Scholars have started to critically examine in how far EU data protection law indeed grants or is able to grant data subjects effective control over the processing of personal data concerning them. Data subject control, however, is not really defined in substance. In addition, there is the question whether the knowledge produced with the help of profiling and predictive technologies may be effectively controlled by either the data controller or the data subject. The GDPR contains provisions which could be interpreted to enable data subjects to engage in an adversarial relationship with the data controller, giving them more negotiation power, which could lead to effectively influencing the data processing and thus some version of control. These opportunities can be found, inter alia, in the provisions on data subject rights and to a lesser extent in the provisions on stakeholder involvement when carrying out a Data Protection Impact Assessment (DPIA). The discussed adversarial relationship opportunities may be found also in the LED, to a certain extent, except as concerns the DPIA.
Keywords: Adversarial Relationship | Control | DPIA | Data Subject Rights | Influence | Negotiation Power
Diana Dimitrova is a post-doctoral researcher in the Intellectual Properties Rights Department at FIZ Karlsruhe– Leibniz Institute for Information Infrastructures. She is also an affiliated researcher at the LSTS/VUB. She researches and publishes on a wide variety of data protection topics, especially on the rights of data subjects and on data protection topics in the migration and law enforcement context. The author wishes to thank Dr. Dara Hallinan and the anonymous reviewers for their precious comments to an earlier version of this article. The author acknowledges that the idea behind the article is based on the author’s PhD Dissertation ‘Data Subject Rights: The Rights of Access and Rectification in the Area of Freedom, Security and Justice’ (VUB, 2021). For Correspondence: <Diana.Dimitrova@fiz-Karlsruhe.de>.
