Conceptualising the Right to Data Protection in an Era of Big Data ANGOR UNIVERSITY McDermott , Yvonne Big Data and Society DOI: 10.1177/2053951716686994 PRIFYSGOL BANGOR / B Published: 01/01/2017 Publisher's PDF, also known as Version of record Cyswllt i'r cyhoeddiad / Link to publication Dyfyniad o'r fersiwn a gyhoeddwyd / Citation for published version (APA): McDermott , Y. (2017). Conceptualising the Right to Data Protection in an Era of Big Data. Big Data and Society, 4(1), 1-7. https://doi.org/10.1177/2053951716686994 Hawliau Cyffredinol / General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. 29. Sep. 2021 Commentary Big Data & Society January-June 2017: 1–7 ! The Author(s) 2017 Conceptualising the right to data Reprints and permissions: sagepub.co.uk/journalsPermissions.nav protection in an era of Big Data DOI: 10.1177/2053951716686994 journals.sagepub.com/home/bds Yvonne McDermott Abstract In 2009, with the enactment of the Lisbon Treaty, the Charter of Fundamental Rights of the European Union entered into force. Under Article 8 of the Charter, for the first time, a stand-alone fundamental right to data protection was declared. The creation of this right, standing as a distinct right to the right to privacy, is undoubtedly significant, and it is unique to the European legal order, being absent from other international human rights instruments. This commentary examines the parameters of this new right to data protection, asking what are the principles underpinning the right. It argues that the right reflects some key values inherent in the European legal order, namely: privacy, transparency, autonomy and nondiscrimination. It also analyses some of the challenges in implementing this right in an era of ubiquitous veillance practices and Big Data. Keywords Big Data, Global Data Protection Regulation, privacy, veillance, human rights, transparency In 2009, with the enactment of the Lisbon Treaty, the Developing a fundamental right to Charter of Fundamental Rights of the European Union data protection entered into force. Under Article 8 of the Charter, for the first time, a stand-alone fundamental right to data The Data Protection Directive of 1995 made no men- protection was declared. The creation of this right, tion to a human right to data protection. As Van der standing as a distinct right to the right to privacy, is Sloot has argued, the original rules in the Data undoubtedly significant, and it is unique to the Protection Directive and related rules ‘could best be European legal order, being absent from other inter- regarded as principles of good governance’, as they national human rights instruments, such as the were not framed as relating to the human rights of International Covenant on Civil and Political Rights. the data subject, but rather focussed on the procedural However, the European Union ‘has neither adequately obligations of controllers (Van der Sloot, 2014). justified the introduction of the right to data protection By contrast, the Global Data Protection Regulation in the EU legal order nor explained its content.’ (GDPR) is expressly framed in terms of rights, with (Lynskey, 2014: 572). Article 1 noting that the Regulation ‘protects funda- This commentary examines the parameters of this mental rights and freedoms of natural persons and in new right to data protection, asking what the values particular their right to the protection of personal underpinning the right are. This piece also analyses data.’ Given that a right to privacy was well-established some of the challenges in implementing this right in in the European legal order for many years before the an era of ubiquitous ‘dataveillance’, or the systematic monitoring of citizen’s communications or actions through the use of information technology (Clarke, Bangor University, UK 1988), and ‘Big Data’, or the collection of large data- Corresponding author: sets, which are capable of being searched, aggregated, Yvonne McDermott, Bangor University, Bangor LL57 2DG, UK. and cross-referenced (Boyd and Crawford, 2012: 663). Email: [email protected] Creative Commons Non Commercial CC-BY-NC: This article is distributed under the terms of the Creative Commons Attribution- NonCommercial 3.0 License (http://www.creativecommons.org/licenses/by-nc/3.0/) which permits non-commercial use, reproduction and distribution of the work without further permission provided the original work is attributed as specified on the SAGE and Open Access pages (https://us.sagepub.com/en-us/nam/open-access-at-sage). 2 Big Data & Society drafting of the Charter, one might wonder what add- processing to those European Union activities that itional value or need was perceived to attach to a stand- fell outside the Data Protection Directive’s remit, alone right to data protection, especially given that the namely police and security co-operation (Article 29 European Court of Human Rights had, in a number of Working Party, 2009; Cannataci and Mifsud-Bonnici, cases, included data protection rights, including the 2005). That argument, while attractive, is not supported principle that data should only be used for the limited by the GDPR, which expressly excludes national secur- purpose for which it was gathered, within the ambit of ity activities and the processing of personal data in rela- Article 8 of the European Convention on Human tion to the Union’s common foreign and security policy Rights on the right to privacy (Peck, 2003). Yet, from the scope of the Regulation’s application. I argue while the right to data protection is closely related to below that the creation of the right could be traced to a the right to privacy, as well as the rights to freedom of number of distinct values inherent in the pre-existing thought, conscience and religion; freedom of expres- data protection framework – namely privacy, auton- sion; an effective remedy, and a fair trial, it has some omy, transparency and non-discrimination – that were distinct elements that justify its framing as a stand- perhaps seen as not being fully protected in the pre- alone right. These elements are: that data should be Charter fundamental rights framework, and that by processed fairly, for specific purposes, and only on placing data protection on an equal footing with exist- the basis of the consent of the person concerned or ing rights, those values were sought to be protected. some other legitimate basis set down in law; the right Aside from the uncertain legislative basis for its of access and rectification of data collected, and control incorporation, the nature of the right to data protection by an independent authority (Article 8, Charter of has sometimes been criticized as being necessarily of a Fundamental Rights). procedural nature, insofar as it ‘does not directly rep- This new construction effectively elevates established resent any value or interest per se; it prescribes the pro- principles of data protection to obligations incumbent cedures and methods for pursuing the respect of values on data processers in order to respect the rights of data embodied in other rights’ (de Andrade, 2012). subjects. In a Habermassian sense, this adds some nor- Determann, for example, is critical of the Schrems judg- mative force to the rights holder’s claim, insofar as indi- ment in pointing out that the claimant ‘could hardly viduals’ status is enhanced when they demand show any plausible harm or need of protection’ compliance with rights, as opposed to some moral obli- (Determann, 2016: 246). This arguably misses the gation (Habermas, 2010: 349). Indeed, the framing of point of fundamental rights protection; the recognition data protection as a right appears to have imposed of rights as fundamental reflect the norms underpinning much greater obligations on private actors than most a legal order (Palombella, 2007), and ‘plausible’ harm other human rights – it is difficult, for example, to think (whatever that might mean) need not be shown for a of another human right that product designers must violation to be proven. This is illustrated by the exten- take into account when developing new products, as sive jurisprudence on the right to a fair trial, for exam- is required under the GDPR. ple, where a violation can be found even where the Therefore, the creation of data protection as a dis- failure to respect a component of the right to a fair tinct right is both normatively and practically signifi- trial (such as the right to examine witnesses, or access cant. The reasons for the creation of this right are to a lawyer) has had no discernible impact on the out- somewhat unclear, however, and the explanations relat- come of the trial (Trechsel, 2005). Rights are recognised ing to the Charter provide little illustration in this as such because they protect particular values of a regard. It could be said to have been a reflection of polity, and whilst rights violations often result in ser- an increasing recognition of the right in domestic law ious harm to claimants, this is not a necessary compo- across Europe – the German Constitutional Court had nent of a claim because a breach of those rights is an developed the notion of ‘informational self-determina- attack on the values underpinning the legal system, and tion’, stemming from the constitutional principle of dig- that is the harm that human rights jurisprudence seeks nity, whilst, in France, the courts had begun to apply to protect against.