# Privacy and Data Protection in the Era of Recommendation Systems: A Postphenomenological Approach

Ana Fernández Inguanzo

► To cite this version:

Ana Fernández Inguanzo. Privacy and Data Protection in the Era of Recommendation Systems: A Postphenomenological Approach. 17th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2022, Virtual, Germany. pp.133-147, 10.1007/978-3-031-31971-6_11. hal-05315947

HAL Id: hal-05315947

https://inria.hal.science/hal-05315947v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Privacy and Data Protection in the Era of Recommendation Systems: A Postphenomenological Approach

Ana Fernández Inguanzo(✉) ID

Law, Science, Technology and Society Research Group (LSTS), Brussels School of Governance, Vrije Universiteit Brussel, Bd de la Plaine 2, 1050 Ixelles Brussels, Belgium

ana.fernandez.inguanzo@vub.be

**Abstract.** Privacy and data protection are two fundamental rights. As complex concepts, they lend themselves to various interpretations aimed at protecting individuals. In this paper, I explore the concepts of ‘privacy’ and ‘data protection’ directly related to the protection of ‘identity’. I argue that the ability for privacy and data protection law to protect identity is being challenged by recommendation systems. In particular, I explore how recommendation systems are continuously *influencing* people based on what can be predicted about them, while the legal tools that we have do not fully protect individuals in this regard. This paper aims at breaching this gap, by focusing on the study of Porcedda, who examines four different notions of privacy related to identity under article 7 of the European Charter of Fundamental Rights. Through the huge capacity for analytics that draws on a lawful combination of consent and non-personal data, this paper examines why data protection regulation does not, in fact, fully protect individuals. In this paper it is explored how the notion of privacy, understood as the protection of identity, is especially relevant to understand the limitations of data protection law, and I explore postphenomenology to help us better contextualize the relationship between identity and recommendation systems.

**Keywords:** privacy · data protection · identity · philosophy · postphenomenology

## 1 Introduction: The Negative Influence of Recommendation Systems

Digital developments in the 21st century that use Big Data Technologies to display content – especially the use of algorithms (Machine Learning or Artificial Intelligence) in social networks – are challenging current privacy and data protection laws. They are labelled ‘recommendation systems’ and refer to technologies that categorize and recommend content based on massive amounts of data. Their increased capacity, power, and analysis in recent years poses new risks to the privacy field. This is not new, but in recent years, the impact of recommendation systems has proven to be increasingly
powerful with the potential for significant negative consequences to individuals and to society. In 2001, Sunstein argued how the Internet creates ‘echo chambers’ [1], where individuals are constantly exposed to conforming opinions, thus creating a feedback loop that reinforce pre-established views. A decade later, Pariser coined the term ‘filter bubble’ [2] to denominate how previous behaviours online determine the information that will be shown in the future, thus similarly reproducing circular content. For example, in politics individuals receive information explicitly about one political party or ideology that is determined by previous searches, which leads to content polarisation and reducing the capacity to make informed decisions in elections. The highly popular and controversial company of Cambridge Analytica [3] was able to retrieve information of millions of Facebook users to target personalised advertisements, and influence their opinions in elections. This is what Christopher Wylie, former employee of Cambridge Analytica [4], refers in his book as ‘computer psychology’, the use of psychology and software engineering that create tools to influence groups in social networks through algorithmic recommendations.

These types of recommendations (based on data) influence people's views through algorithmic and profiling systems that, by gathering (big) amounts of data, *control* or *influence* what people see by categorising and classifying the order of newsfeeds. Researchers have shown how Facebook algorithms were responsible for spreading 'divisive' content that helped the growth of German extremists' groups [5]. Even more, these systems have accelerated the creation of misinformation and fake news, even more problematic today with the prevalence of Covid misinformation [6, 7]. Yet, some of these issues are not only related to the gathering of data, but also to content-moderation in social networks. Although these issues are not only limited to the gathering of data, they are also always related to it. In fact, the algorithms used in recommendation systems are based on personalization, where individuals' data is necessary. These systems *influence* or at the very least *steer* people's opinions, as well as affect groups and communities, by for example reinforcing certain stereotypes [8], and this is only possible through the gathering of data. There are increasingly more personalized websites that use recommendation systems such as Spotify, Amazon, or Netflix, the latter uses algorithms to study groups and communities for content production [9]. Not only individuals are affected by these systems also group analysis reinforce or steer individuals. And thus, the vicious circle continues.

This so-called *influence* is broader than politics and runs deep in every recommendation system that uses data for content delivery. The Facebook Contagion Study [10] conducted by the platform in 2012 allowed to test manipulative effects on news feeds. The result proved that it is possible to influence emotions of a person by tailoring specific content – both negative or positive – in user's newsfeeds, where the more positive content led to a more positive emotions and shared content, and equally the negative content led to a more depressing and negative content-sharing.

