Privacy, Data Protection, and Individual Rights
Scope
Privacy items test whether you can separate privacy (a broad interest in controlling access to oneself) from data protection (the regulatory regime for processing personal data), and whether you can apply the mechanics correctly.
Core rules
- Contextual integrity (Nissenbaum): flows are appropriate when they match the norms of the context in which data was shared. Most privacy failures are flow failures, not secrecy failures.
- GDPR Article 5 principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. Accountability means demonstrating compliance, not asserting it.
- Lawful bases (Art 6): consent, contract, legal obligation, vital interests, public task, legitimate interests. Valid consent is freely given, specific, informed, unambiguous and withdrawable; it is rarely valid in employment or monopoly-service settings.
- Special categories (Art 9): health, biometrics used for identification, genetic, racial or ethnic origin, political opinions, religion, sexual orientation, trade union membership. These need an Art 9 condition in addition to an Art 6 basis.
- Rights: access, rectification, erasure, restriction, portability, objection, and Art 22 protection against solely automated decisions with legal or similarly significant effects.
- Roles and instruments: the controller determines purposes and means; the processor acts on documented instructions; a DPIA is required for high-risk processing; a DPO is required where core activities involve large-scale monitoring or special categories.
- De-identification: pseudonymised data remains personal data. k-anonymity, l-diversity and differential privacy involve real trade-offs, and linkage attacks show that no technique guarantees non-re-identification.
- US state law: CCPA/CPRA grants rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information, backed by notice, contract and opt-out-signal duties.
- Transfers: adequacy decisions, SCCs and BCRs. Schrems II invalidated Privacy Shield; the EU-US Data Privacy Framework (2023) replaced it but still requires transfer impact assessments.
Worked example
A fitness app shares route data with an advertising broker. Users clicked consent in a 40-page policy. Analysis: purpose limitation fails, because routes were collected for activity tracking, not ad targeting; consent is not specific; contextual integrity is violated because users expect route data to stay within the service; home-and-work clustering makes re-identification plausible, so the data remains personal. The fix is a change of flow, not better consent wording.
Traps
Calling pseudonymised data anonymous; treating consent as always the strongest basis; confusing controller and processor duties; forgetting that erasure interacts with backups, legal hold and statutory retention.