Public interest approach to data protection law: the meaning, value and utility of the public interest for research uses of data

Abstract

Due to legal uncertainty surrounding the application of key provisions of European and UK data protection law, the public interest in protecting individuals’ informational privacy is routinely neglected, as are the public interests in certain uses of data. Consent or anonymisation are often treated as the paradigmatic example of compliance with data protection law, even though both are unable to attend to the full range of rights and interests at stake in data processing. Currently, where data processing may serve a realisable public interest, and consent or anonymisation are impracticable (if not impossible to obtain) the public interest conditions to processing are the rational alternative justifications for processing. However, the public interest conditions are poorly defined in the legislation, and misunderstood and neglected in practice. This thesis offers a much-needed alternative to the predominant consent-or-anonymise paradigm by providing a new understanding of the public interest concept in data protection law and to suggest a new approach to deploying the concept in a way that is consistent with the protective and facilitative aims of the legislation.

Through undertaking legislative analysis new insight is provided on the purpose of the public interest conditions in data protection law, revealing critical gaps in understanding. By engaging with public interest theory and discovering the conceptual contours of the public interest, these gaps are addressed. Combined with the insight obtained from the legislative history, we can determine the reasonable range of circumstances and types of processing where it may be justifiable to use personal data based on the public interest. On this basis, and to develop a new approach for deploying the concept, other legal uses of the public interest are examined. The lessons learned suggest legislative and procedural elements that are critical to successful deployment of the public interest concept in data protection. The thesis concludes with the identification of key components to allow a clearer understanding of the public interest in this field. Further, these insights enable recommendations to be made, to reform the law, procedure and guidance. In doing so, the concept of the public interest can be confidently deployed in line with the aims of data protection law, to both protect and facilitate the use of personal data.