A. Introduction
A certain individual, let us call her Alex, signs up for a social network. Alex provides her details, accepts the terms and conditions without reading them, and joins the online community. As soon as she logs in, she starts uploading photographs of herself, both alone and with friends, and she joins various groups within the social network. As Alex is attracted to women, she connects with other people of the same sexual orientation and she joins lesbian groups, from which she gets important support. Unlike most of her contacts, however, Alex discloses her sexual orientation in her profile, as she feels comfortable sharing that information with people.
What normative issues—in relation to data privacy—do these brief facts raise?Footnote 1 We may question the validity of Alex’s consent. Because she has not read the terms and conditions, she lacks knowledge of what her agreement entails.Footnote 2 Perhaps one might wonder whether the terms were fair in general.Footnote 3 Additionally, the disclosure of her sexual orientation raises issues that relate to the processing of sensitive data.Footnote 4 Finally, one might argue that uploading others’ photographs raises some issues if that uploading has happened without their consent.Footnote 5
Let us now imagine a counterfactual. Alex is now the paradigmatic homo economicus, a perfect decision-maker who decides fully rationally. Let us further assume she has access to all relevant information, and after an extensive review of the terms and conditions, which she found fair, she has consented. Moreover, the processing of sensitive data is stellar, and it adheres to all the relevant obligations contained in the EU’s General Data Protection Regulation.Footnote 6 Finally, Alex now abstains from sharing anything that can reveal information about others. Is this state of affairs satisfactory? This Article will argue that the answer is no.
Although most of the discussion on consent in data privacy law focuses on whether the decision is informed and free, I will argue that this is a secondary and largely moot point. Indeed, even informed and rational decisions would do little to improve people’s data privacy. The focus on consent and on privacy self-management more broadly is a result of an individualistic perception of privacy that has become problematic. The main problem is not that this approach has failed to achieve its goals, for example, due to lack of enforcement.Footnote 7 The problem is that even if this approach realized what it perceives as an ideal state of affairs, such as that described in the counterfactual above, it would still fail to protect privacy optimally.
This Article reassesses the conventional wisdom about the role of consent in data protection law. There is a significant and growing literature which has started to analyze the relational nature of data.Footnote 8 This literature has examined how someone’s consent can lead to the reduction of other people’s privacy. In technical terms this is a negative externality, in other words a cost borne by a third party who is not a party to the transaction undertakes. The theory of externalities is a useful starting point in showing the complex relationships that feature in modern data governance.Footnote 9 Similarly, public goods theory offers a strong criticism of individualistic governance models and a strong justification of why the rational decision-making model would not work, even if its—quite unrealistic—assumptions were true. However, this literature has not thoroughly engaged with what these insights mean for data protection regulation and the individualistic governance paradigm that dominates it,Footnote 10 especially because there is much disagreement even among neoclassical economists on the solutions to these problems.Footnote 11
This Article seeks solutions beyond the realm of economics by tying the idea of externalities to the harm principle in philosophy.Footnote 12 As Ronald Coase pointed out, there is a symmetry between the person inflicting the externality and the person suffering from it.Footnote 13 If we prevent the producer of the externality from imposing it, she will suffer a harm in the form of foregone benefits. This harm to the producer is not necessarily less important than that to the third party, morally or efficiency-wise.Footnote 14 This Article examines how the notion of harm relates to privacy externalities and how it can provide normative guidance on which externalities should be subject to regulation. These insights are particularly relevant for data privacy scholarship, which largely ignores the problem. It will also show how the relational nature of privacy goes beyond questions of economic efficiency and has a crucial rights dimension.
This Article aims to provide a new understanding of the role of consent in data privacy law and to make a coherent case for its abolition. Section B seeks to upend two false assumptions about consent: first, that consent is conducive to data privacy, and second, that providing consent is a solely self-affecting decision. Section C examines whether there are ways to resolve the problems that arise from data externalities without abolishing consent. Section D examines potential arguments against abolishing consent and Section E examines whether the arguments against consent also apply to data privacy rights. Finally, Section F examines whether the case for the abolition of consent depends on the desirability of the alternative and what that could be.
B. False Understandings of Consent
Despite its shortcomings, consent holds great sway in the world of data privacy law among all stakeholders: politicians,Footnote 15 regulators,Footnote 16 civil society,Footnote 17 academics,Footnote 18 and businesses.Footnote 19 The criticism against it focuses particularly on the difficulties that individuals encounter in making informed and rational decisions. However, most of the critics accept that if we were able to ensure that individuals made proper decisions, consent would be desirable.Footnote 20 In fact, despite the grave problems that consent currently faces, most scholars call for reform rather than for abolishing consent.Footnote 21 Under their framing, proper consent is a suitable governance mechanism that protects privacy, and the main question is whether we can attain the conditions that make it so and how.
However, the two assumptions implicit in this framing, in other words, that proper consent enhances data privacy and that it is a suitable governance mechanism are wrong. Although consent is usually considered part of data privacy or at least it is assumed that strengthening one will also lead to the strengthening of the other, their main relationship is antithetical. The following section examines more closely the function of consent, which is to facilitate the disclosure of information. Consent hence reduces privacy by making more information available both about the discloser and others. This is crucial because when we are assessing consent, it makes more sense to assess it as a limitation on data privacy rather than as a mechanism which strengthens it. Moreover, insights from economics and public goods theory show that the relational nature of data processing in the data analytics era leads individuals to free ride on each other’s data privacy and thus they end up in an inefficient state of affairs. This is also crucial because even if we managed to close the gap between the ideal decision-maker and the average layperson, we would still not get optimal data privacy.Footnote 22
Revisiting these two assumptions leaves us with a new framework in which we have to think about consent, a paradigm shift in the debate surrounding these issues. The question is no longer whether we can empower individuals to become rational and informed decision-makers. It is rather how we can resolve the problems that such decision-making would create. What used to be the solution is now part of the problem. Moreover, by clarifying the relationship between consent and data privacy, we have to shift our attention from strengthening consent as a means of strengthening privacy to whether there are reasons that justify the limitation of privacy that consent causes. Not only does this revised framework offer much more analytical clarity and a better understanding of the situation on the ground, but it also leads to radically different results when assessing consent and its desirability.
