Search

This paper argues that while the GDPR has arguably delivered positive outcomes by enhancing the protection afforded to data subjects, it has also had adverse effects on competition by strengthening the position of large online platforms in certain markets. In addition, the GDPR has given large platforms a tool to harm rivals by restricting access to the data they need to compete effectively. The present paper focuses on digital advertising and the ad tech industry, where the GDPR appears to have strengthened Google and Facebook. The purpose of this paper is not to call for the weakening of the GDPR, whose positive impact on users cannot be ignored. While from a policy standpoint regulators should thus maintain or even increase the level of protection offered by this legislation, it is vital that they take steps to mitigate its adverse effects on other dimensions of welfare, such as competition. [ABSTRACT FROM AUTHOR]

The Federal Trade Commission (FTC) levied its largest fine to date under the Children's Online Privacy Protection Act (COPPA) against YouTube in 2019. In addition to paying the fine, YouTube agreed to make several changes to its platform in an effort to improve compliance with the law. Almost simultaneously, the Commission announced its intent to revise the COPPA rule and requested comments from stakeholders. This Comment seeks to explain the shortcomings of the FTC's enforcement action against YouTube and offer some proposals for sensible COPPA reforms. [ABSTRACT FROM AUTHOR]

The article discusses updates to the California Consumer Privacy Act (CCPA) of 2018 as of March 2021 to offer new privacy rights and protection to Californians. Other topics include the final regulations issued by the California Attorney General's Office, the right of consumers to request the categories of personal information collected and sold by businesses, and the liability of businesses to consumers in cases of data breaches.

The article focuses on origins of data privacy laws in the U.S. and common law right and extending to congressional legislation across different sectors. It mentions internet's impact on consumer data privacy and the U.S. self-regulatory response to the European Union's General Data Protection Regulation (GDPR). It also mentions self-regulatory bodies and lays out potential factors a newly formed body of industry-leading companies could consider to serve both consumer and corporate interests.

The California Consumer Privacy Act (CCPA) was passed in response to a number of newsworthy data breaches with widespread impacts, and which revealed how little digital privacy consumers actually have. Despite the large market for consumer data, individual consumers generally do not earn money when their personal data are sold. Further, consumers have very little control over who collects their data, what information is collected, and with whom it is shared. To place control back in the hands of the consumer, affirmative consent should be required to collect and sell consumer's data, and consumers should have the ability to sell these data themselves. The CCPA provides a mechanism for consumers to monetize their own data, but it does not go far enough. The CCPA allows consumers to "opt-out" of sharing their data, but an "opt-in" framework would offer increased privacy and greater incentives for companies to pay consumers for their data. Despite these and many other issues, the CCPA represents a step towards improved digital privacy. However, it remains to be seen whether the CCPA will result in any meaningful change to consumer data monetization and digital privacy protection more broadly. [ABSTRACT FROM AUTHOR]

The article addresses statutory developments and court decisions in the area of cybersecurity and data privacy law in the U.S. from October 1, 2018 through September 30, 2019. Topics discussed include states that have enacted an Insurance Data Security Law, information on the California Consumer Privacy Act (CCPA) effective on January 1, 2020, and explanation on New York's Stop Hacks and Improve Electronic Data Security Act.

The article focuses on Homeland Advanced Recognition Technology (HART) system of the U.S. Department of Homeland Security (DHS). It mentions federal government has long touted broad-based biometric data collection as inherently "privacy enhancing" due to the data's efficiency and immutability and expand data-sharing capabilities. It also mentions the Fourth Amendment's prohibition on unreasonable searches and seizures and integration of biometric data.

The article presents an analysis of the General Data Protection Regulation (GDPR) impact on U.S. law and policy and its involvement in domestic and global litigation. It mentions future of data privacy laws and regulations relating to the GDPR within the U.S. and privacy of personal medical data is governed by the Health Insurance Availability and Affordability Act of 1996 (HIPAA) and internet protocol (IP) addresses and social media profile information.