Another example is found with YouTube's algorithms [11], which among other things, analyse data to maintain users engagement, and one of the variables was found to give 'speculation' a high rank, thus prioritizing these types of videos on the newsfeed due to its ability to keep users interested. The result was that YouTube was promoting or recommending conspiracy-theory videos, such as those claiming that the earth is flat [12].
There are plenty of examples in which algorithms and recommendation systems have a negative influence in society by spreading misinformation and polarizing content. These harms also include the exploitation of user's interests and vulnerabilities to sell products [13] such as the development of misleading patterns, sometimes referred to as 'dark patterns' [14], that make users take certain pre-determined actions. These algorithms take a step further, rather than merely analyzing present behavior they also try to predict the future, as if they could analyze our future thoughts, aiming to influence future actions:

> "Instead of merely offering advertisers the ability to target people based on demographics and consumer preferences, Facebook instead offers the ability to target them based on how they will behave, what they will buy, and what they will think" [15].

In this paper, I do not focus on the benefits of these technologies that classify and share content – which are in fact necessary to categorize the huge amount of content produced every day in the digital world [16]. I focus on the negative implications, where I study how recommendation systems can lead to negative consequences for individuals. For example, by retrieving gender data, it has been proven how algorithms exclude women from seeing similar job opportunities than men in social network's newsfeeds [17]; other studies also show a more subliminal influence of advertisements on how women see themselves, represented as sexual objects, based on the continuous ads or content/recommendations they receive [18], and the list goes on.

Algorithmic recommendation systems do not only influence the advertisement industry (e.g., what people buy), but also far more sensitive choices such as people's political views, the jobs they have access to, or how they perceive themselves (e.g., their body image, their gender) with implications for society and culture (e.g., TV content-creation, or health information). Nevertheless, the main regulatory tool in the European Union that protects against the misuse of personal data is the General Data Protection Regulation (hereafter GDPR). In practice, the examples above are lawful under the GDPR, thus proves limited to account for these intrusions or influences in the era of recommendation systems. Nonetheless, the European Data Protection Board (EDPB) an independent organism that contributes to the consistent application of data protection rules, considers dark patterns a violation of the regulation [14]. Yet, the issues are more profound than tricking people (e.g., with language or misleading pop-up boxes) to accept cookies. It affects opinions and thoughts of individuals constantly interacting with recommendation systems. In this paper, I aim to clarify the gap between data protection law and the lack of protection to this negative influence of recommendation systems over individuals. In the next sections I study what is this influence – how it is produced, why it is important and why it should be protected in the legal field.

The paper is structured as follows: Sect. 2 gives an overview of the fundamental rights to privacy and data protection, of their differences, and the limitations to protect individuals with recommendation systems. Section 3 focuses on the necessity to look at a definition of the right to privacy, understood as the protection of identity. Section 4 begins to explore the concept of identity as interconnected, following postphenomenologist, and the importance to include individuals in how recommendation systems co-shape their
identities, and the necessity to build legal tools to that protects them in this respect.
Section 5 offers a discussion and conclusion on these issues.

## 2 Privacy and Data Protection: Two Separate Fundamental Rights

Privacy and data protection are two different, but connected, fundamental rights in the European Union. Historically, these two rights are interconnected [19]. Privacy as a human right appeared first in 1948 when the term ‘privacy’ took a legal dimension with the Universal Declaration of Human Rights (UDHR) under article 12¹ Table 1. Privacy also emerged as a fundamental right under the European Charter of Fundamental Rights in 2009 (hereafter EU Charter), that was a legally binding instrument in the EU<fnref n="2" />. The right to personal data protection was also given a separate status as a human right under article 8 [20]. The latter was a process evolving from different national laws<fnref n="3" />, leading to the GDPR that was put into effect in 2018 [23], where questions regarding privacy in the digital world are directed towards the protection of personal data. Nonetheless, these two rights are connected, if only historically, such as the Directive 95/46/EC<fnref n="4" /> of 1995 commonly known as the ‘Data Protection Directive’ that was after replaced by the GDPR, aimed at protecting individuals “right to privacy with respect to the processing of personal data” (Art.1(1)). On the contrary, in the GDPR there is no mention of the word ‘privacy’, which focuses on the right to data protection (Article 1(2)).

In practice, the separation of two fundamental rights creates a dichotomy where historically both concepts have also been interpreted separately. Privacy is explained by different scholars as a social value because it reduces the capacity of the government to influence or coerce individuals from external influence [21], understood as self-determination, autonomy and freedom of choice [22]. Going back to the famous 1890’s article by Warren and Brandeis that first coined the term ‘right to privacy’, it was referred to as the right to ‘be let alone’, which at the time was threatened by the development of instant-cameras and gossip newspapers. Hardly would these scholars have imagined technologies that analyze your entire behavior and personality traits, such as people’s political preferences, their IQ or emotions, or decide what movies or even jobs are good for you. Since then, the privacy field has changed significantly with new digital technologies. Nonetheless, one hundred years ago Warren and Brandeis were defending the importance to protect people’s psychological traits, related to the protection of

