World “Vectoring” Individuals Towards Disclosing Personal Data?

The project is funded by the bidt and extends to the fields of cultural studies, law, and business information systems and examines the influences on one’s decision to disclose personal data. The event presented the interim research results produced in the first 18 months of the project. Furthermore, the conference enabled a lively and interdisciplinary discussion on potential approaches to subsequent research within the project. As one of the project’s heads, Professor Moritz Hennemann, who holds the Chair of European and International Information and Data Law at the University of Passau, delivered an opening address and set the stage by underlining the significant currency of the topic as personal data is fueling ecosystems worldwide and are shared on a minute-to-minute rather than daily basis. Professor Thomas Höllmann, President of the Bavarian Academy of Sciences and Humanities, picked up on that with a welcoming statement on behalf of the conference’s host.

Topics of the Contributions

Professor Daniela Wawra, University of Passau, introduced the first speaker, Jana Wagner of the University of Hohenheim, who participated via Zoom and talked about factors determining individual privacy regulation from a communication science perspective, noting that privacy is dynamic as it changes with personal and situational aspects. She also mentioned the issue of low privacy literacy – varying in its extent from setting to setting, which was a point raised many times during the conference.

Professor Lothar Determann, who practices Data Protection and IT law in Palo Alto, CA, at Baker McKenzie also contributed virtually to Californian privacy laws. He underlined the increased activity of Californian lawmakers in that field, resulting in the problem of an abundance of pertinent laws controllers must observe, which poses an impediment to innovation. Nonetheless, he claimed that California law should serve as a compromise to be mirrored in other states. Mainly, he emphasizes that the Californian approach differs from a European one in this extent that it protects individual privacy than it protects personal data.

As the first speaker on the part of business information systems, Professor Hanna Krasnova of the University of Potsdam shed light on social media platforms as digital data markets. While addressing the familiar aspect of the “privacy paradox” (people being concerned about their privacy while not adapting their behavior to that concern), she concluded that the definite purpose personal information is used for does not play a more significant role in the disclosure decision.

.

The first day of the conference was rounded off by the project team presenting their research results achieved so far. Professor Daniela Wawra began with the cultural perspective by presenting and discussing different views on data protection regulation and privacy in the examined countries. The survey-based analysis provided insights into intracultural data protection mentalities and revealed considerable intercultural differences. These should be taken into account by data recipients and regulators, not least in transcultural contexts of data disclosure. This was followed by a comparison of the examined law regimes of data disclosure by Timo Hoffmann, research assistant at the University of Passau, who pointed to processes of convergence and divergence as well as to considerable differences regarding enforcement. Finally, Professor Thomas Widjaja from the University of Passau and his research assistant, Martin Richthammer, provided the business information systems expertise by explaining their model tracing different eventualities of a data disclosure decision and how it was crafted with the input of the other two disciplines.

Professor Lemi Baruh from the Koç University of Istanbul commenced the second conference day with a contribution about necessary improvements to the privacy calculus, in which he identified as one possibility to extend the latter that privacy is not about the level of privacy itself, but about an optimal balance of disclosure and benefits. For his explanation, he used a Response Surface Analysis model, which raised some attention of the legal part of the project as it might help comparing colliding data protection regimes. He was followed by Professor Normann Witzleb, who teaches at the Chinese University of Hongkong and at Monash University in Melbourne, Australia:

Professor Witzleb provided insights into the ongoing review of Australia’s 1988 Privacy Act, which is scheduled to be concluded this year. As to his presentation, the Australian law does neither choose the rights-based approach of the EU nor the free market approach of the US, but instead chooses its own path in between and does not aim for adequacy from a GDPR perspective, but for interoperability with it.

Professor Kai von Lewinski from the University of Passau then discussed problems arising from the conflict of different data protection law regimes– as he noted that a universal data protection law is not a realistic solution. He pointed to the necessity to identify genuine links between the colliding factors of different data protection regimes. In order to achieve this, he recommends a holistic approach to conflicts of law, which is to some extent mirrored by the EU’s adequacy decisions.

The final presentation belonged to Professor Jens Grossklags from the Technical University of Munich who shared the results of his studies about data portability and data erasure practices. In these studies, he conducted practical research on user rights by first disclosing bundles of data to different controllers of various sectors (such as social media, tourism or health care) and later invoking the right to erasure and to data portability. His presentation revealed a surprisingly high rate of non-compliance in some sectors.

The final panel discussion with Professors Hennemann, Baruh, Witzleb, and Grossklags.

As a conclusion of the two-day conference, Professor Hennemann moderated a final panel discussion with Professors Baruh, Witzleb, and Grossklags. The participants discussed the value of privacy, varying perceptions of privacy in different cultural, but also legal settings.

Overall the conference gave comprehensive insights on why the interdisciplinary and comparative analysis of the individual’s disclosure decision is more than necessary – and gave the project team much food for thought for the second half of the project. The second half is dedicated to the theoretical framework for comparative data protection law and an in-depth analysis of global data protection regulations as well as to the conduction of empirical studies on different cultural settings and the data disclosure decision-making process itself.

Text: Lukas Illek, student assistant at the Chair of European and International Information and Data Law