Right engineering? The redesign of privacy and personal data protection

The idea of building safeguards for privacy and other fundamental rights and freedoms into ICT systems has recently been introduced in EU legislation as ‘Data Protection by Design’. This article studies the techno-epistemic network emerging around this idea historically and empirically. We present the findings of an ‘extended peer consultation’ with representatives of the emerging network: policy-makers, regulators, entrepreneurs and ICT developers, but also with jurists and publics that seem instead to remain outside its scope. Standardization exercises here emerge as crucial hybrid sites where the contributions and expectations of different actors are aligned to scale up privacy design beyond single technologies and organizations and to build highly interconnected ICT infrastructures. Through the notion of ‘privacy by network’, we study how the concept of privacy hereby becomes re-constituted as ‘normative transversal’, which both works as a stabilizing promise for responsible smart innovation, but simultaneously catalyzes the metamorphosis of the notion of privacy as elaborated in legal settings. The article identifies tensions and limits within these design-based approaches, which can in turn offer opportunities for learning lessons to increase the quality of privacy articulations.