The second speaker in this session at the AoIR 2025 conference is the great Raul Ferrer-Conill, whose focus is on government strategies for protecting citizens’ rights to their user data. This has become particularly critical in the context of generative AI, which uses user data to train Large Language Models; additionally, there is also the constant datafication of citizens in many other contexts.
This is being addressed in part through Data Protection Officers (PDOs): these are tasked with taking care of and championing data privacy. Who are these people, and what are their tasks? Is there alignment between policies and actual practices? The present project explores this through a comparison between China, Kenya, and Norway – three very different policy environments that approach digitisation and data protection very differently.
How do DPOs and their organisations conceptualise and regulate citizens’ rights; what policies do they advocate for; and how do they understand their mandates? This project explores this from the perspective of contextual integrity theory, socio-technical systems, and sense-making theory. It combines policy document analysis with expert interviews – and such expert access was easier in Norway than in the other countries.
In Norway, its adoption of the EU’s GDPR frames data protection as inseparable from human dignity and privacy; this spells out eight core data subject rights, and positioned the DPO as an independent advisor who informs, advises, and oversees but does not bear personal responsibility for non-compliance.
In Kenya, the Data Protection Act of 2019 mirrors the GDPR, and positions personal data protection as a constitutional right while imposing restrictions on transferring personal data outside of Kenya. It establishes a Data Protection Commissioner and requires organisations to designate a DPO under certain circumstances.
In China, the Personal Information Protection Law does not explicitly define data rights, but highlights some key rights; it establishes Personal Information Protection Officers but does not spell out their duties, qualifications, or authority. In July this year, the Cyberspace Administration of China issued guidance on these Officers’ reporting requirements.
Several aspects of DPOs arise from a comparison: the three countries differ in various ways on how they define designation criteria, public authorities, role definitions, legal liability, independence, qualifications, resources, reporting, notification requirements, and tasks for these DPOs. Largely, though, DPOs themselves see themselves in advisory roles without executive powers, providing guidance and advice without making binding decisions. This also affords them a certain level of independence.
There are also issues with legal ambiguity, especially with respect to how much Norwegian laws might override GDPR requirements. Overall, the focus on national norms and values regarding the meaning of privacy seems to be the main factor structuring legislation.
