How the Snowden Revelations Saved the EU General Data Protection Regulation

Why and how does the regulation of emerging technologies occur? Explaining the adoption of the EU General Data Protection Regulation using the multiple streams framework

“…Illustratively, a survey conducted by the Commission, before the release of the draft GDPR, on attitudes on data protection in the EU had revealed that even though two-thirds of internet users were concerned about releasing personal data, a comparable number considered it to be a part of modern life (European Commission 2011). Technology constituencies were nearly successful in side-lining the issue of data protection; privacy advocates feared that the GDPR was being significantly "watered down" (Rossi 2018). In June 2013, Reding, by then the Vice President of the European Commission, stated: "The absolute red line below which I am not prepared to go is the current level of protection as laid down in the 1995 Directive" (European Commission 2013).…”

“…In the European Parliament, for example, nearly 4,000 amendments to the GDPR were proposed (TendersInfo 2013). Even though these proposals came from a variety of channels to indicate widespread opposition, most of them were reportedly filed at the behest of the "Silicon Valley giants" (Rossi 2018). Internet companies had been largely successful in the negotiation until the "Snowden leaks" turned the tide and enabled data privacy advocates to delegitimize the influence of multinational businesses on EU policy-making (Kalyanpur & Newman 2019).…”

“…The case is, therefore, appropriate for uncovering the different actors and activities involved in the policy process. Further, as several studies have provided an account of the regulation based on explanations such as technological change, interests, institutionalism, and policy entrepreneurship (Burri & Schar 2016; Moulonguet 2016; Rossi 2018; Hildén 2019; Kalyanpur & Newman 2019; Laurer & Seidl 2020), a study of the GDPR is apt for investigating whether the MSF can go further and provide a more complete explanation for the formulation and the adoption of the regulation.…”

Public and private just wars: distributed cyber deterrence based on Vitoria and Grotius

“…What if states are not only incapable of protecting their citizens' rights, for instance the human right to privacy, but complicit in foreign agents' violating their citizens' rights? Although, for example the Snowden-revelations have led to an outcry all over Europe (De Hert and Thumfart, 2018, p. 6) and saved the GDPR (Rossi, 2018), national intelligence agencies have, like corporations, in fact collaborated with the NSA (Borger, 2013). If one takes the notion of distributed deterrence seriously, then all three levels of power, states, companies and individuals, need to be equipped with deterrence mechanisms that keep other actors in check.…”

Protected how? Problem representations of risk in the General Data Protection Regulation (GDPR)

“…If economic interests had hitherto thwarted privacy interests in the reform of data protection regulation, revelations of mass surveillance increased attention given to privacy issues and strengthened the influence of privacy advocates in the drafting of the Regulation (Rossi 2018). Ultimately, the GDPR, which came into force in May 2018, can be seen as the product of struggle between competing economic and rights interests (Bernet 2015).…”