One component of the newly implemented European Union General Data Protection Regulation (GDPR), a revision of a 1995 directive, is mandatory breach notification. The US has no such federal law. This means companies must satisfy multiple US laws and that makes it more challenging to comply. This study is a comparison of the GDPR with the statutes of the 50 US states, highlights the challenges companies face and reveals the types of decisions companies must make to be in compliance with these statutes. [ABSTRACT FROM AUTHOR]

This paper introduces the strategic approach to regulating personal data and the normative foundations of the European Union's General Data Protection Regulation ('GDPR'). We explain the genesis of the GDPR, which is best understood as an extension and refinement of existing requirements imposed by the 1995 Data Protection Directive; describe the GDPR's approach and provisions; and make predictions about the GDPR's implications. We also highlight where the GDPR takes a different approach than U.S. privacy law. The GDPR is the most consequential regulatory development in information policy in a generation. The GDPR brings personal data into a detailed regulatory regime, that will influence personal data usage worldwide. Understood properly, the GDPR encourages firms to develop information governance frameworks, to in-house data use, and to keep humans in the loop in decision making. Companies with direct relationships with consumers have strategic advantages under the GDPR, compared to third party advertising firms on the internet. To reach these objectives, the GDPR uses big sticks, structural elements that make proving violations easier, but only a few carrots. The GDPR will complicate and restrain some informationintensive business models. But the GDPR will also enable approaches previously impossible under less-protective approaches. [ABSTRACT FROM AUTHOR]

The article focuses on laws governing internet privacy in the U.S. It mentions about the ability of Internet Service Providers (ISP) to implement a process known as data-mining; efforts of Federal Communications Commission in maintaining users privacy on the internet by creating ISP regulations; and enactment of Telecommunications Act and Communications Act for the same. It also mentions about Carpenter v. United States court case on the same.

As our lives become more driven by technology, California's privacy laws fall short of protecting our personally identifiable information. Vehicles in particular present an increasing privacy concern, as our automobiles become more computer and less car. Cars today have increasingly sophisticated capabilities, stemming from connected technology and sensors, and their ability to capture geolocation and biometric data. This data can be used to make inferences about drivers' behavioral patterns and daily habits. This Article analyzes whether California's privacy laws--California Online Privacy Protection Act ("COPPA") and Shine the Light--adequately address privacy concerns regarding driver data collected by the connected car. This Article considers how notice and consent can effectively protect connected car drivers, and concludes that consumers need a more effective way to manage how connected car data is collected, retained, and used. [ABSTRACT FROM AUTHOR]

The article discusses the General Data Protection Regulation in the European Union (EU) and its possible legal effects to businesses in Georgia. Other topics include the EU-U.S. Privacy Shield, which regulates personal data flow from EU to the U.S., the Georgia-specific data privacy laws, and U.S. data privacy laws like the Federal Trade Commission Act, Children's Online Privacy Protection Act, and Fair Credit Reporting Act.

As shown in Part One of this overview (CRi 2018, p. 97 para. 246 and p. 116), not all EU Member States had adjusted their domestic data privacy law to the GDPR. This Part Two presents the national data privacy laws of the EU Member States which have introduced specific domestic laws supplementing GDPR during the third quarter of 2018. Also for these "late-comer" EU Member States the GDPR granted the option not only to maintain or introduce national provisions to further specify the application of GDPR in specific areas but also to modify certain rules of the GDPR itself. The article provides an overview of how these "late-comer" EU Member States have adjusted their domestic data privacy laws in the following core areas of the new EU privacy law regime: (1) domestic legislation; (2) definitions; (3) relevant authority; (4) registration requirements; (5) data protection officers (DPO); (6) collection and processing; (7) data subject rights; (8) data transfer to third counties; (9) security of personal data; (10) data breach notification; (11) enforcement; (12) data processing in employment context; (13) provisions relating to specific processing situations (chapter 9 GDPR); (14) electronic marketing; (15) online privacy; (16) other notable domestic regulations. Finally, the article presents the updated list of EU Member States not having yet implemented domestic data privacy laws. Although the list indicates the current status of the domestic legislative process for each of these EU Member States, it appears safe to say that 2018 will not see these national data privacy laws adjusted to GDPR. [ABSTRACT FROM AUTHOR]

