I. Introduction

The fifth anniversary of the GDPR1 coincides with data protection law in the European Union being deemed to be at its peak and having its best moment.2 During these five years, there have been rapid societal changes and technological advancements in artificial intelligence, large language models, big data and other data-based technologies. The five-year mark together with the social and technological developments provides an opportunity for reflection on the future of data protection law in the EU. ‘Which fundamental concepts should be revised; what can and should data protection law aim for in ten years and which regulatory approach should be adopted?’ To cater for social changes and address challenges posed by technological changes this article submits that the fundamental concept of personal data which is the subject of data protection has to be revised to cater for collectives. Collectives in this instance refers to both organised and non-organised entities and groups.

Data protection law should aim to accommodate a collective dimension to achieve a holistic realisation of the right to data protection. To achieve a truly collective dimension to data protection, it is recommended that EU data protection law looks outward and undergoes a ‘reverse Brussels effect’3, where the EU learns from countries that have collective cultures that privilege communities and groups. Through the reverse Brussels effect, the EU will be able to identify a collective cultural value that can inform a theoretical framework that recognises collective rights for groups which can be transposed into the current system without a drastic change to EU law. For this article, ubuntu4 is selected as an example of a collective cultural value that the EU can learn from to develop a collective dimension to data protection law. An Ubuntu framework is proposed that contains principles which can be integrated into the GDPR as an example of how collective data protection could look in the EU when influenced by ubuntu.

This article proceeds as follows, Section II traces and outlines the development of data protection for collectives from the first data protection laws to the contemporary state. It also outlines the limitations of collective data protection in the current state. Section III explores the interests of collectives in data protection that have been overlooked and highlights the importance of extending protection to collectives. Section IV addresses the reverse Brussels effect and demonstrates how EU data protection law can learn from the collective culture of ubuntu to attain a truly collective dimension to data protection. Section V introduces the ubuntu framework discussing the selected values of ubuntu and the principles derived from these values. Section VI provides a brief conclusion to the discussion.

II. A Limited Approach to Data Protection for Collectives5

Data protection law in the EU has gone through two main phases. The first phase began in the 1970s up until the adoption of the Data Protection Directive.6 The second phase began with the adoption of the Data Protection Directive to the entry into force of the GDPR. Data protection law is currently in its third phase. Each change of phase has diminished the protection for collectives. Throughout all phases, there have been two divergent approaches, those that extend data protection law to collectives and those that do not.

The legitimacy of extending data protection to collectives was an important part of the early data protection discussions in the first phase. During this phase, six countries recognised the legitimacy of extending data protection to groups and collectives.7 In these countries, two approaches emerged, (i) similar protection for individuals and collectives8 and (ii) limited sectoral protection for collectives.9 However, in both these approaches, some countries made a distinction between collectives, groups and legal persons. An example is Austria where initially protection was extended to legal persons and then subsequently extended to collectives and groups. This divide seems to have been a desire to strike a balance between the approach of extending protection and that of denying protection to collectives.

In Europe, the Council of Europe recognised the legitimacy of extending data protection law to collectives in Convention 108.10 The Convention allows contracting parties to extend the protection offered under the Convention to, ‘groups of persons, associations, foundations, companies, corporations and any other bodies consisting directly or indirectly of individuals, whether or not such bodies possess legal personality’.11 In Convention 108+, the successor of Convention 108, rights in the Convention are granted to natural persons though parties retain the right to extend protection to legal persons to protect their legitimate interests.12 In the EU, the Data Protection Directive applied to an identified or identifiable natural person.13 However, it acknowledged the legitimacy of extending protection to collectives by clarifying that it did not affect existing legislation in member states that accorded protection to legal persons.14 It also provided limited indirect protection for legal persons by recognising the fact that data about legal persons could be considered as relating to natural persons when a legal person’s name was similar to that of a natural person.15

Austria, Denmark and Luxembourg therefore retained the laws extending protection for collectives and were joined by Italy in its implementation of the Directive. However, Luxembourg in 2007 and Italy in 2013 removed the protection for groups and collectives. The limitation of data protection to natural persons was carried into the GDPR.16 However, the GDPR departs from the Directive as it spells out that it does not apply to legal persons.17 The e-privacy Directive is currently the only EU legislation that extends data protection to collectives, particularly legal persons. The Directive lays down clear rules concerning unsolicited communications which apply to legal persons.18 However, the protection in this instance is within the limits laid down by the provisions.

