Cate, Fred H

Kuner, Christopher

Millard, Christopher

Svantesson, Dan Jerker B.

English

Indiana University Bloomington Maurer School of Law

Maurer School of Law: Indiana UniversityDigital Repository @ Maurer LawArticles by Maurer Faculty Faculty Scholarship2011Let's Not Kill All the Privacy Laws (and Lawyers)Fred H. CateIndiana University Maurer School of Law, fcate@indiana.eduChristopher KunerBrussels Privacy HubChristopher MillardCloud Legal ProjectDan Jerker B. SvantessonBond UniversityFollow this and additional works at: http://www.repository.law.indiana.edu/facpubPart of the Information Security Commons, International Law Commons, and the Privacy LawCommonsThis Editorial is brought to you for free and open access by the FacultyScholarship at Digital Repository @ Maurer Law. It has been accepted forinclusion in Articles by Maurer Faculty by an authorized administrator ofDigital Repository @ Maurer Law. For more information, please contactwattn@indiana.edu.Recommended CitationCate, Fred H.; Kuner, Christopher; Millard, Christopher; and Svantesson, Dan Jerker B., "Let's Not Kill All the Privacy Laws (andLawyers)" (2011). Articles by Maurer Faculty. 2610.http://www.repository.law.indiana.edu/facpub/2610EditorialLet’s not kill all the privacy laws (and lawyers)Christopher Kuner,*, Fred H. Cate,**, Christopher Millard,**,and Dan Jerker B. Svantesson***One of the most famous quotes from Shakespeare is‘The first thing we do, let’s kill all the lawyers’.1 Judgingby comments one reads and hears, this sentiment isshared by many who are frustrated with the limitationsof data protection and privacy law. It is often statedthat lawyers have made privacy law and regulation toobureaucratic, and that they are responsible for much ofthe unintelligible verbiage (such as dense privacy pol-icies) that annoy and confuse individuals. The law alsostands accused of constantly falling behind technologi-cal developments; of using terminology that is overlybureaucratic and formalistic (a favourite example is theuse of the term ‘data subject’, rather than the moreunderstandable ‘individual’, in Article 2 of the EU DataProtection Directive 95/46); and of providing ineffec-tive protection for privacy as compared to technologi-cal solutions.2To many of these accusations, the lawyer must plead‘guilty as charged’. Lawyers drafting privacy and dataprotection legislation often use language that is verboseand obscure, and pay more attention to legal nicetiesthan to how the rules will impact the way that data areactually processed in practice. The inability of manylawyers to communicate with and understand compu-ter scientists, who have developed the technologies thatprocess personal data online, has become almostlegendary. Thus, lawyers have a lot to answer forregarding the current deficiencies of legal rules govern-ing data protection and privacy.However, it is important to recall the benefits ofdata protection and privacy law. To begin with, the lawprovides a mechanism by which individual rights andexpectations are protected in a normative way. The lawis also enforceable by the state (as well as beingenforceable against it), and thus has a protective forcethat goes beyond that provided by, for example, soft-ware tools or company privacy policies and redressmechanisms, the workings of which are often murkyand subject to unilateral change. Perhaps most impor-tantly, individuals increasingly expect the law to protectthem against the misuse of their personal data, makingprivacy and data protection law indispensible for thedevelopment of confidence in data processing and thegrowth of the Internet.As the agents that draft data protection and privacylegislation and advise on its application in practice,lawyers have a crucial role to play in ensuring that thepromise of the law is effectively realized. While thelaw alone cannot protect privacy, technical solutionsand self-regulatory mechanisms also cannot do sowithout a legal framework backing them up. Inaddition it should be remembered that much of theunclear verbiage that plagues data protection andprivacy law is not only the work of lawyers, but isintroduced by non-lawyers at various stages (forexample, when preparing unclear and sometimes con-tradictory translations of legislation and other keymaterials; and when designing and implementingcomplex and confusing products, business processes,and technical environments).In fact, many of the charges brought against dataprotection and privacy law are manifestations of moregeneral tensions between the law and various socialfactors, such as the rapid pace of technological develop-ment, the globalization of the economy, and the con-stant development of new products and services onlinethat require the processing of personal data. In manycases, frustration with privacy law reflects the fact thatlegal structures have difficulty keeping up with therapid pace of technological and legal change. Butthis difficulty is not in itself a sufficient reason fordownplaying the role of the law in regulating how per-sonal data may be processed. Of course, this does notmean that lawyers should not do much more toproduce drafting that is intelligible to the averagecitizen, to make a greater attempt to communicate* Editor-in-Chief** Editor*** Managing Editor1 William Shakespeare, Henry VI, Part 2, Act IV, Scene ii.2 See, e.g., Patrick Wintour, ‘Facebook founder Zuckerberg tells G8summit: don’t regulate the web’ The Guardian (26 May 2011), ,http://www.guardian.co.uk/technology/2011/may/26/facebook-google-internet-regulation-g8..International Data Privacy Law, 2011, Vol. 1, No. 4 EDITORIAL 209# The Author 2011. Published by Oxford University Press. All rights reserved. For Permissions, please email: journals.permissions@oup.combetter with technologists, and to take into consider-ation the real-world implications of the legal rules theycreate. But lawyers and the law are often a convenientscapegoat for problems that are much more complexthan they seem on the surface.Those whose frustration with the limitations of dataprotection and privacy law leads them to repeat theShakespearean quote about killing the lawyers shouldremember that it was uttered by a character (Dick thebutcher) who wanted to create anarchy and do awaywith the rule of law. And they should also remember aquote from the play A Man for All Seasons, in whichthe character of Sir Thomas More responds as followsto a character who states that ‘I’d cut down every treein England to get to the devil’:When the last law was down and the devil turned on youwhere would you hide, all the laws being flat? This countryis planted thick with laws from coast to coast, man’s lawsnot God’s, and if you cut them down do you really thinkthat you could stand upright in the winds that would blowthen? Yes, I’d give the devil the benefit of the law, for myown safety’s sake.3By all means make data protection and privacy lawmore intelligible and transparent, and have lawyers doa better job explaining and implementing it. And thelaw will only be effective if supplemented by privacy-enhancing technologies, trustmarks, self-regulatorymechanisms, and other non-legal tools. But the lawmust play a fundamental and irreplaceable role in pro-tecting personal data, for all of our sakes.doi:10.1093/idpl/ipr016Advance Access Publication 8 September 20113 Robert Bolt, A Man for All Seasons, Act I.International Data Privacy Law, 2011, Vol. 1, No. 4210 EDITORIAL

Let\u27s Not Kill All the Privacy Laws (and Lawyers)

bepress Legal Repository

https://www.repository.law.indiana.edu/cgi/viewcontent.cgi?article=3613&amp;context=facpub

Let\u27s Not Kill All the Privacy Laws (and Lawyers)

Abstract

Similar works

Full text

Available Versions

Indiana University Bloomington Maurer School of Law

bepress Legal Repository