The article deals with the application of privacy policies in California in the use of social media phone applications. It highlights the effect of the state's Online Privacy Protection Act of 2003 (CalOPPA) and its amendment for higher consumer protections. The creation of the burden of disclosure on app developers by privacy policies is discussed, as well as the regulation of mobile apps by the U.S. Federal Communications Commission (FCC).

Copyright of Policy & Internet is the property of Wiley-Blackwell and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

U.S. technology companies face growing uncertainty over whether and how they can be compelled to turn foreign-stored user content over to law enforcement officials. In July 2016, the Second Circuit ruled that the government could not require Microsoft to produce user content stored on its server in Ireland because the execution of the government's warrant constituted an impermissible extraterritorial application of the Stored Communications Act (SCA). But after the Second Circuit declined to rehear Microsoft Corp. v. United States, (formally titled In the Matter of a Warrant to Search a Certain EMail Account Controlled and Maintained by Microsoft Corporation, also known as the "Microsoft Ireland" case) en banc in January 2017, the Supreme Court granted the DOJ's petition for certiorari and heard oral argument on the case in February 2018. Throughout this litigation, other courts have issued orders compelling Google to produce foreign-stored data requested by SCA warrants. Two fundamental questions have divided these courts: (1) whether the physical location of the data at the time it is accessed should determine whether it is within the reach of the SCA, and (2) whether other countries' data privacy laws and search-and-seizure protections apply. This Article argues that basing government jurisdiction over data on the data's physical location threatens user privacy. It also creates unworkable and unpredictable results for technology companies by failing to account for the significant differences in how they divide, store, and transmit their users' data around the world. In the context of digital searches, the data location test has two potential effects. First, it will create bottlenecks in the already-burdensome mutual legal assistance system, hindering intergovernmental cooperation on law enforcement investigations. Second, it may embolden foreign governments to circumvent the system by adopting similar, or even more extreme, positions on jurisdiction over data, such as data localization and mandatory encryption backdoor laws. These policies have dangerous consequences for privacy, free expression, and innovation around the world. While some have written about the data location test in Microsoft Ireland in the abstract, this Article takes a step further and considers its role in the rulings conflicting with Microsoft Ireland that have been issued by federal judges over the past two years. It also evaluates several recent legislative and non-legislative proposals to solve the problems arising from the data location test. In particular, this Article highlights the pressing need for Congress to reform the Stored Communications Act, incorporating an alternative test for jurisdiction over user data and provisions that would clarify companies' data disclosure obligations under conflicting legal regimes. Finally, while much of the literature on this topic focuses solely on legislative proposals rather than the real-world impact of the uncertainty creating a need for statutory reform, this Article focuses on what companies should do while they await a resolution from Congress or the Supreme Court. To that end, this Article offers some practical recommendations for how companies can navigate the issues arising from the data location test, particularly as they make decisions about their global operations and data storage architecture. [ABSTRACT FROM AUTHOR]

The article focuses on well-established rights and powers of the U.S. Federal Trade Commission (FTC) in performing the duties of the federal government's privacy watchdog. It informs on regulation of internet privacy in light of the immense power wielded by court case such as FTC v. AT&T court case. It also informs on regulatory gap established by the Ninth Circuit's decision if the decision stands and the Supreme Court does not take up the case.

The article highlights challenges and limitations related to current privacy and data protection rights in the U.S., as of January, 2018. Topics discussed include various conceptions of domination; concerns about surveillance, the collection of information, and power; and approaches made for encoding obscurity into law and the design of technological artifacts.

