What is Data Privacy?

What Is Data Privacy?

Data privacy is the set of rules, practices, and values that govern how personal information is handled. Every time an app collects your location, a store records your purchase history, or a website stores a cookie, a data privacy question is being answered — usually by default settings written by the company, not by you. Data privacy asks who should be allowed to collect information, what they should be allowed to do with it, how long they should be allowed to keep it, and what happens when they are done with it.

It is easy to confuse data privacy with data security, and the two are closely related. Security is about protecting data from unauthorized access — stopping hackers from stealing your credit card number. Privacy is about what happens with data even when everything is secure: whether the company is entitled to have the data at all, whether it may share it with partners, and whether you can get it back. You can have excellent security and terrible privacy, and vice versa.

The philosophical core of data privacy is respect for persons. Information about a person is, in an important sense, an extension of that person. The philosopher Luciano Floridi has argued that personal data is part of a person's identity, and that mishandling it harms the person, not just their interests. On this view, treating data carelessly is not a minor infraction but a failure to respect the people the data is about.

Historical Background

The modern idea of data protection emerged in Europe in the 1970s, in response to growing government and corporate databases. The German state of Hesse passed the world's first data protection law in 1970, and Sweden followed in 1973. The guiding principles of this era — fairness, purpose limitation, transparency — became the foundations of the 1980 OECD Guidelines on the Protection of Privacy, which spread internationally.

The commercial internet created a new chapter. In the 1990s and 2000s, companies discovered that behavioral data was immensely valuable, and "free" services built their business models on monetizing it. Regulation struggled to keep up. The United States adopted sectoral laws — protecting health records, financial data, and children's privacy separately — while Europe consolidated its approach with the 1995 Data Protection Directive.

The modern era is defined by comprehensive frameworks. The European Union's GDPR (2018) is the most influential, introducing strong individual rights, mandatory breach notifications, and fines up to four percent of global revenue. California's CCPA and subsequent laws brought similar rights to U.S. consumers. Around the world, dozens of countries have passed or updated data protection legislation, making data privacy one of the fastest-growing areas of law and of corporate compliance.

Key Concepts

Collection is where privacy begins. The ethical question is not just "how do we protect this data?" but "should we collect it at all?" Responsible organizations practice data minimization: gathering only what is necessary for a clearly stated purpose and avoiding hoarding "just in case."

Consent is the classic justification for collecting personal data, but it is widely criticized as a weak foundation. Research shows most people do not read privacy policies, and interfaces are often designed to steer users toward acceptance. Consent works best when it is specific, informed, and revocable — which is exactly why good privacy laws require it to be more than a checkbox.

Purpose limitation means data collected for one reason should not be silently repurposed for another. When a fitness app's data is sold to an insurer, the original purpose has been abandoned. Purpose limitation is a legal principle in the GDPR and a core demand of privacy advocates.

Individual rights are the heart of modern privacy law: the right to access your data, correct errors, request deletion, and object to processing. These rights shift some power from organizations back to individuals, though exercising them often requires effort and persistence.

Accountability is the final pillar. Privacy is only real if someone is responsible when it fails. Accountability includes transparency reports, privacy officers, audits, and meaningful penalties. Without enforcement, privacy rules are just suggestions.

Contemporary Relevance

Data privacy is no longer a niche concern; it is a mainstream expectation. Consumers increasingly choose products and services based on their privacy reputations, and companies advertise privacy as a feature. At the same time, the data economy continues to grow, and new technologies — AI training on personal data, biometric tracking, smart home devices — keep generating new privacy questions faster than rules can answer them.

The regulatory trend points toward stronger protection. The GDPR has become a global reference point, and similar laws are spreading across Asia, Latin America, and Africa. In the United States, a growing number of states have passed comprehensive privacy laws, and federal legislation is repeatedly proposed. For organizations, compliance is now a board-level issue, with real financial consequences.

For individuals, the situation is mixed. On one hand, tools exist: password managers, privacy-focused browsers, deletion requests, encrypted messaging. On the other hand, meaningful control over how your data moves through the economy is largely out of individual reach. That is why most privacy advocates argue that the future of data privacy depends less on personal vigilance and more on structural rules that constrain the powerful by default — and why data privacy remains one of the defining ethical issues of the information age.

Sources

• Floridi, Luciano. The Ontological Interpretation of Informational Privacy. Ethics and Information Technology, 2006. https://doi.org/10.1007/s10676-005-3109-7
• Stanford Encyclopedia of Philosophy. Privacy and Information Technology. https://plato.stanford.edu/entries/it-privacy/

Related Topics

• What Is Digital Privacy?
• What Is Big Data?
• What Is Surveillance Capitalism?
• Privacy Topic
• Information Ethics
• Digital Ethics Topic