Data Protection Impact Assessments as rule of law governance mechanisms

Abstract

Rule of law principles are essential for a fair and just society and apply to government activities regardless of whether those activities are undertaken by a human or automated data processing. This article explores how Data Protection Impact Assessments (DPIAs) could provide a mechanism for improved rule of law governance of data processing systems developed and used by government for public purposes in civil and administrative areas. Applying rule of law principles to two case studies provides a sketch of the issues and concerns that this article’s proposals for DPIAs seek to address. The article undertakes comparative analysis to find relevant principles and concepts for governance of data processing systems, looking at human rights impact assessments, administrative law, and process rights in environmental law. Drawing on this comparative analysis to identify specific recommendations for DPIAs, the article offers guidance on how DPIAs could be used to strengthen the governance of data processing by government in rule of law terms.

Data privacy and security challenges in environmental research: Approaches to safeguarding sensitive information

“…This case study highlights the effectiveness of engaging community partners in the development of DD strategies, enhancing the translation of research findings and supporting participants' right to know their individual results. Harris (2020) discusses Data Protection Impact Assessments (DPIAs) as a governance mechanism rooted in the rule of law principles. DPIAs are presented as a tool for enhancing the governance of data processing systems, particularly those developed and used by governments for public purposes in civil and administrative areas.…”

The digitization of the Brazilian national identity system: A descriptive and qualitative analysis of its information architecture

“…Taking into account the aforementioned obligations, and the precautionary principle-which has been recognized as one of the guiding principles of administrative activities (Filho, 2020)-the deployment of a digital identity system such as the ICN should be preceded by a DPIA, as stated previously in Section 3.3, since it would be an opportunity to identify the risks for the data subject from the data processing and include tools to minimize and deal with those risks (Harris, 2020).…”

Digital informalisation: rental housing, platforms, and the management of risk

“…It is more, we aim to show that the state occupies an important role in redrawing the boundaries of authorised filtering practices without necessarily transforming the regulatory frameworks and operations that govern them. In the partial suspension of regulations by the state, technological 'innovations' borrowed from corporate management are introduced in ever greater areas of governance, including housing, testing the boundaries of the rule of law (Harris, 2020). In this case, the politics of algorithmic world-making appear to be profoundly reshaping the role of central and local governments, creating systems where it is acceptable, in order to reduce the 'risk' posed by 'improper' bodies, to suspend or to render impossible to implement those same state regulations designed to ensure equality and protect the most vulnerable inhabitants.…”