ava's blog

talking about law

Will be back fully by mid June. Until then: A bit of a mix of stream of thoughts and venting around difficulties in talking about law as an interest, hobby, passion. Just had to get that off my chest. I’ve tried to write it as easy to understand and approachable as I can, though.

As someone very passionate about data protection law and studying it, obviously I want to talk about it in the same way others do about their interests. It feels similar to that of fandom, where someone would write a scene analysis about the connection of the two characters for their favorite show for the fun of it. Not necessarily insisting that their piece is right and everything else is wrong, but something they see and feel in it.

That’s more difficult with law, even if it shouldn’t really be. There’s this huge gap depending on who you’re talking to.

When I talk to other students, the discussions are very fruitful in a theoretical degree. If there are any questions about definitions, if x falls under y, you’re going to have a great discussion with lots of sources attached to back that up and immerse yourself in. That’s one of the main differences I see talking to that group compared to others in every day life: a wall of text is not threatening, annoying, know-it-all. Sources aren’t there to shut you up or seem holier-than-thou, it’s simply what’s needed for the nuance and further learning. Everyone understands that this is just (academic) discussion and not a personal attack.

But sometimes, I want to focus more on things in practice. I wanna look around and describe the cookie banners that are not compliant, I wanna talk about newsletters you shouldn’t be forced to be opted in to automatically, and the like. It also comes up in casual conversation with friends, like how a friend brought up the Brazilian research using data of public Discord servers. And talking with people not knowledgable in it is always a minefield, inevitably.

So in contrast to fellow students: To laymen, law is pain. Law brings panic. When you mention it, it causes strong reactions, as if you merely bringing it up had the intent of threatening them or making them feel inferior. Law is always really harsh and clear to them, but also extremely confusing legalese at the same time. I see it when people try to misuse it to brag or threaten someone with suing them over something, because then suddenly everything is obvious, clear, a slam-dunk. But if you ask people to read the law, or a EULA, a Privacy Policy and the like, it’s too hard to understand and really confusing. In my experience, people don’t tend to integrate these two views and one just comes out when it fits.

What I mean is: there’s this expectation that when you talk about law, you are 100% right, insisting to be right, and giving legal advice. I guess this view comes from overly bold and assertive people online who try to use it to silence someone in a discussion. How you discuss in academia, and in law specifically, is also just not socially acceptable elsewhere, as painful as that was to realize over and over again as an autistic person.

In normal discussions, you’re supposed to keep it short, agree to disagree, not correct people, not butt in with a “well actually…” and not hold an in informative monologue focusing on all the details. The other person will feel cornered, attacked, embarrassed or bored, even if to you, it felt like telling someone their shoe laces are untied or if you just wanted to share knowledge.

I really like that law discussions with student peers are so like how autistic people love to discuss, but the fact that this culture of discussion is so normalized in law means I have almost no other way to discuss it. And really, there cannot be, otherwise you’ll leave out important caveats and nuance.

There’s a reason after all that we have judges and lawyers; if the law was always so easy and obvious, we could just do away with that show. There’s a reason two people doing the same crime in the same country might go to prison for different amounts of times. Within a country, a person might get found not guilty in one court, when another court and judge would have. We can have two courts deciding opposite things in two very similar cases, and your discussion partner will use one case as proof “how it was decided” and you’ll find and use the other that supports your view.

An example from my life: I was in a seminar about data protection law, and the topic of what counts as third-country-transfer came up. Our professor had a view we didn’t understand: She thought that only if the data was physically carried over the border on a hard drive would it be a transfer, but if you use a VPN to access the company’s data from outside the EEA, it wouldn’t be. If you send the data to a processor outside of the EEA, it would be one, but if it’s just an employee, it isn’t.

That’s not something you’d think reading the actual law, and there was pushback in the seminar. Afterwards, I consulted the study materials and literature and asked the data protection officer/IT law guy at work. He shared the students’ sentiment, disagreeing with the professor. I later opened up the discussion to other law students and through that, I found out some arguments for why the professor’s stance might be agreeable. There was even a state supervisory authority holding the same view. Then again, the Federal Office for Information Security (the federal supervisory authority) supported the view the original students and the data protection officer had. By then I knew the arguments and sources for both sides, and none are exclusively right; you have to decide what position you take on personally.