The justification for protecting collectives was three-fold. First, there was concern with how information on collectives could be traced to an individual. As such complete protection of the individual was secured through protecting the data of collectives. The second relates to the concern of threats posed by the collection and processing of collectives’ data to their interests.19 Collective entities were seen as being similarly affected by the increased processing of information that natural persons were experiencing.20 It, therefore, was desirable to redress the balance of power between collectives and data controllers by protecting the processing of their data.21 The third concerned how collectives, like natural persons, had information that was worth protecting. The exclusion of such data from the law would have denied the information the protection it deserves.22

On the other hand, Sweden, France and Germany passed legislation that did not extend protection to collectives.23 They would be joined by eleven other countries.24 The justification for not extending protection to collectives was two-fold. First was a claim that the interests data protection laws seek to protect are only applicable to individuals. Collectives were therefore seen as being ineligible to receive such protection as rights such as privacy and personal integrity were rights that could only be exercised by individuals who held a legitimate claim.25 Extending protection to collectives in the same law would therefore blur the boundary of when the law would apply and regulate data about groups while enabling the protection of individuals.26 It was therefore desirable to protect the data of collectives through a different regime that applied solely to collectives. The second related to the market position of legal persons who viewed the extension of data protection to legal persons as enabling competitors to access information that the businesses stored.27

III. Overlooked Data Protection Interests of Collectives

The concerns identified in the 1970s as justifying the extension of data protection to collectives identified in part II above are more relevant now in a data-driven world where almost all aspects of everyday life are digitally recorded and stored. One would therefore expect legislation addressing the concerns raised in the 1970s, however, to date, these concerns have not been addressed. The absence of legislation addressing these concerns is best explained by the evolution of data protection to a fundamental right separate from the right to privacy.28 This makes it a subjective right invoked by citizens when their interests are threatened.29 As the GDPR gives effect to the right to data protection, the primary focus of the law is the individual and not the collective.

This approach negates the fact that data-driven innovation has enabled platforms and organisations to collect more personal data from individuals than has previously been done in history. Platforms and organisations are now more interested in population-level insights that are identifiable from the personal data they collect. The individual data subject is important in so far as they enable connections to be made to other individuals who share similar attributes. There is an inverse flow where an individual’s attributes are used to draw inferences about the group or collective they belong and vice versa. Data processing therefore takes a collective and group dimension as opposed to being focused on the individual. As a result, risks of harm are no longer experienced at an individual level only but are experienced at a collective and group level.

This challenges the notion that the protection of personal data that identifies people individually will protect collectives naturally. EU data protection law does not address harms or risks that arise from this relationality, and it does not provide a mechanism for collectives to exercise data protection rights that individuals have concerning their data. Data protection statutes have protected collective issues as a sum multiple of individual issues, and they are addressed using remedies premised on individual rights. 30 The individual, a data subject from whom data is collected is the only individual who bears the responsibility for the protection of the data of collectives. This undermines collective claims to data protection and yet these should not be downplayed as there is a possibility that collectives will be unable to control and perceive their own spaces and practices due to extraction.31

Furthermore, practices such as profiling are being used to create aggregate data sets that are valuable to different decision-makers. The inferences derived from these aggregate sets are viewed as more profitable than individual profiles by companies monetising such profiles given the richness of inferences that can be drawn.32 Once purchased the profiles can then be used for a variety of purposes including targeting and controlling collectives. Some of the purposes might have negative consequences for collectives as profiles developed can become more realistic than the identity of the collective itself. Collectives have goals, interests and operational modes that are not reducible to the individual members constituting them.33 In most instances, they have diverging purposes and they play different economic, political, legal and social roles.34 The roles they play and the goals they pursue contribute to the formulation of a ‘collective identity’. If the developed profile is more realistic than the identity of the collective there is a possibility of the collective suffering a significant impact regarding its interests. Thus, collectives have an interest in the quality of the information that is processed and the information systems used to manage this information.

Apart from profiling, artificial intelligence has enabled automated and systematic application of predictive analytics. Such analytics allow predictions to be made about collectives and individuals making up these collectives based on predictive data models. Predictive analytics rely on ‘collective data sets’ including anonymised sets as predictive capacities can be extracted from these sets.35 The predictions made can be used to target individuals or different collectives in society at a large scale. This can then result in exploitation or unequal treatment of different individuals or groups in society due to the resulting predictions. For example, different rates of insurance can be offered by virtue of having been predicted to be a higher risk because of predictions made about one’s financial status from readily available data about a group they have been predicted to belong to. The result is imbalances of power between different collectives in society and the organisations arising from the potential misuse of their data and the predictive models. Collectives have an interest in aiming to balance and address these power asymmetries.

