Privacy engineering and the techno-regulatory imaginary

Abstract

The European Union’s General Data Protection Regulation (GDPR), in force since 2018, has introduced design-based approaches to data protection and the governance of privacy. In this article we describe the emergence of the professional field of privacy engineering to enact this shift in digital governance. We argue that privacy engineering forms part of a broader techno-regulatory imaginary through which (fundamental) rights protections become increasingly future-oriented and anticipatory. The techno-regulatory imaginary is described in terms of three distinct privacy articulations, implemented in technologies, organizations, and standardizations. We pose two interrelated questions: What happens to rights as they become implemented and enacted in new sites, through new instruments and professional practices? And, focusing on shifts to the nature of boundary work, we ask: What forms of legitimation can be discerned as privacy engineering is mobilized for the making of future digital markets and infrastructures?

Digital transitions in healthcare: the need for transdisciplinary research to overcome barriers of privacy enhancing technologies uptake

“…Most studies that have investigated the challenges of technology adoption in healthcare [3,5,6,8,19,22,[31][32][33][34] primarily focused on identifying these obstacles. As two key examples, Witjas-Paalberends et al [8] outlined key challenges faced by multidisciplinary teams adopting digital technologies in healthcare, including managing data variety, addressing data sharing and quality issues, implementing effective data management strategies, and overcoming a lack of big data skills.…”

“…The embedding and adaptation of PETs over time (domain: the interaction and mutual adaptation between all these domains over time) is expected to be challenging in the Netherlands as well as in other European countries, requiring a fundamental shift in assumptions regarding health data treatment [32]. PETs align with European GDPR principles [33], yet limited understanding of how organisations and adopters within the Dutch healthcare system perceive and value (domain: value proposition) PETs, remains.…”

Older people and the smart city – Developing inclusive practices to protect and serve a vulnerable population

“…In datasets obtained by statistical bureaus or other data providers, such as telecom operators, data is min-imised and aggregated to protect rights to privacy and prevent unwanted individual identification. Minority groups are thus not visible in such data: a side effect of "privacy engineering" practices that aim to translate the vague concept of privacy into concrete requirements (Rommetveit & van Dijk, 2022). This is both legally and ethically desirable, but leaves planners without robust ways to guide their work.…”

“…For example, given the possible benefits that the research may provide, certain types of data collection or tracking were considered acceptable. As such, engagement with older people also provided important opportunities to better understand and implement design-based approaches to data protection (Rommetveit & van Dijk, 2022).…”

Which Attributes Should be Considered in Regulating the Internet of Things? Evidence From Conjoint Analysis

“…A comprehensive regulatory framework for IoT services should be developed in terms of potential consumers; however, relevant studies are lacking. This is regarded as a regulatory gap as well as a research gap where the growth of new innovative services can be restrained (Rommetveit & van Dijk, 2022). To bridge these gaps, we should consider the opinions of consumers using new services while developing appropriate regulations that do not restrict the benefits of IoT services for them.…”