ABSTRACT
Data protection law is increasingly important in the modern world, as personal data processing underpins much of social and economic life. Yet there are significant questions over the law’s ability to contend with contemporary data processing relationships. Drawing on the sociological concept of the ‘figuration’, we deconstruct the law’s oversight processes to identify the webs of interdependence and balances of power in data processing figurations. We argue that data subjects are drawn into these oversight processes, charging them responsibility for self-managing relations and interdependencies in those figurations through individual control. Moreover, we argue, controllers are also key in the law’s oversight processes, yet this does not reflect the dynamics of current computing infrastructures. As a result, data subjects that the law should protect become key actors in its regulatory processes – and therefore also key points of oversight failure – while other mechanisms for governing processing are blunted or negated. We therefore argue that the law’s effect is to provide space for harms to data subjects in various ways, including by obscuring collective harms and undermining their ability to protect their common interests, and by relying on controllers to manage technological infrastructures beyond their understanding or control. To address these problems, we again draw on the concept of the figuration to suggest potential directions for future legal reform.
Cobbe, Jennifer and Singh, Jatinder, Data Protection Doesn’t Work: Oversight Failure in Data Processing Figurations (July 2, 2021). Paper presented at the 2022 Privacy Law Scholars Conference, Northeastern University, Boston, MA, USA.
Leave a Reply