1.1 Separation-Based Accounts: Privacy as Concealment of the ‘Private Realm’

Separation-based accounts of information privacy stem from traditional understandings of privacy as a broader, multidimensional concept. The literature on the latter can accordingly be usefully drawn on here, although it does not specifically address information privacy, which gained prominence more recently with new technologies. These traditional accounts conceptualise privacy as the protection of an individual’s private realm from intrusion by others. This understanding can be traced back to the work of Warren and Brandeis – the first articulators of the right to privacy – who described it as ‘the “right to be let alone”’ (Warren and Brandeis, Reference Warren and Brandeis1890: 195; for further information on the origins of privacy, see Richardson, Reference Richardson2017). Even though the authors frame privacy as a ‘right’, their work seems to propose an account of privacy (which they argue had to be protected by a legal right that was missing at the time). Their account frames privacy as the existence of boundaries between one’s inner life – ‘the sacred precincts of private and domestic life’ – and ‘the [outside] world’ (Warren and Brandeis, Reference Warren and Brandeis1890: 195–196). Interestingly, although this account conceptualises privacy broadly, it was rooted in concerns about unprecedented intrusions into individuals’ domestic lives enabled by emerging technologies of the time, specifically ‘[i]nstantaneous photographs and newspaper enterprise’ which made information about individuals’ private lives available on an unprecedented scale. This closely echoes the concerns at the heart of information privacy accounts more specifically.

In informational terms, the private sphere guarded under these accounts corresponds to the so-called private information. This can be understood either as information that is inherently private (e.g. relating to individuals’ personal, sensitive, or intimate matters, such as their health or sexual life) or as information that is not inherently private but can only be obtained ‘by eavesdropping, spying, or other means generally considered intrusive’ (see, e.g., Nissenbaum, Reference Nissenbaum1997: 213). This understanding brings two categories of information within the scope of information privacy: information private by content (per its sensitive/intimate/personal nature) or information private by context (per how it is obtained, e.g., through intrusion into private zones).Footnote ¹ The latter – private information by context – underscores the inextricable connection between informational and other dimensions of privacy, whereby the intrusion upon the latter (e.g. entry into one’s home, a space protected by spatial privacy) also defines the scope of intrusion upon the former (extending, e.g., to seemingly mundane/non-sensitive information obtained from that protected space, such as, say, the floor plan of one’s home). By emphasising the (restrictive) scope of what falls within privacy, these accounts advance a conception of information privacy – applicable equally to information privacy as one of its dimensions – characterised by three underlying features: first, that privacy entails a state of seclusion, measured through inaccessibility vis-à-vis others; second, that privacy is a negative concept, understood as non-intrusion; and third, that privacy functions to shelter the individual – and perhaps their close social circle such as friends/family, as discussed below – from ‘others’.

Separation-based accounts highlight that protecting the ‘private realm’ is essential to securing identity, autonomy, freedom, and dignity, yet they often leave unexplained the assumptions linking these values – both to one another and to privacy itself. Unpacking these links requires drawing on insights from various scholars. Hildebrandt provides a helpful starting point, arguing that privacy provides a negative freedom from ‘unlawful [i.e. unjustified] interference’ of the others (Reference Hildebrandt2015: 80). This negative freedom provides a ‘safe cocoon to hide in’, which then enables positive freedom to ‘build and rebuild identity beyond the continuous pressures of social stereotyping, public opinion, and dominant frames of reference’ (Hildebrandt, Reference Hildebrandt2015: 80), thereby supporting a sphere of decisional privacy. The causal link between these interests can be framed as follows: privacy creates a space for freedom and autonomy, enabling individuals to develop identity and personhood, thereby fostering individuality. It also safeguards dignity, as its denial – through perpetual transparency and the unwanted gaze – can reduce individuals to objects of observation rather than autonomous agents. The power asymmetries this generates between the watcher and watched overlap with the power-based critique, further developed below. Separation-based and power-based perspectives also converge in another important respect: while the former are primarily defined in individualist terms, they nonetheless accommodate privacy’s broader importance in fostering democracy, societal well-being, creativity, and political freedom, as well as in serving as a bulwark against totalitarianism, as also emphasised by the power-based perspectives (Richards, Reference Richards2022: 134; Hughes, Reference Hughes, Roessler and Mokrosinska2015).

Accordingly, separation-based accounts offer important insights into the role and value of a key aspect of privacy: the interest in being secluded from others. In informational terms, this pertains to the restriction of ‘private information’ from others. Indeed, the main critique of these accounts lies not in their claims but in their omissions. This Element focuses on two interlinked aspects of information privacy that separation-based accounts may not fully capture. First, the public–private dichotomy that lies at the heart of separation-based accounts tends to exclude privacy interests in public spheres. By extension, this would also exclude so-called public information, namely, information that is not inherently private by nature and which is available in the public domain (i.e. outside private spheres) (see also González Fuster, Reference González Fuster2014: 22). Yet this public–private dichotomy is no longer justifiable. It is no longer enough to protect individuals only against intrusion into their private sphere because emerging technologies mean that privacy can now also be undermined through public channels (Nissenbaum, Reference Nissenbaum1998: 593). Indeed, individuals could once rely on attentional privacy in public spheres: they could merge into the crowd and preserve their anonymity, going about largely unnoticed. Even where noticed by some, ‘any single observer’ could only ‘observe and harbour discrete bits of information’ that would also be temporally ‘limited by what any single human brain could reasonably and efficiently hold’ (Nissenbaum, Reference Nissenbaum1998: 576). Surveillance infrastructures now continuously monitor and record activity in both physical and virtual public spaces, as a result of which information that existed in a specific context and timeframe is no longer confined to those boundaries. Contexts and spaces are blurred, along with temporal distinctions. The record of the past is no longer necessarily sustained by ‘mere human memory’; instead, technologies render the past available for ‘almost instant replay’ (Allen, Reference Allen2011: 166). Information is collected, aggregated, and combined from various contexts and times, producing the ‘mosaic effect’, whereby disparate pieces of public information can be assembled to provide a comprehensive insight into a person’s private realm, thereby undermining the very values privacy is meant to protect (Nissenbaum, Reference Nissenbaum1998: 589; Véliz, Reference Véliz2024). This illustrates the fragility of the public–private distinction and suggests that a comprehensive account of information privacy must adequately account for privacy interests in the public domain, including in ‘public information’.

The second limitation of separation-based accounts is that, by focusing on the division between the self (the private) and the rest (the public), they risk advancing an overly individualistic view of privacy and, ultimately, of human nature (Inness, Reference 76Inness1996: 43–44). This overlooks the fact that privacy and the interests it protects, such as individuality, are shaped by and dependent on one’s surroundings, relationships, and interactions (Goffman, Reference Goffman1959: 253). Privacy may include – but cannot be ‘reduced to’ – ‘a fixed condition’ such as utter seclusion; it is better understood as a dynamic process that enables an individual to set and manage their boundaries vis-à-vis others (Cohen, Reference Cohen2012: 1906; Nippert-Eng, Reference Nippert-Eng2010: 25; Solove, Reference Solove2007: 763; Richardson, Reference Richardson2017: 122); this also highlights the role of privacy in facilitating social interaction (Hughes, Reference Hughes2012). Admittedly, the recognition that privacy can also be social and relational – although largely advanced by those adhering to control-based accounts – is not incompatible with separation-based accounts. The latter can accommodate this aspect by framing the protected private sphere as encompassing not only the individual but also their close relationships and social circles, provided that sharing of information remains confined to that sphere (e.g. Warren and Brandeis, Reference Warren and Brandeis1890; Richardson, Reference Richardson2017:122). To that extent, separation-based accounts may overlap with control-based accounts, albeit to a limited extent: the overlap ceases once information enters the public sphere, at which point separation-based accounts would suggest that the (information) privacy interest is extinguished. Differently, control-based accounts can treat the same act – sharing information with the public – as an exercise of information privacy (see Section 1.2). The main limitation of separation-based accounts, then, lies in their emphasis on ‘separation’, which either overlooks or only narrowly acknowledges the significance of individuals’ interactions with one another in the exercise of their privacy.

Ultimately, separation-based accounts capture an important aspect of privacy, including of information privacy – the restriction of private information from others – which enables and fosters values such as personhood, individualism, and resistance to totalitarianism. The emphasis on the inaccessibility of private information, however, does not sufficiently account for privacy interests in ‘public’ information and individuals’ relationships in the public sphere outside one’s ‘private life’. Indeed, these criticisms hold only if the separation-based accounts are understood as presenting information privacy in comprehensive and exclusivist terms – which this Element argues against, as it now turns to other perspectives on information privacy.

1.2 Control-Based Accounts: (Information) Privacy as ‘Boundary Management’

Unlike most separation-based accounts, control-based accounts more explicitly – and often, exclusively – focus on information privacy. They gained prominence in the late 1960s, particularly in response to the rise of computerised data processing technologies. Perhaps the best-known formulation of this account is Westin’s definition, which, though intended to apply to privacy generally, frames it strictly in informational terms, as ‘the claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is communicated to others’ (Reference Westin1967: 7). Control-based accounts shift the emphasis towards whether the subject has exercised control over the flow of information, adopting a functional approach. The emphasis in these accounts on (individual) control has received a ‘staggering’ ‘consensus’ (Schwartz, Reference Schwartz1990: 820): it has dominated theorisations of not only information privacy but also privacy more generally (see, e.g., Fried, Reference Fried1968: 482; Miller, Reference Miller1971: 25; Gross, Reference Gross1971: 71; Altman, Reference Altman1975; Roessler, Reference Roessler2018). Notably, this understanding of information privacy is often adopted by scholars – those based in the US, Australia, and Canada – who also use the term interchangeably with data protection, given the central role of control in the latter (see Section 1.3 on jurisdictional terminology choices and Section 2.3 on the role of individual control in data protection frameworks) (Bygrave, Reference Bygrave2010: 170; Clifford, Reference Clifford2024: 208). It is also worth noting here that, in line with its dominant framing within the information privacy literature, control-based accounts discussed here conceive of control in an individualised sense, rather than at a broader/architectural level. The latter dimension of control has emerged separately through power-based critiques of privacy (below) and within conceptualisations of data protection (Section 2.2).

Control-based accounts articulate information privacy as a ‘means’ for the individual to ‘achiev[e] a preference about whether their data is processed’, ‘placing … [them] … at the center of decision-making’ (O’Hara, Reference O’Hara2023: 6; Schwartz, Reference Schwartz1999: 820). Two elements are integral to these accounts. The first is the subjective ‘preference’ of the individual regarding the flow of their information. The second element is objective, concerning whether the individual is in fact able to ‘achieve’ their preferences. The combination of both elements distinguishes control-based accounts from separation-based accounts. The latter’s exclusive focus on withholding information means that any act of making it accessible beyond the private realm is seen as the ‘voluntar[y] relinquish[ment] … of … privacy’ (Parent, Reference Parent1983: 273; Allen, Reference Allen2000: 868; Schoeman, Reference Schoeman and Schoeman1984: 1–3). Conversely, the subjective element within the control-based accounts means that these accounts can characterise the same act of disclosure as the manifestation of information privacy where it aligns with the individual’s subjective preferences. This means that under control-based accounts, information privacy does not end each time information is made accessible; instead, it is the ongoing capacity to exercise control over one’s information and thus extends spatially and temporally as information flows across different contexts and throughout the life cycle of information processing.

