When Data Governance Undermines Privacy

by Maya Recanati, Program Assistant, International Forum for Democratic Studies

In today’s information-driven economy, laws that govern the collection and handling of data can be critical safeguards for digital privacy. However, in recent years, authoritarian, hybrid, and democratic states alike have used these kinds of regulations to control information flows and even legitimize intrusive data collection. The weaponization of these regulatory regimes by governments for anti-democratic purposes undermines the rights and principles, such as privacy, that they purportedly protect. To ensure that data governance laws reflect democratic values, a consultative role for civil society is critical. Collaboration across different civil society sectors can help to make policymakers more aware of the diverse ways in which data governance regulation can impact human rights, the rule of law, and other crucial democratic principles.

In January, the Forum asked five leading experts to consider the significance of digital privacy in this rapidly changing, information-driven economy. As one contributor explained, privacy is a gateway right, essential to protecting human rights such as freedom of expression and nondiscrimination. There are ample illustrations available of the human rights risks that can arise where data privacy protections are weak or absent. For example, government officials in the Middle East harassed and prosecuted LGBT people based on information gathered from their social media profiles. More broadly, unrestrained data collection by governments may facilitate mass surveillance that leads to self-censorship and even crushes freedom of thought.

Democratic as well as autocratic states have increasingly relied on carveouts in data protection laws to codify officials’ right to collect information on citizens, with little independent oversight. Data protection laws with wide exemptions can subdue citizen concerns about digital privacy and provide governments with a veneer of legitimacy as they institutionalize state surveillance.

In India, the recently passed Digital Personal Data Protection Bill permits the government to exempt its own agencies from any provision of the bill to protect the vaguely defined “security of the state.” The law also establishes a data protection board appointed by the ruling party, which calls into question its ability to act as an independent body. China’s authoritarian rulers introduced a Personal Information Protection Law (2021) that allows government agencies to collect data without notifying or obtaining consent from individuals when (again, vaguely) “acting in the public interest.” While these laws introduce meaningful checks on private sector data collection, open-ended government exemptions threaten the right to privacy and undermine democratic norms.

Another risk stems from data localization laws, which countries such as Vietnam have passed in the name of protecting sensitive user data from being mishandled when transferred abroad. In contexts where rule of law is weak, however, these laws present a serious threat: They allow states to mandate that social media companies store users’ data in-country and provide information to the government upon request. These regulatory regimes—present across a growing number of authoritarian and democratic states alike—can essentially legalize government surveillance and create a chilling effect for civic actors and the public.

While data governance laws can be effective mechanisms to constrain government and corporate surveillance, they should be rooted in international human rights principles that protect the right to privacy, as well as other critical democratic values such as rule of law and government transparency. Civil society organizations, which are uniquely positioned to understand the nuances of local political contexts, can inform the drafting of these through meaningful consultations. Digital rights groups can also partner with traditional human rights organizations to amplify advocacy efforts, as Eduardo Ferreyra explains in a blog post for the Forum, and deepen understanding of the different concerns at stake in digital privacy conversations. Lastly, democracy advocates should embrace and diligently leverage transparency mechanisms like freedom of information laws that hold governments accountable for abuses of digital privacy.