Related to this is how data protection law fails to acknowledge the relationality of data to ensure that societal harms are prevented while facilitating collective interests.36 Relationality in this instance refers to how data about a single individual when processed can reveal data about other individuals they are connected with. Relationality is what gives data value as it allows aggregation of data collected from different individuals who share the same characteristics without consideration of the individual. The process of aggregation removes the identified or identifiable data subject leading to a collective data subject.37 This data is then used to target and influence decisions that affect individuals and the collectives they are part of usually with grave consequences without the individuals or collectives being aware of the causes of the phenomena they experience. An example of the effects of aggregation relates to predictive policing which results in increased law enforcement in areas where data about crimes and violence deems to be necessary.38

This has the potential to impact how individuals interact with collectives they are part of or belong to. Collectives have an interest in ensuring that there is a suitable environment for which its members can come together, ‘to exchange information, share feelings, make plans and act in concert’ to attain their objectives and the objectives of the collective.39 Individual members have an interest in the collective as it fosters an environment that allows them to share, make plans and act in concert. Individual members in this instance would rely on whom they associate with in the collective to ensure that what has been shared and planned stays within the environment of the collective.40 These interests in the protection of their data allow collectives to undertake their different roles to the benefit of society.41 However, these interests are not catered for by data protection law.

To overcome the inadequacies of the individual dimension, recent works have sought to expand the scope of data protection by examining its collective dimension.42 Bieker proposes a reformation of the term data subject to relate to one or more individuals.43 This would extend data protection rights to collectives which rights can be enforced by an individual or collective in line with the case law of ECtHR on measures of secret surveillance. van der Sloot proposes a two-tiered system for data protection. In this system, with respect to negative obligations for the state and data controllers, collectives would be entitled to similar protection with exceptions concerning the protection of sensitive data. In respect of positive rights for persons and data subjects, collectives would be entitled to limited rights of access to data and rectification of data. Collectives would also be offered a lower level of protection in comparison to natural persons.

Tzanou proposes the adoption of an egalitarian project. She proposes a new normative orientation for data protection which would be guided by methodologies that put to the fore neglected perspectives and narratives. This would ensure the inclusivity and diversity of data protection law in the EU. The focus of her proposal was to cater for the perspectives of vulnerable and disadvantaged groups that are subjected to monitoring and additional forms of surveillance which has been missed by data protection law in the EU. She therefore advocated for a paradigm shift in data protection that would be human-centric and focused on society.44 However, their formulations have one major limitation. The proposals are premised on Western conceptualisations of fundamental rights as a remedy against intrusions on the individual. They therefore retain their individualistic dimension and fail to effectively address the collective dimension of a right to data protection.45 Addressing the issues identified above as well as the interests of collectives requires dealing with large, systemic and deeply rooted data collection and processing practices from a collective perspective. To adequately protect the interests of collectives with their diverging interests requires an alternative system that recognises collective rights. However, such a system is less developed in the EU and would require the traditional system of rights to be changed together with EU primary law.46

IV. Towards a Paradigm Shift: Reverse Brussels Effect

The process of changing the traditional system of rights within the EU is a utopian endeavour and while it is one well worth pursuing,47 I wish to introduce a novel argument that does not involve changing the rights system. I call for a shift of the current focus of EU data protection law from the Brussels effect to a reverse Brussels effect. The reverse Brussels effect entails a two-fold task (i) identification of collective cultures that have rights systems that privilege collectives over individuals and (ii) identify elements from these cultures that can be integrated into current and future EU data protection law. Several countries have collective cultural norms that inform collective rights which the EU can learn from. This paper aims to propose an alternative approach to the integration of collective rights in data protection law in the EU without changing the traditional system of rights. This is done by demonstrating that there are elements within collective cultural norms such as ubuntu that the EU can learn from to develop collective data protection.