That’s something already included in most of the law you learn - learning the different opinions and which ones are leading/popular and which ones are a minority viewpoint. There’s the typical shade thrown around in footnotes of literature about how another author is obviously wrong that you might know from other studies as well. At my uni, we even have a professor that’s called the König der Mindermeinungen, the king of minority views, because he almost always supports outlandish and weird interpretations of the law. You can just do that.

But laypeople not really being aware of this has stopped me talking about law, even on the blog, because I don’t want them to take it as legal advice. Also, there are people who would see a different interpretation online, conclude I must be wrong and not know what I’m talking about and my view is an unsupported outlier. It’s just not really how that works.

Most of the professors I learn from follow the spirit of the GDPR and its recitals, which are very pro-consumer, but that one professor in my example, and many IT law firms that have companies as clients follow a more relaxed, company-friendly interpretation of the law (and they love to publish those interpretations far and wide online). This is possible because the law has leeway and is subjective at times.

Obviously, if you want to keep having companies as your clients, you’ll want to go with the interpretation that serves them best with as little effort invested into data protection as possible and the most data they can get about the customer while still seemingly being compliant. If you’ll insist on measures that are restrictive, expensive, or messing with the money, you’ll lose them as a client. Same goes as internal but especially external data protection officers; you can imagine how bad it is when the GDPR has protections against retaliation for them (termination, for example).

That’s where we’ll naturally clash.

To demonstrate on an example, Article 6(1) f) GDPR says: “[Processing shall be lawful only if and to the extent that at least one of the following applies:] Processing is necessary for the purposes of the legitimate interests pursued by the controller […]”.

What are legitimate interests? Many definitions are held in Article 4 GDPR, but none for this. That’s because f) is a catch-all for when none of a)-e) apply. You need these kinds of catch-all’s sometimes because real life cases are messy and hard to categorize, you don’t want to need to rewrite the law as values change over time, and being too strict with law can harm rights and freedoms instead of supporting them. But what is ‘legitimate’? Isn’t that deeply subjective? If I have a more company-critical view, I see their needs as less legitimate than they do. They see anything that helps their business and brings profit as a legitimate interest. Stuff like this is what the main disagreements are about.

But that also means that when I am ready to talk about law, I look like a ranting fool to others. Pasting sources has gotten a bad reputation online, long texts are too tryhard and focusing on the meaning of a single word seems pedantic and insufferable normally, and so it goes. I get that, but there is really no other way.

I recently noted to an online shop that I don’t think that forcing me into their email advertising automatically and waiting for me to opt-out is GDPR compliant. They were nice, as was I in my initial note, but you could also tell the tension. Big “having to justify myself” vibe. “We got this approved by TWO IT law firms!”. I responded that I still don’t agree and can explain upon request, but that I am thankful they opted me out and that I look forward to receiving the order (it’s vegan pistachio chocolate, if you’re curious).

I hope they leave it at that, because for my own training and research, I already wrote the text where I explain my arguments and the articles they’re based on, and there is just no way that would go over well, even if it’s really nice and non-threatening. It’s just so long and with so many sources, it would just be read as a crazy person chanting magic spells in hopes to get you to submit to their view. I also noticed the annoying limit of having access to law literature databases but being unable to link anything because the access is paywalled, so you can’t even use it for laypeople. They just have weird sites like Mr. Dr. Data Law Guy (made up, but you know the ones) and AI summaries.

The differences we have comes down to these few things:

I would love to discuss that with businesses in an open and honest way, but people get hostile easily when law enters the convo, as if everyone is out to get you and will use it to sue you. Even the response mail basically said “Don’t worry your pretty little head about that shop disclaimer, we just include that for evil people who play law games with us!”.

I get nothing out of such an email exchange (except practice, maybe); if I really wanted to, lodging a complaint with the supervisory authority would do more. I’m essentially just doing you a service by pointing something out that could cause issues.

Maybe I’ll write more about law in the future, but these constraints and outside perception hold me back a lot.

Reply via email
Published 30 May, 2025

#2025 #data protection