From a normative perspective, like separation-based accounts, control-based accounts frequently articulate the value of privacy (including information privacy) as self-development, personhood, dignity, and individuality. The underlying narrative that links privacy to these values is broadly shared across both accounts and is therefore not repeated here. This is with two notable differences. The first pertains to the role of autonomy. While separation-based accounts suggest that privacy carves out a space that enables the exercise of autonomy, control-based accounts – to the extent that they require active engagement by individuals – assume the pre-existence of autonomy in the exercise of privacy, which is critiqued shortly below. The second difference lies in control-based accounts’ capacity to accommodate information privacy more explicitly and comprehensively. Framed as the individual’s ability to manage their ‘borders’ vis-à-vis others, these accounts often focus on the diverse relationships that privacy helps establish and sustain. Fried, for instance, highlights the indispensability of privacy for the ‘relations of the most fundamental sort: respect, love, friendship and trust’ because it enables sharing information which ‘one does not share with all’ (Reference Fried1968: 484). Likewise, Gerstein argues privacy enables intimate relationships through the ‘exclusive sharing’ of information that ‘no one else knows’ about (Reference Gerstein1978: 76, 79). Although these scholars arguably fall within control-based accounts by framing privacy as control over information, their view of privacy as the exclusive sharing of information within an intimate zone shows notable overlaps with separation-based accounts. Other control-based accounts, however, move beyond this overlap by emphasising the role of privacy-as-control in enabling and sustaining a broader range of relationships, extending beyond intimate ones. For instance, Rachels suggests that the ‘ability to control … who knows what about us’ is preconditional to the ‘ability to create and maintain different sorts of social relationships with different people’ (Reference Rachels1975: 326). Lynskey argues that this control facilitates the presentation of different facets of one’s persona in different contexts, allowing one to simultaneously assume diverse roles, say, as colleagues, friends, and strangers (Goffman, Reference Goffman1959; Lynskey, Reference Lynskey2015b: 218–221), although Lynskey makes these observations regarding data protection, which already hints at areas of overlap between data protection and privacy, as examined under Section 2.3. It is worth noting here that some control-based accounts – particularly those that connect (informational) privacy with intimacy – understand the scope of information covered thereunder more narrowly as one’s ability to share their ‘private information’ (e.g. information about one’s intimate lives) with others (e.g. Gerstein, Reference Gerstein1978: 76; Parent, Reference Parent1983: 70). In doing so, they internalise the scopic limitations of separation-based accounts critiqued above. Yet most other control-based accounts do not specify the scope of protected information and instead refer more broadly to information about oneself (which can be broader than ‘private information’ as defined above, including non-sensitive information about someone in publicly available domains) (e.g. Westin, Reference Westin1967).

Control-based perspectives usefully complement separation-based models by providing a functional account of how privacy can be exercised. However, these accounts encounter important limitations vis-à-vis modern technologies for two key reasons. First, the core assumption underpinning control-based accounts – that individuals are autonomous, informed, and capable of exercising control over their data – does not hold in power-asymmetric contexts involving modern technologies. These technologies are often deployed by powerful public or private actors with whom individuals have hierarchical, power-asymmetric relationships, undermining their ability to make informed and voluntary decisions about their information. First, much information collection occurs covertly (Solove, Reference Solove2001: 1450). Purported efforts to inform people about the collection and uses of their information through the so-called privacy policies are often illusory. People typically fail to ‘notice, read, or understand’ these policies due to their ubiquity, resulting user fatigue, and limited time (Solove, Reference Solove2013: 1885). The so-called transparency paradox compounds this problem: broad descriptions of data processing fail to enable meaningful decisions, while detailed/technical explanations often exceed the average person’s ability to understand complex technologies (Richards and King, Reference Richards and King2013: 42). Modern technologies such as data analytics may be applied to large datasets at incredible speeds to identify correlations and unprecedented inferences, meaning that previously insignificant information can acquire new meanings and significance subsequently (van der Sloot, Reference van der Sloot and Tzanou2020). Consequently, individuals cannot be provided with intelligible and comprehensive information about when, how, and by whom their data are processed, which is a necessary precondition for meaningful exercise of control. Structural factors further undermine individuals’ decision-making. While scholars invoke the ‘privacy paradox’ to explain the gap between people’s stated concern for privacy and their actions that fail to safeguard it (e.g. Solove, Reference Solove2021), the issue arguably lies less in irrationality than in individuals’ often rational sense of powerlessness and lack of agency, driven by structural power asymmetries. The cognitive burden of estimating the future value of safeguarding privacy against the immediate benefits of accessing online resources further compounds this challenge (Cohen, Reference Cohen2000: 1371). Although control over information extends beyond initial consent to the entire data life cycle, structural and informational burdens undermine individuals’ ability to control their information post-collection.

Second, by focusing on individuals’ ability to control the flow of information, control-based accounts overlook the fact that information itself is often shared and relational, especially in light of emerging technologies (Solove, Reference Solove2022: 984). To illustrate this, consider the example presented by Viljoen (Reference Viljoen2021). Adam, a former gang member, shares images of his tattoos on TattooID, an online platform for tattoo enthusiasts, whilst explicitly indicating his affiliation with this gang. Subsequently, the FBI scans the database and apprehends Ben, who possesses a similar tattoo, as a suspected gang member. This captures the relational logic of data analytics at its core: they analyse multiple (often large) datasets, identify correlations (here, a recurring connection between being a gang member and having this tattoo), and accordingly draw inferences (namely, that Ben, possessing the same tattoo, is also likely to be a gang member). The analytical process involves the ‘deindividualization of the person’ because it assesses and perceives people based on the collective characteristics of their respective groups rather than their individual traits and merits (Vedder, Reference 80Vedder1999: 75). Indeed, as Viljoen claims, ‘it does not matter who the data “came” from, but what such data says about Ben, and how such meaning is used to act upon Ben’ (Reference Viljoen2021: 608).

Individualised control-based accounts of information privacy encounter particular challenges here because it is difficult to qualify the act of extrapolating insights and inferences itself as an information privacy issue. The extrapolation seeks to generate ‘knowledge about the world’, pertaining to a fact or a pattern that is ‘out there’. In this instance, relevant privacy issues relate rather to the FBI’s access to the initial information on Adam’s tattoo and gang membership, which was shared voluntarily by Adam, but from which the inference about Ben was extrapolated. The extrapolated information is used to uncover information about Ben that he has never disclosed or in whose creation/discovery he has had no control. At the same time, this extrapolation exacerbates the impact on Ben’s privacy in the sense that it allows him to be targeted and profiled in more invasive ways later. The knowledge obtained renders capturing information about Ben’s tattoo more meaningful, revealing more information about him. What this example illustrates, for the purposes of this section, is that genuine individual control over information can often be an illusory possibility in the modern technological landscape and thus is not a fully effective standalone tool for managing information boundaries. Although individual control remains an important – if not sufficient – element, its limitations indicate that an adequate conceptualisation of information privacy cannot remain focused exclusively on privacy breaches at the individual level but must also account for the broader infrastructures of information processing. This broader focus on the informational ecosystem is reflected in power-based perspectives on information privacy, explored now.

1.3 Power-Based Perspectives: Critiquing and Complementing the Mainstream Accounts

Finally, power-based perspectives developed most recently have been gaining prominence in the literature (e.g. Solove, Reference Solove2025; Richards, Reference Richards2022; Véliz, Reference Véliz2020; Cohen, Reference 74Cohen2019a; Austin, Reference Austin and Sarat2014). These perspectives have emerged directly in response to the limitations of the former accounts vis-à-vis power asymmetries generated by emerging technologies. Thus, power-based perspectives both challenge some of the premises of the former two accounts and complement them by injecting further elements, elaborating in particular on the means and methods (the causes), implications (the consequences), and ways of preventing (the remedies) information privacy breaches. While often framed as alternative and self-standing accounts, this section demonstrates that they are better conceptualised as critiques of, or perspectives on, information privacy. Indeed, it also illustrates that by shifting the emphasis to power as a means of both identifying and responding to the limitations of existing conceptualisations of privacy, power-based perspectives also extend beyond privacy as such, blurring into and cascading across other rights and interests that information privacy breaches may undermine downstream.

Power-based perspectives focus on the complex relationship between privacy, power, and knowledge, placing surveillance – namely, the ‘focused, systematic and routine attention to personal details for the purpose of influence, management, protection or direction’ (Lyon, Reference Lyon2007: 14) – at their centre. As Cohen suggests, surveillance has both ‘passive’ and ‘active’ dimensions (Reference Cohen2008). Passive surveillance involves receiving, collecting, and/or recording information. This is aptly captured in Foucault’s theorisation of Bentham’s work on the Panopticon (Reference Foucault1991), which, although originally developed as a model of State power rather than privacy per se, now often stands at the centre of contemporary perspectives that frame privacy in power-based terms. The Panopticon imagines a circular prison architecture where the central watchman has a comprehensive view of the prisoners (‘pan’ meaning ‘all’ and ‘optikon’ meaning ‘seeing’). The design achieves the efficient enforcement of discipline, not (only) through prisoners’ visibility but more fundamentally through their perception of being observed. The possibility of being seen generates a chilling effect on their behaviour. Passive surveillance often leads to and combines with active surveillance. Unlike passive surveillance, which involves recording pre-existing information, active surveillance refers to the use of the collected information (e.g. classifying and sorting information) to construct new inferences or imaginaries by placing people into categories. Emerging technologies, such as data analytics, facilitate this process, with their ‘core and unavoidable’ mode of operation being the classification and profiling of individuals based on patterns and correlations, from which inferences and predictions are drawn (see further Mittelstadt, Reference Mittelstadt2017: 477).

The overarching problematique at the heart of power-based perspectives is the arbitrary authority that both components of surveillance confer on the surveilling party, which creates a sense of disempowerment for individuals and limits their control over how their information is used and the potential effects it may have. This concern overlaps with control-based accounts but adds distinct dimensions to it (and to separation-based accounts). Namely, while passive surveillance’s chilling effect is discussed in both mainstream accounts, power-based perspectives introduce a crucial shift in focus: they highlight that the chilling effect arises not from an actual invasion of informational boundaries, but from the perception that such boundaries do not exist to begin with – regardless of the objective reality. This highlights that privacy harms can occur without a violator – which is ‘precisely’ why ‘[t]he Panopticon works’ – ‘because people can be mistaken about whether someone is watching them and nonetheless suffer similar or identical effects’ (Calo, Reference Calo2011: 1147). Similarly, the (power-based) critiques of active surveillance distinctively focus on the unpredictability of how information about individuals may be used against them, particularly by highlighting the mosaic effect where seemingly trivial data can (co-)produce highly sensitive insights. This challenges or complements separation- and control-based accounts, which define the scope of (informational) privacy either very narrowly or not at all. Yet, in doing so, power-based perspectives create new uncertainties about when a piece of information falls outside information privacy and often risk cascading into a general regulatory framework that conflates privacy and data protection (see also Section 3.1).

In addition to the mosaic effect, power-based perspectives highlight how the insights or inferences obtained can subsequently underpin significant decisions affecting individuals, adding another layer of power over them. Zuboff, for instance, explains that such inferences predict human behaviour to target individuals with personalised services, steering them into desired patterns of action (Reference Zuboff2019). This not only channels individuals towards consuming certain products in the commercial realm, as part of the ‘surveillance capitalism’ project, but also extends into the political realm, interfering with democratic processes, as illustrated by the Cambridge Analytica scandal (Zuboff, Reference Zuboff2019). Importantly, power-based perspectives stress that the impact of these practices is not limited to the individual but also extends to the creation of new realities and categories that fundamentally reshape societies in ways envisioned by those deploying the technologies. Predictive analytics exemplify this: the collection and structuring of information for these systems is never neutral but is carried out by powerful actors according to their own objectives and visions, inevitably reflecting a particular reading of the past (Gandy, Reference Gandy2016: 63). Gandy highlights, for instance, how racial proxies are built into these systems ‘even where their inclusion made little sense at all’, resulting in discriminatory and biased decision-making under the guise of scientific neutrality (Gandy, Reference Gandy2016). These technologies enable powerful actors not only to ‘see’ but also ‘shape’ and ‘control’ the future (Matsumi and Solove, Reference Matsumi and Solove2024: 36).

Central to these concerns is the creation of a ‘Kafkaesque world of bureaucracy’, in which information is not only beyond the individual’s control but also subjected to a bureaucratic process that is itself inadequately controlled (Solove, Reference Solove2004: 96). Yet, unlike the individualised focus of control-based accounts, power-based perspectives do not treat information privacy breaches as (merely) fragmented individual harms but as systemic issues embedded in the very architectures of information processing. By placing their emphasis on power, these accounts shift the focus away from the wrong suffered at the individual level to the wrongdoer at the structural level (Austin, Reference Austin and Sarat2014: 160–177). Accordingly, their concern is not limited to personal loss of control but extends to the arbitrary and unchecked power embedded in the social and legal frameworks governing information processing, demonstrating that these may be harmful per se even where power is not actively exercised (Austin, Reference Austin and Sarat2014: 166; van der Sloot, Reference van der Sloot, Taylor, Floridi and van der Sloot2017). By foregrounding the broader asymmetries within which information processing operates, power-based views suggest that the remedy does not lie – or at least does not solely lie – in enhancing individual control. Instead, they call for structural and institutional ‘rules’ aimed at ‘controlling power’ to avoid situations where no one is meaningfully accountable for the use of personal information (Richards, Reference Richards2022: 38; Austin, Reference Austin and Sarat2014: 100; Solove, Reference Solove2001: 1428; Cohen, Reference Cohen2019b: 2). The remedy envisaged by power-based accounts is therefore still control, but of a different kind: control not exercised (solely) by individuals but embedded within broader structures that safeguard individuals. This conception goes beyond, albeit overlaps with, the individual-focused, control-based accounts discussed earlier. It understands control more broadly – as the creation of an environment in which individual autonomy is both supported and enabled through oversight by responsible entities (see also Cohen, Reference Cohen2019b: 2; Solove, Reference Solove2004).

