ARTICLE SUMMARY
Summary:
Existing data protection rules are mostly procedural, focused on notice and consent. A “relational” privacy model would prohibit some data practices without considering consent.
POLICY RELEVANCE
Policy Relevance:
A relational model would better protect civil liberties.
KEY TAKEAWAYS
Key Takeaways:
- Privacy rules that differ at first glance, such as those of the US and the EU, all tend to focus on data collection, processing, access, and deletion, as well as considering whether the data is personal, sensitive, or anonymized.
- Fair Information Practices (FIPs) provide a blueprint for privacy law on both sides of the Atlantic, and tend to focus on procedural rights of notice and choice; however, FIPs often lack prohibitions on particular kinds of data practices.
- A different approach to privacy, a "relational turn," would consider how people who disclose data and those who invite disclosures relate to each other.
- Powerful parties may have obligations to vulnerable people.
- Privacy regulators failed to anticipate the power of large tech firms.
- Powerful parties may have obligations to vulnerable people.
- Tech companies should have duties of loyalty, confidentiality, and care to their users.
- Data privacy concerns civil rights, free expression, freedom from harassment, collective autonomy, and use of data to manipulate individuals and undermine public institutions.
- A relational turn in privacy would provide substantive rules that would limit how people's data could be used against them.
- Relational privacy rules would jettison the concept of consent, along with concerns about whether consent was truly meaningful and informed; people would be protected no matter what they choose.
- The European Commission's proposed Data Governance Act would follow the relational model; data sharers would have a fiduciary duty to data subjects.