CoChat
Sign Up
PreprintCited by 40Digitalization, Law, and RegulationPrivacy, Security, and Data ProtectionLaw, Rights, and Freedoms

Data Is What Data Does: Regulating Based on Harm and Risk Instead of Sensitive Data

Open access
Solove, Daniel J.·2023·SSRN Electronic Journal
DOI 10.2139/ssrn.4322198
Open this paper in CoChat — free account

Abstract

Heightened protection for sensitive data is becoming quite trendy in privacy laws around the world. Originating in European Union (EU) data protection law and included in the EU’s General Data Protection Regulation, sensitive data singles out certain categories of personal data for extra protection. Commonly recognized special categories of sensitive data include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual orientation and sex life, and biometric and genetic data. Although heightened protection for sensitive data appropriately recognizes that not all situations involving personal data should be protected uniformly, the sensitive data approach is a dead end. The sensitive data categories are arbitrary and lack any coherent theory for identifying them. The borderlines of many categories are so blurry that they are useless. Moreover, it is easy to use nonsensitive data as a proxy for certain types of sensitive data. Personal data is akin to a grand tapestry, with different types of data interwoven to a degree that makes it impossible to separate out the strands. With Big Data and powerful machine learning algorithms, most nonsensitive data give rise to inferences about sensitive data. In many privacy laws, data giving rise to inferences about sensitive data is also protected as sensitive data. Arguably, then, nearly all personal data can be sensitive, and the sensitive data categories can swallow up everything. As a result, most organizations are currently processing a vast amount of data in violation of the laws. This Article argues that the problems with the sensitive data approach make it unworkable and counterproductive as well as expose a deeper flaw at the root of many privacy laws. These laws make a fundamental conceptual mistake—they embrace the idea that the nature of personal data is a sufficiently useful focal point for the law. But nothing meaningful for regulation can be determined solely by looking at the data itself. Data is what data does. To be effective, privacy law must focus on harm and risk rather than on the nature of personal data. The implications of this point extend far beyond sensitive data provisions. In many elements of privacy laws, protections should be proportionate to the harm and risk involved with the data collection, use, and transfer.

Integrity signals

Registry

Crossref · 10.2139/ssrn.4322198

Cites

6 of 6 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Solove, D. J.
Affiliations
George Washington University (US)
Corresponding author
Solove, Daniel J.
ORCID
Solove, Daniel J.
Venue
SSRN Electronic Journal
Publisher
Elsevier BV
Published
2023
ISSN
1556-5068 (ISSN-L)
DOI
10.2139/ssrn.4322198
OpenAlex
W6980858494
Cited by
39
References
5
Citations by year
2026: 4 · 2025: 6 · 2024: 25 · 2023: 4
Type
posted content
Language
en
Open access
Locations
  • SSRN Electronic Journal (acceptedVersion)
  • eYLS (Yale Law School) (submittedVersion)
  • Scholarly Commons - George Washington University Law School (George Washington University) (submittedVersion)
Topics
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Social Sciences › Sociology and Political Science › Law, Rights, and Freedoms
Keywords
sensitive personal data, General Data Protection Regulation, privacy law, risk-based regulation, personal data protection, data inference, biometric data, genetic data, proportionality, data classification, big data, machine learning

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review