Anouk Ruhaak

In 2016 the European Union adopted the General Data Protection Regulation (GDPR) that seeks to protect the privacy rights of Europeans. However, since the GDPR came into force in 2018, regulators have been slow to enforce it. To ensure that the privacy rights of Europeans are sufficiently protected, a growing number of private actors have taken it upon themselves to bring cases against companies that are in violation of the GDPR.

How does private enforcement work? What mechanisms are available? And how do these differ between different European member states? 

How do we calculate the value of privacy violation and specifically the material and non material damages?

• GDPR enforcement tracker

• Mulders (2022), Collective Damages for GDPR Breaches: A Feasible solution for the GDPR Enforcement Deficit?

Even when you never shared any data about you, AI systems trained on the data of your peers can be used to predict your future behavior and interests with ever greater accuracy.

Given this reality, we cannot only consider privacy as an individual concern, without also looking at the collective consequences of each of us making individual decisions about our data. 

• Fairfield & Engel (2015), Privacy as a Public Good 

• Group Privacy (2017)

A large part of my work is concerned with the governance of personal and non-personal data and the different models we may deploy for stewarding such data. These models range from data trusts, to data commons and cooperatives.

All these models concern themselves with how groups of people can collectively make decisions about their data, while potentially delegating some control over their data to a trusted steward.

• Anouk Ruhaak (2020), Data Commons & Data Trusts

• Ruhaak & Kapoor (2021), What is data stewardship, and how could it address questions of power imbalance in the data economy?

When one family member decides to upload their data to a DNA platform, they are not just making decisions about their own data; They are also deciding on behalf of family members who share (part of) their DNA, including unborn family members. Ideally, these types of decisions are made by every family member together. But how would we go about that? And how do we enforce such decisions on the group level?

Background reading:

• Anouk Ruhaak (2020), When One Affects Many

• CHIRON (2025) - A tool to consider group interests in biomedical research

Just because data does not always identify people, does not mean it cannot be used in nefarious ways. Even non-personal data requires careful governance. For instance, consider the case of farm data, such as data about soil conditions, crop production etc. In the hands of the farmer, this data could be used to improve crop yields. In the hands of for instance a commodity trader, this type of data (especially in aggregate) could be used to manipulate the commodity market.

Given that non-personal data is not protected by privacy rights, how do we go about governing it? Who decides where this data ends up and who has the right to access this data? Of course, good governance of non-personal data has only become more urgent with the invention of LLMs.

Background reading:

• Casolari et al. (2023), The EU Data Act in Context 

• Wiseman et al. (2019), Farmers and their data: An examination of farmers’ reluctance to share their data through the lens of the laws impacting smart farming

In 2020 the European Union adopted its Representative Actions Directive (RAD) that “aims to ensure that consumers are able to protect their collective interests in the EU via representative actions, the legal actions brought by representative entities (so called qualified entities). It provides that all EU countries have in place a mechanism of representative actions. The Directive improves consumers’ access to justice while it also foresees appropriate safeguards to avoid abusive litigation.”

As the chair of a foundation that brings actions under the RAD I would be happy to talk about the importance of this directive and explain what is involved in bringing a collective action and how the RAD has evolved in different European countries. 

Background reading:

• European Commission (2020), Representative Actions Directive

Private enforcement of the GDPR and other digital regulations requires evidence. As private actors do not have the same powers as national regulators. Instead, we rely on technical tools and whistleblowers to build our cases.

We would welcome all the help we can get in building these tools and I would love to talk to all of you about the tools that already exist and the many tools that are needed.