I. Consent as an Element of Privacy
Consent is a mechanism that enables data disclosures and as such it is antithetical to privacy. By providing our consent we enable the collection and processing of our data and as such we increase what other parties know about us. If individuals have control over access to their data, then that increases their privacy only insofar as they make privacy-enhancing decisions, which is anything but a given.Footnote 23 More generally, consent inherently aims to enable such disclosures. Of course, one can withhold consent and thus deprive a data controller of a legal basis for data processing. Yet, that would also be the case if consent did not exist at all. At best, consent allows us to retain the same degree of privacy that would exist without consent as a legal basis for data processing by withholding it. At worst it enables data disclosures that increase what other parties know about a data subject and potentially others as well. As Natalya Bazarova and Philipp Masur rightly point out, “[d]isclosure, as ‘the process of making the self known to other persons,’ presents itself as a dialectical opposite to privacy in that it regulates a selective access to the self in social interactions.”Footnote 24
At this point, one might object that the right to data privacy is actually about data subjects controlling who has access to information about them.Footnote 25 A well-established view considers control and, in particular, consent as an integral part of the right to privacy. This perception has been cultivated through the concept of informational self-determination (ISD). ISD became popular when the German Constitutional Court recognized such a right in its famous census decision.Footnote 26 The eminent privacy scholar Alan Westin had also argued for such a conception.Footnote 27
The ISD reading of data privacy remains controversial, even in Europe.Footnote 28 The normative appeal of ISD is even more dubious in the face of data externalities. However, even if we were to accept ISD, this would not be a conclusive objection against understanding consent as antithetical to privacy. Both in legal systems where the right to data protection co-exists with the right to privacy, such as the EU,Footnote 29 or in systems where the right to privacy is embellished with data protection aspects, such as the Council of Europe (CoE),Footnote 30 the negative dimension of privacy as lack of access to information about someone remains.Footnote 31 Thus, even if we accept that privacy is not exclusively about lack of access to information about us, it is at least partly so.
Moreover, it is important to disentangle the content of a right and the interests which it seeks to protect.Footnote 32 Although rights as enshrined in the law protect certain interests, it is not necessary that the exercise of those rights advances those interests.Footnote 33 Most rights give us the power to act in a certain way, but not an obligation. Most rights also entail the freedom to abstain from exercising that right. Therefore, if I, for example, choose to abstain from receiving a medical treatment or non-mandatory education, to which my rights to health and education respectively entitle me, I am exercising my rights, but I am hardly advancing my healthcare or my education.Footnote 34 Consent is as conducive to privacy as my freedom to smoke and drink alcohol is to my health. Neither consent nor smoking is in violation of my rights to privacy and health respectively; one could even argue that these rights bestow these freedoms upon me. Yet, consenting or smoking is antithetical to my interests in privacy and health.
The fact that consent is antithetical to one’s privacy-as-opacity interests does not mean that it does not advance any interest. Controlling the flow of information about oneself could, in theory, increase people’s influence on what happens to their data.Footnote 35 In fact, being able to disclose information about ourselves is vital for our participation in social life.Footnote 36 Not only is it often a social requirement to provide information to participate in various activities, but it is also one of the most important ways in which we form intimate relationships.Footnote 37 However, it is important to identify which interest is at stake. Having control over one’s data does not necessarily entail having privacy and vice-versa. In fact, these interests can and often do clash. Therefore, we must examine to what extent consent furthers our control, to what extent it affects our privacy, and whether the gains in control justify the losses in privacy.Footnote 38
II. Consent as a Self-Affecting Decision
The second important misconception is that when we provide our consent to the processing of our data, that is a decision that concerns only: (i) the person providing consent; (ii) the entity which collects our data; and (iii) any third parties that might gain access to our data. This is simply not true. When a data disclosure takes place there are many interests involved both in favor of the disclosure and against it.Footnote 39 The interests in favor of the disclosure—and to processing in general—mainly involve the entities that hope to derive value from the data, such as the data subject, the data controller,Footnote 40 the data processor,Footnote 41 or other parties that indirectly benefit from such processing.Footnote 42 These interests do not necessarily have to be for-profit, or even economic. They can be, for example, the interests of researchers that want to discover knowledge for non-commercial purposes.Footnote 43 Insofar as they are beneficial to them, data subjects may also have an interest in such disclosures taking place.Footnote 44
By contrast, most people assume that the interest in the disclosure not taking place concerns the data subject exclusively. This is the reason that one often hears comments such as ‘if people want targeted advertising, we should let them have it’.Footnote 45 If this were true, it would justify giving data subjects the power to decide about disclosing their data. The only case where we should override them is when we find the interests in favor of the disclosure stronger than the ISD of data subjects. However, there are two other sets of interests in preventing disclosures that are equally important. The first comprises the collective interests of third parties or groups, which the data disclosures affect. The second is societal interest. Because the interests of data subjects are well examined in the literature, I shall focus on the two latter.
1. Collective Interests
The dominant individualistic perception of privacy focuses on the vertical relationship between the data subject and the data controller.Footnote 46 Under this conception, one’s privacy concerns them exclusively. If the person concerned accepts the reduction of privacy and they have the capacity to make that decision meaningfully, this raises no moral or legal issues.Footnote 47 This conception is the reason that much of the discussion on consent has focused on whether we can make it meaningful. However, these views falsely assume that the consenter’s unilateral decision cannot harm others.Footnote 48
Although privacy might have had a mainly vertical nature in the past, that is no longer true.Footnote 49 The development of data analytics has allowed data scientists to uncover information about someone from someone else’s data. For instance, empirical work has demonstrated that social platforms can create “shadow profiles” of non-users merely by using data that their own users provide.Footnote 50 One of those studies managed to deduce the sexual orientation of non-users by mapping their connections to users.Footnote 51 This phenomenon has started to attract attention in legal and economic scholarship and there is a variety of terms that papers use to describe it, such as horizontal relations,Footnote 52 data externalities,Footnote 53 privacy dependencies,Footnote 54 and relational data.Footnote 55
Data disclosures that can create externalities do not apply only among people who have some social or biological relationships. People engage in behavioral patterns that have many similarities. Although some of these patterns are universal, others occur among people that are part of the same social group. Importantly, algorithms can also uncover behavioral patterns about groups that are not even socially salient.Footnote 56 Nor is it necessary for someone to be part of a group for her privacy to be reduced. Sometimes knowledge of a group’s characteristics can allow the identification of non-members.Footnote 57 This effectively means that data disclosures reduce everyone’s privacy in various ways.
We can conceptualize these horizontal privacy relationships either individualistically or collectively. Under an individualistic conception, people who are affected by the processing could also be considered data subjects.Footnote 58 Under a collective conception, we can think of people that are data subjects in relation to the same data as groups.Footnote 59 These approaches can have significant legal and governance implications such as whether we consider groups as agents, whether we recognize group rights along individual ones, and how we ensure that individual or collective rights holders can exercise their rights. In any case, however, what is clear is that there are other, potentially numerous, stakeholders beyond the disclosing data subject that have an interest in privacy as opacity.
This horizontal nature of privacy is a game changer for personal data governance. Most disagreements with the current model expressed in the past were reflective of deeper viewpoints on how best to govern and regulate data.Footnote 60 If you believed in liberal values, the individualistic, consent-based model would be highly likely to convince you. Yet, that is no longer true. Consent in data privacy law violates the harm principle, contrary to liberal values, and it is economically inefficient.Footnote 61 However, no defense of consent takes data externalities seriously into account. A potential objection might be that although consent is a basis for data processing, it is one among many and that the wishes of the data subject do not exclusively determine the conditions of the processing.Footnote 62 Nevertheless, the existence of these other lawful bases does not do much to protect the interests of third parties. These provisions are grounds that enable data processing. They may allow the processing to go forward in the absence of consent, but they cannot prevent it when there is consent. This does not mean that if consent exists, anything goes. Most privacy laws provide for some mandatory rules, which are not waivable. However, regarding the question of whether the processing is to take place, the point remains.