<footnote n="1">¹ This gave ‘privacy’ the acknowledgement of a human right; and inspired the creation in 1950 of article 8 of the European Convention of Human Rights (ECHR). Article 17 of the International Covenant on Civil and Political Rights (ICCPR) of 1976 followed, which is the first legally binding instrument in Europe related to privacy, as it refers to an international treaty which was joined by 180 states, however it was not legally binding for the European Union.</footnote>

<footnote n="2">² Specifically, the right to privacy in EU law was not legally binding until the Lisbon Treaty in the same year 2009.</footnote>

<footnote n="3">³ Broadly speaking, national laws started to emerge, not regarding the concept of privacy but data laws. In 1973 Sweden created the first national privacy law named ‘Data Act’, followed by the German Federal Data Protection Act of 1978.</footnote>

<footnote n="4">⁴ Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995.</footnote>
thoughts or feelings or as they put it “the protection afforded to thoughts, sentiments, and emotions, expressed through the medium of writing or of the arts [...] is merely an instance of the enforcement of the more general right of the individual to be let alone” [22].

The two concepts developed differently from the understanding of the ‘protection of feelings and emotions’, autonomy, self-determination or ‘to be let alone’, and as the fundamental right to privacy Table 1 to a modern conception of privacy in the digital world, understood as control over personal information. In 1967 Alan Westin conceived the modern notion of privacy as “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others” [23]. These two notions are different from each other, the latter being a more practical approach towards considering data something that can be exchanged and controlled, that led to the GDPR [24], while privacy has a broader scope and refers to the protection of “private, family life, home and communications”.

There is a question that remains – why are the (negative) examples exposed in Sect. 1 linked to the use of data in recommendation systems, namely the negative impact on gender, filter bubbles, reinforcement of stereotypes etc., still lawful? The GDPR is the main regulation that exists today<fnref n="5" /> to protect people in this regard, yet it is limited, as it only refers to personal data<fnref n="6" /> and leaves every other data outside of the scope of the law. It is relevant to highlight that the GDPR still considers pseudonymized data personal (Article 4(5)), leading authors to consider that it has a broader scope of what ‘personal’ is therefore making GDPR applicable. However, in practical terms, it is all allowed by the legal basis<fnref n="7" /> of ‘consent’. The GDPR offers legal bases under which it is possible to gather personal data – one of them being ‘consent’. According to the GDPR, consent must be: freely given, specific, informed, unambiguous and clear (Article 4(11)). Social Networks commonly gather consent to analyze data and create recommendations that are tailored and personalized to individuals. In practice, this is achieved through long statements in forms of Privacy Policies and Cookies. This is rather contradictory, as normally these are long pieces of text that people do not understand nor have time to read. Such as one sentence of Facebook’s data policy warns users that it may “use the information we receive about you… for internal operations, including troubleshooting, data analysis, testing, research and service improvement” [26]. Language is complex, far from specific, and lacks clarity. Similarly, the examples in Sect. 1 of this paper where influence over ideologies, gender and circular content exist lawfully, this is achieved without protection, through GDPR’s consent.

<footnote n="5">⁵ There will be new EU regulations such as Data Act or AI Act that will deal with non-personal data, but these are not enforced yet and refer to a data transformation by 2030. [25] https://www.europarl.europa.eu/factsheets/en/sheet/64/digital-agenda-for-europe.Data Governance Act has been approved in 2022 but will only be enforced in 2023. And it only applies to the facilitation of public data sources. See: https://digital-strategy.ec.europa.eu/en/policies/data-governance-act. In addition, especially relevant for this paper is the Digital Service Package that contains two regulations: Digital Service Act (DSA) and Digital Markets Act (DMA), that will enter into force in 2024: https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package.</footnote>

<footnote n="6">⁶ Article 4(1) GDPR.</footnote>

<footnote n="7">⁷ Article 6 GDPR.</footnote>
<table><caption>**Table 1.** Conceptual graphic of the concept of ‘Privacy’ as a fundamental right</caption><tr><td>Art 12 Universal Declaration of Human Rights (UDHR, 1948)<br/>1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation<br/>2. Everyone has the right to the protection of the law against such interference or attacks</td><td>Art. 8 European Convention on Human Rights (ECHR, 1950) [overlaps to art.12 UDHR]<br/>1. Everyone has the right to respect for his private and family life, his home and his correspondence<br/>2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others</td></tr><tr><td>Art. 17 International Covenant on Civil and Political Rights (ICCPR, 1976)<br/>1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation<br/>2. Everyone has the right to the protection of the law against such interference or attacks</td><td>European Charter of Fundamental Rights (EU Charter, 2009) [overlaps with art. 8 ECHR]:<br/>Article 7 - Everyone has the right to respect for his or her private and family life, home and communications<br/>Article 8, - 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority</td></tr></table>

