Does the GDPR Enhance Consumers’ Control over Personal Data? An Analysis from a Behavioural Perspective
Open accessAbstract
Because of increased technological complexities and multiple data-exploiting business practices, it is hard for consumers to gain control over their own personal data. Therefore, individual control over personal data has become an important subject in European privacy law. Compared to its predecessor, the General Data Protection Regulation (GDPR) addresses the need for more individual control over personal data more explicitly. With the introduction of several new principles that seem to empower individuals in gaining more control over their data, its changes relative to its predecessors are substantial. It appears, however, that, to increase individual control, data protection law relies on certain assumptions about human decision making. In this work, we challenge these assumptions and describe the actual mechanisms of human decision making in a personal data context. Further, we analyse the extent to which new provisions in the GDPR effectively enhance individual control through a behavioural lens. To guide our analysis, we identify three stages of data processing in the data economy: (1) the information receiving stage, (2) the approval and primary use stage, and (3) the secondary use (reuse) stage. For each stage, we identify the pitfalls of human decision-making that typically emerge and form a threat to individual control. Further, we discuss how the GDPR addresses these threats by means of several legal provisions. Finally, keeping in mind the pitfalls in human decision-making, we assess how effective the new legal provisions are in enhancing individual control. We end by concluding that these legal instruments seem to have made a step towards more individual control, but some threats to individual control remain entrenched in the GDPR.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
A key goal of the European General Data Protection Regulation is to strengthen individuals' control over their personal data, which stands in contrast to privacy regulations in the United States.
“a key goal of the European General Data Protection Regulation is to strengthen individuals' control over their personal data (Strycharz et al., 2020;van Ooijen & Vrabec, 2019), which stands in contrast to the privacy regulations in the United States”
From The validation of the Perceived Surveillance Scale (2022) · cites this paper as van Ooijen & Vrabec, 2019
Individuals' efforts to manage their online privacy seldom adequately inform them or protect their online privacy.
“these efforts seldom appear to adequately inform them or protect their online privacy (cf. Acquisti etal., 2015; Hargittai & Marwick, 2016; Van Ooijen & Vrabec, 2019).”
From Privacy Cynicism and its Role in Privacy Decision-Making (2024) · cites this paper as Van Ooijen & Vrabec, 2019
As the amount of data collected from individuals through apps, websites, and other platforms continues to grow, individuals increasingly experience a loss of control over their privacy in the online environment.
“As the amount of data collected from individuals through apps, websites, and other platforms continues to grow, individuals increasingly experience a loss of control over their privacy in the online environment (Sundar & Marathe, 2010; Van Ooijen & Vrabec, 2019).”
From Privacy Cynicism and its Role in Privacy Decision-Making (2024) · cites this paper as Van Ooijen & Vrabec, 2019
Users should have control over their personal information.
“Users should also have control over their personal information (van Ooijen and Vrabec 2019).”
From AdaptUI: A Framework for the development of Adaptive User Interfaces in Smart Product-Service Systems (2024) · cites this paper as van Ooijen and Vrabec 2019
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 44 · Cited by 180
Research works printed but not linked: 7
- Bargh, J. A. (1994). The four horsemen of automaticity: Awareness, intention, efficiency, and control. In R. Wyer & T. Srull (Eds.), Social cognition. Handbook of social cognition (pp. 1-40). London: Psychology Press.
- G. D. P. Regulation (GDPR) (2016). Regulation (EU) 2016/679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46. Official Journal of the European Union, 59, 1- 88.
- Goodman, B., & Flaxman, S. (2016). European Union regulations on algorithmic decision-making and a" right to explanation" (1606.08813). ArXiv. Retrieved from https://arxiv.org/abs/1606.08813. Accessed 28 Nov 2018. · arXiv
- Irion, K., Luchetta, G. (2013). CEPS task force report of the CEPS digital forum. Resource Document. Centre for European Policy Studies. Retrieved from https://ssrn.com/abstract=2275267. Accessed 28 Nov 2018.
- In K. Dykstra-Erickson, M. Tsscheligi (Eds.), Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 471-478). ACM.
- Koops, B. J., Newell, B. C., Timan, T., Skorvanek, I., Chokrevski, T., & Galic, M. (2016). A typology of privacy. University of Pennsylvania Journal of International Law Review, 38, 483.
- Nissenbaum, H. (2004). Privacy as contextual integrity. Washington Law Review, 79, 119.
- Authors
- van Ooijen, I., & Vrabec, H. U.
- Affiliations
- Leiden University (NL)
- Venue
- Journal of Consumer Policy
- Published
- 2018-12-11
- Volume
- 42
- Issue
- 1
- Pages
- 91-107
- ISSN
- 0168-7034 (ISSN-L)
- 1573-0700
- OpenAlex
- W2902203272
- Cited by
- 180
- References
- 44
- Citations by year
- 2026: 11 · 2025: 34 · 2024: 24 · 2023: 24 · 2022: 22 · 2021: 36 · 2020: 19 · 2019: 10
- FWCI
- 149.95
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Journal of Consumer Policy (publishedVersion, cc-by)
- RePEc: Research Papers in Economics (submittedVersion)
- Radboud Repository (Radboud University) (submittedVersion)
- University of Twente Research Information (submittedVersion, cc-by)
- Funders
- Universiteit Leiden
- Topics
- Social Sciences › Law › Digitalization, Law, and Regulation
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Social Sciences › Law › European and International Contract Law
- Keywords
- General Data Protection Regulation, personal data control, consumer privacy, behavioral economics, human decision-making, data economy, data reuse, data protection law
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