Although understanding the externalities that data disclosures cause offers us some important regulatory insights, there is an even more far-reaching theorization of horizontal privacy—privacy as a public good. Public goods in economic theory have two characteristics: they are non-rival and non-excludable.Footnote 63 The non-rivalry means that the consumption of a good by someone does not reduce anyone else’s ability to consume it. Non-excludability means it is not possible to prevent anyone from consuming that public good. There is a great body of economic theory on the characteristics of public goods and the best ways to optimize them that we can apply to privacy, if we accept that it is a public good.
Joshua Fairfield and Christoph Engel in a pioneering article made the case that privacy is indeed a public good and that we should govern it accordingly.Footnote 64 Indeed, privacy presents both characteristics: it is non-rival and non-excludable. As explained above, when someone discloses her data, she reduces the privacy of others. By the same token, when she withholds that disclosure, she increases the privacy of others or rather, to be more exact, she prevents the reduction of privacy, which in utility terms yields the same net effect. This heightened level of privacy that she and others enjoy is non-rival and non-excludable. When the data subject has a higher degree of privacy because they did not disclose their data, their enjoyment of that good does not diminish the capacity of others to enjoy it, nor is it possible to exclude others from doing so.
Individualistic governance yields sub-optimal results in the production of public goods because of the so-called free-riding problem.Footnote 65 Because privacy is a public good, absent a cooperation mechanism, the rational thing for individuals to do is not to cooperate. When someone discloses their data, they will do so to get a private benefit, usually access to a free service, against a private cost—loss of individual privacy and a social cost—loss of collective privacy. As long as the private benefits exceed the private costs and their part of the social costs, the rational decision is to disclose.Footnote 66 The worst possible outcome would be if she withheld her data and everyone else disclosed, in which case she would have no benefit, while suffering the social costs. Absent a way to know that others will not disclose, defection is the rational strategy. Yet, this thinking results in the sub-optimal production of the public good of privacy.Footnote 67 In fact, data disclosures do not only result in inefficient levels of privacy, but they also depress the price of the data that people disclose.Footnote 68
The conceptualization of privacy as a public good does not provide definitive answers. As Fairfield and Engel rightly noted there might be opportunity costs involved in investing in the production of different public goods,Footnote 69 there is the thorny issue of how to balance the interests of the parties involved in horizontal relationships, and, more generally, there are different views on how we should regulate public goods. Therefore, although this perception of privacy enables us to gain some crucial insights from economic theory, it does not provide any fixed or uncontroversial solutions. What the rules ought to be remains an open question even within the conceptualization of privacy as a public good.
What the public goods theory contributes is to demonstrate that individualistic governance of personal data is bound to fail. I think this is the case despite the big caveat of the rationality assumption that is usually the Achilles heel of neoclassical economics. This is because, in data privacy law, rationality is the assumed ideal state of affairs that we are trying to approximate; if it is bound to yield inefficient results anyway, even if we were, against all odds, to succeed in achieving it, there is no reason to pursue it in the first place. Even if everyone became an omniscient, perfectly informed, rational, self-maximizing homo economicus when deciding on whether to disclose data, the results would not be much different to our current state. Eliminating information asymmetries and enabling rational decision-making in ordinary people will not improve their privacy; it quite possibly will worsen it. A rational and informed decision-maker will free-ride on privacy because they are informed and rational, not despite it.
I do not underline the failure of individualistic governance under neoclassical economic theory because I consider this theory to be correct. Nor do I take these standards to be politically or normatively neutral. I use them rather because I think it demonstrates forcefully the failure of consent, even if we allow for the assumptions of its proponents. If consent would fail even if the perfect self-interest maximizer made the decisions, the entire discussion on bridging the gap between the perfect decision-maker and laypeople is entirely superfluous. This does not mean that the discussion on information asymmetries has no value. Information asymmetries, as well as other problems that affect the decision-making of individuals, raise questions about whether people have an autonomy interest in making such decisions. And whether they do has important legal and moral implications. However, eliminating information asymmetries or even limiting them will not solve the problems of privacy by itself.
2. Societal Interest
Data processing can advance or hinder goods to which no particular individual has a special claim. The attempted distortion of democracy in the Cambridge Analytica case or the environmental degradation as a result of data processing facilities are such examples. These goods are common goods and they transcend individual and collective interests.Footnote 70 Because common goods benefit everyone, there is an assumption that the advancement of individual interests and common goods are in harmony. Indeed, Aristotle even thought that individual interests are inseparable from those of the community.Footnote 71 However, that is clearly not true. There have been numerous examples where individuals’ material wealth has been advanced by harming common goods such as democracy or the environment.
The concept of public interest is sometimes used as synonymous to the interest of society in producing these goods.Footnote 72 However, the “public interest” is a notion that remains quite opaque despite its wide use in many disciplines. In fact, its obscurity has led many to doubt whether it can be analytically useful.Footnote 73 Moreover, often the term public interest is used in relation to the interest of government in having certain powers to achieve its goals. For example, public safety is a common good but maintaining a police force has only instrumental value as a means of achieving the common good of public safety. To distinguish these concepts, I use the term societal interest in relation to the interest of society in common goods.Footnote 74
These distinctions have important implications for data protection law. By definition, every member of society has an interest in the production of a common good but, as we saw, certain individual and collective interests can conflict and potentially override the interest in the common good. As a result, the protection of individual and collective interests does not necessarily ensure the protection of societal interests, although there seems to be an implicit assumption to the contrary. Moreover, even if individual interests do not conflict with societal ones, people might lack knowledge or an incentive to uphold societal interest, unless it is tied to a significant individual interest. If we return to the rationality model, individuals will act only if their private benefits exceed the sum of their private and their share of the social costs. However, due to the uncertainties involved in pursuing a common goal, most people would have a rational incentive to not participate, the so-called “collective action” or “social dilemma” problem.Footnote 75 If, however, every individual whose interests coincide with the public interest were to contribute, or at least most of them, contributing might become efficient.
This means that the state must uphold societal interest and it cannot rely on individuals upholding their private interests to do so, not only because those interests do not necessarily coincide, but because even if they do, there is a collective action problem.Footnote 76 So far, I have not mentioned the problems that have to do with information asymmetries and other cognitive deficiencies that prevent individuals from making rational decisions and result in a market failure.Footnote 77 These are particularly relevant here as well. However, the fact that we reach the same conclusion even without taking these considerations into account makes the case a fortiori that there is a need to protect the public interest in data privacy that must go beyond individualistic remedies.
Lastly, there is a moral—and often legal—obligation to uphold certain values regardless of whether it is efficient to do so. For instance, it would not be very convincing to argue that a government should choose not to uphold democracy or national security because it was not efficient to do so or that it left it up to the market. Yet, astonishingly, that is exactly what many governments do in the area of data privacy. Although there are rules that mandate data collection, there are no rules that prevent data collection when there is consent, even if such data can jeopardize democracy or national security.Footnote 78 As we saw, the pursuit of individual interests does not necessarily align with the public interest, both because they diverge, but also because individual enforcement will be lacking. It is hard to justify why data privacy law provides grounds to process data against the data subjects’ wishes, but it does not provide grounds to prevent or restrict the data processing when the individual consents.