In addition, many authors like Solove warn that privacy as a fundamental right and not only data protection is necessary to protect against the possible threats to new socio-economic and technological developments to protect human ‘self-determination’ from external influences and new developments. In this line, Solove explains the complexity of this term [27] highlighting the necessity to understand privacy as “the capacity of the human subject to keep and develop his personality in a manner that allows him to fully participate in society without however being induced to conform his thoughts, beliefs, behaviours and preferences to those thoughts, beliefs, behaviours and preferences held by the majority”. Following this rationale, privacy protects against the misuse or influence over the thoughts of individuals<fnref n="8" />. In the next section, I will focus on the relation between privacy and thought processes with the concept of ‘identity’. These two concepts are

<footnote n="8">⁸ Herein lies another path, which merits further exploration in the future: could the fundamental right to ‘freedom of thought, conscience and religion (Article 9, EU Charter) also be considered</footnote>
interrelated, and I will clarify how the concept of privacy in the digital sphere refer to
the protection of thoughts, and the necessity for data protection to also account for it.

3 Privacy and Identity

The fundamental right to personal data protection, and the GDPR, has proven to be
limited to protect individuals against the *influence* of recommendation systems. This
lack of protection has been explained in the literature as an issue with the limited scope,
arguing that all types of data should be considered personal as it always relates to
an individual [28]. This is also what has been accounted for the necessity for ‘group
privacy’, advocates have claimed that groups (or group profiling) should also be part
of a regulatory landscape [29], but also framed as discriminatory algorithms, and we
should aim for anti-discrimination law in algorithmic profiling [30], the latter leading to
algorithmic governance. Individual (personal) data protection is therefore not enough to
protect us against the (negative) *influence* of recommendation systems.

The fundamental right to privacy shares more light on this issue. Porcedda [31] has
coined the term the ‘four limbs of privacy’ to explain the fundamental right to privacy
under article 7 of the EU Charter Table 1. She considers privacy as an “umbrella term” that
contains ‘four limbs’ related to the protection of four different sections: (1) private life (2)
family life, (3) home (4) communications. In her work, the author shows the importance
of identity as an intrinsic value of privacy: “I ideally belong in a group of authors
that consider privacy instrumental to the development of identity/personhood based on
intimacy and leading to autonomy”<fnref n="9" />. Porcedda’s analysis shows that protecting privacy
is in fact, protecting people’s identities, and her work supports the benefits of having two
separate rights, a more practical approach of data protection<fnref n="10" /> “both rights, in fact, are
instrumental in fostering personhood, one’s unique identity, protected as an expression of
dignity, and enabling autonomy as the two rights emerged out of modernity”<fnref n="11" />. Porcedda
names it ‘one synergy’, both rights supporting each other. However, the scholar does not
explore<fnref n="12" /> the lack of identity protection in practice with secondary law GDPR; and how
it should change regarding new development of (big) data technologies, as exposed in
Sect. 1 of this paper, especially with recommendation systems. The multiple dimensions
of the right to privacy have also been exposed by several scholars and have been part of
the EU Court of Justice decisions, yet Porcedda’s analysis helps to frame the issue. In

applicable in protecting identity in the digital sphere? – However, in this paper I center the
discussion on privacy and data protection as sufficient to understand this issue.

<footnote n="9">⁹ Page 74 – Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>

<footnote n="10">¹⁰ The right to the protection of personal data as related to private life is also one at the core of the European culture of data protection since the German Constitutional Court claimed that we have the “right to informational self-determination”.</footnote>

<footnote n="11">¹¹ Page 80 – Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>

<footnote n="12">¹² Although Porcedda’s work mentions how the notion of ‘personal data’ does not account for new inventions of computerized systems and unprecedented (personal) data processing capabilities, such as transborder data flows (p.93).</footnote>
the following paragraphs, I summarize Porcedda’s analysis of the four limbs of privacy, and how these are related to protecting identity, and the limitations of this protection within recommendation systems.

(1) **The right to private life** refers to protect private life since the Greek Polis, where this life was outside the public eye, even claiming that it allowed to benefit male's domination at home [32]. Porcedda shows the change since the Greeks towards the modern concept of privacy, and how it now refers to protecting one's development and personality in a liberal democracy, to forge individual and their free thoughts without external interferences, arguing that privacy allows "... the development of one's personality by making sense of the different roles played by the individual in a community..."<fnref n="13" />. This is a modern consideration of privacy, protecting the freedom to decide and to act in private that can interfere with citizen's thoughts and ideas, and even more so with the importance to avoid fascists or totalitarian regimes in these instances. In this line, to protect private life is not to protect the private space but to protect 'personality or identity' in private spaces, however, this has proven challenging with a computerized society, especially regarding recommendation systems and analytics that decide what content an individual should see, or as it is claimed in a misleading form, it provides you with recommendations tailoring your interests but restraining others.

