Maria Eduarda Gonçalves DINÂMIA’CET-IUL, ISCTE-IUL Law/technology lag or 'law as technology'? Deconstructing data protection law in the big data age Maria Eduarda Gonçalves DINÂMIA’CET-IUL, ISCTE-IUL ENCONTRO CIÊNCIA 2017 Centro de Congressos, Lisboa, 5 junho 2017

The technology – law lag law perceived as a reactive institution, which falls behind technological advances. the case of the EU personal data protection reform in the age of big data.

Basic data protection principles (Directive 95/46/EC; Regulation (EU) 2016/679) Consent Purpose limitation Data minimisation

The big data challenge for data protection principles Big data: The “3Vs” revolution – volume, variety, velocity big data technologies (data mining and analytics) use large data sets obtained from diverse unrelated sources, and automatically processed. consent, purpose limitation and minimisation clash with everything that big data stands for, as one of this technology strongest suits is its ability to gather and re-use information that was collected for other reasons and from other data controllers, automatically (the “collect-everything approach”). ‘The Internet has evolved in a way that surveillance - tracking people’s behaviour - is considered as the indispensable revenue model for some of the most successful companies.’ (European Data Protection Supervisor, 2015)

Paradoxically, the EU persistent optimism … On the European Data Protection Day, the 28th of January 2015, the Commissioners reaffirmed their faith in the new Regulation to “strengthen citizens' rights” and “put citizens back in control of their data”.

The EU data protection reform: the turn to a “risk-based approach” The data protection impact assessment to be carried out by the data controllers in case of ‘high risk’ of the data processing. Privacy by design and by default, i.e. the duty to develop and apply technical tools shaped by the design to protect privacy and personal data. The duty to notify data breaches.

From legality to safety? “The risk-based approach results in leaving data protection issues mainly to data controllers to decide, replacing the ex ante notification and control by the supervisory authorities by enforcement means approximating the USA’s more liberal regime” (Hasty, Nagel & M. Subjally, 2013).

How to account for this option of the EU legislator? Should this turn be explained by the technology/ law lag? or are we in the face of a EU deliberate option to use “law as technology”, i.e. data protection as an “enabler for big data services in Europe”, “a condition for trust in the new technological applications to be fostered”?