Personal data management and accountability: European regulation, market principles and civic agency strategies

ABSTRACT

Digital personal data could be used in different ways to administrate populations, as in the case of commercial exploitation and surveillance to regulate individuals’ preferences and behavior. In that sense, this article questions whether accountability can transform this kind of usage in two fronts: (a) to guarantee a certain degree of privacy and individual autonomy, and, (b) to replenish the asymmetries of power between personal data subjects and data processors. In order to do so, we analyze the accountability of personal data in three domains at European Level: state-rooted regulations, market principles, and civic agency strategies. The conclusion explores new forms to redefine the use of personal data through the production, consumption, and control of this information, analyzing the limits and potentials of accountability in each domain.

KEYWORDS:

• Accountability
• personal data
• commodification
• surveillance
• privacy

Acknowledgments

This work was supported by the ‘Basque Scientific Policy Office’ under the grant 2017/2018 of Professional Research and Training Program, and by the Research Committee in International Law and Governance of the ‘International Association of Political Science Students’.

Disclosure statement

No potential conflict of interest was reported by the author.

ORCID

Jaseff Raziel Yauri Miranda http://orcid.org/0000-0002-1419-0525

Notes

1 Charter of Fundamental Rights of the European Union. Official Journal of the European Communities. 12/2000. Available in: http://www.europarl.europa.eu/charter/pdf/text_en.pdf, access date 08/06/2017.

2 Court of Justice of the European Union (CJEU). Press release no. 70/14, Luxembourg, 13 May 2014. Case C-131/12, available at: https://curia.europa.eu/jcms/upload/docs/application/pdf/2014-05/cp140070en.pdf, [11/03/2018].

3 European Commission, Antitrust: Commission fines Google €2.42 billion for abusing dominance as search engine by giving illegal advantage to own comparison shopping service, IP/17/1784 (27 June 2017); European Commission, Antitrust: Commission fines Google €2.42 billion for abusing dominance as search engine by giving illegal advantage to its own comparison shopping service, MEMO/17/1785.

4 European Data Protection Supervisor (EDPS), Opinion on coherent enforcement of fundamental rights in the age of big data. 23 Sep 2016. Available at: https://edps.europa.eu/sites/edp/files/publication/16-09-23_bigdata_opinion_en.pdf [18/04/2018]

5 European Parliament. Report on fundamental rights implications of big data: privacy, data protection, non-discrimination, security and law-enforcement, 20 Feb 2017. (2016/2225(INI)), disponible: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+REPORT+A8-2017-0044+0+DOC+XML+V0//EN, [20/04/2018].

6 “Since the Snowden revelations in May 2013 regarding national security surveillance, there has been a scramble for improved encryption services as a measure to protect consumers from surveillance and to win back consumer trust in using ICT services (especially cloud services). However, the use of encryption is not an absolute form of protection – there is an ongoing debate regarding the extent to which the private sector should help law enforcement agencies gain access to encrypted material”. United Nations Conference on Trade and Development. 2016. Data protection regulations and international data flows: Implications for trade and development, Genève Press: 52.

7 Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 per cent of the total worldwide annual turnover of the preceding financial year, whichever is higher. Official Journal of the European Union. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016.

8 One example of the technical vulnerabilities exploited by security agencies, such as the US CIA, was released in a series of documents acknowledged as “Vault 7”. The Guardian. What is WannaCry and why is it attacking global computers? 04/12/2017. Available in: https://www.theguardian.com/technology/2017/may/12/nhs-ransomware-cyber-attack-what-is-wanacrypt0r-20, access date 12/07/2017.

9 “The rules surrounding data protection and cross-border flows of data affect individuals, businesses and governments alike, making it essential to find approaches that address the concerns of all stakeholders in a balanced manner”. UN Conference on Trade and Developments: Implications for trade and development, 2016.

Additional information

Funding

This work was supported by the ‘Basque Scientific Policy Office’ under the grant 2017/2018 of Professional Research and Training Program, and by the Research Committee in International Law and Governance of the ‘International Association of Political Science Students’.