(2) **The right for family life** also relates to answering the question 'Who am I?'<fnref n="14" />. The author points out how family life must be protected to freely choose who you want to be (private life), but also to decide without external interference who an individual decides to marry, or what type of family you would like to have (family life). The latter is, according to the author, another crucial component to protect *identity*, as identity develops through different stages of socialization that starts with the family<fnref n="15" />, and family life is a crucial element should be protected also against fascists or totalitarian systems that want to repress it, such as prohibiting interracial or gay marriages<fnref n="16" />. Following this, recommender systems that allow to *influence or coerce* individuals based on family status or relationship and suggest what movies a person should watch, or what news might be relevant (e.g., a single woman receives different content than a lesbian, different from a person that is gay, and another one from a person that is married), are, at the very least, in some degree of conflict with the right to privacy.

(3) **The right of home;** this should not be confused with the right of *a home*, in contrast, this is also shown to be a place to forge individual identity, a safe place to express one's identity and thoughts without repercussion or interference, far from authoritarian powers. In Porcedda's words "because Article 8 concerns rights of central importance to the individual's identity, self-determination, physical and moral integrity, maintenance

<footnote n="13">13 Page 83 – Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>

<footnote n="14">14 Page 87 – Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>

<footnote n="15">15 Taylor (1989) in Sources of the self argues that the fundamental interaction of identity is of love and family "the increasing possibility to choose freely one's partners, which places love at the heart of the family, makes family life instrumental to the development of identity" (Idem).</footnote>

<footnote n="16">16 Page 88 – Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>
of relationships with others and a settled and secure place in the community .... While
this is threatened by new technologies, such as a form of ‘self-surveillance”<fnref n="17" />. Indeed,
this has been shown to be conflicting with new technologies such as recommendation
systems that limit the capacity for individuals to have a ‘home’ due to profiling, analytics
and data gathering, where they have little control over profiling.

Finally, (4) right of communications; refers to our thoughts expressed in (written) language, be it through the phone or chats. Identity is expressed through language and must be protected “and can prove particularly harmful for the creation of the individual’s image of the self”<fnref n="18" />. This refers particularly to data protection, however new developments in algorithmic data analysis challenge this, where our desires are also based on clicks and likes. Every data point counts, even Facebook is able to gather what a user starts to type but deletes afterwards [33].

The value of Porcedda’s work is shown in the intersection of the right to privacy, as in fact a right to identity, with the right to personal data protection. These two rights are important to protect individuals from an abusive intrusion in their *identity, personhood, and autonomy* in support of a “freely developed identity” [31]. Porcedda affirms that both rights act as a synergy and help to protect individuals (in different ways), where data protection allows to ‘once this personality is expressed, its integrity can be protected against misuses, even allowing it to change’<fnref n="19" />. As analysed and demonstrated in these past two sections, however, not only is the right to data protection currently inadequate to address the *influence* of recommendation systems, but in addition the influence of recommendation systems threatens the right to privacy, seen as the right to identity.

4 Privacy as Interconnected – Postphenomenology and Identity

Recommendation systems have an influence over the identity of a person. It has been shown to, lawfully, modify through recommendation systems, culturally and individually, the thoughts and opinions of an individual. The extent to which this influence is exerted is up to interpretation. Let us imagine (although it has a similar real-life example [37]) a recommendation system that profiles a woman in her 30s as interested in baby products because of her age, where the recommendation system refers pregnancy products to her, as well as other articles or even videos referring to married people, kids, and the importance of being a mother in a variety of forms across platforms, romantic movies, family-oriented articles that explain the psychology of kids etc. On the contrary, a man in the same age is profiled by a recommendation system as a single-oriented, interested in articles about economy and work performance. There are two different identities, however one cannot be sure how these profiling or analysis affects them in their lives. As de Hert argues “‘Being profiled” therefore supplement “being identified” as the real threat to identity.... Because profiles on us will be established on us without us knowing how and when and if they will be used…” [38]. It can be the case that the woman was not

<footnote n="17">¹⁷ Page 90 – Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>

<footnote n="18">¹⁸ Page 91 – Idem.</footnote>

<footnote n="19">¹⁹ Page 97 – Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>
sure she wanted to become a mother, with these recommendations constantly referring to this type of content, based on profiling, it will perhaps be convinced or feel pressure to become one, while the male in his 30s did not come across this content.

There are impositions or influences in our identity that modify individual thoughts and emotions, and that have repercussions over individuals' perceptions of themselves and their lives, but the nature of identity as something subjective and culturally constructed makes it difficult to pinpoint one single element. In this line, social networks and recommendation systems have created tools to remove dangerous content that can easily be perceived as alarming [39], but not to withdraw general instances such as those based on gender. In this section, I analyze why the nature of identity is a far more interrelated complex than merely understood as a separate digital form, where I consider that post-phenomenology helps to clarify this concept in this digital world of recommendation systems and social networks.

Scholars have warned about how information platforms are a ‘massively interme-
diated environment’ that must be addressed [21], and the necessity to control different
forms of algorithms as “it configures life by tailoring its conditions of possibility” [36].
However, the concept of identity does not appear in their analysis. Other authors have
also coined the term ‘digital subject’, and refer to a complex relation of human beings,
although related to, still separated from the digital [35]. Cheney-Lippold [36] has advo-
cated for a separated ‘algorithmic identity’ meaning “an identity formation that works
through mathematical algorithms to infer categories of identity on otherwise anonymous
beings”. Similar is the view of scholars [34] that see the character of data protection as
dynamic, detached from a person and susceptible to flow. Traditionally, the concept of
identity as well as privacy has been explained as socially constructed, as a part of culture
and public understanding; even considering social institutions part of the identity of a
person [40], technology was also thought as socially constructed [41]. Similarly, authors
have considered social networks or algorithms are mere representations of the society
that we live in<fnref n="20" />.