This broader notion of (architectural) control closely overlaps with conceptualisations of data protection as a system of checks and balances on information structures, as further explored in Section 2.3. There is thus a significant overlap – and a blurred boundary – between power-based perspectives on information privacy and data protection. Part of the reason for this close connection lies in jurisdictional differences in terminology and conventions, particularly between the US and the EU. Strikingly, many scholars who adopt power-based perspectives on information privacy – primarily based in the US – appear, in their accounts of privacy, to be discussing privacy law more broadly. By this, they often seem to be referring to what would, in the EU context, be understood as data protection laws and frameworks (e.g. Richards, Reference Richards2022; Matsumi and Solove, Reference Matsumi and Solove2024; Kaminski, Reference Kaminski2022; Bennett, Reference Bennett1992: 14). This suggests that, in many instances, when power-based perspectives address information privacy, they are in fact engaging with data protection in a broader sense. Indeed, some of the central premises of these predominantly US-based power-based perspectives – such as the argument that privacy extends beyond individual control – often stem from what these scholars understand to be an (arguably overemphasised, as demonstrated in Section 2) focus in data protection law on individual control (see a similar observation in Clifford, Reference Clifford2024: 192).

Accordingly, while power-based perspectives offer valuable insights that enrich conceptualisations of information privacy – for example, by highlighting the limitations of framing information privacy solely in terms of restriction or control of information flows in the context of emerging technologies – they often extend beyond information privacy per se. This is evident in the seemingly unbounded nature of the ‘information’ these perspectives encompass, as well as in the range of concerns they raise regarding practices such as pervasive (active and passive) surveillance, which implicate related but distinct rights, including protection from discrimination. To be sure, the latter are inextricably linked to information privacy, since their materialisation hinges on extensive collection and unforeseeable uses of individuals’ information without respect for informational boundaries. But those interests seem to relate more to the consequences of information privacy breaches for other rights and interests than to the conceptualisation of information privacy itself. This point is acknowledged by scholars such as Zuboff, who argues that new technologies generate unprecedented challenges for which the tendency has been to rely on familiar concepts such as privacy, while admitting that those concepts ‘fall short in identifying and contesting the most crucial and unprecedented facts of this new [reality]’ (Reference Zuboff2019: 14). This raises broader questions about the utility of attempts to subsume all informational harms under the umbrella of information privacy, as power-based perspectives sometimes appear to do. The concern that privacy, as a familiar and well-established interest, is being stretched to accommodate novel challenges posed by emerging technologies is also at the heart of jurisprudence on the right to privacy, as explored under Section 3.

1.4 Interim Conclusions

The foregoing discussion shows that, despite their differences, separation-, control-, and power-based perspectives are complementary rather than competing. Developed at different points in time – in the order discussed – these accounts reflect evolving ways of thinking about information privacy, which do not replace but rather build on one another to form a layered understanding. Separation-based accounts stress the protection of private information as a means of safeguarding autonomy, identity, and democracy but tend to overlook privacy interests in public and relational contexts. Control-based accounts address some of these gaps by emphasising individual agency over information flows; however, they presuppose an autonomous individual capable of managing their data – an assumption that falters in power-asymmetric contexts – and they often overlook the relational nature of modern ‘knowledge’ production. Power-based perspectives respond to these shortcomings by examining structural disempowerment and the systemic regulation of information flows. Yet, as these perspectives frequently advance their critiques in relation to privacy laws – by which they often refer to data protection laws – their claims extend beyond information privacy to encompass other rights and interests affected by unfair processing structures. This also reflects differences in terminological choices across jurisdictions, which further contribute to confusion in the relationship between privacy and data protection.

2.1 The Emergence of Data Protection Frameworks and Their Articulation of Their Relationship to Privacy

A brief account of the genealogy of data protection is essential for understanding how these frameworks have interpreted privacy and how this understanding has shaped their articulation of the relationship to it (see also Bosua et al., Reference Bosua, Clifford, Qian and Richardson2025). Its roots can be traced back to governments’ growing need for citizen data to manage post–Second World War welfare states, which triggered in citizens a sense of loss over their personal information (González Fuster, Reference González Fuster2014; Mayer-Schönberger, Reference Mayer-Schönberger, Agre and Rotenberg1997). Early data protection laws accordingly started emerging in the 1970s at the national level in order to ‘tame’ technology and forestall the emergence of unchecked information processing bureaucracies (Mayer-Schönberger, Reference Mayer-Schönberger, Agre and Rotenberg1997: 223). These national frameworks had a ‘primarily “protective” approach’, which meant that their substance was predominantly composed of ex ante obligations imposed on information processors, with limited rights afforded to individuals (Ausloos and Dewitte, Reference Ausloos and Dewitte2018: 4). They accordingly tended to omit vocabulary such as ‘privacy’ or ‘protection of intimate affairs’, using instead ‘technical jargon’ such as ‘data’, ‘data bank’, and ‘data file’ (Mayer-Schönberger, Reference Mayer-Schönberger, Agre and Rotenberg1997: 224; cf. the 1978 French law, which granted stronger control rights to individuals; González Fuster, Reference González Fuster2014: 64). This anti-totalitarian origin of early data protection frameworks, oriented around checking state power, reflects an early emphasis on controlling large-scale information processing. This mirrors the power-based perspectives on (information) privacy, which however only gained prominence later in the twenty-first century in response to new technologies’ emergence. This is presumably why the early domestic frameworks omitted explicit references to (informational) privacy, which at the time was primarily understood either as restriction of access to one’s private (e.g. intimate) information or as individual control over their information, neither of which was the central concern of these frameworks.

Data protection then developed in a different direction as cross-border flows of data increased. These flows were increasingly affected by a patchwork of different national laws, which created uncertainty and inconsistency and led to efforts to harmonise rules internationally. This resulted in two major developments: namely, the non-binding OECD Guidelines and Governing the Protection of Privacy and Transborder Flows of Personal Data (adopted in 1980 and updated in 2013) and the legally binding treaty, the Council of Europe’s Convention 108 for the Protection of Individuals with regard to Processing of Personal Data (adopted in 1981 and modernised in 2018 with ‘Convention 108+’). Both frameworks sought to balance the dual goals of facilitating the free flow of information and safeguarding fundamental rights and freedoms, ‘in particular’ the right to privacy. In doing so, they established a close, instrumental link between data protection and privacy, portraying the former as a means to safeguard the latter. Simultaneously, they also introduced an ambiguity by implying an equivalence between the two (González Fuster, Reference González Fuster2014: 253–256). This is especially evident in the OECD Guidelines, which consistently use the term ‘privacy’ rather than ‘data protection’ to frame the main problematique it responds to in the preamble (i.e. ‘privacy risks’) and to describe the relevant frameworks regulating the processing of personal data (i.e. ‘privacy laws’ and ‘privacy enforcement authorities’). Notably, the Guidelines’ explanatory memorandum recognises that ‘data protection’ is the preferred term in the EU and highlights how conceptions of privacy have ‘[g]enerally … broaden[ed]’ from its ‘traditional’ understanding as ‘“the right to be left alone”’ (OECD, 2023: 19). This suggests an understanding of privacy and data protection as largely equivalent, with the difference being primarily terminological. This exemplifies this Element’s central claim: that the confusion and divergent interpretations surrounding the relationship between privacy and data protection arise in large part from terminological preferences across jurisdictions, as well as from differing (and evolving) understandings of privacy itself.

Another key international development often overlooked in historical accounts is the UN Guidelines on Computerised Personal Data Files (Bygrave, Reference Bygrave2002: 33). Like the OECD Guidelines, these are non-binding, but they are also notably brief – just three pages, with no recitals, explanatory notes, or preamble. This brevity means they offer limited insight into the privacy–data protection relationship. Privacy is mentioned only once, in Article 9, which provides that ‘transborder data flows’ may occur freely where other countries ‘offer comparable safeguards for the protection of privacy’. Some background documents on the Guidelines, such as the final preparatory report, refer to privacy as the main but not the only right protected by the Guidelines, in line with the language of other international frameworks. It is likely that the Guidelines were primarily intended to establish a shared (transatlantic) language rather than to set out an explicit or implicit position on the relationship between privacy and data protection. It is also worth noting that the emphasis on – or at least the explicit reference to – privacy across the three international frameworks is accompanied by a growing focus on the individual and their right to exercise control over personal information (Mayer-Schönberger, Reference Mayer-Schönberger, Agre and Rotenberg1997: 226–227; see further Section 2.2 on these frameworks’ substance). This is reflected in the set of rights these frameworks grant to data subjects, which aim to empower them vis-à-vis the processing of their personal data, such as the right to request access to or erasure of their information (as further delineated in Section 2.2). Arguably, the correlation between such rights and the increased visibility of privacy in these frameworks is not coincidental and suggests an implicit understanding of individual control as an integral aspect of privacy.

Subsequent developments at the EU level, however, deliberately decouple privacy and data protection. Data protection was initially regulated through the 1995 EU Data Protection Directive (DPD). The DPD was widely considered a ‘market-born’ framework, as it was enacted based on Art. 114 of the Treaty on the Functioning of the European Union (TFEU), which authorises legislation for the internal market. However, this market-based characterisation is overly reductive, as the choice of legal basis also reflected a treaty constraint: only with the 2009 Lisbon Treaty did the EU gain explicit competence to legislate for the ‘protection of individuals with regard to processing of personal data … and the rules relating to the free movement of such data’ (Art. 16 TFEU, which reflects a balance between internal market and rights protection objectives on which the GDPR (replacing the DPD) was based; Bosua et al., Reference Bosua, Clifford, Qian and Richardson2025; Jančiūtė, Reference Jančiūtė, Leenes, Brakel, Hert and Gutwirth2017; Lynskey, Reference Lynskey2015b). The Lisbon Treaty was also crucial in making the 2000 Charter of Fundamental Rights (CFR) legally binding. For the first time, the CFR enshrined a standalone right to data protection (Art. 8), distinct from the right to respect for private and family life (Art. 7). This distinguishes the CFR from other human rights frameworks, in which data protection is instead read into the right to privacy (see Section 3).

The inclusion of both rights in the now-binding CFR marked a clear shift in how the relationship between privacy and data protection was framed. Specifically, the GDPR, replacing the DPD, articulates its rights-based limb as the protection of the ‘fundamental rights and freedoms of natural persons and in particular their right to protection of personal data’ (Article 1; emphasis added), in contrast to the DPD, which instead singled out the ‘right to privacy’ as the ‘particular’ right protected (Art. 1). Strikingly, the GDPR refers to privacy only once, and merely on a par with other rights protected within the data protection framework (see Recital 4). Indeed, a key motivation behind the reform of the DPD through the GDPR was the European Commission’s concern that individuals were losing control over their personal data (e.g. Recital 68 GDPR), prompting the introduction of a more extensive set of individual rights. This suggests that, at the EU level, data protection was understood predominantly as individual control over personal information. This interpretation is further supported by the drafting history of the right to data protection, as earlier drafts explicitly referred to informational self-determination (i.e. control over one’s information), suggesting that this principle was likely the main driver underpinning the right (Clifford, Reference Clifford2024: 185; Bygrave, Reference Bygrave2002: 119). Although the reference to informational self-determination was removed from the final text, it is reflected in various core data protection principles embedded in the GDPR (see further Section 2.2). Distinguishing data protection, understood in such control-based terms, from privacy implies, a contrario, that privacy was conceived in its traditional, narrower sense – namely, as a right to restrict others’ access to one’s information, in line with separation-based accounts. This reflects a more restrictive conceptualisation of (informational) privacy than the control-based understanding implied in the international data protection frameworks discussed above, resulting in a different understanding of how privacy relates to data protection.