Online shops could offer each website customer a different price. Such personalized pricing can lead to advanced forms of price discrimination based on individual characteristics of consumers, which may be provided, obtained, or assumed. An online shop can recognize customers, for instance through cookies, and categorize them as price-sensitive or price-insensitive. Subsequently, it can charge (presumed) price-insensitive people higher prices. This paper explores personalized pricing from a legal and an economic perspective. From an economic perspective, there are valid arguments in favour of price discrimination, but its effect on total consumer welfare is ambiguous. Irrespectively, many people regard personalized pricing as unfair or manipulative. The paper analyses how this dislike of personalized pricing may be linked to economic analysis and to other norms or values. Next, the paper examines whether European data protection law applies to personalized pricing. Data protection law applies if personal data are processed, and this paper argues that that is generally the case when prices are personalized. Data protection law requires companies to be transparent about the purpose of personal data processing, which implies that they must inform customers if they personalize prices. Subsequently, consumers have to give consent. If enforced, data protection law could thereby play a significant role in mitigating any adverse effects of personalized pricing. It could help to unearth how prevalent personalized pricing is and how people respond to transparency about it. [ABSTRACT FROM AUTHOR]

Advocates of digital privacy law believe it is necessary to correct failures in the market for digital privacy. Though legislators allegedly craft digital privacy regulation to protect consumers, some advocates have understated the dangers that digital privacy law may engender. This paper provides evidence for Kirzner's 'perils of regulation' in the digital privacy arena. The regulatory process fails to simulate the market process, stifles entrepreneurial discovery, and creates opportunities for superfluous discovery. My research suggests that policy-makers should consider a more holistic accounting of the costs before imposing additional digital privacy regulation. [ABSTRACT FROM AUTHOR]

The concept of Privacy by Design is rooted in systems engineering. Yet, it is the legal framework of global privacy that gives new color to this concept as applied to Big Data. Increasingly, the long arm of the law is reaching into Big Data, but it is not simply by matter of regulatory enforcement or civil legal developments that Privacy by Design (PbD) is being thrust into the spotlight once more. Given that Big Data is considered miniscule in contrast to future data environments, 1 PbD is simply the right thing to do. This paper aims to explore the origin of PbD, the current and future state of Big Data and regulatory enforcement, and the methodology of PbD applied to Big Data. As a cornerstone of organizational culture, PbD is a concept that allows organizations of any size to embrace the privacy interests of the data they collect, store, and use at the forefront of their approach. [ABSTRACT FROM AUTHOR]

Social media platforms aggregate large amounts of personal information as "social data" that can be easily downloaded as a complete archive. Litigants in civil cases increasingly seek out broad access to social data during the discovery process, often with few limits on the scope of such discovery. But unfettered access to social data implicates unique privacy concerns-concerns that should help define the proper scope of discovery. The Federal Rules of Civil Procedure, as amended in 2015, already contain the tools for crafting meaningful limits on intrusive social data discovery. In particular, the proportionality test under Rule 26 weighs the burdens of discovery against its benefits, creating important boundaries on discovery's scope. Privacy burdens should be part of the proportionality analysis. By considering the privacy implications of social data discovery, courts can fashion fair and meaningful limits on the scope of social data discovery. [ABSTRACT FROM AUTHOR]

Digital giants, enabled by America's courts, Congress, and the Federal Trade Commission, devise click-through, clickwrap, browsewrap, "I Agree" waivers, and other legal fictions that purport to evidence user "consent" to consumer privacy erosions. It is no longer enough to justify privacy invasions as technologically inevitable or as essential to the American economy. As forced consent is no consent at all, privacy policies must advance with the technology. This article discusses adhesion waivers, the potential for FTC corrective action, and a comparison to privacy policies of the European Union. [ABSTRACT FROM AUTHOR]