C. Can We Address the Problem While Retaining Consent?
Although the existence of data externalities poses a strong challenge against individualistic data governance in general and particularly in relation to consent, it is not, yet, fatal. There might be ways in which we could rein in the problems that data externalities create without having to resort to the abolition of consent. This section examines such solutions but finds them lacking. More specifically, it focuses on three kinds of solutions. The first is data decorrelation. The second is the introduction of regulation that aims to resolve the collective action problem or at least to induce individuals to behave in a way that is not antithetical to the production of privacy as a public good. The third solution is placing limitations on what consent can do, which Daniel Solove has termed “murky consent.”Footnote 79 Although these solutions can make a positive contribution, they cannot achieve a better state of affairs than abolishing consent.
I. Data Decorrelation
One potential solution to the problem discussed above is to decorrelate data.Footnote 80 The idea is that by applying various techniques, one person’s data will no longer yield information about others and hence the vertical privacy framework will again become relevant. These techniques mostly focus on anonymization of data through the so-called Privacy Enhancing Technologies.Footnote 81 The main criticism against such solutions focuses on the infeasibility of anonymization.Footnote 82 Indeed, advances in data analytics have increased the capacity to reidentify individuals on the basis of anonymized data. However, anonymity is an inherently relative concept in data protection law, and it can vary by context. Perhaps the biggest problem with such techniques is that they can bring about many of the harms that data protection violations entail, often in scale, while evading the scope of data protection law.Footnote 83 For example, truly anonymized data can affect the privacy of others without having to identify them as individuals.Footnote 84 Imagine a company collects information about a particular group of people, say computer gamers, and it correlates them with a lower likelihood of them repaying their debts. In that case, the company identifies no individuals. Yet, not only is there a reduction in the privacy of the people belonging to the group, but this information is also likely to affect them in a negative way.
The question of whether such group identification falls within the notion of personal data in data protection law is contentious.Footnote 85 The Article 29 Working Party has suggested that data can identify someone when they single out a person from other persons.Footnote 86 It is not clear whether this criterion is in line with the jurisprudence of the Court of Justice of the EU.Footnote 87 In any case, it is important to note that even if the singling out criterion persists, this would not solve all problems. One example where there would be a gap of protection is that suggested by Przemysław Pałka where one entity carries out the data collection and application of data analysis insights to individuals and another carries out the data analysis.Footnote 88 Another example would be when data analysis is used for policymaking, in which case there might not be an application to a specific individual yet the consequences might be as dire or perhaps even more so.
II. Bottom-Up Regulation
Another potential solution to the problem of data externalities that does not require the abolition of consent is the introduction of some sort of bottom-up regulation that prevents individuals from making excessive data disclosures in the first place. One way to achieve this is by amending the incentive structure for individuals so that, if they decide rationally, they will disclose data only insofar as it is socially efficient. Another way is to use mechanisms that can alter the individuals’ behavior and make it socially efficient without altering the individuals’ incentives or appealing to their rational decision-making more generally. Although these suggestions differ in their modus operandi as well as in their implicit assumptions, they both aim to tackle data externalities by altering the behavior of data subjects rather than changing the legal rules or imposing obligations on data controllers.
1. Pigouvian Taxation
Ben-Shahar has proposed addressing data externalities through the imposition of a tax on data disclosures.Footnote 89 This tax would be imposed on data subjects making such disclosures and thus would not alter their power to provide consent; it would merely alter their economic incentives. These taxes would be Pigouvian. Arthur Pigou was a renowned British economist who studied the problems of externalities in his famous book The Economics of Welfare.Footnote 90 He suggested that the solution to the problem is the imposition of taxes on the producer of externalities. Pigouvian taxes are supposed to be equal to the price of the social costs that the externality-generating activity produces and would thus force the producer to internalize those costs.Footnote 91 The internalization of social costs would thus allow data collection to go forward only when the social benefits exceed social costs and the taxes would prevent socially inefficient production of goods from taking place.
This proposal faces significant challenges. An important problem for the effectiveness of such a tax is that Pigouvian taxes rely on an assumption of uniform marginal social costs.Footnote 92 However, this uniformity is unlikely to exist in the context of data processing. First, the social harm that results from the collection of data will vary depending on who the data controller is. The privacy intrusiveness of data collection depends, inter alia, on who holds them.Footnote 93 Access to larger datasets can allow data controllers to infer much more information than data controllers who have more limited data. Other parameters are also of importance such as the availability of software and computational resources, especially when the scale of the analysis increases.
The second reason that marginal social costs of data collection vary is the manner in which the accumulation of data results in the reduction of privacy. Common sense might suggest that the more someone’s personal data are processed, the less privacy she will have. This is not, however, necessarily the case. The additional data points might be duplicates, or they might contain information that is trivial. Moreover, we intuitively understand that certain kinds of information are much more intimate, and they infringe our privacy in much more intense ways than others. My sexual orientation is much more sensitive than what I had for lunch, although they are both personal information.
Thirdly, externalities are likely to vary from one data subject to another. For instance, it might be that the data controller already holds information about a particular group of people. Because of this, the disclosure of information from yet another member of this group might impose little to no data externalities on other members of the group, other than that it confirms what the data controller already knows. However, the externalities of data disclosures by members of another group, for which the data controller knows less and thus has greater potential to draw inferences will be much greater. The same might be true for individuals whose data are at the tipping point of making a sample statistically significant; their data disclosures will likely result in much more significant externalities than the individuals who disclosed earlier.
