Data protection and privacy are not the same

These are distinct rights that should be treated as such

Data protection and privacy are often used interchangeably, but they mean different things.

Privacy is mostly concerned with the 'right to be left alone.' It is about preserving autonomy by concealing information you consider secret, intimate and confidential.

In other words, privacy is a shield or a gate. It functions as a way to determine what information about you can be accessed by others.

Data protection, on the other hand, has a different purpose. This is about imposing a set of safeguards on those using information about others to ensure fairness and the respect of their fundamental rights.

Privacy regulates who gets access to your data. Data protection regulates how that data can be used once accessed.

But data protection does not only help ensure privacy. It is a much more expansive legal tool that ensures a variety of individual rights.

For example, the GDPR protects people from being subject to decisions based solely on automated processing producing significant affects on them, with some exceptions.¹ Even where those exceptions apply, individuals have the right to obtain meaningful information about the logic involved in the automated processing and to contest such a decision.²

These rights become highly relevant when, for instance, a company algorithmically manages the shift of its gig economy workers. Such workers have the right to know exactly how this automated processing works, especially when it determines their job opportunities.³

This is not really about privacy, since the employer would need to know the availability of its workers to assign shifts for the delivery of its service. But how this is done is important, for this still ought to be done in a manner that does not lead to unfair outcomes.

Data protection is therefore useful for safeguarding a number of rights, freedoms and interests beyond that of privacy. This includes transparency, accountability, due process, data security, data quality, non-discrimination, proportionality and dignity.⁴

So if you think that data protection and privacy mean the same thing, you are probably thinking too narrowly.

1. General Data Protection Regulation, Article 22.1.

2. General Data Protection Regulation, Article 13.2(f) and 22.3.

3. Italian DPA decision regarding Deliveroo (2021).

4. Maria Tzanou, The Fundamental Right to Data Protection: Normative Value in the Context of Counter-Terrorism Surveillance (Hart Publishing 2019), 24-31.