Revisiting the governance of privacy: Contemporary policy instruments in global perspective

Abstract

In the early 2000s, we surveyed and analyzed the global repertoire of policy instruments deployed to protect personal data in "The Governance of Privacy." In this article, we explore how those instruments have changed as a result of 15 years of fundamental transformations in information technologies, and the new digital economy that they have produced. We review the contemporary range of transnational, regulatory, self-regulatory and technical instruments according to the same framework, and conclude that the types of policy instrument have remained remarkably stable, even though they are now deployed on a global scale, rather than in association with particular legal or administrative traditions. While the labels remain the same, however, the conceptual foundations for their legitimation and justification are shifting as a greater emphasis on accountability, risk, ethics and the social/political value of privacy have gained purchase in the policy community. Our exercise in self-reflection demonstrates both continuity and change within the governance of privacy, and displays how we would have tackled the same research project today. As a broader case study of regulation, it also highlights the importance of going beyond the technical and instrumental labels. The change or stability of policy instruments do not take place in isolation from the wider conceptualizations that shape their meaning, purpose and effect.

A contextual approach to information privacy research

“…The differences between the Canadian/E.U. approach to privacy, and that of the United States, have been well documented and analyzed (Bennett & Charles, 2006;Krotoszynski, 2016). Although the E.U.…”

The European General Data Protection Regulation: An instrument for the globalization of privacy standards?

“…At the time of the passage of the Data Protection Directive, the entire panoply of policy instruments associated with the protection of personal data were neither globally understood nor deployed. Rather, particular self-regulatory, regulatory and technical instruments were closely associated with different national administrative and regulatory traditions (Bennett & Raab, 2006). The GDPR not only revises the 1995 Data Protection Directive to produce a single harmonized regulation for the entire EU, it is also a more multi-faceted instrument, embracing and combining policy instruments that have tended to originate in non-European jurisdictions.…”

“…As more countries joined the data protection "club" so there was increasing pressure on those outside the club to pass equivalent laws. There has been a process of policy convergence (Bennett, 1992), an intensification and broadening of transnational policy networks (Newman, 2008;Raab, 2011), and a general trading up of standards (Vogel, 1992;Bennett & Raab, 2006).…”

Public Values in the Age of Big Data: A Public Information Perspective

“…An additional argument for assessing these countries is that much attention in the literature has been devoted to English speaking countries. In the United States, where most research is focused, big data initiatives in the public sector mostly rely on help from the private sector (Mergel et al, ), strong presumption of responsible data use is left to private sector discretion (Bennett & Raab, ), and there is confusion about how to connect big data policies such as those concerning algorithms to the public information commons (Fink, ). Like the Anglo‐Saxon countries, technological development in Germany and the Netherlands is high, but we would expect the different institutional and legal traditions to create a different set of opportunities and challenges.…”