The two-fold task of the reverse Brussels effect is an important first step towards the realisation of an alternative solution to protecting collective data protection. It allows the development of a contrast between relational and collective societies represented by concepts such as ubuntu and the individualistic societies in the EU. Ubuntu in this instance is taken at the ideological and principle level where it is comparable to individualism rather than the regulation level at which data protection law exists. This is because ubuntu reflects a diversity of practices, values and cultures found in Africa. However, it is important to acknowledge that it is a unique challenge to carry out such socio-legal transplantation in the EU and in the GDPR, where the individual dimension prevails in today’s culture. Nonetheless, given the need for the realisation of a collective right to data protection, those in the EU will have to take up the challenge. The cultural norm proposed in this instance is ubuntu. Ubuntu is ideal as a starting point for this process because it is, ‘a collection of values and practices’ that is nuanced ‘across different ethnic groups’ but having a common theme of seeing human beings as part of a, ‘relational, communal, societal, environmental and spiritual world’.48

Ubuntu is a social-cultural concept that explains individual behaviour in groups. It emphasizes the notion that individuals are members of groups and their actions affect not only themselves but also others in their groups. It is best expressed as an aphorism in various native languages of Southern Africa with the most common being in Zulu, umuntu ngumuntu ngabantu which translates to a person is a person through other people.49 It has also been expressed as, ‘I am because we are; and since we are, therefore I am.’50 Ubuntu provides an understanding of individual behaviour in groups in an African society because the interests of individual members are focused towards activities and behaviours that ensure the good of the group.51

Two important questions then arise, whether the transplantation of ubuntu from African culture is consistent with European socio-legal culture and whether it is feasible to integrate it into the GDPR.52 To answer these two questions, I propose an Ubuntu Framework that contains data protection principles derived from the values of ubuntu. Ubuntu is made up of several values such as communitarianism, interdependence, dignity, solidarity and responsibility. This article focuses on the values of communitarianism, interdependence, responsibility, relationality and dignity. A framework containing principles premised on the values of ubuntu would provide a different kind of starting point for a collective right to data protection in the GDPR. The principles would have a similar status to principles found in the GDPR. This will allow ubuntu to be infused into the GDPR thereby contributing to the development of a collective dimension to data protection. The validation of the consistency of ubuntu with European socio-legal culture and the feasibility of its integration it the GDPR is to be pursued as future work.

V. Integration of Ubuntu into the GDPR: An Ubuntu Framework53

The Ubuntu Framework is based on four principles to ensure a holistic collective right to data protection that caters for collective interests and mitigates potential risks. For each of the principles, a description of the value underpinning the principle is provided as well as how the principle might impact a collective right to data protection. The framework itself is underpinned by Communitarianism. At its core ubuntu is concerned with communitarianism which entails communalism54 a mindset in which group welfare and interests are greater than those of the individual. Ubuntu emphasises the duties of the individual in the community and encourages respect for each person as a social unit.55 The right of one member of the community is the duty of another member of the community56 as such community rights are embedded in the culture of the people.57

This communal character presents a challenge to the consistency of ubuntu with the individual lifestyle of the EU with regard to the nature of the relationship between the individual and the collective. 58 However, it is important to note that the communal character of ubuntu does not imply individual rights are subordinated. It instead implies that individuals pursue their own success and goals by pursuing the community good.59 Two possible approaches emerge from this. The first, where data protection focuses on the welfare of collectives and not individuals with the individual being an organic component of the group. The second is where data protection law recognises that individual data protection and collective data protection would be incomplete without mutual recognition and complementarity.

The Ubuntu Framework proposed here is premised on the second approach as it is able to strike a balance between individual rights and collective rights. It will allow individuals and organisations that require data for their goals and success to pursue these goals by also pursuing the community good of protecting the data of groups and collectives to minimise risk and harm to these collectives and groups. The values and principles that make up the Ubuntu Framework are as follows.

VI. Conclusion

Data protection law in the EU has gone through significant changes from the 1970s to its current state. However, the changes have been at the expense of the interests of collectives when it comes to their data. Data protection law has therefore overlooked collectives in its development and currently lacks a collective dimension. This article argued that in answering the following questions, Which fundamental concepts should be revised; what can and should data protection law aim for in ten years and which regulatory approach should be adopted?, EU data protection law must revise the fundamental concept of personal data to cater for collectives. It recommended that EU data protection law look outward and undergo a ‘reverse Brussels effect’, where the EU learns from countries that have collective cultures that privilege communities and groups. Values from these countries such as ubuntu could ultimately help the EU in developing a collective dimension to data protection. One such possible approach would be through the use of the proposed ubuntu framework which has principles that can be integrated into EU data protection law. The consistency of such an approach with EU socio-legal culture and the feasibility of the integration of such a framework into the GDPR remains the subject of further study.