Privacy on the Internet is a multi-faceted issue that requires attention on the user's part, both to protect information from third-party data collection and to manage personal impressions across a variety of contexts and relationships (Ellison, et al, 2011). This study investigated the notion of online anonymity, as a privacy issue, among young Internet users in Nigeria. Situated within the framework of the deindividuation, uses and gratifications, and technological determinism theories, the research was designed as a survey. A sample of 400 respondents was selected from the study population (which was the undergraduate students of Nnamdi Azikiwe University, Awka, Anambra State, in South-East Nigeria) and a structured questionnaire employed as the data collection instrument. Findings showed that online anonymity is common among a significant part of the users; and that they utilise online anonymity mainly for the purposes of protecting their privacy, shielding themselves against fraud and other Internet harms and abuses, and for fun. Similarly, it was found that while the youths perceive online anonymity as socially beneficial, they at the same time view it as potentially destructive. The study also discovered that anonymity has not had significant impact on the Internet use habit of the respondents. This means that it is not a motivating factor that draws them to the Internet, and that it has neither made them feel free to communicate nor lured majority of them towards communications that are ethically and legally undesirable. [ABSTRACT FROM AUTHOR]

The paper delves into the intricacies of communication via social media platforms. The manner in which mediation on social media has come to influence norms of interpersonal communication is discussed in detail. How the relationships and their parameters have come to get transformed in the modern age of social media is explored. Moreover, the ethical concerns that problematize the domain of communication on social media are explicated in relation to interpersonal dynamics on social media. The paper also explores the issue of privacy that comes across to be a paradoxical thing on the platform of mediation. As such, the ethical parameters that govern interpersonal communication on the present day have come to be more complicated to the degree of not being comprehensible to the common people in general. Apart from this, the social ill of cyber-bullying is also explored in the course of the paper as it further complicates interpersonal dynamics leaving a lasting impression on the minds of people who are victimized. The ethics of communication thereby seem to have changed drastically in the age of social media and internet mediated communication. [ABSTRACT FROM AUTHOR]

This paper investigates the digital privacy provisions in the island of Jersey. This is mainly done by examining the two key pieces of legislation with which any workplace must comply with. Those legislations are: The Employment (Jersey) Law 2003, and the Data Protection (Jersey) Law 2005. Neither law has digital privacy provisions per se, but these are the two prevalent pieces of legislation governing employer-employee relations in the island of Jersey at present. The study relates the local legislation in the island of Jersey to its UK and European counterparts identifying the missing parts. To investigate how much compliance to those legislations in the island's workplace, a typical workplace of Lysaght's, the current employer for the second author, is chosen as a case study. The study highlights the areas of concerns and provides specific recommendations for the employer. This work can be used as the basis for steering the future judicial review of this area, to ensure the island of Jersey remains in compliance with its peers both domestically and internationally. [ABSTRACT FROM AUTHOR]

The article reports on the decision of the U.S. and Canadian regulators to increase the spectre of privacy law infringements by devices using the Internet of Things (IoT Devices). The U.S. Federal Trade Commission released a report which outlines recommended steps for businesses to take to enhance and protect the privacy and security of consumer. The Office of the Privacy Commissioner of Canada released two reports that addressed privacy issues of IoT.

Privacy policies are supposed to provide transparency about a service's data practices and help consumers make informed choices about which services to entrust with their personal information. In practice, those privacy policies are typically long and complex documents that are largely ignored by consumers. Even for regulators and data protection authorities privacy policies are difficult to assess at scale. Crowdsourcing offers the potential to scale the analysis of privacy policies with microtasks, for instance by assessing how specific data practices are addressed in privacy policies or extracting information about data practices of interest, which can then facilitate further analysis or be provided to users in more effective notice formats. Crowdsourcing the analysis of complex privacy policy documents to non-expert crowdworkers poses particular challenges. We discuss best practices, lessons learned and research challenges for crowdsourcing privacy policy analysis. [ABSTRACT FROM AUTHOR]

The article discusses the need for protection of employees' online information in order to avoid employers rejecting job applications courtesy emplopyees' specific online activities , and explains the laws committed towards online privacy.

