Data analytics and the GDPR: friends or foes? A call for a dynamic approach to data protection law

Abstract

In this paper, we aim to help overcome a perceived paradox (and attendant tensions) between the two objectives of innovation and privacy/data protection, in particular in relation to data scenarios where organisations are open to personal data they control to be reused (internally within their corporate group, or externally via a third party) for innovative purposes. We argue that to do this requires better defining key notions in data protection law, acknowledging the interdependence of data protection requirements or principles, and relying upon ongoing data management processes in order to control complex data environments. These are the pillars of a dynamic approach to data protection law.

We start our demonstration by suggesting that the conceptualisation of data analytics by policy makers has not helped to produce clear guidance for practices going beyond the mere production of statistics. On the contrary, by drawing a distinction between the production of statistics and the rest, this approach has indirectly formed the seedbed for the view that EU data protection law and in particular the GDPR is antithetic to data analytics. We then revisit this critique of EU data protection law to show its limits and build the argument that a more constructive interpretation of the GDPR is possible, this on the basis of a dynamic approach to data protection law. Finally, we unfold the main tenets of such a dynamic approach and ultimately suggest that the GDPR does not undermine the logic of data analytics as a form of ‘data-driven general analysis,’ which implies a re-purposing or secondary processing of data legitimately hold by a data controller over a limited period of time and with no consequences defined prior to the analysis, although consequences could be attached in the future but only once a second impact assessment has been undertaken.

More information

Identifiers

ORCID for Sophie Stalla-Bourdillon: orcid.org/0000-0003-3715-1219

Catalogue record

Export record

Altmetrics