Privacy and Data Protection: The interaction of meta-regulation and information governance

Abstract

Collection and storage of exponential volumes of personal data give rise to significant opportunities and risks for organisations. This thesis examines the challenge of controlling personal information from the standpoints of the regulator and the regulated organisation. First, the thesis analyses the regulatory design of Australia’s Privacy Act 1988 (Cth) and the European Union’s General Data Protection Regulation involving the use of principles-based and meta-regulation that devolves the design and implementation of compliance mechanisms to regulated organisations. Second, from the organisational perspective, the thesis examines the challenges for corporate governance when boards must grapple with multifaceted strategic opportunities and risks arising from the intersection of technology, data, and regulation. Based on interview evidence, it develops a theory of effective information governance, which enables data and information to be safely leveraged as a business asset, while ensuring compliance with privacy and other information regulatory and legal requirements. These findings are intended as a practical governance solution that may assist organisations in achieving data and privacy meta-regulatory requirements, while pursuing strategic organisational objectives in complex and data-driven operating environments.