On the contrary, the field of postphenomenology [42, 43], a field of study in philoso-
phy of technology, argues the necessity to understand technology as a mediated tool, that
acts upon the world, influencing or creating (new) interconnected relations. Technology
is, in view of postphenomenologists, a co-shaper (co-evolving) with society and with
individuals. These authors strongly affirm that there is an agency of technology, and
this is especially relevant to understand the influence of new technologies like recom-
mendation systems over the identity of individuals. Following postphenomenologists, I
argue that new technological tools, especially recommendation systems, challenge and
co-modify the freedom to define the identity of individuals, and in its extent challenge
the right to privacy.

Whereas it has been shown how the concept of ‘identity’ is central to understanding
privacy [38], the threat to identity is only stronger in a world where the *influence of*
(big) data to study and analyze people is increasing exponentially, and data protection
law should account for it. However, there is still a long way until we have regulatory

<footnote n="20">²⁰ The field of Science and Technology Studies (STS) has traditionally considered technology as socially constructed e.g., Trevor Pich; Langdon Winner.</footnote>
tools<fnref n="21" /> that can protect individuals from this *influence over our identity*, thus making individual's data protection stronger.

Following postphenomenologica perspective, identity should be considered not solely socially constructed, but technologically co-modified: the technology also modifies our own views and relations to the world. While Porcedda argued that “profiling removes the power of individuals to make claims about who they are”<fnref n="22" />, this is only one side of the problem, because profiles also co-modify the very own individuals. Identity is not separated from the individual, but is co-shaped by technologies, such as recommendation systems, that influence how we see ourselves and the world. This can lead to reflect of the necessity to give more autonomy of individuals over the profiles being made of them. Going back to the example of the woman in her 30s, perhaps this woman would like to know that she is being profiled as wanting kids and she is being denied of other type of content. But whereas Porcedda showed the importance to protect identity from interference, I also support the necessity to consider how identity is fluid, in constant co-modification by these technologies. People's identities are constantly being influenced by recommendation systems, against traditional social constructivism, individuals do not exist independently of these technologies that use data and algorithms to classify content.

Thus, the importance of data protection law to assess these type of classifications not as outside the individual, but co-modifying people in real life based on their data. Thus, data protection law should have tools to protect not only data, but also the inferences that a person has in real time. On the contrary, if one look at the problem as the necessity for group privacy or algorithmic discrimination become separate from the individual, discrimination is seen as a negative form that should be banned in certain instances or groups should be protected. While in fact, discrimination can vary from individuals, perhaps the 30-year-old woman wants to keep receiving kids' products and related pregnancy information, while other woman will find this to be limiting her possibility to find other career-oriented content. Discrimination can be in many different forms, and can change depending on how identities are developed, or who the person is. If we take the autonomy of individuals to see what is happening with their data, protecting people from discrimination without them being included is not very efficient. In the previous example, a woman in her 30s might be *influenced* to have a child just based on algorithmic profiles because (1) she is a woman (2) she is old enough (3) she likes couples' pictures (4) she likes romantic movies etc. Is she being discriminated based on gender? Is she aware that this is happening? The issue then is framed differently, it is not about discriminatory algorithms, but rather protecting people in the digital sphere from interference on their thoughts or emotions, and in its extent, to develop freely their identity, whereby the importance to give individuals more autonomy in social networks and recommendation systems becomes necessary.

<footnote n="21">²¹ Further investigations should account for new regulatory tools such as the AI Act and the influence or manipulation of recommendation systems.</footnote>

<footnote n="22">²² Page 100 - Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology.</footnote>
# 5 Conclusion

The right to privacy has been shown to protect thoughts and ideas of individuals from outside technological interference – their identity. Porcedda’s work helps to clarify the definition of the right to privacy, explaining how each ‘four limbs’ relate to the protection of identity. The right to privacy has been distinguished from the right to data protection, highlighting how the two rights are different, whereas privacy allows for a much-needed protection from the external (negative) influence of recommendation systems over people’s identities. However, data protection tools do not help people in this respect e.g., the legal basis of consent that led to (long) privacy policies that individuals do not read and even less understand, or anonymization where profiles are lawfully being made influencing people’s identities.

In this paper, it has been shown how data protection is the main regulatory framework in EU to protect individuals’ personal data, however limited. Here it lies the conflict, data protection does not protect individuals from the manipulation generated from data analytics in social networks and recommendation systems. It is necessary to discuss that the two rights should not protect the same values, as they are in fact two separate rights, however this line of arguments points towards the problem: privacy protects individuals’ thoughts and identities, whereas in practical terms, data protection law is the only regulatory framework that protects people’s data but does not consider these issues.