This problem is further exacerbated in the era of Big Data, where the accumulation of data yields even more unexpected results regarding the intrusion of privacy. As Eric A. Posner and Eric Glenn Weyl note, in data analytics “[f]or any one, well-defined learning task, data only tend to have marginal value for a limited range of data sizes, those close to the sample complexity of the problem.”Footnote 94 The additional value of each data point comes from yielding additional information or at least contributing towards that goal. Given that this yielding of additional information will be privacy-intrusive, when it comes to personal data, the increase in marginal value will usually equal the decrease in privacy.Footnote 95 This means that the accumulation of data points when a controller holds enough data to make inferences about one kind of a problem but not enough for another will not lead to a linear decrease of privacy and thus an increase in social costs. Given these parameters, a fixed tax based on the amount of data collection will sometimes over-tax and other times under-tax data collection vis-à-vis its social harms.Footnote 96
Omri Ben-Shahar, perhaps in anticipation of this problem, has suggested that the “[m]arginal tax curve need not be linear: it ought to reflect the marginal risk of additional data.”Footnote 97 He also suggests that the tax could vary depending on the category of data concerned so that disclosure of more sensitive data would carry a heavier tax.Footnote 98 However, it is highly unlikely that a tax that is sufficiently differentiated on such a basis can be operationalized. There is simply so much variation among the privacy intrusiveness of different data points that it is highly doubtful that the general conditions of a tax statute could capture this variety, at least in a way that is not too complex to administer.Footnote 99
A second important problem, which Ben-Shahar himself acknowledges, is the difficulty in calculating social costs.Footnote 100 In his view, the main difficulty lies in that data processing yields both positive and negative externalities and the positive externalities have to be subtracted from the tax.Footnote 101 Moreover, he stresses that it is difficult to predict which data processing activities will result in harms, until such harms take place.Footnote 102 Yet, Ben-Shahar insists that a tax is justifiable. On the one hand, he notes that producers internalize most of the benefits so the social benefits that we must deduct from social costs are not that large.Footnote 103 On the other hand, he notes that even if we are unable to calculate the social costs exactly, given that the net social value is not zero, governments are justified in imposing some tax, provided that the administrative costs are not excessive.Footnote 104
However, the difficulties with valuing the positive and negative externalities of data are exacerbated by the fact that we do not know what insights data analytics can uncover from a given dataset.Footnote 105 These insights can result in positive externalities such as improvements in medical diagnoses or in privacy intrusions or, usually, in both. In addition to the standard difficulties that estimating such externalities entails, due to the nature of Big Data, we are unable to even estimate whether such externalities will occur. This has led to a big debate on whether we should regulate collection at all, at the risk of curtailing the potential benefits that Big Data can create and instead focus on regulating the use of such data.Footnote 106 Indeed, given that we are unaware of the risks, some scholars have explicitly called for the application of the precautionary principle to Big Data.Footnote 107
Perhaps one could argue that the imposition of a tax on data collection would act as an instrument to implement the precautionary principle. Instead of using command and control we could use taxation to make assuming unknown risks too expensive. However, such a tax is so conceptually different that it cannot be characterized as a Pigouvian tax and effectively the discussion shifts on the best means to apply the precautionary principle. If we remain within the notion of Pigouvian taxation, which aims to restore the market equilibrium rather than to implement deterrence through taxation, valuing social costs presents an important hurdle.
Moreover, there are important distributional issues that raise concerns about both the effectiveness and equity of Pigouvian taxation. First, as we saw, marginal social costs vary among other things depending on the characteristics of the data subject. Therefore, a flat tax rate, even if it were based on the average social cost, would result in some data subjects over-disclosing and others under-disclosing their data.Footnote 108 Perhaps such taxation might be a second-best solution if there is no other way to improve market efficiency. However, given the high degree of variation in marginal social costs and the high degree of uncertainty in estimating these variations, such an outcome seems unlikely. Still, even if we assume that it is possible, it also raises important questions of equity.Footnote 109
Pigouvian taxes are known to be regressive, i.e. as the amount of income of taxpayers increases, the percentage of their income that is taken up by the tax decreases.Footnote 110 Although this is not always the case, economics research has shown that increased income inequality makes it more likely that such taxes will be regressive.Footnote 111 A tax on data disclosures will place the burden on users and will most likely have a greater impact on those with lower incomes, who are more in need of trading their data for services.Footnote 112 Even if demand elasticity allows lower-income consumers to abstain from consumption, they will suffer an opportunity cost by losing access to the services that they could afford with their data.
This will result in the inverse of the current “privacy as a luxury good paradigm.”Footnote 113 Whereas now the poorer cannot afford privacy because they need to pay with their data, after the tax the poorer will not be able to afford not to have privacy. That may seem like a good thing, but it will come at the cost of increasing the divide of access to a range of services that are becoming increasingly embedded in the way we learn, socialize, communicate, or even love. In addition, given that many now claim that social media are the new public fora, access to these fora will be conditional on one’s income—not unlike the times when citizenship was dependent on one’s income.Footnote 114
There might be mechanisms that could complement the Pigouvian tax to remedy these distributional inequalities. The most obvious one is the use of taxation to redistribute incomes from the richer to the poorer.Footnote 115 Designing a redistribution scheme faces its own complexities and it depends on various parameters, which I cannot examine in detail here. These problems are further exacerbated by the fact that a large chunk of data collection takes place across borders, and the nationalities of the data controller and the data subject might differ, which creates a myriad of institutional problems for redistribution. These complexities further worsen the difficulties with making such a tax feasible.
Lastly, because Pigouvian taxes seek to restore market efficiency, they raise important normative questions about equity. Although efficiency may seem like a neutral standard, critical scholars have rightly pointed out that there is nothing natural or neutral about it.Footnote 116 In this respect, environmental regulation is a good analogy. There is something perverse in seeking to make pollution efficient and the same can be said about privacy infringements and the informational harms that often accompany them.Footnote 117 Regardless of the normative salience of efficiency, the broader issue is more complex than it appears because the economic arguments about efficiency and innovation can be easily recast in moral terms. Innovation can be about improving returns for shareholders, but it can also be about, for example, creating new medical tools that save lives. This is a very important debate and I would not do it any justice by cramming it into a few paragraphs in this paper. For present purposes, I believe that the difficulties in making such a tax feasible provide us with strong grounds for rejecting it. Yet, when delving into economic arguments, it is important to remember that they have important normative assumptions that we should not leave unchallenged.Footnote 118 If a measure can establish efficiency, one is perfectly entitled to ask “so what?”Footnote 119
2. Nudging
Another proposal to overcome the problems associated with consent has been to use privacy nudges.Footnote 120 A nudge, according to the definition by Richard Thaler and Cass Sunstein, is “any aspect of the choice architecture that alters people’s behavior in a predictable way without forbidding any options or significantly changing their economic incentives.”Footnote 121 The idea behind the use of nudges is that they can steer people towards making decisions that are in their interest and thus mitigate the problem that going over lengthy and incomprehensible privacy notices poses. Some authors even propose that nudges can make consent more informed and empower people in making choices.Footnote 122
If nudges are highly effective, perhaps we do not need to change the laws that govern data disclosures, assuming that our end goal is to make such disclosures socially efficient. However, in such a scenario, the only reason we would allow individuals to make decisions is that they would be making the decisions that we, as a society, want them to make. If the effectiveness of nudges went down, we would fall back to more oppressive regulatory means. One could argue that under this structure nudging would simply be command and control by other means. This might seem illiberal, but it is not. Even Thaler and Sunstein, who are not big proponents of government regulation, acknowledged that when externalities are present, referring to the environment, nudges are a complementary mechanism until the government acts.Footnote 123 In this sense, nudges can and should only be a complementary mechanism providing individuals with nominal rather than actual control. However, providing nominal control might be undesirable in that it deceives people into thinking they have control when in fact they do not.
III. Murky Consent
Daniel Solove, a critic of consent himself,Footnote 124 has recently put forward a proposal on how to address the difficulties that consent involves while retaining some of the control that it provides to individuals.Footnote 125 In his interesting approach, which he entitles Murky Consent, he argues that we should retain consent to preserve people’s control—he uses the term autonomy—but that we should place guardrails on that control, which will rein in what data controllers can do on the basis of consent. According to Solove, this approach will bridge the gap between the legal fiction of consent and its practical “murkiness”Footnote 126 and thus it will reduce its unwarranted legitimating powers.Footnote 127
Solove’s guardrails centre on four main duties. The first duty is the duty “to [o]btain [c]onsent [a]ppropriately.”Footnote 128 The second duty is “to [a]void [t]hwarting [r]easonable [e]xpectations.”Footnote 129 The third duty is the “[d]uty of [l]oyalty.”Footnote 130 The last duty is “to [a]void [u]nreasonable [r]isk.”Footnote 131 Interestingly, these guardrails are a combination of existing rules in Fair Information Principles and the GDPR along with the adoption of some new proposals such as duties of loyalty or accounting for societal harms.
