ORIGINAL

Abstract

This thesis focuses on rethinking the approach to addressing data privacy in America. It examines and proposes the use of innovative policy solutions and private sector mechanisms to address the consumer data privacy concerns of citizens that are at the heart of the issue. It proposes a new framework for analyzing the issue at hand and argues that a hybrid of improved private and public sector mechanisms must be in place in order to safeguard privacy in America. The analysis and arguments in this paper stem from a non-technical perspective on the issue of data privacy, and therefore it is important to acknowledge the limitations in the consideration of the technical implications of some of the policy recommendations presented in this paper.

Before diving into policy recommendations and potential solutions, Chapter 1 first defines data privacy as a concept and emphasizes the importance of the topic as an area for research and analysis given recent developments. Using data from the Pew Research Center and other sources, Chapter 1 substantiates the three largest concerns that need to be addressed as being: lack of transparency, lack of control, and lack of choice. In order to ensure data privacy, this paper argues that users must be empowered with end-to-end transparency on their data, along with the autonomy to control its collection and use. In Chapter 2, this paper presents a case study of Facebook in order to highlight many of these issues and concerns in practice at one of the largest and ubiquitous technology companies in the world. Later, Chapter 3 examines the existing data privacy regulatory approaches of the European Union and the United States by focusing on the two preeminent legislations with the General Data Protection Regulation and the California Consumer Privacy Act.

After understanding and analyzing the issues and concerns at hand along with the current regulatory approach in Europe and the United States, the key research takeaways and ensuing recommendations are presented in Chapter 4 and a reimagined American federal regulatory framework for data privacy is proposed. While government policies such as the GDPR and CCPA are on the path towards an adequate regulatory framework, there is much room for improvement and growth. The larger themes captured within these recommendations include creating a new data protection and privacy authority, increasing private and public sector collaboration, exploring ways to implement the notice and choice model, and incorporating digital literacy into policy. However, Chapter 5 highlight that while policy-making plays an important role in addressing the data privacy concerns consumers have, it is not the complete solution and only works to a certain extent, as many gaps remain. Therefore, in Chapter 6, this paper present how private sector mechanisms can fill the remaining gaps in addressing lack of transparency, lack of control, and lack of choice through a variety of technologies and solutions. Afterwards, Chapter 7 highlights remaining considerations that should be included in the conversation of data privacy, from the concept of privacy for the privileged to the privacy implications of Covid-19. Lastly, this thesis concludes with a synthesis of the analysis and an outlook on the path forward.