Further thoughts on study regarding human dignity & data as an asset

Is “personal data” an asset? A study on human dignity & data protection has been released that on paper sounds like it should cover all the key topics. Its authors argue that individuals are “the primary right-holders in relation to the processing of their personal data” and that these “are dignity-relevant manifestations of the person and must not be treated as mere merchandise or fuel”.
Unfortunately, the study glosses over a few things.

First, any study on the nature of personal data that fails to mention Directive 2019/770 is incomplete. While that Directive said data isn’t a commodity, it treats it pretty much as such, as consideration (= payment) for service access.

Next, the authors suggest 6 limits to the processing of personal data:
1. Commercialisation of especially protected attributes
2. Fully automated consequential decisions without meaningful human intervention
3. Intrusive collection without necessity and minimisation (disproportionate tracking, surveillance, data fusion)
4. Dark patterns and lock-in (manipulated consent and exit)
5. Opaque transfers to third parties (hidden flows, no traceability)
6. Retaliation for exercising rights (portability, erasure, objection, access)
Yet the study lacks detail on this or consideration for the way things work in practice.

First, a positive point is that based on their description, the authors clearly view *active inferences* of sensitive attributes as the risk, not potential ones, which to me reads as an implicit admission that the OT CJEU judgment should be seen as very specific to online publications and should not be generalised (+ that Lindenapotheke should not be over-interpreted).

But for the remainder, their list of non-negotiable limits is unfortunately very vague.

– Readers know for instance how I have been critical of broad interpretations of the notion of automated decision-making – add a vague term like “consequential” to the mix, and what does that then mean exactly?

– On “opaque” transfers: opaque from whose perspective? Traceability is important, but nothing in the law actually dictates that the public have full transparency.

– “Intrusive collection without necessity and minimisation”? I have often seen individuals claim this is the case, despite a solid justification for the collection of data.

– “Dark patterns and lock-in”? I have seen several – including the EDPB – suggesting that mere nudging is a dark pattern, while nudging does *not* actually rob a data subject of their freedom.

– “Retaliation for exercising rights”? Service degradation is not the same as service feature lock-out/objective service differences, yet the “pay or consent” debate shows that several mix the two.

Human dignity-centric” does not mean the subjective perspective of an individual always prevails (as that is a very slippery slope towards just prohibiting anything and everything). Instead, we need objective criteria.

The study: https://lnkd.in/exkCeQn7

GDPR privacy”