Governing knowledge and technology: The European approach on data protection

At a systems level data, knowledge and technology are interconnected. Data is the raw material that is used to create knowledge, and technology is the application of knowledge. In recent decades, the growth of data technology has been exponential due to the development of digital technologies such as computers and the internet. The General Data Protection Regulation (GDPR) was implemented in response to the increasing use of data by private companies and the inadequacy of the 1995 Directive on Data Protection in addressing these issues. The GDPR has effectively strengthened data protection in the EU through its harmonization with the European Data Protection Board, the requirement for Data Protection Officers within data controllers' organizations, and the implementation of clear rules and explicit fines. However, it is important to recognize the limitations of the regulation, including its selective nature regarding the growth of personal data and the potential negative impact on citizens' knowledge about themselves. An efficiency and efficacy analysis found that it has contributed to the development of a common European data protection culture and the protection of individuals' rights, though it has had a negative impact on the financial performance of some companies. A systems analysis using systems thinking illustrates the implications of the regulation for the functioning of societal systems and the relationships between them. As data technology and the use of data-driven synthetic agents like AI continue to advance, it may be necessary to consider alternative approaches, such as focus on anonymization, in future addiction to the data protection regulatory framework.