The GDPR aims to control the risks associated with the processing of personal data. It requires measures to minimise these risks and gives data subjects certain powers, such as the rights to be... Show moreThe GDPR aims to control the risks associated with the processing of personal data. It requires measures to minimise these risks and gives data subjects certain powers, such as the rights to be informed and to be forgotten. Big data is a relatively new technology, giving the controllers of data the power to permanently observe the users of digital services. Therefore this thesis answers the question whether the GDPR is suited to avert the risks and power shifts associated with big data. To answer this question, the GDPR is compared to earlier EU legislation associated with technological risks and power shifts. Additionally, the suitability of the GDPR’s anti-discrimination provisions are evaluated for the prevention of algorithmic discrimination. Results: The GDPR is not based on any discernible analysis of the risks of big data. Methods from EU environmental protection law and consumer protection law, aimed at technological risks and power shifts, were not applied. This can make evaluation of the GDPR’s effectiveness more difficult and could stand in the way of developing a coherent body of case law. The conclusion proposes a number of guidelines for the decision of court cases and points for evaluating the GDPR. Show less
The GDPR poses special requirements for the processing of sensitive data, but it is not clear whether these requirements are sufficient to prevent the risk associated with this processing because...
The GDPR poses special requirements for the processing of sensitive data, but it is not clear whether these requirements are sufficient to prevent the risk associated with this processing because this risk is not clearly defined.
Furthermore, the GDPR’s clauses on the processing of—and profiling based on—sensitive data do not sufficiently account for the fact that individual data subjects are parts of complex systems, whose emergent properties betray sensitive traits from non-sensitive data.
The algorithms used to process big data are largely opaque to both controllers and data subjects: if the output of an algorithm has discriminatory effects coinciding with sensitive traits because the algorithm accidentally discerns an emergent property, this may remain unnoticed. At the moment, there are no remedies that can prevent the discovery of sensitive traits from non-sensitive data.
Managing the risks resulting from processing data that can reveal sensitive traits requires a strategy combining precautionary measures, public discourse, and enforcement until the risks are more completely understood. Insights from complex systems science are likely to be useful in better understanding these risks.
Several authors have compared the impact of Big Data to the environmental impact of industrialisation (Kuneva, 2009, Schneier, 2013, Hirsch, 2006). This analogy seems useful: like the exhaust and... Show moreSeveral authors have compared the impact of Big Data to the environmental impact of industrialisation (Kuneva, 2009, Schneier, 2013, Hirsch, 2006). This analogy seems useful: like the exhaust and use of chemical compounds, the omnipresent generation and subsequent use of personal data can impact individuals as well as society as a whole. Similarly to the effects of industrialisation, adverse side-effects of datafication on individuals, societies and ecosystems could manifest themselves only years later and in seemingly unrelated contexts.Industrialised societies have enacted laws in response to the adverse environmental effects of industrialisation. Theories from modern sociology and public awareness have played a significant role in this process. Similarly, the European Union has enacted the General Data Protection Regulation to address the risks of processing of personal data. But laws tend to come only after any negative impact has become sufficiently apparent. This has spurred the introduction of precaution- and discourse-based management of unknown risks. The GDPR appears to implement these risk management mechanisms less extensively than current environmental protection laws.As with the effects of industrialisation, the side-effects of datafication cannot be entirely known in advance. Privacy is currently a prime concern, but datafication can also affect entire societies if it results in a “digital panopticon”. Considering the influence of Risk Society Theory and Normal Accident Theory, two important social theories concerning industrial hazards, this article proposes a number of areas where future iterations of data protection law can be developed. Show less
As a result of datafication (the generation and acquisition of personal data from automated processes), consumers’ activities generate large data streams. Analysis of these streams reduces privacy... Show moreAs a result of datafication (the generation and acquisition of personal data from automated processes), consumers’ activities generate large data streams. Analysis of these streams reduces privacy and shifts power towards data controllers. Consumers often contractually agree to this analysis of their data, but their autonomy can be questioned: the agreements often contain non-negotiable terms unilaterally drafted by data controllers. Consumer protection law can alleviate this power shift towards data controllers, but only if EU member states increase their enforcement efforts. Show less