The article explores developments in cybersecurity in the U.S. driven by the rise of the Internet and the need for free flow of information. The security regulations' evolution is examined through four periods starting with pre-9/11 terrorism and through the cyber era. It looks at executive orders regarding cybersecurity as well as offers information on several legislation on cybersecurity pending in the 114th Congress.

The article discusses the lack of a coordinated network of laws that promote cybersecurity and prevent the occurrence of data breaches in the U.S. A definition of cybersecurity from a legal standpoint is given, along with its distinction from concepts such as privacy and data security. It looks at state and federal privacy laws and data security laws that are linked with cybersecurity as well as suggests a unity framework for adaptable cybersecurity laws and policies.

The article examines the laws related to privacy protection in New Zealand in relation to the media and discusses several court cases that shaped the laws in the country such as "C v Holland" and "Hosking v Ranting."

The article examines the laws related to intellectual property protection and copyrights of digital materials in Australia; reports the enactment of Copyright Act 1968 in the country; and mentions the laws aimed to prevent online privacy.

Modern society is driven by data. Data storage is practically unlimited with today's technology, and analytical tools make it easy to find patterns and make predictions in a way that is very useful for private businesses and governments. These uses of digital data can raise considerable privacy issues that are of great concern to consumers. In this Article, we present and analyze the results of an extensive survey that we conducted to explore what people know, what people do, and what people want when it comes to privacy online. Our survey is the first comprehensive examination of the intersection of knowledge and opinions on topics including online privacy, law, and the data practices of both the private sector and the government. Our survey results indicate that consumers often want more options than the market gives them. Over 80% of our survey participants, for example, indicated that on some occasion they have submitted information online when they wished that they did not have to do so. One of the possible reasons why consumers still participate in these markets is that they do not have any meaningful alternatives. The private sector currently has very little incentive to provide these alternatives because consumers have been responding to unattractive business practices with complacency. Responses to our survey also indicate a low level of trust of the government as a data collector and data keeper. Our results indicate that significant changes are needed to increase consumer engagement in the online marketplace and improve trust between the government and its citizens. These improvements should begin by empowering users and giving them more control over their digital data, and we present ambitious proposals to this end. The long-term solution that we propose would involve an overhaul of current data privacy laws and the creation of a centralized profile repository that would serve a purpose similar to credit reporting bureaus. Through this repository, consumers could view and challenge most information that private businesses and the government hold about them. Dramatic changes are necessary in order to ensure that consumers can have empowering and engaging experiences in today's world oj digital data. [ABSTRACT FROM AUTHOR]

In March 2015, the Federal Communications Commission reclassi-fied broadband Internet access service providers as "common carriers" subject to obligations under Title II of the Communications Act. One such obligation is to comply with the Act's section 222 privacy provisions. As a result of reclassification, the Federal Communications Commission claims privacy enforcement jurisdiction over a broad swath of companies that formerly fell within the Federal Trade Commission's regulatory reach. The Federal Trade Commission and industry players have been outwardly critical of this effect. This Note explores the resulting tension between the two agencies and proposes potential resolutions for it. [ABSTRACT FROM AUTHOR]