There is still a long path to improve the protection of people’s data, but this paper intended to show the necessity for considering identity as co-modified by these technologies as a central concept, and through postphenomenology, propose to consider people continuously co-shaped by data (e.g., stereotypes, gender, age...). Identity is a complex process of co-modification with technologies, and this paper highlights the continuous influence of opinions and ideologies through recommendation systems. This helps to re-interpret the issue as broader than only discriminatory algorithms and illustrates the gaps between data protection and privacy.

How can we prosper/protect identity in the digital sphere? This paper helps to frame the issue of the intrinsic relation of people’s identities as a dynamic character that evolves and co-exist with recommendation systems. It also clarifies the lack of tools among GDPR, and the necessity to create new tools that support inferences created by (big) data technologies, among social networks and recommendation systems. I argued the importance of giving people autonomy over the recommendations, as they are constantly co-modified, and they should have the freedom to decide what they would like to receive or how (or if) they are being steer or deprived from certain content.

Both rights cannot and should not protect the same issues, but it is possible to learn from the right to privacy. Data protection law, as it has developed, does not have the tools to protect from the negative influence over identity in recommendation systems, that have led to intrusions over people’s ideas and thoughts, be it political or as common as the decision to have a kid, read poetry, or restrain to offer news about personal development. Individuals in our current digital society cannot and should not be considered outside the digital, but rather ‘brought-up’ and influenced through technologies. In this regard, data protection still has a lot to learn.
**Acknowledgements.** This paper has received valuable comments and support of my supervisors Rosamunde Van Brakel, Trisha Meyer and Rocco Bellanova; the previous work and inspiration of Maria Grazia Porcedda, and Paul de Hert.

This project has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 813497.

## References

1. Sunstein, C.R.: Echo chambers: Bush v. Gore, impeachment, and beyond. Princeton University Press, Princeton (2001)

2. Pariser, E.: The Filter Bubble: What The Internet Is Hiding From You. Penguin UK (2011)

3. Cadwalladr, C., Graham-Harrison, E.: Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach (2018). https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election

4. Wylie, C.: Mindf*ck: Inside Cambridge Analytica's Plot to Break the World. Profile Books (2019)

5. Horwitz, J., Seetharaman, D.: Facebook Executives Shut Down Efforts to Make the Site Less Divisive (2020). https://www.wsj.com/articles/facebook-knows-it-encourages-division-top-executives-nixed-solutions-11590507499

6. Posetti, J.: News industry transformation: digital technology, social platforms and the spread of misinformation and disinformation. 15 (2018)

7. The online world still can't quit the 'Big Lie'. https://www.politico.com/news/2022/01/06/social-media-donald-trump-jan-6-526562. Accessed 11 Oct 2022

8. Bellanova, R., González Fuster, G.: No (Big) Data, no fiction? Thinking surveillance with/against Netflix. Presented at the February 9 (2018)

9. Hallinan, B., Striphas, T.: Recommended for you: the Netflix Prize and the production of algorithmic culture. New Media Soc. 18, 117–137 (2016). https://doi.org/10.1177/1461444814538646

10. Meyer, M.N.: Everything You Need to Know About Facebook's Controversial Emotion Experiment. https://www.wired.com/2014/06/everything-you-need-to-know-about-fac[ebooks-manipulative-experiment/

11. As algorithms take over, YouTube's recommendations highlight a human problem. https://www.nbcnews.com/tech/social-media/algorithms-take-over-youtube-s-recomm[endations-highlight-human-problem-n867596. Accessed 17 Mar 2022

12. Thompson, C.: YouTube's Plot to Silence Conspiracy Theories. https://www.wired.com/story/youtube-algorithm-silence-conspiracy-theories/

13. The Age of Surveillance Capitalism: The Fight for a Human Future at the New ... - Shoshana Zuboff - Google Libros. https://books.google.be/books?hl=es&lr=&id=W7ZEDgAAQBAJ&oi=fnd&pg=PT12&dq=surveillance+capitalism+book&ots=dpn6GTSDu0&sig=nlwmFMGAZqt2bwVPdNloOhCRSXQ&redir_esc=y. Accessed 10 Dec 2021

14. edpb_03-2022_guidelines_on dark patterns_in social media platform interfaces_en.pdf. https://edpb.europa.eu/system/files/2022-03/edpb_03-2022_guidelines_on dark patt[erns_in社会_media 平台 interfaces_en.pdf

15. Biddle, S.: Facebook Uses Artificial Intelligence to Predict Your Future Actions for Advertisers, Says Confidential Document. https://theintercept.com/2018/04/13/facebook-advertising-data-artificial-intelligence-ai/. Accessed 01 Mar 2022

16. How to clear your viewing history in Netflix. https://www.imore.com/how-clear-your-vie[wing-history-netflix. Accessed 19 Aug 2022
17. Facebook's ad algorithms are still excluding women from seeing jobs. https://www.technologyreview.com/2021/04/09/1022217/facebook-ad-algorithm-sex-discrimination/. Accessed 10 Aug 2022

