MAIN ARGUMENT

The core question of this book is whether a rights-based approach to privacy regulation still suffices to address the challenges triggered by new data processing techniques such as Big Data and mass surveillance. A rights-based approach generally grants subjective rights to individuals to protect their personal interests. However, large-scale data processing techniques often transcend the individual and her interests; they may affect broader and more general values. To provide an example, it is very difficult to specify whether and if so, to what extent the large-scale data gathering activities of the NSA have negatively affected the personal interests of an ordinary U.S. or E.U. citizen, which holds true even for broader values such as human dignity, individual autonomy and personal freedom. Similarly, although specific individuals may be filmed by the thousands of CCTV camera's surveilling some European cities, the problem is not so much that these camera's film specific individuals; the problem is that everyone or almost everyone living in these cities is filmed almost constantly and everywhere. Consequently, rather than affecting specific personal interests, such data processing initiatives seem to revolve around general and societal interests.

On a practical level, the problem is that people are oft en simply unaware that their personal data are gathered by either fellow citizens (e.g., through the use of smart phones), by companies (e.g., through tracking cookies) or by governments (e.g., through covert surveillance). Obviously, people who are unaware of their data being gathered will not invoke their right to privacy in court. But even if people were aware of these data collections, given the fact that data gathering and processing is currently so widespread and omnipresent and will become even more so in the future, it will quite likely be impossible for them to keep track of every data processing initiative involving (or potentially involving) their data, to assess whether the data controller abides by the legal standards applicable, and if not, to file a legal complaint. Consequently, it is increasingly the question whether individuals are able to effectively exercise their rights.

It is important to stress, however, that a rights-based approach to privacy regulation will need to be preserved to address issues in which individual interests are at stake.