Although Solove’s proposal is interesting and it goes the furthest among proposals that seek to salvage consent, it is ultimately unconvincing for two reasons. First, Solove does not justify why retaining consent is so important in terms of safeguarding freedom, despite his acceptance of the fact that “[m]ost privacy consent is a fiction.”Footnote 132 If a freedom I have is only nominal, then I believe there is a heavier onus to explain why taking it away would actually reduce my overall freedom. Solove’s main argument in favor of retaining consent is that it is desirable because the alternative would require the government to be making all relevant decisions, which would be “overly controlling.”Footnote 133 However, even if that were true, this does not explain why the individual’s freedom would suffer a loss.Footnote 134 Even if retaining fictional consent were a good idea to avoid government overreach or because, despite their flaws, individuals still do a better job at it, that rationale relies on institutional considerations and not on retaining people’s freedom, despite the author’s assertions to the contrary.Footnote 135
Moreover, the introduction of mandatory rules to address the problems of individualistic data governance is not a new idea and it has so far failed.Footnote 136 However, the new duties show some promise. Yet, if we are to give the new guardrails teeth, the added value of retaining consent, even in relation to the freedom of those providing it, will be minimal. Consent will be beneficial for the data subject when it coincides with the data subject’s interest for or against the data processing. It will be beneficial for the data subject and society when it coincides with both the interest of the data subject and the social interest. Yet, this alignment of interests is simply coincidental. Given that consent is fictional, it is an inaccurate reflection of both. Despite that, there could have been a justification for retaining consent, if we had no better way to protect the interests of individuals. But we do. The duty of loyalty that Solove proposes can ensure that data controllers act in accordance with the actual interest of data subjects, rather than the false resemblance of those interests that consent provides.Footnote 137 Moreover, I agree with Solove that we should retain data protection rights, despite their shortcomings, which can provide individuals with powers that can prevent intrusions upon their privacy.Footnote 138 Yet, if we do all that, why do we still need consent?
Solove’s correct suggestion that we should add a rule that accounts for social impact further limits the importance of consent.Footnote 139 Almost all, if not all, data disclosures generate some form of social impact in the form of positive or negative externalities. This means that in almost all cases we would have to balance the interests of the data subject against social interests and that consent could not but be a low-accuracy token of that individual’s desires and interests. Within the framework of duties of loyalty on the one hand and balancing of social interests on the other, it is hard to imagine the role that consent will play. The use of the term “guardrails” to describe the duties that Solove proposes seems to suggest that consent cannot override them.Footnote 140 And given its “fictional” nature, it would not have much role as an expression of the data subject’s desires either. My suspicion is that it would play a mostly nominal role and it would let the other rules do most, if not all, of the heavy lifting.
One may wonder what is wrong with that. That depends on whether my speculation is right. If consent were indeed nominal, then this proposal would be effectively similar to what this paper argues. Yet, I think we have good reasons to avoid such an arrangement, unless we have constitutional hurdles to overcome, such as the existence of a fundamental right to data protection in Europe that might include consent.Footnote 141 By retaining consent, but making it nominal, we are likely to mislead people into thinking that they are making consequential decisions, when in fact they are not. Although I think that taking away consent would be a good thing, many others do not share that view and we have the onus to set our arguments in a transparent way and make their consequences clear. There might be other reasons in favor of retaining nominal consent, such as political difficulties in abolishing it or problems with surviving judicial review in jurisdictions that embrace ISD. However, without such specific reasons, abolishing consent is the best option.
D. Potential Objections
Despite consent’s bad track record, there are many scholars and policymakers that remain convinced that it still has a place in data protection law, even if they acknowledge that it is in need of improvement.Footnote 142 Support for consent comes from diverse and perhaps even conflicting perspectives. For instance, some arguments focus more on how consent affects innovation while others focus on a human rights perspective of autonomy and ISD.Footnote 143 The diversity of the arguments in favor of consent makes it necessary that each one of them be addressed on its own grounds. Indeed, it is not a usual occurrence for arguments that raise concerns about the markets and innovation to coincide—in their solutions—with those that focus on autonomy and human rights.Footnote 144
In this section, I will seek to rebut two arguments in favor of consent. The first argument is that consent is an aspect of individuals’ freedom and by abolishing it we would impinge on that freedom. The second argument is that consent is a feasible governance mechanism that avoids excessive burdens and thus does not excessively hinder innovation. In a sense, I have already stated my objections to these arguments. Even if we accept their premises, those arguments would not be convincing against the social dilemma argument. By analogy, it would no doubt be more feasible to leave pollution to the markets and it might even foster innovation, at least in the short term, but no one, or at least not many, would argue that we should just let consumers deal with polluting factories. The same applies to all of the following arguments. Yet, I think it is useful to explore in more detail how these arguments relate to the public goods argument that I made above. Moreover, there are some weak points in these arguments that go beyond the public goods dimension.
I. Freedom and Informational Self-Determination
One of the main objections to abolishing consent in data protection law is that it would violate the autonomy of individuals to make decisions about their data.Footnote 145 However, it is well-established, even among scholars who endorse such a view, that ISD has limits. These limits are demarcated by the interests or rights of others as well as the public interest. Thus, this argument implicitly assumes that for the most part these other interests do not feature in the calculus. Yet, as must have become clear by now, this is far from the truth.