Meanwhile, other data protection frameworks have been adopted at regional levels beyond the EU. These have often been overlooked in the literature comparing privacy and data protection, which tends to focus predominantly on the EU. But these regional instruments also illustrate – and contribute to – the ambiguous relationship between privacy and data protection. For instance, the (non-binding) OAS (Updated) Principles on Privacy and Personal Data Protection, the APEC Privacy Framework, and the (binding) ECOWAS Supplementary Act on Data Protection all appear to reinforce the close connection between privacy and data protection – whether by treating them as equivalent or by framing data protection as an instrument for safeguarding privacy. While the title of the OAS Principles explicitly refers to ‘privacy and personal data protection (emphasis added)’ – potentially implying a recognition that the two are different – the instrument’s substance points in a different direction. It frames the purpose of the principles as ‘establish[ing] effective rules for personal data protection that give effect to the individuals’ right to privacy and demonstrate respect for their personal data’, implying that data protection is conceived as a means of safeguarding privacy. Relatedly, the OAS Principles state that the term ‘data’, which defines their material scope (Section 2.2), was deliberately chosen over ‘information’ to indicate a broader scope aimed at promoting the greatest possible protection of ‘privacy’. Somewhat confusingly, the introductory section of the OAS Principles includes a subsection on ‘privacy’, noting that the constitutions and laws of many member States guarantee data protection as ‘distinct and complementary’ to privacy and other rights such as personal dignity. However, read holistically, this appears to describe variations among Member States rather than introduce a conceptual separation between privacy and data protection within the Principles themselves. This reading is reinforced by the subsection’s conclusion, which reverts to the notion of a general ‘right to privacy’ (OAS (Updated) Principles: 21) and states that privacy functions as an overarching category encompassing related rights such as data protection and dignity.

Going further than the OAS Principles, the APEC Framework refers only to privacy in its title. The preamble defines its dual goals as ensuring ‘effective privacy protections’ while avoiding barriers to information flows. Notably, the preamble presents the Framework’s raison d’être as addressing the difficulty individuals face in ‘retain[ing] a measure of control over their personal information’. When outlining obligations such as notice (i.e. informing individuals how their data is processed), the framework explicitly refers to ‘informational self-determination’ without introducing a separate right or concept, thereby presumably treating it as part of privacy. These elements suggest that the drafters adopted a control-based understanding of privacy, thereby treating privacy and data protection as conceptually equivalent. A similar reading emerges from the ECOWAS Supplementary Act. Its preamble refers to human rights protection and the ‘harmonization of the policies and regulatory framework of the Information and Communication Technologies sector’, reflecting the dual aims of data protection frameworks. Notably, the preamble emphasises the ‘urgency’ of filling the ‘legal vacuum generated by the use of internet’ ‘notwithstanding’ national legislation on the protection of privacy and the free movement of information. This ‘legal vacuum’ could be read in two ways: either as implying that privacy alone is insufficient and needs to be complemented by data protection – suggesting a conceptual (and a legal) gap therebetween – or as pointing to the need to give concrete legal expression to data protection as a dimension of privacy. The latter appears more likely: Art. 2 states that the objective of the Supplementary Act is to protect ‘privacy relating to the collection, processing, transmission, storage and use of personal data’, subject only to the ‘general interest of the state’. This phrasing, as in the OAS and APEC instruments, indicates that the Act treats privacy and data protection as closely intertwined, if not conceptually equivalent.

Conversely, the Ibero-American Standards – explicitly inspired by the GDPR, as indicated in their preamble – explicitly distinguish between ‘data protection’ and ‘privacy’ as separate rights. The Standards refer to the ‘right to personal data protection’ as a ‘fundamental’ right of a ‘different’ nature from the right to ‘privacy’. They suggest that the right to personal data has ‘its own characteristics and dynamics’, aimed at safeguarding individual control over information. By framing data protection in control-based terms – and explicitly distinguishing it from privacy – the Standards imply a narrower understanding of privacy, possibly aligned with separation-based accounts. This echoes, to some extent, the conceptual division between privacy and data protection that is also implicit in the EU framework. As with the above frameworks, it is a particular conception of privacy that drives the framing of its relationship with data protection. However, to assess these varying framings, it is also necessary to understand what data protection frameworks – as the other element in the equation – encompass.

2.2 Core Data Protection Principles

This section delineates the content of data protection by examining the core data protection principles shared by the aforementioned frameworks. These frameworks vary both geographically and in terms of legal status, encompassing both binding and non-binding instruments. Among them, the (only) binding frameworks are Convention 108,Footnote ² the GDPR, and the ECOWAS Supplementary Act.Footnote ³ This means not all of the frameworks examined here are what Greenleaf considers ‘data privacy laws’ in the sense of being legally binding treaties (Reference Greenleaf2014: 8). Nevertheless, they represent the main international and regional efforts in data protection and are assessed here to identify the core elements that give concrete meaning to data protection (which, in turn, facilitates comparison with different conceptualisations of privacy).Footnote ⁴ At the outset, it should be noted that examining this broad range of data protection frameworks – adopted at different times and across different regional contexts – inevitably reveals divergences in terminology and formulation. Outlining core principles is therefore an exercise in approximation to identify general contours. Accordingly, the Element notes some nuances where appropriate and important – not to provide an exhaustive comparison, but to demonstrate that, notwithstanding certain variations, the frameworks are sufficiently aligned with one another to support a meaningful extraction of core principles.

Before discussing these core principles, it is first necessary to delineate the material scope of data protection frameworks. The material scope determines when these frameworks – and hence their core principles – apply. This scope pertains to the ‘processing’ of ‘personal data’. Both terms are defined broadly across data protection frameworks, which illustrate the flexibility embedded in these frameworks to respond to new technologies as they emerge. Despite variations in the terminology used, their definitions are functionally similar. Personal data (or, e.g., ‘personal information’ under the APEC Privacy Framework, Art. II.9) refers to any information relating to an identified or identifiable individual. Importantly, this definition does not distinguish between ‘private’ and ‘public’ information – as understood in separation-based information privacy accounts (Section 1.1). It is rather odd, then, that the APEC Framework states it ‘has limited application to publicly available information’ (Art. II.11). The accompanying commentary on this provision explains that notice and information provisions ‘in particular’ are ‘superfluous where the information is already publicly available’ and not directly obtained from the individual. This can be read to suggest that this provision on publicly available information does not delimit the Framework’s material scope generally, but applies specifically to notice (i.e. transparency) obligations. This likely reflects the influence of traditional, separation-based conceptions of privacy, which tend to consider privacy extinguished when one’s information is accessed by others; by equating privacy with data protection, the Framework adopts this restrictive tendency – even as it reflects broader, control-based understandings of privacy elsewhere (Section 2.1).

Another potential difference in the scope of ‘personal data’ across the frameworks concerns the breadth of identifiability, a constitutive element of the definition where information does not relate to an identified individual. Although identifiability has long been interpreted broadly at the EU level – largely through CJEU jurisprudence – recent case-law suggests a partial narrowing of this approach. In EDPS v. SRB, the Court held that pseudonymised information – data processed so that it cannot be attributed to a specific individual without additional information (Art. 4(5) GDPR) – is not necessarily personal data for all entities. Instead, information is personal data only for entities that have ‘means reasonably likely [and, as per Breyer v Bundesrepublik Deutschland, lawful] to be used’ to identify the person. At first sight, SRB may appear difficult to reconcile with earlier case-law such as Breyer, where the Court held that information may remain identifiable even if the necessary additional information is not ‘in the hands of one person’ (para. 43). This could be understood to offer a very broad conception of personal data, as in a context of increasing datafication and advanced re-identification techniques there will often be some third party holding identifying information. This understanding would substantially narrow the scope of anonymous data (i.e. data processed in a manner that the individual is no longer identifiable), which marks the outer limits of identifiability (and of personal data). Yet SRB can also be read as reaffirming the relative and subjective approach already implicit in Breyer. That case concerned whether a dynamic IP address constituted personal data for a website operator who did not themselves hold the identifying information (which was held by the internet service provider (ISP)). The Court found that the dynamic IP address could still be personal data, since the operator could reasonably and lawfully obtain the necessary information from the ISP, for example, in the context of a cyberattack and subsequent criminal proceedings. The mere existence of a third party holding identifying information was therefore not decisive; what mattered was the specific actor’s realistic and lawful access to the additional information. This subjective approach to determining what constitutes personal data – and thus whether the GDPR applies – introduces a degree of uncertainty in the context of multi-actor processing environments and may narrow the regulation’s material scope (see also Cobbe, Reference Cobbe2026). The challenges embedded in this relative turn will assume increasing importance, especially in light of the European Commission’s initial proposal of November 2025 to codify this approach, although a full examination lies beyond this Element’s scope. It is sufficient to note here that this relative approach narrows – but does not eliminate – the potential gap between the EU framework and the (Updated) OAS Principles. This is because the latter excludes both anonymous and pseudonymised data from the scope of ‘personal data’. While the OAS Principles do not define pseudonymised data, the use of a different term from anonymous data (which is defined in the Principles in similar terms to the GDPR) suggests that pseudonymised data is presumably intended to cover information that still allows re-identification (as under the GDPR). Excluding pseudonymised information from protection categorically reflects a narrower approach than the EU model, where such an exclusion will be context dependent. Yet given the ambiguities and loopholes inherent in the EU’s relative turn, the practical difference between the two frameworks may be less substantial than it initially appears.

The second determinant of the material scope – processing – is also defined broadly across data protection frameworks. Processing (or, e.g., ‘treatment’ under the Ibero-American Standards, Art. 2(1)(i)) is deliberately framed broadly to cover any operation performed on personal data, including but not limited to its collection, storage, use, transmission, alteration, or erasure.Footnote ⁵ This expansive definition ensures that the core data protection principles apply throughout the data life cycle. It is therefore notable that some frameworks articulate specific principles only in relation to certain stages of processing. Namely, the OECD Guidelines (Art. 7) and the APEC Framework (Art. III.18) appear to limit the application of the collection limitation principle to the data collection stage only. This may reflect early frameworks’ focus on regulating information collection (Bygrave, Reference Bygrave2014; Clifford, Reference Clifford2024). Alternatively, it may result from imprecise drafting in the OECD Guidelines – later adopted by the APEC Framework – rather than an intentional restriction of the principle’s scope. The focus on collection may have assumed that restricting collected data would naturally limit later uses, overlooking how minimisation applies across the processing life cycle. This latter interpretation is more consistent with the objective of these data protection frameworks, namely, to ensure that interferences with individuals’ rights resulting from the processing of their personal data are no more than necessary for other legitimate rights and interests. It would be perverse if specific provisions, such as collection limitations, were taken literally and if similar limits did not extend to other processing activities, such as the storage or disclosure of personal data.

Data protection principles apply to personal data processing both in the private and public sectors, but some examined frameworks provide exceptions or limitations in national security contexts (see, e.g., OECD Guidelines, Art. 4; UN Guidelines, Art. 6; GDPR, Art. 2(2)(a); Ibero-American Standards, Art. 6; Twelfth OAS Principle; and so on). Regarding the subjects to whom data protection obligations apply, the primary addressees and duty-bearers are ‘data controllers’ (also referred to as ‘controller’ under Convention 108+, Art. 2(d), ‘person responsible’ under Ibero-American Standards, Art. 2(1)(c), or ‘personal information controllers’ under APEC Framework, Art. II(10)). On the other side are ‘data subjects’ who are the right-holders (also called ‘holders’ under Ibero-American Standards, Art. 2(1)(h) or simply ‘individuals’ throughout Convention 108+). Despite terminological variations, ‘data subjects’ refer to individuals whose personal data is processed, while ‘data controllers’ denote those who determine the purposes and means of that processing. Some frameworks also refer to ‘data processors’, who are the entities that process data on behalf of, and under the instructions of, data controllers. Given their subordinate role and generally limited direct obligations towards data subjects, data processors are not discussed further. For purposes of simplicity and consistency, the remainder of this Element will use the terms personal data, processing, data controller, and data subject.

In terms of substantive protections, the core data protection principles can be grouped into three main pillars: data subject participation, data controller obligations, and oversight. The first pillar includes principles imposing default obligations on data controllers. For example, the principle of lawfulness requires that the processing of personal data be based on a legal basis. Some data protection frameworks provide an exhaustive list of legal bases, with data subject consent being the most common – though not the only – ground. The transparency principle requires that data subjects be provided with key information about their personal data processing in a concise and intelligible form. Such information includes, inter alia, the purpose, legal basis, and duration of processing. Transparency is closely linked to the fairness principle (referred to as loyalty in some frameworks: the Ibero-American Standards, Art. 15, and the First OAS Principle). Some instruments provide illustrative examples of fair processing, such as the obligation to avoid deception or fraud (ECOWAS Supplementary Act, Art. 24; APEC Privacy Framework, Art. III(18); and First OAS Principle). At the same time, they emphasise that these examples are not exhaustive, suggesting that fairness (or loyalty) entails a broader duty to act in a manner that respects the trust and legitimate expectations of data subjects (e.g. Ibero-American Standards, Art. 15; First OAS Principle).

