Salo and Liyanage
412
17.6 Analysis of Potential Regulatory Approaches
There are at least three levels at which Security and Privacy could be regulated, each
with benefits and drawbacks [32]:
● Government regulation;
● Industry self‐regulation; and
● Consumer or market regulation.
The most obvious place to regulate Security and Privacy is at the governmental level.
The governments are responsible for writing laws and regulations, and people look to
their governments to lay down such rules that prevent harms to the public.
Another level at which to regulate privacy is at the industrial level. Industries can
develop principles and practices that reflect consensus on the best approach to privacy.
In “industry self‐regulation”, a network of leading companies may require their business
partners to meet industry standards on privacy.
Finally, there is consumer or market regulation. Consumers are in the best position to
know their desires with respect to privacy, and they are in the best position to enforce
the terms of their desires through their choices in the marketplace.
Table 17.1 Summary of regulatory targets with Security and Privacy issues of high impact.
Regulatory objectives
Issues of high relevance and impact
1) Promote Digital Single
Market
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Different objectives for Trust, Interconnectivity,
Loss of governance/Loss of control, Service Provider lock‐in,
Visibility
2) Balance of interest
By law conflict/Location of legal disputes, Shared environment,
Interconnectivity, Loss of governance/Loss of control
3) Global context
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Shared environment, Different objectives for
Trust, Interconnectivity, Visibility
4) Foster interoperability
and data portability
Shared environment, Interconnectivity, Loss of governance/Loss of
control, Service Provider lock‐in
5) Applicable law must be
easy to define
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Shared environment, Different objectives for
Trust, Interconnectivity, Loss of governance/Loss of control,
Visibility
6) Right to be forgotten
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Different objectives for Trust, Loss of governance/
Loss of control
7) Increased responsibility
and accountability
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Shared environment, Loss of governance/Loss of
control, Service Provider lock‐in, Visibility
412
17.6 Analysis of Potential Regulatory Approaches
There are at least three levels at which Security and Privacy could be regulated, each
with benefits and drawbacks [32]:
● Government regulation;
● Industry self‐regulation; and
● Consumer or market regulation.
The most obvious place to regulate Security and Privacy is at the governmental level.
The governments are responsible for writing laws and regulations, and people look to
their governments to lay down such rules that prevent harms to the public.
Another level at which to regulate privacy is at the industrial level. Industries can
develop principles and practices that reflect consensus on the best approach to privacy.
In “industry self‐regulation”, a network of leading companies may require their business
partners to meet industry standards on privacy.
Finally, there is consumer or market regulation. Consumers are in the best position to
know their desires with respect to privacy, and they are in the best position to enforce
the terms of their desires through their choices in the marketplace.
Table 17.1 Summary of regulatory targets with Security and Privacy issues of high impact.
Regulatory objectives
Issues of high relevance and impact
1) Promote Digital Single
Market
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Different objectives for Trust, Interconnectivity,
Loss of governance/Loss of control, Service Provider lock‐in,
Visibility
2) Balance of interest
By law conflict/Location of legal disputes, Shared environment,
Interconnectivity, Loss of governance/Loss of control
3) Global context
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Shared environment, Different objectives for
Trust, Interconnectivity, Visibility
4) Foster interoperability
and data portability
Shared environment, Interconnectivity, Loss of governance/Loss of
control, Service Provider lock‐in
5) Applicable law must be
easy to define
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Shared environment, Different objectives for
Trust, Interconnectivity, Loss of governance/Loss of control,
Visibility
6) Right to be forgotten
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Different objectives for Trust, Loss of governance/
Loss of control
7) Increased responsibility
and accountability
Responsibility ambiguity/Data ownership, By law conflict/Location
of legal disputes, Shared environment, Loss of governance/Loss of
control, Service Provider lock‐in, Visibility