LAW6001 Chap.6 Privacy, Data Protection and Self-Determination
Privacy, Data Protection and Self-Determination
From secrecy to data power
Data protection reaches beyond private secrets to identifying, inferred and reusable information that gives organisations power over decisions.
This chapter classifies direct, indirect, inferred, pseudonymised and anonymous data, then traces purpose, legal basis, recipient and consequence across the processing chain.
Rights inside organisational accountability
Consent is one control, not the whole system. Original scenarios show why correction may leave a derived profile intact and why disclosure cannot legitimise unassessed reuse.
The chapter closes by returning organisational choices to the person through evidence, rights and effective review.
What this chapter covers
- 01
Direct and indirect identification
- 02
Inference and pseudonymisation
- 03
Purpose and legal basis
- 04
Limits of consent
- 05
Individual rights and data lineage
- 06
Organisational accountability
Worked example · free
Trace a new use through the data chain
- 3Classify collected and inferred data.
- 3Test purpose and legal basis at each transition.
- 4Allocate duties and challenge routes.
Key terms
- Personal Data
- Information relating to an identified or reasonably identifiable natural person.
- Inferred Data
- Information derived from behaviour or other inputs rather than directly supplied by the person.
- Pseudonymisation
- Separation of identifiers while retaining a means or realistic possibility of reconnecting information to a person.
- Purpose Limitation
- The principle that data is collected for specified purposes and not reused incompatibly without justification.
- Accountability
- The duty to comply with data rules and maintain evidence capable of proving that compliance.
Privacy, Data Protection and Self-Determination FAQ
Is publicly available information outside data protection?
Not automatically. The relevant questions include whether the information relates to an identifiable person, how it was obtained, what purpose governs reuse, which power the organisation exercises and which exceptions apply. Public visibility does not by itself settle every processing duty.
Why can consent be insufficient?
Agreement may be bundled, poorly informed or unrealistic where the service is essential. It may not reach later inference or incompatible reuse. Data governance also relies on purpose limits, substantive restrictions, organisational duties, security and rights that do not depend entirely on a tick box.
Does deleting raw data remove every consequence?
Not necessarily. Copies, backups, derived profiles, model outputs and downstream recipients may remain. A complete response needs data lineage, recalculation or deletion of affected derivatives, recipient notification where required and review of decisions made from the old information.
What makes consent a weak answer to a data-governance problem?
Consent is weak when refusal is unrealistic, the purpose is too broad, downstream uses are unpredictable, the person lacks bargaining power or the processing affects others. Diagnose which condition applies instead of dismissing consent categorically.
Then identify a control that does not depend entirely on individual choice: purpose limits, minimisation, retention rules, access controls, impact assessment, representative oversight or a prohibition on a particularly harmful use. Trace the data from collection through inference, sharing, decision and deletion so the safeguard reaches derived information and recipients.
Preserve a usable right to obtain reasons and correct records where the processing affects an important outcome. A strong answer also states the legitimate function that may continue and explains why the alternative control is capable of protecting it.
This approach treats self-determination as a combination of meaningful choice, bounded institutional power and effective remedy rather than a box ticked at the moment of collection.
Exam move
Use a verb-based data map: collect, infer, combine, disclose, decide, retain and delete. Attach a purpose, basis, actor and right to each transition. Rework one scenario by changing only the downstream use and observe how the legal analysis changes even though the original input stays the same. Finish by identifying the record that would prove compliance to a reviewer.
Build classification drills with direct, indirect, inferred, pseudonymised and anonymous information. For each item, state what additional fact would change its category or legal treatment. Follow one correction request through raw data, derived profiles, recipients and decisions so that the remedy does not stop at the visible field.
When comparing regimes, use a continuous chain of principle, legal basis, right, organisational obligation, regulator and remedy. Do not separate countries into descriptive essays until the common dimensions are fixed. Test consent problems by asking whether refusal was realistic, whether the purpose was understandable and whether later inference was ever presented.
For the written assignment, focus on data power and institutional design rather than treating privacy as secrecy. For final revision, practise choosing the right remedy for the stage of harm and explain why the neighbouring right would not reach it.
Working through Privacy, Data Protection and Self-Determination in LAW6001? Sia is AskSia’s AI Law tutor — ask any LAW6001 Privacy, Data Protection and Self-Determination question and get a clear, step-by-step explanation grounded in how LAW6001 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.