Digitalisation, democracy and the GDPR: The efforts of DPAs to defend democratic principles despite the limitations of the GDPR

This article discusses the perspectives of European Union (EU) / European Economic Area Data Protection Authorities (DPAs) on their role in protecting democratic rights and freedoms in digitalised societies. Data Protection Authorities, which are independent regulators, are responsible for implementing the EU's General Data Protection Regulation in their respective countries. The views of DPAs are important given their special role in monitoring newly emerging digital technologies and how their use may impact on the functioning of democracies. The article highlights three key themes which emerged in interviews with 18 DPAs in answer to the question about what they consider to be the greatest challenges to democratic freedoms. These are: (1) threats to elections due to the manipulation of voters; (2) discriminatory effects of automated decision-making; and (3) broader chilling effects on democratic norms due to ubiquitous surveillance. The article then analyses the solutions named by DPAs to mitigate these challenges to identify their governing, or political, rationalities. The paper finds that the solutions available to DPAs to manage democratic harms tend to emphasise individual over collective responsibility and are connected to broader currents of neoliberal governance. The paper highlights the ways in which some DPAs act as important critical voices within their respective jurisdictions to draw political attention to potentially anti-democratic effects of certain practices, such as profiling, or to the model of digitalisation as it is currently constructed.