Although the absence of a definition of fairness appears to be a deliberate choice to keep the concept open-ended, it also renders it inherently indeterminate. To complicate matters further, different layers of fairness seem to operate within data protection frameworks. These layers are not always easy to delineate (Clifford, Reference Clifford2022; for further details on the (European) scholarly literature unpacking fairness, see Clifford and Ausloos, Reference Clifford and Ausloos2018; Malgieri, Reference Malgieri2020). Clifford’s mapping of these layers (Reference Clifford2022 and Reference Clifford2024), though rooted in the EU context, provides a useful lens for understanding fairness across different frameworks. First, fairness can be seen as a principle with both substantive and procedural aspects, overlapping with other principles in various ways. Procedurally, it is closely linked with transparency, equipping individuals with the information needed to make informed choices about their data. Substantively, it concerns the requirement to strike a ‘fair balance between all interests concerned’ (Convention 108+, Art. 5(1)). While explicitly articulated in some instruments, its substantive dimension is omitted in others such as the OECD Guidelines (Art. 7), where fairness appears process oriented. This substantive dimension overlaps with the broader role fairness plays in data protection frameworks. In this second layer, fairness functions as an overarching goal of the entire framework, operating as a system of checks and balances to achieve an appropriate equilibrium between competing rights and interests. Lastly, fairness may underpin – or at least form part of – the right to data protection, where such a right is provided in its own terms (e.g. in the EU, in Art. 8 CFR), and is distinct from the broader data protection framework (e.g. the GDPR) itself (see further below on the connection between this right and fairness). The indeterminacy of fairness and its ambiguous relationship with other principles have produced diverse configurations across frameworks. Some treat lawfulness, transparency, and fairness as separate principles (e.g. Ibero-American Standards, Arts. 14–16), while others combine them in various ways (e.g. GDPR, Art. 5(1)(a)), which may be interpreted as one joint principle, two principles under the lens of fairness, or three distinct principles (Clifford, Reference Clifford2022, para. 14). Some frameworks pair lawfulness and fairness (UN Guidelines, Art. 1; OAS First Principles; OECD Guidelines, Art. 7; APEC Privacy Framework, Art. III.18; ECOWAS Supplementary Act, Art. 24), while others pair fairness and transparency (Convention 108+, Art. 5(4)(a)).

The principle of minimality requires that personal data be processed only to the extent necessary, measured against the specific purposes of processing. For the reasons set out in the discussion on ‘processing’ above, the minimality principle should be understood as applying to any processing operation, even where the relevant provisions enshrining it may sometimes refer specifically to the ‘collection’ of personal data (e.g. OECD Guidelines, Art. 7). This comprises three main prongs: purpose limitation (personal data must be processed only for specific and explicit purposes); data minimisation (only personal data necessary for those purposes should be processed); and storage limitation (personal data must be retained only for as long as needed to fulfil the stated purposes). Some frameworks articulate these prongs separately but within the same provision (e.g. GDPR, Art. 5(1)(b), (c), and (e); Convention 108+, Arts. 5(4)(b) and 5(1); and ECOWAS Supplementary Act, Arts. 25(1)–(4)). Others group some or all of the prongs together (e.g. Ibero-American Standards, Art. 18, and Third OAS Principle, which combines purpose limitation and data minimisation purposes). Some frameworks also combine aspects of minimality with other principles such as lawfulness and fairness (e.g. OECD Guidelines, Art. 7; APEC Framework, Art. III.18). Notably, not all frameworks explicitly provide for all three minimality sub-prongs. For example, storage limitation is absent from the OECD and APEC instruments. Similarly, the Ibero-American Standards do not provide storage limitations as a controller obligation but rather as part of the data subject’s right to restrict processing when data is no longer needed (Art. 31). Nonetheless, the minimality principle is arguably implicit in these instruments through their inclusion of data minimisation, which applies to all processing operations, including storage.

The data accuracy principle requires that personal data be accurate, relevant, and kept up-to-date in relation to the purposes of processing (e.g. Convention 108+, Art. 5(4)(d); UN Guidelines, Art. 3(a); GDPR, Art. 5(1)(d); OECD Guidelines, Art. 8; Seventh OAS Principle; ECOWAS Act, Art. 26; APEC Framework, Art. VI.21). By requiring data to be ‘relevant’ to processing purposes, the accuracy principle also reinforces minimality, ensuring only necessary and appropriate data is processed. The data security principle requires personal data to be adequately protected against, inter alia, unauthorised disclosure, tampering, exploitation, or loss. In the Ibero-American Standards, this principle appears as both the ‘Safety Principle’ (Art. 21) and the ‘Confidentiality Principle’ (Art. 23). Closely related to data security is the sensitivity principle, which calls for heightened safeguards for – or a default prohibition on – processing sensitive personal data, subject to limited exceptions such as explicit consent (e.g. ECOWAS Act, Art. 30; GDPR, Art. 9). Although sometimes presented as a standalone principle (e.g. the Ninth OAS Principle), it may be more accurately viewed as a rule applying to personal data requiring additional protection (e.g. GDPR Art. 9). The scope of sensitive data varies across frameworks but typically includes information on racial or ethnic origin; political opinions, religious, philosophical, or moral beliefs; trade union membership; health, sex life, or sexual orientation; and genetic or biometric data used for unique identification. To this list, Convention 108+ adds data relating to criminal offences, proceedings, and sanctions (Art. 6(1)), while the ECOWAS Act also covers administrative sanctions (Art. 1). Some frameworks adopt a broader definition of sensitive data, such as the UN Guidelines (Art. 5) and the Ibero-American Standards (Art. 2(1)(d)), the latter defining it as data ‘refer[ring] to the intimate sphere of their holder, or whose undue use may cause discrimination or serious risk thereto’. The connection between the protection of sensitive data and the safeguarding of dignity, honour, and fundamental freedoms – as well as the prevention of discriminatory or harmful outcomes – is explicitly recognised in Convention 108+, Art. 6(2), and in the commentary to the Ninth OAS Principle. This link to non-discrimination is particularly pronounced in the UN Guidelines, which frame the sensitivity principle explicitly in terms of non-discrimination. The implications of this for the relationship between privacy and data protection frameworks are explored further in Section 2.3.

The second pillar – data subject participation – encompasses principles providing individuals with the tools to engage meaningfully in the processing of their personal data. This includes the principle of consent, which requires data controllers to obtain informed, explicit, voluntary, and revocable consent before processing personal data.Footnote ⁶ Consent is a common legal basis for processing and, as such, overlaps with the lawfulness principle (e.g. GDPR, Art. 6; Convention 108+, Art. 5(2); OECD Guidelines, Art. 7, where it appears under the ‘Collection Limitation Principle’). Although the OAS Principles initially appear to treat consent (coupled with ‘Transparency’ under the Second Principle) as a separate principle, a closer reading shows it is simply one of several possible legal bases. The wording of the Second Principle refers to ‘when processing is based on consent’, implying consent is not always required, and the explanatory notes allow reliance on another legal basis if consent is not possible. The First Principle (Lawful Purposes and Loyalty) lists legal bases, including but not limited to consent, largely mirroring other frameworks. Thus, despite singling out consent and coupling it unusually with transparency, the OAS Principles’ requirements on consent operate substantively much as in the other frameworks.

A second key principle under the participation pillar is data subject rights. These include the right to be informed about the processing of one’s personal data, the right to request access to, rectification of, or erasure of that data, and the rights to object to or request restriction of its processing. Frameworks differ in how they provide for these rights: some, such as the GDPR and ECOWAS Supplementary Act, list them separately, while others group them, such as the OAS Principles (Seventh Principle); OECD Guidelines (Art. 13, ‘Individual Participation Principle’); and Convention 108+ (Art. 9). Beyond these core rights shared across all instruments, some frameworks recognise two additional rights. The first is the right not to be subjected to solely automated decision-making that produces legal or similarly significant effects on the data subject (‘the right against ADM’) (see, e.g., Convention 108+, Art. 9(1)(a); GDPR, Art. 22; Ibero-American Standards, Art. 29).Footnote ⁷ Interestingly, the ECOWAS Act provides a different formulation of this right: the relevant provision (Art. 35) is titled ‘Basis of a Court Decision’ and includes a first clause prohibiting court decisions ‘implying an assessment of the behaviour of an individual … based on … [automated processing] … evaluating certain aspects of their personality’. The second clause provides a broader prohibition on any decision ‘that has legal effect on an individual’ based solely on automated processing to define a profile or evaluate aspects of personality. This appears narrower than provisions on the right against ADM elsewhere, as it omits decisions with non-legal but similarly significant effects and limits the scope to certain (yet vague) profiling purposes. The second ‘additional’ right is the right to data portability, which entitles individuals to receive their personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted directly to another controller (e.g. GDPR, Art. 20; Ibero-American Standards, Art. 30). Overall, although consent and data subject rights (both ‘core’ and ‘additional’) are often framed as enabling informational self-determination, the existence of legal bases beyond consent and the in-built limitations on data subject rights – such as when the controller’s legitimate interests override – suggest that they more accurately support individual participation rather than full determination over personal data processing (Nolan, Reference Nolan2023: 125–131).

The third pillar – oversight – comprises two interrelated principles: accountability and supervision. First, the accountability principle requires data controllers to implement, and be able to demonstrate, measures ensuring compliance with their obligations. Data protection frameworks articulate these requirements in varying ways; accountability often implicates – and sometimes explicitly requires – data controllers to assess processing risks ex ante and adopt technical and organisational safeguards proportionate to the likelihood and severity of anticipated risks. Second, the supervision principle requires establishing independent bodies with effective powers, expertise, and resources to monitor and enforce data protection. These are often called ‘data protection authorities’ (DPAs).

Notably, this dissection of these core principles is not a neat one, as there is significant overlap, continuity, and complementarity therebetween. This means, importantly, that the three key pillars complement one another by allocating responsibilities to the main actors involved in ensuring compliance with data protection rules. For instance, data subject rights – many of which were introduced during the internationalisation of data protection principles – aim to empower individuals by enhancing their control over the processing of personal data. Bieker (Reference Bieker2022) argues that this pillar represents the ‘individual’ face of data protection, which is complemented by its ‘structural’ dimension, that is, the first pillar that imposes default and general obligations on data controllers. This divide is not absolute, however, because exercising individual rights can drive structural change by exposing non-compliant practices to litigation (as illustrated par excellence by high-profile cases brought by digital rights activists, such as the Schrems litigation: Ausloos and Dewitte, Reference Ausloos and Dewitte2018; Clifford in Bosua et al., Reference Bosua, Clifford, Qian and Richardson2025). Nonetheless, the structural impact of data subject rights depends on individuals’ ability, willingness, and resources to pursue them, often against powerful entities. For the same reasons highlighted by critiques of control-based accounts, the actual data subject does not always match the assumed profile. This is where the overlap between data protection principles becomes significant: this overlap means, for example, that data controllers should ensure accurate data processing even where data subjects do not or cannot exercise their rights to rectification. This means that data controller obligations protect ‘even when nobody is looking’ and even when no harm has materialised (Bieker, Reference Bieker2022: 59; Quelle, Reference 78Quelle2017). At the same time, data protection frameworks do not merely rely on the good faith of data controllers, and introduce a third actor: DPAs, responsible for overseeing processing systems. These DPAs may act upon requests and complaints from data subjects, but they also initiate investigations independently. Beyond protecting individuals, DPAs may perform a broader role by representing structural oversight of processing operations, with significant societal implications. The complementarity of these three pillars demonstrates that data protection frameworks go beyond granting individuals control over their information, requiring instead the establishment of a broader institutional infrastructure that safeguards systemic control over the flow of personal data (Basri, Reference Basri2026: 6). These safeguards show that data protection explicitly takes into account and provides built-in mechanisms to respond to power asymmetries in the technological context. As such, they are relatively less unsettled by these asymmetries than mainstream conceptualisations of (information) privacy (i.e. separation- and control-based accounts).Footnote ⁸ Indeed, the structural components of data protection frameworks closely mirror the safeguards envisaged by power-based critiques of information privacy, and this suggests that scholars who adopt such perspectives but criticise data protection law as being overly focused on individual control may fail to appreciate these frameworks in their entirety.