18. Nkem, F.U., Chima, O.A., Martins, O.P., Ifeanyi, A.L., Fiona, O.N.: Portrayal of Women in Advertising on Facebook and Instagram (2020). https://doi.org/10.5281/ZENODO.4006048

19. 20190513.Working_Paper_González_Fuster_Hijmans.pdf. https://brusselsprivacyhub.eu/events/20190513.Working_Paper_Gonza%CC%81lez_Fuster_Hijmans.pdf

20. EU Charter of Fundamental Rights. https://ec.europa.eu/info/aid-development-cooperation-fundamental-rights/your-rights-eu/eu-charter-fundamental-rights_en. Accessed 05 Aug 2022

21. Cohen, J.E.: What privacy is for symposium: privacy and technology. Harv. Law Rev. **126**, 1904–1933 (2012)

22. Gutwirth, S., De Hert, P.: Privacy, data protection and law enforcement. Opacity of the individual and transparency of power. Direito Público. 18 (2022). https://doi.org/10.11117/rdp.v18i100.6200

23. Warren, S.D., Brandeis, L.D.: The right to privacy. Harv. Law Rev. **4**, 193–220 (1890). https://doi.org/10.2307/1321160

24. Westin, A.F.: Special report: legal safeguards to insure privacy in a computer society. Commun. ACM. **10**, 533–537 (1967). https://doi.org/10.1145/363566.363579

25. GDPR EUR-Lex - 32016R0679 - EN - EUR-Lex, https://eur-lex.europa.eu/eli/reg/2016/679/oj. Accessed 01 Mar 2022

26. Digital Agenda for Europe | Fact Sheets on the European Union | European Parliament. https://www.europarl.europa.eu/factsheets/en/sheet/64/digital-agenda-for-europe. Accessed 13 Dec 2022

27. Meta Privacy Policy – How Meta collects and uses user data. https://www.facebook.com/pri/vacy/policy/?entry_point=data_policy_redirect&entry=0. Accessed 05 Aug 2022

28. Solove, D.J.: A taxonomy of privacy. Univ. Pa. Law Rev. **154**, 477–564 (2005)

29. Bellanova, R.: Digital, politics, and algorithms: governing digital data through the lens of data protection. Eur. J. Soc. Theory **20**, 329–347 (2017). https://doi.org/10.1177/1368431016679167

30. Taylor, L., Floridi, L.: Group Privacy: New Challenges of Data Technologies. Group Priv. (2017)

31. O'Neil, C.: Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy. Crown (2016)

32. Porcedda, M.G.: Cybersecurity and privacy rights in EU law: moving beyond the trade-off model to appraise the role of technology (2017). http://hdl.handle.net/1814/26594. https://doi.org/10.2870/4605

33. Schoeman, F.D.: Philosophical Dimensions of Privacy: An Anthology. Cambridge University Press, Cambridge (1984)

34. Naughton, J.: Facebook Saves The Stuff You Type — Even If You Have Second Thoughts And Delete It BEFORE You Post. https://www.businessinsider.com/facebook-saves-stuff-you-start-typing-and-the-delete-2013-12. Accessed 14 Dec 2022

35. Hill, K.: How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did. https://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/. Accessed 12 Aug 2022

36. What's in a name?: identiteitsfraude en -diefstal. Maklu (2012)

37. How to Filter, Block, and Report Harmful Content on Social Media | RAINN. https://www.rainn.org/articles/how-filter-block-and-report-harmful-content-social-media. Accessed 12 Aug 2022

38. Cheney-Lippold, J.: A new algorithmic identity: soft biopolitics and the modulation of control. Theory Cult. Soc. **28**, 164–181 (2011). https://doi.org/10.1177/0263276411424420
39. The Digital Subject: People as Data as Persons. https://journals.sagepub.com/doi/epub/https://doi.org/10.1177/0263276419840409. https://doi.org/10.1177/0263276419840409. Accessed 22 Oct 2022

40. Rodotà, S.: Data protection as a fundamental right. In: Gutwirth, S., Poullet, Y., De Hert, P., de Terwangne, C., Nouwt, S. (eds.) Reinventing Data Protection?, pp. 77–82. Springer, Dordrecht (2009). https://doi.org/10.1007/978-1-4020-9498-9_3

41. Agre, P.E.: The architecture of identity: embedding privacy in market institutions. Inf. Commun. Soc. **2**, 1–25 (1999). https://doi.org/10.1080/136911899359736

42. Winner, L.: Do artifacts have politics? *Daedalus* **109**, 121–136 (1980)

43. Ihde, D.: Postphenomenology: Essays in the Postmodern Context. Northwestern University Press (1995)

44. Verbeek, P.-P.: What Things Do: Philosophical Reflections on Technology, Agency, and Design. Penn State University Press (2021). https://doi.org/10.1515/9780271033228