Because of increased technological complexities and multiple data-exploiting business practices, it is hard for consumers to gain control over their own personal data. Therefore, individual control over personal data has become an important subject in European privacy law. Compared to its predecessor, the General Data Protection Regulation (GDPR) addresses the need for more individual control over personal data more explicitly. With the introduction of several new principles that seem to empower individuals in gaining more control over their data, its changes relative to its predecessors are substantial. It appears however that, to increase individual control, data protection law relies on certain assumptions about human decision making. In this work, the authors challenge these assumptions and describe the actual mechanisms of human decision making in a personal data context. Further, they analyze the extent to which new provisions in the GDPR effectively enhance individual control through a behavioral lens. To guide our analysis, the authors identify three stages of data processing in the data economy: (1) the information receiving stage (2) the approval and primary use stage, and (3) the secondary use (reuse) stage. For each stage, they identify the pitfalls of human decision-making that typically emerge and form a threat to individual control. Further, the authors discuss how the GDPR addresses these threats by means of several legal provisions. Finally, keeping in mind the pitfalls in human decision-making, the authors assess how effective the new legal provisions are in enhancing individual control. They end by concluding that these legal instruments seem to have made a step towards more individual control, but some threats to individual control remain entrenched in the GDPR.
Link zur Publikation