Reviewer has chosen to be Anonymous

Summary of paper in a few sentences (summary of changes and improvements for second round reviews):

The submitted manuscript presents a new tool for anonymizing data download packages (DDPs) released by online service providers (data controllers) in the context of the GDPR. The main motivation behind this tool is to enable researchers to make use of these DDPs for scientific purposes. The provided tool is tested with 11 participants creating fake Instagram profiles and actively using them for about a week. It is a revised version of previously submitted manuscript.

Reasons to accept:

- The work is overall well presented and detailed, with a clear motivation and a sound approach
- The empirical results of the improved script are excellent
- Both the scripts and dataset are made open source
- The proposed tool is applicable to different social media

Reasons to reject:

- The method used to hide faces in images/videos previously shown to be prone to re-identification attacks

Nanopublication comments:

Further comments:

Except for one point, the authors have addressed all the main weaknesses in their revised manuscript. In particular, they have clearly positioned their work with respect to prior literature and referenced the missing tools. The authors also convinced me that the submitted paper fits within the journal scope. The authors have further shown that their tool could be applied more broadly than just to Instagram by providing a detailed table on the features of five prominent social networks (Instagram, Facebook, Twitter, Snapchat, WhatsApp). This table includes valuable information about the types of PII present in the different social networks, the information in the DDP, the format of the DDP files, etc. This table clearly demonstrates that different social networks share similar features and formats, and thus that the tool's impact goes beyond Instagram.

The authors have not addressed the last weakness that I listed in my review, i.e., that the method used to hide faces in images/videos is prone to re-identification attacks. However, as they noted in their revision letter, the tool is made of various de-identification modules and could be complemented later with more robust methods for face hiding. I think this goes beyond the scope of this work.

On a negative side, there still remain many typos, like:
- includede
- feature based -> feature-based
- anonimizing
- person identifiable information -> personal identifiable information
- DDP's
- Rephrase the last sentence of Section 7.

Reviewer has chosen to be Anonymous

Summary of paper in a few sentences (summary of changes and improvements for second round reviews):

The manuscript described the process of de-identification through the use of an algorithm proposed by the authors. The authors are describing the problem and background well, clearly setting the scene for this research. The manuscript has been mostly rewritten in a way that is now easy to read and more understandable, and the authors have made huge progress in terms of sentence structure and style. It is clear that the authors have taken in great consideration the feedbacks and have implemented the given suggestions. Moreover, the “Methods” and “Results” sections are now well described and understandable.

Overall, the authors have made huge improvements and they have elevated the quality of their work. All of the comments given have been addressed, and the style of the paper has been optimised.

Reasons to accept:

Overall, the topic addressed in the manuscript is relevant to the DataScience platform and the authors have described well the importance of the work done.

Reasons to reject:

I think this paper should be accepted.

Nanopublication comments:

Further comments:

Great improvements were made compared to the first paper.