Against Data Fixation: Why ‘Data’ Fails as a Regulatory Target for Data Protection Law and What to Do About It

Abstract This article critiques the fixation on data as an object of regulation for addressing a broad range of digital problems. We challenge the idea that data are always the appropriate regulatory targets for addressing information-related problems, specifically in the context of data protection and the General Data Protection Regulation (GDPR). The GDPR tackles a broad range of digital problems by regulating personal data. This results in regulatory imprecision. Framing digital problems as (personal) data problems often does not reflect the causal processes law aims to control, pre-empts modernising traditionally non-digital legal domains, such as consumer and labour law, and distracts from what is really problematic and in need of regulatory intervention. Drawing on theories of regulation and information, we distinguish between two different causal processes underlying information-induced problems: semantic (meaning-driven) and syntactic (meaning-agnostic). We propose a roadmap for improving legal protection against information-related problems.