDPR, in its present deployment, has actually decreased the privacy of
the users of web services.
