Intelligible Data Protection Legislation: A Procedural Approach

Abstract

In this article, it is argued that legislation must be drafted clearly, simply and precisely, especially when it pertains to ordinary citizens. This involves ensuring that the legislation sets out clear procedures so that those applying it know how they should act in order to attain legally correct and valid results. To illustrate the potential benefits of this ‘procedural approach’ to legislative drafting, the article focuses on the General Data Protection Regulation (GDPR) enacted by the European Union in 2016. The article explores hidden and tacit procedural questions related to the parts of the Regulation that deal with the legal basis for processing personal data, in particular the use of data subject consent as one such basis. The article shows how it is possible to restructure these parts of the Regulation so that they are less fragmented and more intelligible. Another core point made by the article is that a ‘procedural approach’ to legislative drafting is highly desirable for the development of computerised decision-support systems. A non-procedural, fragmented approach to drafting legislation, as is manifest in the GDPR, must be abandoned if the legal system is to become an integral part of a computerised society.