In light of the above breakdown of the core principles, it is important to reflect on the uncertainty surrounding the conceptual foundations of the right to data protection and, consequently, its relationship with those principles. Although the right to data protection is explicitly recognised only in certain frameworks, understanding its conceptual foundations remains relevant even for frameworks that do not expressly provide for such a right. The overarching issue is whether there is – or should be – such a right, which is closely tied to the question of whether data protection offers any ‘added value’ compared to other pre-existing rights and freedoms, such as the right to privacy (see further Sections 2.3 and 3.3).Footnote ⁹ In EU literature – where most discussions surrounding the right to data protection have occurred, owing to its explicit provision in the EU CFR – the right has been conceptualised in two main ways: first, as a system of fairness-based checks and balances, and second, as informational self-determination. Hijmans and Dalla Corte fall into the former camp, arguing that the right to data protection can be perceived as a ‘right to a rule’; ‘a legal structure aimed at allowing individuals to claim that their data should be fairly and lawfully processed’ (Dalla Corte, Reference Dalla Corte, Hallinan, Leenes, Gutwirth and De Hert2020; Hijmans, Reference Hijmans2016: 66). This framing effectively treats data protection as a procedural framework that gives effect to rights and freedoms, rather than as a substantive right in its own terms (as Dalla Corte explicitly notes: 41). Differently, scholars such as Ausloos argue that this framing conflates data protection as a framework (per the GDPR) with data protection as a right (per Art. 8 CFR) (Reference Ausloos2020). Ausloos argues that while the former represents a regulatory framework, the latter constitutes a substantive right per se, one that pursues the independent objective of informational self-determination. According to this view, the right to data protection is not only about providing individual control through active rights (as embodied in the data subject participation pillar) but also about establishing a broader architecture and environment that enables individuals to maintain control over the processing of their personal information.

The differences between the two perspectives, however, may not be as substantial in practice as they initially appear. Under the first conceptualisation (data protection as a right to fair checks and balances), the right comes to represent the entirety of principles included under data protection frameworks. Under the second conceptualisation (data protection as a right to informational self-determination), the incorporation of the architectural dimension means that the right also encompasses many core principles within data protection frameworks, extending beyond those included in the data subject participation pillar. To illustrate, data minimisation and data security principles can also be seen as ways to limit interferences with individual informational self-determination, such as by ensuring that only the information necessary for a specified purpose is processed and that it is not further disclosed to unauthorised parties. Although this second conceptualisation may appear more specific, hence narrower, than the first, it is not easy to separate the informational self-determination aspects of data protection frameworks from other rights-promoting elements within data protection frameworks; nor is it easy to disentangle these from the more market-oriented aspects of data protection, since many core principles pursue rights-based and economic goals jointly (see next subsection 2.3). These entanglements and overlaps across different principles mean that even under the second conceptualisation, uncertainty remains as to what, if anything, an understanding of the right as informational self-determination could exclude from the core principles of data protection. Accordingly, the ambiguities over the right’s conceptual foundations – and, by extension, over which principles it encompasses – mean that the boundaries of the right and its relationship to core principles under data protection frameworks are not clearly marked. Consequently, even scholars who explicitly discuss the right to data protection often turn to data protection frameworks themselves when comparing data protection with privacy.Footnote ¹⁰ Accordingly, the following subsection also refers to data protection principles when comparing data protection with privacy, while returning to the question of whether there is or should be a right to data protection when considering the added value such a right would bring to pre-existing rights and freedoms.

2.3 Revisiting the Conceptual Relationship between Privacy and Data Protection

Building on the multifaceted understandings of (information) privacy and data protection developed thus far, the relationship between the two can now be revisited in a more nuanced manner. This analysis considers the two possible ways in which the relationship between data protection frameworks and privacy can be articulated, as reflected in the scholarship: first, by viewing privacy and data protection in binary and contrasting terms; and second, by viewing data protection as pursuing a plurality of objectives, with privacy being one of the main objectives. Whereas the first view treats privacy and data protection as serving distinct and potentially opposing functions (albeit ones that may still complement each other), the second understands them as sharing similar components and functions, such that they overlap without being identical. The following discussion demonstrates that the second model – framing data protection and privacy as ‘heavily overlapping’ yet non-identical – is the most persuasive, while also showing that this framing does not fully resolve but shifts the ambiguity from the nature of their interaction to the extent of their overlap.

The first view, which considers privacy and data protection as distinct (yet possibly complementary), rests on a series of interconnected contrasts defining their relationship (‘the distinction model’). For instance, de Hert and Gutwirth argue that privacy and data protection are both necessary to limit State power but serve different functions: privacy provides an ‘opacity tool’ by ‘setting normative limits’ on the reach of the State’s power, whereas data protection offers a ‘transparency tool’ that ‘regulat[es] and channel[s] necessary/reasonable/legitimate power’ (De Hert and Gutwirth, Reference De Hert, Gutwirth, Claes, Duff and Gutwirth2016: 510; see also Tzanou, Reference Tzanou2013: 97). The authors’ focus on the State-as-controller is presumably due to the law enforcement context in which they were writing, but their account also conceptualises privacy and data protection more generally beyond this setting. This contrast between opacity and transparency leads to a series of related distinctions: privacy operates as a prohibition entailing negative obligations, whereas data protection functions – at least as ‘a general rule’ – as a legitimising framework imposing positive obligations (De Hert and Gutwirth, Reference De Hert, Gutwirth, Claes, Duff and Gutwirth2016: 520; see further on the legitimising versus prohibiting nature of data protection in the EU context in González Fuster and Gutwirth, Reference González Fuster and Gutwirth2013). These features characterising their nature also cascade into temporal qualities: Rodotà suggests, for instance, that privacy is ‘static’, aimed at preventing interferences at specific moments, while data protection is ‘dynamic’, setting out rules for data processing throughout its life cycle (Reference Rodotà, Gutwirth, Poullet, De Hert, de Terwangne and Nouwt2009: 79–80). Dalla Corte offers another contrast, arguing that privacy is a substantive right (exemplifying a ‘right[] that are created to protect and uphold interests considered important’) while data protection is a procedural right/framework (exemplifying a ‘right[] that appear at a later stage, setting the conditions through which substantive rights are implemented’) (Reference Dalla Corte, Hallinan, Leenes, Gutwirth and De Hert2020: 41; see also Tzanou, Reference Tzanou2013: 90).

Notably, these contrasts hold true only insofar as one selectively focuses on specific facets of privacy and data protection. A more nuanced understanding of both concepts helps to illustrate the fragility of these contrasts. For instance, a holistic view of the core data protection principles reveals that the distinction model overlooks – or at least oversimplifies – important aspects of data protection in order to sustain these contrasts. De Hert and Gutwirth themselves recognise these limitations, noting that although data protection operates primarily as a transparency tool, exceptions exist (Reference De Hert, Gutwirth, Claes, Duff and Gutwirth2016: 520). These exceptions are particularly evident in the sensitivity principle, which establishes either default prohibitions on processing sensitive personal data or imposes strict conditions on processing such data. Minimality can likewise be seen as a prohibitory rule, forbidding the collection and storage of personal data beyond that which is necessary to fulfil the specified purposes (Bygrave, Reference Bygrave2001: 280). While the contextual nature of these principles admittedly limits their prohibitory force – since their applicability, including determinations of what amount of personal data is ‘necessary’ for a given purpose, is made on a case-by-case basis, and data controllers, the duty-bearers, are themselves the primary actors making these decisions (see relatedly Clifford, Reference Clifford2024: 135–174) – the better view is that data protection remains both prohibitory and legitimising. Instead, these principles can be seen as a means of ensuring that processing occurs proportionally, mirroring the legal protection of the right to privacy, which is also not an absolute right and can be lawfully restricted to the extent necessary and proportionate (see further Section 3). The recognition that data protection principles also include prohibitory elements further means that data protection (also) entails obligations to refrain from certain conduct. Indeed, most data protection principles arguably have both negative and positive dimensions. To exemplify, data security not only requires that data be not disclosed to unauthorised parties (a negative obligation) but also mandates active steps to prevent access by such parties and ensure that adequate measures and architectures are implemented to preserve confidentiality and integrity (reflecting positive obligations to ‘protect’ and ‘fulfil’). The final contrast offered in the distinction model – the procedural versus substantive nature of privacy and data protection – is revisited below when discussing data protection’s added value.

Similarly, on the ‘privacy’ end, the distinction model relies on a narrow understanding of (information) privacy to construct and maintain the contrasts it proposes. Although proponents of this view do not always define privacy explicitly, their references to opacity suggest that they understand it in separation-based terms. This allows them to distinguish data protection frameworks as doing more than – or sometimes even the opposite of – simply restricting the sharing of private information. However, as discussed in Section 1, a nuanced understanding of privacy should not be limited to separation-based accounts but must also incorporate control-based accounts and, at least, some of the insights offered by power-based critiques. All three perspectives shed light on key features of privacy, and indeed, each is reflected in the different components of data protection frameworks. The overlap between separation-based accounts of privacy and data protection is evident in the sensitivity principle and other ‘prohibitory’ aspects of data protection. Control-based accounts of privacy are reflected in the data subject participation pillar in two ways. First, in the criteria for valid consent, which are designed to ensure that, where consent serves as a legal basis for processing, it represents the data subject’s genuine and informed control. Second, in the ‘micro-rights’, which provide data subjects with tools to exercise control throughout the processing life cycle (Lazaro and Métayer, Reference Lazaro and Métayer2015: 15–16). Notably, scholars such as Lynskey draw on these control-based elements to distinguish privacy from data protection, which can be read as reflecting a separation-based, rather than control-based, understanding of privacy. This becomes evident when Lynskey observes, for instance, that the strict conditions attached to consent under data protection ‘do not stem from traditional privacy concerns’ (emphasis added) but instead arise from a recognition that, in such settings, individuals ‘are not, de facto, in control of their personal data’ (Lynskey, Reference Lynskey2015b: 189–190). This suggests that the objective served by consent here is not ‘privacy’ but ‘individual control’ (see also Tzanou, Reference Tzanou2013: 89). Whilst consent would indeed not sit easily with separation-based accounts – since they would view any processing of personal data as an interference with, rather than an exercise of, information privacy – control-based accounts, which focus on data subjects’ subjective wishes, necessarily require that any consent for data processing be given voluntarily.

Lastly, recognising the limitations of individual control in power-asymmetric settings (Section 1.2), data protection frameworks are built on pillars that accommodate both ‘individual’ and ‘structural’ components. The resulting focus on broader systems of information processing resonates with key contributions of power-based critiques to information privacy conceptualisations. In particular, the structural dimension of data protection – inter alia through a set of ex ante obligations on data controllers – aligns with these critiques by ensuring that information processing should be regulated at broader levels, even in the absence of a demonstrable impact on an individual. At the same time, a fundamental difficulty in comparing and contrasting power-based critiques of privacy with data protection is that, as explained in Section 1.3, such critiques often extend beyond (information) privacy, making it difficult to determine where their observations on the right to privacy end and where other rights and interests begin. Sometimes, they directly talk about privacy and data protection in same terms, reflecting jurisdictional terminology preferences. Ultimately, the recognition of the broader conceptualisations of (information) privacy and the multidimensional nature of data protection demonstrates that the supposed contrasts between privacy and data protection are not only over-simplistic but also inaccurate, even as general framing tools.