As we saw, the freedom to disclose one’s data often—if not always—causes harm to others by diminishing their privacy. Given that we generally have the freedom to make data disclosures, the crucial question is if and under what conditions the externalities that such disclosures create justify restrictions on our freedom. Rutger Claassen has written an excellent piece which bridges the economic and philosophical literature on externalities and provides crucial insights on when externalities can be the basis of regulation.Footnote 146 As Claassen notes, traditionally economists like Arthur Pigou were thinking of externalities as the fault of the producer who would have to be forced to bear that cost.Footnote 147 However, Ronald Coase in his classical paper The Problem of Social Cost refuted that assumption.Footnote 148 If we focus on utility as personal preference, then externalities are reciprocal.Footnote 149 To use Claassen’s example, if I smoke and that annoys the people next to me or even harms their health, that is as much an externality as not being allowed to smoke, even though I want to.Footnote 150 In both cases, one party suffers a loss of utility. What leads us to treat one behavior as an externality that requires regulation and not the other is a normative criterion, which philosophy and not economics can provide us with.Footnote 151
Claassen identifies the harm principle that John Stuart Mill first famously articulated as such a criterion, according to which the state can restrict one’s freedom when that person uses her freedom to impose harm on others.Footnote 152 The crucial question here is what counts as harm. Obviously, if we were to consider any reduction in utility-as-personal-preference as harm, a vast amount of human activity would fall within the concept and this would yield morally troublesome results.Footnote 153 Ultimately, even the notion of harm does not provide us with the necessary guidance because we need some kind of principle to define what harm is and when it is justified for the state to intervene.Footnote 154 This is crucial given that Mill thought of harm as a necessary but not sufficient condition for intervention.Footnote 155
It is not possible to examine here all the theories that suggest what can qualify as harm. In a sense, this question is at the heart of political philosophy as it sets the boundaries of when the state can restrict freedom. However, Claassen offers an account that can provide us with such normative guidance, even if that guidance is, inescapably, controversial.Footnote 156 He suggests that we can draw this normative guidance from objective list theories of wellbeing.Footnote 157 Claassen refers to Feinberg’s theory of basic interests and Raz’s theory of personal autonomy as examples, although he clarifies that we could use other such theories as well.Footnote 158
To make the case that privacy should be one of the interests on such lists is not particularly hard. Aside from the fact that privacy is well established as a moral and legal right, it falls within the criteria that most theories use to demarcate their objective lists of good. Feinberg, for example, argues that we should exclude from the notion of interests passing desires, such as going to the cinema and ulterior goals, such as buying our dream house.Footnote 159 What remains is “wants and goals of an intermediate range of ulteriority.”Footnote 160 The debate on whether privacy and data protection are ends in themselves or means to ensure other rights remains unsettled.Footnote 161 However, regardless of the answer one gives, it is clear that data privacy remains a prerequisite of many other ulterior goals such as personal development, political participation, family life, and intimate relationships, among many others.Footnote 162 Although it is not possible to examine here all objective theories of wellbeing, as Claassen notes, there are important similarities among them.Footnote 163 Given privacy’s importance, it is highly likely that it would make the cut and be part of the list of most, if not all, such theories.Footnote 164 Therefore, because data disclosures impose harms on others’ data privacy, we can legitimately curtail their freedom to do so, at least in certain circumstances.
The harm principle and the objective list theories that we may use to substantiate it are not without their own weaknesses. Someone who disagrees with them might perhaps be tempted to reject my criticism of the ISD argument for consent on these grounds. Yet, I mention these theories not because I necessarily agree with them, but because they are among the most protective ones for individual freedom. If we can justify curtailing the freedom of individuals to disclose their data under the harm principle, the same task will likely be much easier on different normative grounds that are less liberal. What is in any case clear is that firstly, this is not a case of paternalism because we are not restricting this particular freedom for the sake of those exercising it, and secondly, that the negative effects that the exercise of freedom can have on others provides the state with strong moral and legal grounds to intervene.
II. Feasibility and Innovation
One of the main reasons that consent has been so popular and resilient is its practicality. The decentralized system of arranging affairs on the basis of mutual agreement permeates private law and it is anything but new.Footnote 165 Not only is consent a familiar governance model that is readily applicable, but it also supposedly strikes a balance between enabling individuals to make their own decisions and avoiding undue interference with innovation and data intensive economic activity.Footnote 166 As Julie Cohen aptly noted, the portrayal of data processing companies as innovative has led to “the emergence of a surveillance-innovation complex within which advances in information processing are privileged for their own sake and regulatory oversight is systematically marginalized.”Footnote 167 Therefore, there is great reluctance to alter the regulatory model in ways that may hinder innovation, particularly due to fear of the repercussions to the economy.
Moreover, consent can be easier for enforcement purposes than the top-down data protection governance systems that Europe used in the past.Footnote 168 For example, in Europe, consent and individualistic governance based on rights more generally shifted the enforcement structure of data protection authorities (DPAs) from primarily exercising public oversight to adjudicating individual complaints.Footnote 169 Although this increased the burden on DPAs in that they had to respond to all complaints, it saved them the trouble of having to carry the brunt of enforcement through auditing. They may have retained auditing powers, but these are discretionary whereas there is an obligation to address the complaints of data subjects. However, regardless of what the optimal regime is, a complaints-based system does not require consent as long as we maintain data privacy rights.
Another potential benefit of using consent is that it can provide increased legal certainty in comparison with more abstract legal grounds for data processing, such as the legitimate interest of the data controller in the GDPR.Footnote 170 Uncertainty can be even higher when these legal grounds involve the need to balance various interests. There is a fear that delegating such abstract balancing to private companies might lead to a damage control mindset that will prioritize the right that is less likely to create litigation costs for the company.Footnote 171 However, in Europe, given the very high requirements of the GDPR for consent to be valid, it is doubtful whether consent provides much more legal certainty itself.Footnote 172
In any case, the crucial question when examining these attributes of consent is “in relation to what?”Footnote 173 For example, consent might be less restrictive of innovation than licensing but more than deregulating data processing even further. Moreover, it is imperative that we examine governance mechanisms in context. It would probably be true that if we lifted restrictions on data processing, we would increase innovation in data intensive industries, in the same way that deregulating pollution might increase innovation in manufacturing industries. That argument, however, does not tell us very much. Innovation is obviously not an end-goal in itself, but a means to an end. Therefore, unless we have in mind those ends and the alternative means to achieve them, we will not be able to assess such arguments properly.
What is clear is that the weight of data privacy is not zero. Therefore, arguments that appeal to innovation without even the attempt to mask the argument in human rights language do not carry much normative or constitutional authority. The same would be true in a philosophical or even economic context. One also needs to show why increased innovation instead of increased privacy protections will increase overall utility, or improve the pursuit of the common good, or whichever other goal different theories might identify. Granted, one could argue that, other things being equal, having more innovation is a good thing. However, as we saw, there is a growing body of research that shows how consent produces inefficient and inequitable results.Footnote 174 In any case, abolishing consent does not preclude designing alternative regimes that are more or less innovation friendly, including alternatives that foster innovation further than the status quo.
E. Why Are Data Protection Rights Not a Problem?
The collective nature of many of the problems that Big Data processing creates could lead one to argue that the problem is not with consent per se, but with individualistic governance in general. This is not exclusively a data privacy issue. Indeed, critical scholars have rightly cast doubt on the ability of rights to tackle more systemic issues and to foster solidarity.Footnote 175 Rights presuppose a very particular Western archetype of the people who will exercise them, which is often entirely detached from reality, even in Western societies.Footnote 176 Perhaps there is a better way to protect people’s interests other than legal rights. The answer largely depends on what one envisions as an alternative; this issue can easily subsume many core issues in political philosophy. In this section I will restrict myself to the question of whether a data protection system without rights would be better or not. After all, though many are quick to forget this, such a system is anything but unfamiliar, at least in Europe.Footnote 177
It does not take too much of a leap to apply the anti-consent arguments I made above against individual rights too. Data disclosures do not only have negative externalities—although their privacy externalities will almost always be negative. Many of the radically improved functions of digital services are a result of the accumulation of data. Despite the efforts of companies to ensure that many of these benefits remain private, there is no doubt that a non-trivial part of those benefits is social.Footnote 178 Moreover, non-profit organizations and the government also engage in data processing, which can also generate important societal benefits. Yet, by retaining the rights of data subjects to prevent or limit data processing, we empower them to prevent these positive spillover effects and as such they can cause negative externalities in the form of foregone benefits to others.Footnote 179
This argument is not the exact mirror reflection of the argument against consent. Even if we accept that in terms of utility the costs from less data processing are symmetrical to negative privacy externalities, their moral and legal evaluation is notably different. People have a right to privacy, but they do not have a right to benefit from the positive externalities of others’ data disclosures per se. To the extent that the benefits of others’ data disclosures touch upon specific rights of theirs, perhaps they could couch a claim in human rights terms. Yet, such a claim would be unlikely to fare particularly well. It is unlikely that a claim that my right to health or safety entails an obligation of a private individual to disclose her data would go very far. The example of the COVID-19 pandemic where such claims, one would expect, were particularly strong showed how the right to privacy prevailed without creating too much of a fuss.Footnote 180
Regardless of the moral and legal status of claims for data disclosures, there is another reason that this argument is less forceful. Our existing laws already provide extensive rules that allow for processing to take place, even against the data subject’s wishes.Footnote 181 For example, freedom of expression or research override the data subject’s assertion of the right to erase her data.Footnote 182 Regardless of whether one agrees with the specifics, data privacy law does have mechanisms in place to allow data processing to take place when the interest of others or the public interest that support it override the rights of the data subject. By contrast, there is no way for the rights of others to override the data subject’s consent. This is the case even though, as we saw, the human rights claims against such disclosures are much stronger than the ones for the disclosures to take place.
