Does the GDPR Enhance Consumers’ Control over Personal Data? An Analysis from a Behavioural Perspective

I. Ooijen () and Helena U. Vrabec ()
Additional contact information
I. Ooijen: Twente University
Helena U. Vrabec: Yale University

Journal of Consumer Policy, 2019, vol. 42, issue 1, No 5, 107 pages

Abstract: Abstract Because of increased technological complexities and multiple data-exploiting business practices, it is hard for consumers to gain control over their own personal data. Therefore, individual control over personal data has become an important subject in European privacy law. Compared to its predecessor, the General Data Protection Regulation (GDPR) addresses the need for more individual control over personal data more explicitly. With the introduction of several new principles that seem to empower individuals in gaining more control over their data, its changes relative to its predecessors are substantial. It appears, however, that, to increase individual control, data protection law relies on certain assumptions about human decision making. In this work, we challenge these assumptions and describe the actual mechanisms of human decision making in a personal data context. Further, we analyse the extent to which new provisions in the GDPR effectively enhance individual control through a behavioural lens. To guide our analysis, we identify three stages of data processing in the data economy: (1) the information receiving stage, (2) the approval and primary use stage, and (3) the secondary use (reuse) stage. For each stage, we identify the pitfalls of human decision-making that typically emerge and form a threat to individual control. Further, we discuss how the GDPR addresses these threats by means of several legal provisions. Finally, keeping in mind the pitfalls in human decision-making, we assess how effective the new legal provisions are in enhancing individual control. We end by concluding that these legal instruments seem to have made a step towards more individual control, but some threats to individual control remain entrenched in the GDPR.

Keywords: Individual control; EU data protection law; GDPR; Decision-making; Behavioural economics (search for similar items in EconPapers)
Date: 2019
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (10)

Downloads: (external link)
http://link.springer.com/10.1007/s10603-018-9399-7 Abstract (text/html)
Access to full text is restricted to subscribers.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:kap:jcopol:v:42:y:2019:i:1:d:10.1007_s10603-018-9399-7

Ordering information: This journal article can be ordered from
http://www.springer. ... es/journal/10603/PS2

DOI: 10.1007/s10603-018-9399-7

Access Statistics for this article

Journal of Consumer Policy is currently edited by Hans Micklitz, John Thøgersen, Lucia A. Reisch, Alan Mathios and Christian Twigg-Flesner

More articles in Journal of Consumer Policy from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().