This paves the way to assess the second framing of the relationship between data protection and privacy as overlapping yet non-identical. The latter aspect, that the two cannot be ‘identical’, is relatively straightforward to establish when one recalls that under examination here are data protection frameworks, which are instruments that expressly identify their objective as the protection of a range of rights and freedoms including but not limited to privacy, as well as certain economic objectives. This (rights-versus-market-based) duality manifests itself not only in the normative values data protection frameworks protect but also in the substance of their core principles. The ‘market-based’ end of this duality is most visible in how data protection principles legitimise and enable the free flow of information for grounds other than – and sometimes even against – data subjects’ subjective wishes. For instance, the lawfulness principle permits the processing of personal data without the data subject’s consent, including even where processing is not in their interests, provided that controllers can demonstrate a legitimate aim, such as pursuing economic interests through direct marketing which does not override data subjects’ fundamental rights and freedoms (e.g. GDPR, Art. 6(1)(f) and Recital 47). Likewise, data subjects’ exercise of their micro-rights may be restricted, inter alia, where controllers can invoke overriding legitimate interests, which may include their commercial objectives (e.g. GDPR, Art. 6(1)(d)). These examples demonstrate that an overarching principle of fairness underpins data protection frameworks as a fundamental premise, but fairness operates not solely to protect data subjects’ rights; it also functions pluralistically to safeguard other interests, such as data controllers’ economic interests (Clifford, Reference Clifford2024: 17; Bygrave, Reference Bygrave2002: 282).Footnote ¹¹

Yet the duality and simultaneity of the objectives pursued under data protection mean that it is not always easy to disentangle the rights-based and market-based elements of these frameworks, which may sometimes overlap. Even those elements that seemingly fall at the latter end (market-focused components of data protection) – and would therefore be relatively easier to separate from the right to privacy – are often interwoven with rights and interests that could also be captured under (broader conceptions of) privacy. A frequently discussed example in this context is the right to data portability, although, as noted, this right is not universally recognised across all data protection frameworks. The ambiguous nature of the right within the economic-versus-rights-based duality is illustrated by the different ways it has been understood in the literature: whilst Lynskey, for instance, suggests that data portability falls within data subject micro-rights, forming part of data protection’s overarching aim to ‘allow individuals to better determine how their data is processed, by whom, and for what purposes’ (Reference Lynskey2014: 591) (which provides an interpretation that may also bring data portability within control-based accounts of privacy), others such as Cormack (Reference Cormack2016) discuss data portability primarily as a remedy aimed at enabling consumers to switch service providers to enhance competition and foster innovation. In a way, the right does both, as it fosters competition within the market for higher privacy and data protection standards, between which the data subject, as a consumer, can choose (see below on what other safeguards data protection may add compared to privacy). Data accuracy depicts a similar duality (and ambiguity). On the one hand, this principle can support certain understandings of privacy by ensuring that only accurate and contextually relevant personal data is processed, thereby preventing the circulation of irrelevant information that could undermine personal control or lead to privacy intrusions. On the other hand, data accuracy also serves broader interests. As Bygrave notes, ‘it [also] breaks down into a multiplicity of interests … that have little direct connection to privacy-related values’ (Reference Bygrave2001: 281), such as enhancing efficient data processing by reducing operational risks and costs that might arise from inaccurate or outdated data. The simultaneity of different interests pursued under data protection frameworks thus makes it difficult to determine which of their multiple elements fall within, and which fall outside, the right to privacy.

These difficulties are further compounded by the fact that data protection frameworks pursue multiple (human) rights, whose boundaries with information privacy are also not always clear. One such right, frequently and explicitly pursued under data protection frameworks, is the right to protection from discrimination. This right manifests most clearly in the sensitivity principle, which the UN Guidelines explicitly label as the ‘non-discrimination principle’. The categories of information protected under this principle broadly mirror, but are not identical to, the prohibited grounds of discrimination, such as information concerning ethnicity, religion, or sexual identity. As some frameworks explicitly highlight, protecting sensitive data aims both to pre-empt and reduce the risks of discrimination while also safeguarding information in the most intimate realms of individuals, thereby overlapping with privacy interests emphasised in separation-based conceptualisations. Another component aimed at protecting against discrimination is the right against ADM. This right seeks to prevent the de-individualisation of persons by prohibiting significant decisions about individuals that are based not on their own characteristics or behaviour, but on attributes assigned to algorithmically profiled groups. This overlaps with, yet goes beyond, protection against discrimination. Individuals may be grouped based on characteristics not covered by discrimination law (such as age, ethnicity, or sex), but rather on specific behaviours, for example, the websites they visit. Moreover, these groups are generated through correlations of multiple, often opaque factors, undermining the requirement to establish a clear link between a protected ground and unjustified differential treatment as required under discrimination law. Crucially, the right against ADM also appears to extend beyond (information) privacy. Although the initial collection of data that feeds into ADM systems may raise privacy concerns, none of the conceptualisations of information privacy offer a satisfactory account of how the act of making and applying algorithmic decisions itself constitutes a privacy issue (Section 1.2). Likewise, while power-based critiques address ADM more explicitly by acknowledging the risks of biased and potentially discriminatory outcomes, they tend to treat these risks as consequences of privacy violations rather than as constitutive elements of privacy per se.

This brings us back to the difficult question posed at the beginning, which has no easy answers: is data protection merely a means to further a plurality of objectives protected by pre-existing rights, freedoms, and regimes, one of which is privacy, or does it have an ‘added value’ of its own? Such an added value would mark the area where neither privacy nor another protected right or interest could extend and justify, or call for a space to be carved for, a self-standing right to data protection. The analysis of the right against ADM is a good example, explored functionally here to illustrate that there might be an argument for such a space. At the same time, this example also demonstrates the difficulties in then delineating the boundaries between privacy, data protection, and other interests and rights also served by them, precisely because of the uncertain foundations of all these rights and protections. As mentioned above, scholars who argue that data protection has its own independent interest often point towards informational self-determination. Like Ausloos, Lynskey argues that the distinct addition of the right to data protection, alongside the right to privacy, is that the former grants individuals more rights over a broader range of information, thereby enabling informational self-determination. This allows individuals to better determine how their data is processed, by whom, and for what purposes. In turn, this facilitates, first, selective self-representation, whereby individuals can choose which facets of their identity they share with different audiences; and second, the structural mitigation of power asymmetries in the context of information processing (Reference Lynskey2014: 591). The descriptive aspect of this position is difficult to challenge; the above discussion makes clear that data protection can regulate forms and types of information processing that cannot be fully captured by privacy or by another right such as protection from discrimination. Yet the normative observation that informational self-determination distinguishes privacy and data protection (both as rights) may be better qualified and caveated, because privacy, too, can be conceptualised in terms of individual control and thus can serve much of the two aspects highlighted by Lynskey. Instead, it might be claimed that both privacy and data protection can serve informational self-determination, but data protection has an added value because it serves informational self-determination more comprehensively, both in terms of the categories of information it covers and the tools it provides to secure such control.Footnote ¹²

This supports the second model categorising the relationship between privacy and data protection as non-identical yet ‘heavily overlapping’ (see similar conclusion in Lynskey, Reference Lynskey2015: 90). Yet this model is the most persuasive since it shifts the ambiguity towards identifying the sphere of overlap. As this Element shows, this task becomes increasingly difficult the more one focuses on broader conceptualisations of information privacy and adopts a more multifaceted view of data protection. One may therefore need to turn to the law on the right to privacy to better understand the concrete differences that have emerged in practice between privacy and data protection, as Section 3 now does. But, as will be seen, the law is often driven, constrained, and muddled by these conceptual ambiguities, which are not merely abstract debates but have tangible implications – albeit often implicit – for how the law has developed and may continue to develop (see relatedly Clifford, Reference Clifford2024: 208).

3.1 Material Scope

A clear comparison of the material scopes of privacy and data protection is encumbered by the fact that human rights bodies do not always or clearly distinguish between when the right to privacy is engaged and when it is interfered with (Lynskey, Reference Lynskey2014: 583). Only the former reveals its material scope, whereas a finding that the right to privacy was not interfered with may mean either that the right was not engaged at all or that it was engaged but not interfered with. Despite this ambiguity, the jurisprudence still offers some sense of the scope of information privacy. It illustrates that the material scope of (information) privacy is more restricted than that of data protection, although the gap between the two has been narrowing as human rights bodies have become more willing, albeit only partially, to embrace broader conceptualisations of privacy (Lynskey, Reference Lynskey2014).

This evolution is best illustrated by the ECtHR’s case-law, which has long engaged with the informational dimension of privacy. Early cases delineated the material scope of the ‘private life’ through a public–private dichotomy, reflecting the traditionalist separation-based accounts. For instance, in Herbecq and the Association ‘Ligue des droits de l’homme’ v. Belgium (1998), the European Commission of Human Rights (which filtered and referred petitions to the ECtHR until its abolishment in 1998) found the complaint against unregulated police CCTV surveillance manifestly ill-founded, as the surveillance concerned ‘essentially public behaviour’ and did not render captured information ‘available to the general public’. This approach has not been maintained in later cases and, in any event, is also inconsistent with the jurisprudence being developed by the ECtHR during that period. Notably, the Court has come to firmly recognise – which it now reiterates as a general principle under Art. 8 – that ‘it would be too restrictive to limit the notion [of private life] to an “inner life” … and to exclude entirely the outside world not encompassed within that circle’ (Niemietz v. Germany, 1992, para. 28). It holds that respect for private life ‘must also comprise to a certain degree the right to establish and develop relationships with other human beings’ (Niemietz v. Germany, 1992, para. 29), recognising the relational aspect of privacy. This recognition has expanded the scope of information covered under privacy to include business-related information obtained in the workplace, since ‘it is, after all, in the course of their working lives that the majority of people have a significant, if not the greatest, opportunity of developing relationships with the outside world’ (Niemietz v. Germany, 1992). As Section 1.1 explains, separation-based accounts can also accommodate relational privacy by encompassing individuals’ social (private) lives. This decision illustrates this: the Court includes professional information within the scope of the right to private life because working lives (and information pertaining to/emanating from them) are an aspect of individuals’ interpersonal relationships with others. Simultaneously, the decision also echoes, to some extent, a control-based understanding of privacy, as it shifts the focus away from the nature or content of information towards the individual’s ability to manage their self-presentation across different contexts for the purposes of developing and maintaining various relationships, albeit provided that these pertain to close, personal relationships within one’s private sphere of life.

This control-based understanding of privacy is most clearly reflected in Von Hannover v. Germany (No. 1) (2004), which concerned the publication of Princess Caroline of Monaco’s photos in German magazines. The Court suggested that privacy includes ‘the individual’s right to control the use of [their] image[s]’ and exists ‘even in the sphere of the relations of individuals between themselves’ (paras. 57, 72). The nature of photos against which this right to control was articulated is significant: they depicted the Princess engaging in everyday activities such as horseback riding, shopping, skiing, leaving her house, playing tennis, or tripping over an obstacle at a beach club. Admittedly, some of these images could be regarded as ‘private’ insofar as they pertained to her personal, intimate life (Section 1.1) – for instance, images taken around her house (which could be considered private by ‘context’, as they were obtained in a climate of harassment by waiting near her most private space (home)) or images of her interacting with a friend (which could be considered as part of her private life regarding her personal relationships). Yet, this cannot be said for all the photos, such as those showing her shopping in a market or cycling, which separation-based accounts would struggle to classify as private, since they were intuitively private neither by content nor by context, being taken in publicly accessible spaces. While the Court acknowledged these were scenes from her daily life in public spaces, it nevertheless characterised them as ‘very personal or even intimate “information”’ (para. 59). This is a clear ‘mischaracterisation of the images’, which highlights a fundamental tension in the Court’s reasoning (Hughes, Reference Hughes2009: 161). Although the Court applies a broader, control-based understanding of privacy – focused on managing access to personal information about one’s public image – it implicitly remains attached to more traditional, separation-based accounts that associate privacy with intimate or secluded information. To be sure, and as explained in Section 1, separation- and control-based accounts are not necessarily incompatible, in the sense that the latter may regard control over information as exercisable only in relation to ‘private’ information. However, what is striking in this decision is the Court’s reluctance to openly articulate what it is in fact doing, namely, protecting essentially public information (i.e. to recall, information which is not private by nature and which is available from public domains).

Other jurisdictions also suggest that the scope of the right to private life extends beyond traditionally private information, though similar tensions underpin some of these approaches. One example is the IACtHR’s decision in Fontevecchia and D’Amico v. Argentina (2011), which concerned the publication in a newspaper of the existence of an illegitimate son of then-President Carlos Menem. Similar to the ‘right to control the use of [one’s] images’ articulated by the ECtHR in Von Hannover, the IACtHR suggested that privacy encompasses the ‘control of the dissemination of personal information to the public’ (para. 48). The IACtHR did not elaborate further on this statement, which at face value hints at a broader scope than ‘private’ information, akin to that of ‘personal data’ that defines the material scope of data protection frameworks (Section 2.2). Notwithstanding this, a closer look at the case’s facts suggests that the Court’s seemingly broad statement should be taken with caveats. In particular, the information at issue concerned reputationally damaging content. Therefore, despite the Court’s seemingly broader articulation of privacy as control over the dissemination of ‘personal information’, it was arguably referring to a narrower category of highly private information, namely humiliating content whose publication would expose it to very large audiences. The information at stake in this case also possibly suggests that, when discussing a right to control the dissemination of one’s information to the public in this context, the Court may have had in mind the protection of honour and dignity, which are explicitly protected under Art. 11 ACHR alongside the right of private life. This decision reveals a tension between the Court’s rhetoric and its application that is similar to that in Von Hannover, but in the opposite way: the IACtHR articulated a broader scope of privacy protection than it applied in this case. Most recently, CAJAR v. Colombia (2023) went much further by articulating a notion of control as informational self-determination exercisable vis-à-vis ‘personal data’, which the Court defined in the same terms as ‘personal data’ under the OAS Principles. However, it is difficult to use this case as a basis for comparing the material scope of privacy and data protection, as the Court grounded informational self-determination jointly on various rights, as discussed further below.

