Co-creating data protection solutions through a commons

Abstract

In our data-driven society, personal data affecting individuals as data subjects is increasingly being collected and processed by sizeable, international companies. While data protection laws and privacy technologies attempt to limit the impact of data breaches and privacy scandals, they rely on individuals having a detailed understanding of the available recourse, resulting in the responsibilisation of data protection. Existing data stewardship frameworks incorporate data protection considerations and employ data-protection-by-design principles but may not include data subjects in the process itself, relying on supplementary legal doctrines to strengthen data protection enforcement. Current data protection solutions also lack support for protecting individual autonomy over personal data through co-creation and participation, particularly where there is socio-technical and communal value to collaborative data from which data subjects may not currently benefit. These challenges motivate the application of a theoretical and practical framework that can encourage co-creation of data protection solutions, increase awareness of different stakeholder interests, and rebalance power between data subjects and data controllers. In this thesis, we propose adapting the commons framework to create a data protection-focused data commons. We conduct interviews with commons experts to identify the institutional barriers to creating a commons and challenges of incorporating data protection principles into a commons. We propose requirements for establishing a data protection-focused data commons by applying our interview findings and data protection principles. We then deploy the data protection-focused data commons using an online learning use case. We conduct a study to explore the usefulness of the commons for supporting students' agency and co-creating data protection solutions in response to tutorial recordings, their consent preferences, and attitudes towards privacy and online learning. We find that a data protection-focused data commons as a socio-technical framework can support the collaboration and co-creation of data protection solutions for the benefit of data subjects.