Regardless, the points above do not fully refute the anti-rights argument. There might not be a right to the positive externalities of data processing, and we might have some rules to mitigate data privacy rights to protect societal benefits, but these do not explain why we should have data privacy rights in the first place. After all, the deficiencies that prevent individuals from making meaningful decisions can also prevent them from making meaningful and informed decisions on how to exercise their rights. Yet, these criticisms go far beyond the context of data protection. People lack information and the capacity to make meaningful decisions when exercising many of their rights. In addition, the exercise of human rights in general can often negatively affect the interests of others or the public interest itself. Therefore, these criticisms will either have to target human rights in general, in which case I will leave that discussion for another forum, or they cherry-pick in targeting data protection rights specifically.
The case for data protection rights does not need to be only negative. It does not rely exclusively on the weaknesses or the over-inclusiveness of the criticisms against it. On the contrary, there is an important positive case for data protection rights without consent, both for reasons of principle and for more practical ones. This arrangement is what I call “control without consent”.
A data protection system that does not have any data protection rights would have to rely on some other entity, which will have to monitor the violation of data protection rules. Individuals might be bad at spotting diffuse systemic information harms, but they are unparalleled in spotting intense harms that violate their interests.Footnote 183 Conversely it is not hard to imagine how some other entity that monitors all harms can neglect serious individual harms that lack scale. Even if this does not happen, we cannot exclude the possibility that some of these harms will slip through the cracks and individuals will have to suffer without recourse.
In addition, control without consent could fix many of the problems with data externalities without completely abolishing rights. Moreover, retaining rights has significant benefits for the transition to a regime that effectively addresses externalities. Such a regime requires the abolition of consent, but this is not the only reform that we need, as I will explain below. As we embark upon this reform endeavor, which might require upending some core features of our current law, retaining a familiar and well-established mechanism for the protection of the interests of individuals can be valuable.
F. What Should Replace Consent?
A final issue that one could raise in relation to the proposal to abolish consent is the question of what should replace it. In a certain sense, the salience of the arguments above depends on the alternative. One could argue that consent is the worst rule except for all the others we have already tried, to paraphrase Churchill’s famous quote.Footnote 184 Yet, such an objection would be overstated. For example, we might not agree on how we should tackle environmental pollution and climate change yet still acknowledge that leaving that up to market mechanisms of supply and demand is a bad idea. The example is not coincidental. The problems that relate to the production of public goods exist both in relation to the environment and to data privacy.Footnote 185
Perhaps some readers will remain apprehensive about endorsing the abolition of consent without a fully developed alternative. However, we are seeing an increasing number of proposals for alternatives.Footnote 186 The pertinent question here is not what should replace consent but whether there is any arrangement under which consent is justified. I do not think so. Even if the proposals examined above were successful in inducing people to maintain desirable levels of privacy, consent would simply provide the illusion of individual control. People would be allowed to consent only insofar as we can ensure by other means that they provide consent in a socially desirable manner. Although I agree with the goals of such an approach, it is highly likely that it will be deceptive and thus not justified.
I do not claim that abolishing consent or even establishing “control without consent” will resolve all the problems that relate to data externalities, much less all of data protection’s problems. There is a need for wider reform of data protection law. However, I think we can make a strong case for the abolition of consent and for maintaining data protection rights irrespective of the specific arrangement we adopt. This is not to avoid tackling these—undoubtedly thorny—issues directly. I have developed an approach to tackling these problems that goes beyond the scope of this paper.Footnote 187 However, it is important to identify common ground even when we disagree on the specifics, and I believe that the abolition of consent could and should be one of them.
G. Conclusion
The debate about whether we need new law in light of technological changes is old and well-known.Footnote 188 Most data protection lawyers, not without a certain degree of bias, would find themselves firmly arguing in the affirmative. Yet, when it comes to certain aspects of data protection law, there is sometimes an aversion to change. However, we should strive to maintain the ethos of the pioneers of this field who managed to adjust the legal system to the new challenges, despite the skepticism that they faced.
Regardless of whether we should retain consent or individual rights, we need to change the framework in which we examine them. Ignoring the horizontal dimensions of privacy, particularly in the form of data externalities, distorts our perception and leads us to erroneous results. Accounting for data externalities does not necessarily mean arguing for the abolition of consent, although I think it should. Despite the popular conviction to the contrary, consent does not further our privacy interests. It can theoretically further our control, but study after study has demonstrated that such controls are nothing more than symbols at best and fig leaves at worst. It is time that we find a different mechanism that does the heavy lifting retaining rights as recourse when someone suffers significant prejudice, rather than relying on them as the main regulatory mechanism.
One might dismiss the argument in this paper because it is easy to criticize without providing an alternative that will work better. However, removing consent as a lawful basis for data processing would relieve a significant burden from data subjects, it would prevent data controllers from using a legal basis that is often illegal anyway, and it would encourage the use of other legal bases, some of which are more amenable to the consideration of third-party interests. After all, even if that is not the case, the ball is now in the court of the defenders of consent. Data externalities provide very strong reasons for abolishing consent. The onus is now on those that still want to uphold it to provide even stronger reasons in its favor.
Acknowledgements
I would like to express my thanks to Daniel Bertram, Tommaso Fia, Carolina Paulesu, Thomas Streinz, and to the participants in the Oxford Future of Technology and Society Discussion Group, the European University Institute Information Society Working Group, and the Computers Privacy and Data Protection Conference sessions where an earlier draft was presented for their precious feedback. I also owe thanks to Andrew Murray for his mentorship during my research stay at the London School of Economics during which the gist of this article was developed and to Simon Deakin and Viktor Mayer-Schönberger for discussions and advice that influenced my wider thinking on many of the themes that I touch upon in this paper.
Competing Interests
The author declares none.
Funding Statement
The completion of the scientific publication was financed by the State Scholarship Foundation (I.KY.), within the framework of the Greek PhD candidate scholarship program of the EUI. I acknowledge support by the Open Access Publishing Fund of University of Tübingen.
Open access
