Privacy Self-regulation Through Awareness?

This paper aims to provide a critical contribution to the ongoing discourse on self-regulation with regard to privacy and data protection. This discourse encompasses the amendment of the EU Data Protection Directive and the related discussion about a principle of accountability. Underlying these conceptualisations is the assumption that data protection law is generally observed, but could be simplified and even reduced in favour of more self-regulatory approaches which are deemed more efficient. We would like to raise critical questions about the institutional conditions and frameworks that greatly influence data controllers' potential and motivation for enacting privacy awareness and self-regulation; in other words, the market structures that these organisations operate within. An investigation into organisations' practices is indispensable in order to evaluate these current claims for self-regulation and to lay out the conditions that need to be met if market forces are to be harnessed for privacy and data protection. The results and conclusions presented were gained in the course of the EU FP7 project “Privacy Awareness through Security Organisation Branding” (PATS). The project inquires into the possibilities of organisational self-regulation in the field of security technology and services by means of branding – understood as a complex, two-sided communication process between companies and stakeholders. Specifically, research from the first three work packages is used. We started out with an analysis of current security regimes and actors, then interviewed representatives of security organisations in detail about their privacy awareness and practice, as well as conducting a qualitative analysis of security organisations' communications and selfpresentations. The security field can be used as a burning lens to focus particular problems when it comes to the selfregulation of privacy and data protection: while the industry certainly represents a particular case when it comes to actor relationships, our analysis shows which questions need to be asked in order to understand existing structures of, and obstacles to, privacy protection. We argue that powerful obstacles lie in market structures that are obscure rather than a provider of incentives for self-regulation. These findings facilitate