Control over personal data: True remedy or fairytale?

By Christophe Lazaro and Daniel Le Métayer. More than ever the notion of control plays a pivotal and pervasive role in the discourses of privacy and data protection. Privacy scholarship and regulators propose to increase individual control over personal information as the ultimate prescriptive solution to tackle the issues raised by emergent data processing technologies. Conceived as “the claim of individuals to determine for themselves when, how, and to what extent information about them is communicated to others”, the notion of control is not new. It is often considered as the unique means of empowerment of the data subject. The mechanisms of this empowerment remain however surprisingly vague and understudied. What does it really mean to be in control of one’s data in the context of contemporary socio-technical environments and practices? What are the characteristics, purposes and potential limits of such control and how can we guarantee data subjects effective control over their own data? This paper undertakes an interdisciplinary review of the concept of “control” to explore such questions in the fields of law and computer science.