We live digital lives, working in the cloud, doing online banking, and adjusting our smart thermostat. Without exception, there’s always that prompt: do you agree with our terms? We click ‘yes’ without reading, because refusal means no meeting, no service, no connection. But unwittingly, we agree to the collection and processing of our personal data. Privacy isn’t a formality – it’s a fundamental right allowing us to live freely. How to protect ourselves? I call for a new approach.
Renas Hamad is Legal & Compliance Officer at PXS. He earned his doctorate with a thesis on the constitutional protection of privacy, and the impact of digitalization and lawful restrictions.
Illusion of choice
Every online step leaves a trace: data about our behavior, location, and preferences. This data is systematically collected, linked and analyzed, eroding the foundation of privacy. Laws such as the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) are designed to protect users. They do not address the core issue, however: that most digital services for consumers are built on the collection and processing of personal data.
Data isn’t collected out of necessity for the service, but because it fuels analytics, marketing and optimization. Users consent to this through deliberately long and complex policies, without really knowing what they agree to – an illusion of choice. The price: our privacy.
Constitution falls short
This practice clashes with constitutional promises. For instance, Articles 10 through 13 of the Dutch Constitution protect privacy, physical integrity, the inviolability of the home and the confidentiality of communications. These are articles forming the foundation of a free society.
The challenge of our digital age is that constitutional protection focuses on government interference, whereas today, the terms of private platforms affect our private lives. What’s the value of constitutional rights if they don’t protect against systems that dictate what information we see, who we can connect with, or what access we have?
If this power of tech touches our autonomy, the law must set boundaries, even beyond the traditional scope.
A new approach
New legislation isn’t necessarily required, since the Constitution already allows a broader application. Courts can (and should) assess whether terms imposed by digital platforms are compatible with fundamental rights.
That requires a test of necessity and proportionality. Does data processing violate personal privacy, without justification? Then these terms must be declared invalid. Without this review, fundamental rights are empty promises.
We need to shift our thinking: from reasoning through technological possibilities, to what’s truly necessary. Most digital services work perfectly fine with minimal data. Privacy must be the default – to only process what’s strictly necessary and proportionate.
Privacy by design
At PXS, we put this principle into practice. Our systems are built on data minimization and consent, ensuring that only essential data is collected, processed and shared. In case of number portability, that is the number to be transferred, the type of service, and the confirmation that identity verification has been done. Nothing more is needed, so nothing more is asked.
This way, we contribute to a digital environment where privacy is not restored after the fact, but respected from the start. Not as an afterthought, but as a foundation.
Because in the end, we shouldn’t adapt to the system, the system must adapt to us.
If you want to read more about the necessity of revising the constitutional protection of privacy, please find my full thesis here (in Dutch).
