The European Union general data protection regulation: what it is and what it means*

By C. Hoofnagle, B. Sloot, F. Z. Borgesius. Information & communications technology law, 2019

621 citations recorded by the source corpus.

ABSTRACT This paper introduces the strategic approach to regulating personal data and the normative foundations of the European Union’s General Data Protection Regulation (‘GDPR’). We explain the genesis of the GDPR, which is best understood as an extension and refinement of existing requirements imposed by the 1995 Data Protection Directive; describe the GDPR’s approach and provisions; and make predictions about the GDPR’s implications. We also highlight where the GDPR takes a different approach than U.S. privacy law. The GDPR is the most consequential regulatory development in information policy in a generation. The GDPR brings personal data into a detailed regulatory regime, that will influence personal data usage worldwide. Understood properly, the GDPR encourages firms to develop information governance frameworks, to in-house data use, and to keep humans in the loop in decision making. Companies with direct relationships with consumers have strategic advantages under the GDPR, compared to third party advertising firms on the internet. To reach these objectives, the GDPR uses big sticks, structural elements that make proving violations easier, but only a few carrots. The GDPR will complicate and restrain some information-intensive business models. But the GDPR will also enable approaches previously impossible under less-protective approaches.

Subfields: Law, Political Science and International Relations, Sociology and Political Science

View Paper: https://www.semanticscholar.org/paper/9e019730d5723069a8e0f46dc09ae3b2f69e9fcc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

1. Sijia Liu
2. Yihua Zhang
3. Jiancheng Liu
4. Eric Wong
5. Dennis Wei
6. Chongyu Fan

Citations in the corpus

• Rethinking machine unlearning for large language models (2024, neutral): “The study of MU can be traced back to non-LLMs in response to data protection regulations such as ‘the right to be forgotten’ Cao & Yang (2015); Hoofnagle et al. (2019); Bourtoule et al. (2021); Nguyen et al. (2022).”
• Beyond the individual: governing AI's societal harm (2021, neutral): “…but sets out a number of mechanisms for public oversight (for instance by virtue of the role assigned to national data protection authorities) and for accountability (for instance by virtue of transparency obligations upon personal data controllers and processors) (Hoofnagle et al., 2019).”
• SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation (2023, background): “It emerged in response to data protection regulations like ‘the right to be forgotten’ (Hoofnagle et al., 2019).”