Two Concepts of Information in European Data Protection Law

Two Concepts of Information in European Data Protection Law Presented by: Dr. Hallinan Date: 24 November 2020 Introduction - Information is a core concept in data protection law - There is almost no scholarship or jurisprudence dealing with the functions or material boundaries of the concept - Preliminary investigation shows a concept which is complex, multifaceted and, eventually, functionally problematic in data protection law Three Theses - (1) There are in fact two different roles played by the concept of information in data protection law: information as an applicability criterion; and information as an object of regulation - (2) The substantive boundaries of the concepts of information populating these two roles differ - i.e. these are two different concepts, not relating to the same substantive phenomenon. - (3) The substantive differences between these two concepts of information are significant for the efficacy of data protection law Thesis 1: The Concept Of Information Plays Two Roles In Data Protection - Role 1: information as an applicability criterion - Article 4(1) GDPR • Intended to be interpreted in a highly flexible way • Intention to allow data protection law to apply to a wide range of situations in which use of depictions of individuals cause risks in information society - Role 2: information as an object of regulation • The substance in relation to which concrete provisions of law were designed and in relation to which these provisions are meant to act • Limited flexibility as pre-baked into concrete provisions of data protection law Thesis 2: Concepts Filling These Roles Do Not Converge On The Same Phenomena - To demonstrate this, a framework for mapping and comparing boundaries of the two concepts of information is necessary - Unfortunately, as there has been little legal consideration of concepts, no such framework is evidently available from within data protection law - Need to build a framework for charting substantive boundaries of concepts from outside law, looking to other disciplines. - To build framework, look across various disciplines in which concept of information appears, identify commonalities between conceptualizations - In relation to each commonality, build an axis along which to plot differences between the approaches which appear in different disciplines - The identified axes together then constitute a structured framework against which the concepts of information in data protection law can be mapped - We engaged in this exercise, we put together a framework consisting of three key axes of differentiation: • Relationship between concept of information and transmission of meaning  Certain concepts ambivalent to transmission of meaning, others only relate to meaning, differences in degree of prior structuring of substance to transmit meaning • Relationship between concept of information and media of storage and transfer  Certain concepts open as to media of storage and transfer, others specific as to media of storage and transfer • Relationship between concept of information and human cognition  Certain concepts ambivalent to human cognition, other concepts require human cognition to play some role in curation of substance Thesis 2: Boundaries of concepts filling the two roles do not converge on the same phenomena - Information as an applicability criterion, taking into account purpose and flexibility of concept and available jurisprudence • Along axis 1)-relationship between concept of information and transmission of meaning: concept of information encompasses all types of substance capable of meaning transmission  Regardless of the degree to which these must be subsequently structured to transmit meaning directly to one or more parties • Along axis 2) - relationship between concept of information and media of storage and transfer: concept of information encompasses substances stored on all forms of storage and transfer media • Along axis 3)-relationship between concept of information and human cognition: concept of information encompasses all substances for which human cognition has been involved in setting processing context - Information as an object of regulation, taking into account dimensions of concrete provisions and working backwards: • Along axis 1) - relationship between concept of information and transmission of meaning: concept of information relates to substances capable of transmission of meaning  But only substances which are already structured such as to directly provide meaning to recipients-i.e. social facts • Along axis 2) - relationship between concept of information and media of storage and transfer: concept of information encompasses substances processed in media which facilitate relatively frictionless copying and transfer of information • Along axis 3) - relationship between concept of information and human cognition: concept of information requires that human cognition has played some role in setting processing context and substance is capable of being perceived and understood by humans - Comparison along axis 1: information as an applicability criterion all substances capable of meaning transmission, information as an object of regulation only highly structures substances in the form of social facts - Comparison along axis 2: information as an applicability criterion encompasses all storage and transfer media, information as an object of regulation only encompasses media which facilitate frictionless storage and transfer - Comparison along axis 3: information as an applicability criterion requires human cognitive involvement in setting processing context, information as an object of regulation also requires that a substance can be perceived and understood by humans Thesis 3: Lack Of Convergence Of Substantive Boundaries Of Concepts Of Information Filling The Two Roles Is A Problem For Data Protection Law - Example of significance of differences along axis 1: human genomic sequences • Human genomic sequences are capable of being analyzed to produce socially relevant facts about individuals, but full range of facts expands unpredictably over time as genetic science advances • Human genomic sequences fall within concept of information as an applicability criterion, human genomic sequences do not fall within concept of information as an object of regulation-not pre- structured in the form of facts • Several concrete provisions in data protection law which require data controller to provide information to data subject about processing to allow data subject to understand consequences of processing - happen in one-off manner so information must be accurate for duration of processing  Knowledge of relevant semantic content in substance being processed essential for evaluating consequences • Provisions cannot work effectively in relation to genomic sequences as the semantic content in substance will expand unpredictably over time - Example of significance of differences along axis 1: biological samples in medical research • Biological samples can fall within boundaries of concept of information as an applicability criterion, but not within boundaries of concept of information as an object of regulation- do not facilitate easy storage and transfer of information • Several concrete provisions in data protection law require data controllers to provide data subjects, or another party, with a copy of the personal data being processed  These provisions are not intended to be associated with significant burdens on data controllers • When these provisions are applied to human biological samples, data controllers are faced with significant burdens  Obliged to sequence sample, or make a biological copy of sample, both resource intensive - Example of significance of differences along axis 3: advanced analytics, neural networks etc. • In certain constellations, personal data processed in such systems can be impossible or very difficult to humans to access, perceive and evaluate • Substances processed within the context of such systems fall within scops of concept of information as an applicability criterion, but not within scope of concept of information as an object of regulation-not susceptible to human perception and understanding • Numerous provisions in data protection law which require that humans engage in evaluation of data being processed against some socially defined benchmark • These are difficult to apply in relation to such systems  E.g. How should the obligation to store and process data accurately be realized in relation to such systems? - Lack of convergence, as well as range of consequent problems, will likely grow over time - Concept of information as an applicability criterion is more flexible than the concept of information as an object of regulation - As information processing becomes ever more important, novel forms of information will likely continue to emerge which will fall within former definition but will not be subsumed within the latter Conclusion - Information is a key concept in data protection law - Yet its boundaries and function have scarcely been considered in jurisprudence or academia - Preliminary investigation reveals a concept occupying different roles in data protection, which is conceived in different ways depending on the role, and the conceptualization of which can be seen as problematic