‘The Digital Citizen’ has become a buzzword in recent years as part of the social and economic agendas of many countries and as a key theme in the strategy for Europe 2020. In 2014, the Vice-President of the European Commission and Commissioner for the Digital Agenda, Neelie Kroes, described its emergence as “people with greater access to information, people empowered to shape the world around them. More able to both learn: and participate”. 1 Yet, while the benefits of this vision are clear, harnessing the opportunities on offer requires confronting significant challenges. In seeking to explore what this empowering concept means for law and policy-makers today, this Seminar is intended to encourage reflection upon how increasing digitisation and hyper-connectivity affects our day-to-day interactions with those in power, as well as the security and privacy issues arising from them. For example, in many countries the development of new forms of digital identity management enables citizens to assert their identity electronically in order to access public services (such as online access to their medical data). However, these can only work optimally when supported by citizen-centric policy and legal frameworks that are technology-neutral, trust enhancing and mutually recognised across borders. New data-driven and virtual relationships with governments also necessitate a reconsideration of the rights that digital citizen deserve. On the one hand, the ease with which increasing amounts of accessible personal data can be collected – overtly or covertly – and analysed by states about their citizens' raises concerns about lost privacy controls and substantial power imbalances (such as regarding storage and access rights to such data). On the other hand, massive improvements in accessing information permit opportunities for greater engagement with government by individuals, yet assume the rollout of better and faster internet connectivity for all citizens to participate. In turn, social media has demonstrated how ICT can facilitate collective citizen activism to pressure for societal change, alongside the power of sousveillance to act as a countervailing force to pervasive state monitoring. Also ripe for discussion is the notion of reciprocal responsibilities between citizens and governments. In the physical space, for example, concerns are mounting over the implications of the advent of cheap wearable computers and drones. In the virtual domain, the borderless nature of the online world and its distributed control has connotations for a wider concept of networked citizenship with attendant rights. This led the creator of the Web – Sir Tim Berners-Lee – to call for a Bill of Rights (a ‘Magna Carta for the Web’) in 2014, the Web's 25th birthday, to protect its users. Citizen rights that already exist relevant to the online environment are scattered across various laws and are not always easy to understand. The roles of transnational institutions in fostering closer international cooperation on ICT policy, as well as strengthening confidence in privacy, consumer and data protection rights online, are also topics for discussion in this respect. Questions for discussion include: What does digital citizenship mean today? What rights, obligations and responsibilities should be associated with digital citizenship? What types of legal solutions are fit for purpose to protect digital citizenship interests? What should be the role of public sectors in e-identity assurance schemes, such as regarding liability? Should e-identity management be regulated? How does digital citizenship relate to novel rights, such as a right to public-sector data and a right to be forgotten online, and how might these rights be enforced effectively? To what extent can law and policy support increase transparency and trust by citizens in the actions of their governments? How can privacy and security be guaranteed to citizens where automated technologies affect their rights and civil liberties? How are biometrics and location-tracking devices used by states in body surveillance changing the digital citizenship landscape? How can individuals be more empowered to control their personal data held by governments and give informed consent to its use? What are the global drivers of digital citizenship policies and international cooperation in rule making and standard setting, especially in relation to emerging sensor-embedded technologies that will change the lives of citizens dramatically in the future? [ABSTRACT FROM AUTHOR]

According to both whistle blowers and public reports, some commercial and governmental practices concerning personal data do not even appear to notice the law as a regulatory force. We are not satisfied by what mainstream legal scholarship has on offer in this context. Positivists consider the issue outside their domain. Realists (including their critical branch) focus on the behavior of legal institutions, ignoring many of the diverse institutions that have regulatory force. We need an additional, complementary perspective to help us, legal scholars, earn and hold serious positions in the diverse disciplinary teams that we need to participate in, in order to adequately investigate (and inform on) persistent problems concerning personal-data protection as faced by legislators. In this article we investigate whether the subject matter of data protection law, identified as Personal Data Community (hereinafter PDC), can be treated as a complex adaptive system (hereinafter CAS). This proposition is premised on the argument that the PDC exhibits key traits of CAS, including systemic, dynamic and complex characteristics. And we further show how complexity theory can help legal scholarship (without losing its identity) to join and add value to diverse disciplinary research and advisory teams. In this article, we aim for a stepping-stone (establishing that data protection law addresses a complex adaptive system with all of its corollaries), rather than for final solutions. [ABSTRACT FROM AUTHOR]