Data protection as privilege—Factors to increase meaning of GDPR in vulnerable groups

Abstract

The General Data Protection Regulation in the EU has the potential to empower citizens towards data-based innovation and datafication. Realising this potential in practise is challenging, mainly because not everyone has the capabilities, seemingly expected by the lawmakers, to make use of relevant legal provisions. This empirical study sets out to investigate what can increase capabilities of citizens in datafied societies to understand and exercise their rights to data protection, as means to increase participation in socio-technical systems. We concentrate on vulnerable groups and criticise the GDPR as regarding data literacies as intrinsic life goals instead of instrumental means. We expand vulnerability to capability deprivation, based on a dynamic understanding of layered vulnerabilities. This overcomes solely negative associations of vulnerability and provides a more constructive framing in support of literacies of everyone, including less literate or more vulnerable. Based on this approach, we consider what is lacking to achieve GDPR literacy. We conducted interviews with representatives of civil society organisations supporting different groups in Flanders, Belgium. Based on these insights, we argue that a layered approach to vulnerability leads to a layered approach to capabilities, and to a layered approach of support based on the most appropriate conversion factors for different groups: (a) at the right place and time, (b) broader support structures from authorities, and (c) a focus on clear communication with the reader in mind.