Study on human dignity and limits to processing of personal data: first thoughts

Interesting study on where human dignity and data protection come together, worth the read. I’m not convinced by some parts, though, as there is too much room left for subjectivity in the way certain things are worded.

The authors suggest 7 guiding principles, but of particular interest to me were their suggested 6 limits to the processing of personal data:
1. Commercialisation of especially protected attributes
2. Fully automated consequential decisions without meaningful human intervention
3. Intrusive collection without necessity and minimisation (disproportionate tracking, surveillance, data fusion)
4. Dark patterns and lock-in (manipulated consent and exit)
5. Opaque transfers to third parties (hidden flows, no traceability)
6. Retaliation for exercising rights (portability, erasure, objection, access)

Here, the study breaks down a little in my view due to lack of detail or consideration for the way things work in practice.

First, a positive point is that based on their description, the authors clearly view *active inferences* of sensitive attributes as the risk, not potential ones, which to me reads as an implicit admission that the OT CJEU judgment should be seen as very specific to online publications and should not be generalised (+ that Lindenapotheke should not be over-interpreted).

But for the remainder, their list of non-negotiable limits is unfortunately very vague.

– Readers know for instance how I have been critical of broad interpretations of the notion of automated decision-making – add a vague term like “consequential” to the mix, and what does that then mean exactly?

– On “opaque” transfers: opaque from whose perspective? Traceability is important, but nothing in the law actually dictates that the public have full transparency.

– “Intrusive collection without necessity and minimisation”? I have often seen individuals claim this is the case, despite a solid justification for the collection of data.

– “Dark patterns and lock-in”? I have seen several – including the EDPB – suggesting that mere nudging is a dark pattern, while nudging does *not* actually rob a data subject of their freedom.

– “Retaliation for exercising rights”? Service degradation is not the same as service feature lock-out/objective service differences, yet the “pay or consent” debate shows that several mix the two.

Human dignity-centric” does not mean the subjective perspective of an individual always prevails (as that is a very slippery slope towards just prohibiting anything and everything). Instead, we need objective criteria.

GDPR privacy