I was not trying to imply that government will not attempt to prevent cyber-attacks, quite the contrary is likely true. What I was trying to point to is that citizens’ trust in its government’s ability to protect them from outside attacks has decreased. By way of example, after the revelation that Chancellor Merkel’s phone was tapped by NSA for three years, the trust of German citizens in its government has decreased. While government-on-government spying is nothing new, what has changed – and what Snowden revealed – was the unprecedented scale of the spying activities, which are mainly made possible by technological developments.

Agreed that users are likely more concerned about private surveillance. I was trying to point to a slightly different aspect, notably the convergence of private and government surveillance. Governments use data and tech from private companies. Generally, the strict separation of the two spheres (government vs. private surveillance) has become blurred and private companies’ surveillance poses new challenges to democracies. On example that comes to mind is the Cambridge Analytica scandal and the corresponding data gathering of private companies targeted at influencing public opinion and elections.

The names were dropped to show general examples of (possible) unwanted realities that could result from a combination of political initiatives that attack privacy and today’s technological possibilities. It wasn’t intended to link specific politicians to particular ideologies. Since this wasn't clear, I deleted the names. In my view bad realities would be Benthamian-inspired thinking of utilitarianism or Harari’s Homo Deus, which presuppose a fully-transparent citizen.

Even if these policies may be well intended, they don’t lack shortcomings. On a political point, it seems unlikely that non-EU countries will follow these demands due to fundamentally divergent views and interests when it comes to privacy. Dictated by real-world economy constraints and shareholder value considerations, unfortunately private sector companies are likely to cave into demands on local data storage and sharing, as recently observed with the demands made by China and followed by apple (https://www.cnet.com/news/apple-moving-icloud-encryption-keys-to-china-for-china-based-users/). Infrastructural, the major shortcoming is that GDPR focuses on a bilateral transactional relationship. The governance of the bilateral relationship is necessary but far from sufficient since the big issue relates to behavior collection on a large scale that affects society as a whole. On this point, GDPR remains silent. Speculating as to why this may be the case, two presumptions come to mind: Either expert technological know-how and/or enforcement manpower is lacking or, perhaps the more likely explanation, the EU fears to fall further behind in the “digitization” race, which it feels might happen if the EU was to actually intervene in the technological infrastructure and in code.

Education, I believe, should start with tricks we learned in this course: Knowing how to browse anonymously and writing encrypted emails. Further, we have to figure out whether there is any actual smart way of using the smart phone. In the greater shape of things, educating children about privacy is crucial. We must make sure that children understand the risks involved in their daily usage of technology and equip them with tools that allow to take better control of their own data. This will require a severe realignment of the current trends in education. The task requires a wider societal discourse, which has been largely lacking so far.