From consent to accountability : reforming data protection laws

Abstract

Consent is widely seen as the cornerstone of data protection laws. Yet reliance on consent attracts much criticism because consent from data subjects is rarely informed or voluntary and can easily be manipulated in the digital context. Existing studies have not adequately addressed the theoretical valorization of consent with its practical deficiencies. If the defects of consent are inherent, then its role in data protection laws should be re-evaluated. To address this issue, this thesis explores the following question: How can consent be appropriately approached in data protection laws and what reforms should be undertaken to better safeguard data privacy?

The thesis uses historical research, doctrinal study, content analysis, and comparative studies to answer the question. Based on the research findings, the argument put forward is twofold. Firstly, consent should not be considered the cornerstone of data protection laws. While it should be retained in the laws for its residual value under certain circumstances, it should not be relied upon as the primary mechanism for protecting data privacy. Secondly, the focus of data protection laws should shift from securing individuals’ consent to enhancing data controllers’ accountability because this is the only feasible means to defend individual privacy given the growing power disparity between data subjects and data controllers.

While global data protection laws already seek to strengthen controllers’ responsibility through a series of technical and organizational mechanisms, the rationale behind some of these mechanisms remains problematic and they risk falling short of their goals. To make controllers truly accountable, the laws should adopt a holistic approach to risk assessment in data processing and enforce ex post transparency, requiring controllers to reveal their actual data processing practices and data protection measures. While the specific details of such reform may differ across jurisdictions, the underlying principle is applicable to the EU, the US, and China given the converging features of their data protection laws. Overall, the thesis contributes to the existing literature by proposing risk-based and transparency-based reforms to strengthen controller accountability as the ultimate reform for data protection laws.