Privacy is Dead”- is the Law Sufficient in Protecting the Right to Privacy in the New Digital Age?

The internet and its capabilities are advancing in this new digital age. This is intrinsically reshaping what privacy means to individuals. Some would contend that privacy is dead, others positing that it simply needs to be redefined. In this article, I will explore the controversy surrounding privacy and why it is under threat despite the EU’s General Data Protection Regulation (GDPR) recognising a litany of privacy rights. To do this, I will discuss what privacy is in theory and how it operates in practice. Furthermore, I will examine how modalities such as the law, social norms, the market, and architecture (the design of digital systems) have aided both the erosion of privacy and the fight for it.

Privacy has been an everlasting concept, desired by human beings. However, what it means and looks like has always been a matter of contention. Privacy preserves Athenian ideals of private life,¹ and, fundamentally, it is the right to be left alone. Some definitions go beyond that, suggesting that privacy is ‘the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others’.² Privacy’s roots in ideas like autonomy make it increasingly important to authorities and society. Arguably, ‘the more apparent its [privacy] significance in the real world becomes, the more obscure the core and the limitations of the concept become’.³ In light of this and the growing information age, controlling and protecting the ideal becomes challenging. The GDPR focuses on the regulation of personal data processing, and strengthening individual control was a stated goal.⁴ Though the GDPR addresses privacy threats, it has been criticised for its lack of effectiveness.

Privacy under the GDPR in Practice

Navigating the digital world whilst maintaining privacy has become an increasing concern. However, the GDPR’s accentuation of individual control suggests that privacy is being preserved. Van Ooijen and Vrabec conceptualise individual control as the extent to which an individual is consciously aware of a situation and has the conscious intention and the ability to start, stop or maintain a situation.⁵ On this basis, consent is an important concept that signals an individual’s awareness. Article 4(11) of the GDPR defines consent as:[A]ny freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.⁶

This, in turn, promotes control. Although the purpose of this definition is to protect privacy by allowing the data subject to maintain control, the practical implementation of tracking walls, for example, implies that control is illusory. Tracking walls are a strategy used by data controllers to obtain consent for tracking; some have suggested that they are ‘take it or leave it’ decisions,⁷ requiring users to choose between giving up their privacy or not using the site. Due to psychological myopia – a bias that places more emphasis on immediate gratification than on long-term implications – users are compelled to give their consent. Thus, it can be argued that consent that has been coerced cannot be considered ‘freely given’. This demonstrates how modalities such as law and architecture contradict one another, resulting in a gap between the preservation of privacy in theory and in practice.

Furthermore, the ‘unambiguous’⁸ condition of consent raises questions. This is because Recital 32 provides that unambiguous consent may be signified by ticking a box.⁹ For this action to be considered ‘unambiguous’ is problematic, however, because simply ticking a box does not equate to consent. Although it is a physical affirmation of consent, researchers argue that individuals have normalised sacrificing their privacy and so tend to click without reading the terms and conditions. This means they are not aware of what they have consented to. Further, arguably, the information overload created by a site’s terms and conditions overwhelms a layperson and deters them from fully reading and understanding them. In light of this, can simply ticking a box be unambiguous consent when it does not take into account the factors that push individuals to behave in this way? This highlights how the lack of control over privacy has been internalised, thus changing social norms, which intrinsically alters how one navigates the internet.

Power in Privacy

Privacy as we once knew it no longer exists, owing to a change in social norms. Social media has made oversharing commonplace. This creates a ‘privacy paradox’¹⁰ as, socially, it has become acceptable to sacrifice one’s privacy, yet privacy is still desired and legally protected. Véliz therefore posits that privacy should be ‘reclaimed’¹¹ as opposed to redefined, in an era of ‘surveillance capitalism’.¹² This is interesting because it places an onus on the data subject – calling for self-regulation – which contradicts the GDPR’s approach of mainly limiting the controller, processor, and recipient. This offers a new stance on how privacy is viewed: whether it should be protected for us or whether we should protect it.

However, the fact that ‘personal data is the new oil of the internet and the new currency of the digital world’¹³ intensifies the power of that data, making it harder to control and protect. Thus, the argument for ‘reclaiming’ privacy becomes less appealing than simply redefining it according to where society now stands. Conversely, the market’s influence on personal data highlights that it is the new money; reclaiming the power of privacy may therefore be more beneficial to its preservation than redefining it. Ergo, although redefining privacy is easier, reclaiming it offers the greater protection.

