The Collective Right to Data in the Age of Artificial Intelligence: A Critical Study of Personal Data Regulation

Abstract

This study examines and critiques the effectiveness of the individual-control model adopted by the EU General Data Protection Regulation (GDPR) and, subsequently, Egypt’s Personal Data Protection Law, in the face of artificial intelligence. This legislative philosophy places the individual at the centre, seeking to protect them by enabling personal control. In the context of personal data, it aims to empower the data subject to determine how their data are collected and processed.

To advance this perspective, the study investigates the impact of AI on privacy and personal data from a novel analytical perspective by introducing the concept of the “Data Influence Cycle” as a framework for understanding the risks AI poses to privacy and personal data. According to this framework, data pass through four phases: collection, processing, dissemination, and eventually feedback and readjustment. While each of these phases involves its own distinct risks, artificial intelligence interconnects them into a continuous cycle designed to exert an ongoing influence on data subjects.

The study reveals that individual control may inadvertently harm not only the data subject but also others. Due to AI’s analytical and inferential capabilities, it can create virtual algorithmic groups of individuals who share common traits and beliefs, such that one person’s data inform the understanding of everyone else in those groups. To shed light on this phenomenon, the study employs an economic analogy to evaluate how individual control affects these broader groups.

Ultimately, the study reaches two primary conclusions. First, when confronted with AI, data subjects lose meaningful control over their personal data. Second, it is more efficient to regard privacy and personal data as a collective right that affects the group, rather than as a purely individual right.