In other cases where human rights jurisprudence has explicitly deconstructed the private/public distinction, it has nevertheless required additional factors – such as the extensiveness of processing operations – to bring public information within the scope of the right to privacy. In cases such as Rotaru v. Romania (2000) and PG and JH v. UK (2001), the ECtHR affirmed that public information (specifically referring to information publicly available, i.e., obtainable from public spaces) falls within the scope of the right to private life, ‘even where the information has not been gathered by any intrusive or covert method’ provided that it is ‘systematically [or permanently] collected and stored in the files held by the authorities’ (paras. 59 Peck v. UK (2003), 43 (Rotaru), and 57 (PG)). Other human rights bodies have not made explicit determinations vis-à-vis public information. However, at the UN level, the HRC’s concluding observations and reports by the UN High Commissioner for Human Rights (OHCHR) seem to confirm that ‘public’ information can fall within the scope of the right to privacy only where processed systematically – a criterion which they express either explicitly or implicitly (by virtue of references to and problematisations of the scale of surveillance practices: see, e.g., HRC, 2016, para. 32; OHCHR, 2022, para. 43). The notion of ‘systematicness’ is undefined, but presumably it refers to data being processed either on a large scale or in methodical/structured ways (i.e. as part of a system). This expansion of privacy protections to cover publicly available information that is processed systematically suggests that human rights bodies are becoming less concerned with the content of the information itself and more with the aggregation of seemingly trivial data, which can be used to develop detailed profiles of individuals, echoing power-based perspectives on privacy. Nevertheless, the focus on the nature of the information is not entirely lost: the added criterion of systematicness imposes a higher threshold for public information to fall within the scope of privacy, in contrast to the material scope of data protection, which applies to any processing of personal data regardless of its scale. This approach can be regrettably restrictive because it may result in the exclusion from privacy’s scope of public information that is not systematically or permanently processed by the State Party at the time of the Court’s assessment, even if that same data is later shared or combined with other datasets to generate detailed insights about individuals, including by other actors. This restrictive focus under IHRL – both in actoral and temporal terms – suggests that it does not fully capture the broader infrastructures of information processing and the role of multiple actors in generating privacy breaches. This contrasts with the data protection approach, where personal data is defined through the concept of identifiability, which includes a relational element: information that may not identify an individual on its own but could do so when combined with other information held by different actors. This recognises and accounts for the presence and capacities of various actors in determining the material scope of data protection.Footnote ¹⁸

The foregoing analysis demonstrates that the material scopes of (information) privacy and data protection are distinguished by the additional contextual considerations that limit the former, though not always consistently (as in Von Hannover, where all photos were deemed intimate despite depicting scenes from public life) or desirably so (as in Rotaru, where the treatment of ‘public’ information may be overly restrictive). Two apparent anomalies in the jurisprudence, challenging this general position, require addressing. The first is the ECtHR’s frequent claim that its broad interpretation of (information) privacy aligns with the definition of ‘personal data’ under Convention 108. Yet this claim is largely rhetorical. As discussed, the Court’s jurisprudence shows a consistent reliance on additional contextual factors when recognising privacy interests in non-private information – specifically, a link to an individual’s private life, including close personal relationships (as in Niemietz), or systematic processing (as in the Rotaru line of cases).

A more curious anomaly appears in the recent IACtHR decision in CAJAR, which concerned, inter alia, the surveillance and harassment of members of a human rights organisation (CAJAR) since the 1990s. In this judgment, the Court, when discussing information obtained from individuals, referred to a wide range of data, including public information, namely, information which is not inherently private and which has been/could be obtained from publicly accessible sources, such as the applicants’ professional information. Yet, the Court made no distinction between the different categories of data at stake (see, e.g., para. 516), nor did it discuss whether this information – or which of it – falls within the scope of the right to private life. Later, the Court merely considered that the State’s intelligence activities, including the acquisition and use of information ‘including personal data’, fell within (and constituted a breach of) individuals’ rights, particularly the right to private life (e.g. paras. 520, 625). When addressing protections for information collected in the intelligence context, the Court referred more broadly to ‘personal data’, later clarifying that the term was understood in line with the OAS Principles (para. 572). More fundamentally, the Court declared the existence of an ‘autonomous right’ to informational self-determination under the ACHR, stating that ‘the person is also free to exercise when and how much to reveal matters of their personal lives, which includes what type of information, including personal data, may be known by others’ (para. 570). At face value, this suggests a complete alignment between the material scopes of privacy and data protection at the Inter-American level. However, the lack of elaboration leaves it uncertain whether this alignment reflects careful deliberation or merely a terminological/conceptual conflation. In any case, the alignment is complicated by the Court’s joint analysis of privacy violations alongside other rights, such as freedom of expression. Indeed, the Court explicitly states that the right to informational self-determination – defined very broadly – manifests not only in the right to privacy (Art. 11 ACHR) but also in the rights to freedom of expression and judicial protection (Arts. 13 and 25) (para. 586). This makes it unclear which types of personal data fall within the scope of the right to private life and which are protected under other rights. This creates legal uncertainty about how future cases may be adjudicated if applicants rely solely on the right to private life, for example, because they cannot demonstrate downstream impacts on other rights.

Ultimately, the material scope of the right to privacy has been expanding under human rights jurisprudence. This expansion has occurred as IHRL bodies have become more willing to move beyond traditional and narrow conceptualisations of privacy (as captured in separation-based accounts; see Section 1.1). Increasingly, their decisions reflect a broader understanding of privacy, sometimes implicitly or explicitly echoing elements of control- and power-based perspectives on (information) privacy. This broadening has been made possible because IHRL bodies do not set out or endorse a single conceptualisation of privacy, but instead apply the right in a piecemeal manner in specific cases. However, this has also produced inconsistencies and a lack of clarity in the courts’ reasoning. For instance, courts may overstate the ‘privateness’ of the information in question when they are in fact recognising an individual’s right to control a broader range of information (e.g. the ECtHR in Von Hannover) or do the opposite, as in the IACtHR’s Fontevecchia. They may also appear to move beyond a strict public–private dichotomy while still conditioning protection on whether the information is characterised as public or private (e.g. the ECtHR’s Rotaru and similar approaches at the UN level). In these approaches, IHRL bodies seem to circle back to traditional conceptualisations of privacy even as they signal a greater willingness to broaden its scope. This is partly understandable, as IHRL bodies must demonstrate that the information in question is linked to individuals’ ‘private life’ in accordance with the explicit wording of some IHRL treaties. However, it also overlooks the role of broader infrastructures in intruding on individuals’ privacy interests. For the purposes of this section, this signifies a narrower material scope of (information) privacy compared with data protection. The latter covers any processing of personal data, regardless of the nature or context of the information involved.

3.2 Substantive Protections

Once the right to privacy is engaged (that is, where relevant information falls within its material scope), there is significant convergence between the protections offered under privacy and data protection frameworks. This convergence largely stems, again, from the broader conceptualisations of privacy that courts and treaty bodies often apply, even implicitly. Many of the overlaps between the two regimes arise organically within privacy jurisprudence, reflecting the fact that data protection principles are, in large part, an expression or adaptation of existing human rights thinking to a technologically driven world. Under human rights law, once the right to privacy has been engaged in a particular case, the assessment of whether that right has been violated is undertaken in two stages: first, determining whether the right has been interfered with (the interference stage); and second, assessing whether that interference can be justified (the justification stage). The justification stage comprises three prongs: namely, whether interference is (i) provided by law, (ii) pursues a legitimate aim, and (iii) is proportionate. Many core data protection principles map onto each of these stages of human rights reasoning, though not always symmetrically or uniformly. The following analysis considers principles falling under the three main pillars of data protection frameworks – data subject participation, data controller obligations, and oversight – to examine the convergences and differences between the protections under data protection and those under privacy. It then offers final reflections on the relationship between (information) privacy and data protection in Section 3.3.

3.3 Final Reflections

This section shows human rights bodies have interpreted the right to privacy – including, but also moving beyond, separation-based accounts to encompass control- and power-based approaches – has been instrumental in facilitating a significant degree of convergence with data protection principles. By incorporating relational, structural, and power-based dimensions into their interpretation of privacy, human rights bodies have reflected many core data protection principles in their jurisprudence on the right to privacy. Despite this, the overlap between privacy and data protection remains incomplete. Even as human rights bodies adopt bolder approaches – motivated by the protective goal of ensuring that human rights remain relevant to new digital technologies, for which the right to privacy often serves as the primary safeguard – there are limits to the extent to which these bodies have incorporated, or could justifiably incorporate, data protection elements into privacy jurisprudence. At the same time, conceptual uncertainties surrounding privacy and data protection, and consequently their relationship, mean that these limits can often be identified only at a broad level and are difficult to implement with precision.

This has been a central challenge for human rights bodies, which have had to apply the right to privacy – despite its surrounding conceptual uncertainties – to the facts of specific cases. As a result, they have rendered decisions on the right to privacy in ways that are not always coherent or consistent. This is evident in the jurisprudence interpreting the material scope of the right to privacy. Courts have sought to broaden traditionally restrictive understandings of information privacy (as reflected in separation-based accounts), while simultaneously acknowledging that there are limits to what privacy can cover, without always clearly defining those limits. This is particularly apparent in IHRL bodies’ treatment of ‘public information’, which is now recognised as falling within the scope of privacy but only when processed in ‘systematic’ ways, introducing an undefined criterion (which likely denotes some degree of extensiveness in processing). The IHRL approach to limiting the scope of privacy is understandable, given that such bodies can only consider claims relating to individuals’ ‘private life’. However, the private–public dichotomy it preserves can be overly restrictive. As explained, it may fail to extend protection to public information that is not systematically processed by the State at the time of the Court’s assessment, but which may later be combined with other data – including by different actors – to generate more sensitive insights about individuals.

Similarly, with respect to substantive protections, IHRL jurisprudence indicates that the right to privacy struggles to encompass all principles found in data protection. At times, human rights bodies have simply refrained from incorporating certain principles – for instance, data accuracy, which has only been partially and indirectly recognised in privacy case-law. At other times, however, they have moved towards including additional principles, such as accountability obligations. Yet, such expansions risk drawing courts into the broader and more uncertain domain of information regulation, which risks further oscillations and inconsistencies in future privacy case-law, as partly arguably observed vis-à-vis material scope jurisprudence. Ultimately, conceptual ambiguities have, in some respects, had a positive effect by enabling courts to extend the scope of privacy to incorporate additional data protection principles. This has been particularly valuable in cases where applicants would otherwise be unable to challenge the use or application of certain technologies under data protection frameworks – either because no binding treaty or national law exists or because such laws are inapplicable (for instance, due to national security exemptions). However, the by-product of this jurisprudence has been a catch-22 situation, further deepening the conceptual uncertainties surrounding the relationship between privacy and data protection.

All of this serves to buttress the overarching argument of this Element: that privacy and data protection overlap substantially, with the overlap becoming more extensive the broader privacy is understood, but that precisely delineating the contours of this overlap is extremely challenging, if not impossible. Nevertheless, it seems possible to suggest, based on the foregoing analysis, that data protection has an ‘added value’ in offering broader protections over a wider range of information compared with the right to privacy (see similarly Lynskey, Reference Lynskey2014), even if the boundaries between privacy and data protection cannot be clearly delineated. There might even be an argument that a separate right to data protection is justified – or, where such a right does not exist, that it should be recognised in human rights treaties – because data protection safeguards rights that are not fully covered by pre-existing rights and freedoms. The recognition of a separate right could enable human rights bodies to interpret the right to privacy in more thoughtful ways, without the pressure of forcing important protections into the right to privacy as the ‘next best’ alternative available to them. That this right would inevitably overlap with other rights or freedoms is neither problematic nor novel; such overlaps are inherent in most human rights, and indeed applicants often invoke multiple rights jointly to demonstrate that an act or omission has breached their rights. What matters more is that a right to data protection would introduce protections that existing rights cannot fully encompass. That said, the introduction of such a right inevitably raises the question of which components of data protection frameworks can and should be incorporated into a human right to data protection. This Element does not seek to resolve that question but rather to highlight the need for greater clarity in the relationship between privacy and data protection – whether or not through recognising a separate right to data protection – while acknowledging the difficulties inherent in doing so.