GDPR Loopholes

Article 25 of the GDPR incorporates the broader ‘privacy by default’ notion, which the Regulation frames as ‘data protection by default’: ‘The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.’¹⁴ This data minimisation is vital because it prevents data subjects’ information from being overexposed. However, it might be argued that this is conditional exposure rather than privacy by default, because data subjects are fundamentally exposed to the processing of personal data on the condition that it is disclosed and necessary. Depending on the purpose, this might be readily justified.

Further, one way in which the GDPR fails to ensure control, and thus to protect privacy, is at the processing stage. The route personal data takes can be very opaque and complex.¹⁵ Data controllers and processors are often unaware of the parties that ultimately receive data subjects’ data. On the basis of Westin’s definition of privacy as the claim to determine ‘to what extent information about them is communicated to others’,¹⁶ if the route data takes beyond the data processor is opaque, then the extent of that communication cannot be controlled. Therefore, in terms of the scope and flow of data streams, individual control is certainly challenged;¹⁷ this is detrimental because, if control is the primary means of protecting data subjects’ privacy, then privacy is eradicated. This alludes to the stance that ‘privacy is dead’.

Conclusion

To conclude, privacy is preserved to an extent. Legislation such as the GDPR has created a mechanism for maintaining privacy; thus, to say it is dead is excessive. However, architectural and economic factors have challenged the status of privacy, leading to the idea that it is illusory and that its absence is inevitable. To argue that it needs to be reclaimed rather than redefined is compelling. Nevertheless, the growth of the digital age and the economic value of personal data challenge whether reclaiming privacy is practically possible. To improve the situation, privacy legislation that takes behavioural science into account should be introduced.

Footnote(S):

1. CJ Hoofnagle, B van der Sloot and F Zuiderveen Borgesius, ‘The European Union General Data Protection Regulation: What It Is and What It Means’ (2019) Information & Communications Technology Law.
2. AF Westin, Privacy and Freedom (Atheneum 1967).
3. K Komamura, ‘Privacy’s Past: The Ancient Concept and Its Implications for the Current Law of Privacy’ (2019) 96 Washington University Law Review.
4. V Reding, ‘Your Data, Your Rights: Safeguarding Your Privacy in a Connected World’ (Privacy Platform, The Review of the EU Data Protection Framework, Brussels 2011).
5. I van Ooijen and HU Vrabec, ‘Does the GDPR Enhance Consumers’ Control over Personal Data? An Analysis from a Behavioural Perspective’ (2019) Journal of Consumer Policy.
6. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (GDPR), art 4(11).
7. FJ Zuiderveen Borgesius and others, ‘Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation’ (2017) European Data Protection Law Review.
8. GDPR (n 6) art 4(11).
9. GDPR (n 6) recital 32.
10. S Barnes, ‘A Privacy Paradox: Social Networking in the United States’ (2006) First Monday.
11. C Véliz, Privacy Is Power: Why and How You Should Take Back Control of Your Data (Bantam Press 2020).
12. S Zuboff, The Age of Surveillance Capitalism (PublicAffairs 2018).
13. Hoofnagle, Van der Sloot and Zuiderveen Borgesius (n 1).
14. GDPR (n 6) art 25(2).
15. Van Ooijen and Vrabec (n 5) 101.
16. Westin (n 2).
17. Van Ooijen and Vrabec (n 5) 102.

Bibliography

Primary Sources

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1

Secondary Sources

Barnes S, ‘A Privacy Paradox: Social Networking in the United States’ (2006) First Monday

Hoofnagle CJ, Van der Sloot B and Zuiderveen Borgesius F, ‘The European Union General Data Protection Regulation: What It Is and What It Means’ (2019) Information & Communications Technology Law

Komamura K, ‘Privacy’s Past: The Ancient Concept and Its Implications for the Current Law of Privacy’ (2019) 96 Washington University Law Review

Reding V, ‘Your Data, Your Rights: Safeguarding Your Privacy in a Connected World’ (Privacy Platform, The Review of the EU Data Protection Framework, Brussels 2011)

Van Ooijen I and Vrabec HU, ‘Does the GDPR Enhance Consumers’ Control over Personal Data? An Analysis from a Behavioural Perspective’ (2019) Journal of Consumer Policy

Véliz C, Privacy Is Power: Why and How You Should Take Back Control of Your Data (Bantam Press 2020)

Westin AF, Privacy and Freedom (Atheneum 1967)

Zuboff S, The Age of Surveillance Capitalism (PublicAffairs 2018)

Zuiderveen Borgesius FJ, Kruikemeier S, Boerman SC and Helberger N, ‘Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation’ (2017) European Data Protection Law Review