Lifting the Cage of Consent: A Techno-Legal Perspective on Evolvable Trust Relationships

TL;DR

The paper argues that the prevailing focus on privacy and consent is a major barrier to scalable, beneficial data flows in a data-driven economy. It introduces evolvable trust as a techno-legal framework that distributes decision-making across data exchanges through meta-policies, negotiation protocols, and automation, aiming to align economic incentives with social values. By analyzing GDPR grounds and EU regulations (Data Governance Act, Data Act, AI Act, EHDS, EUDI Wallet) it highlights both constraints of consent-based models and pathways for scalable, trust-based data exchange. The work advocates shifting from one-shot consent to evolving, context-specific trust relationships that support long-term mutual benefits for individuals and organizations, with practical mechanisms for governance, interoperability, and RegTech support.

Abstract

Those concerned about privacy worry that personal data changes hands too easily. We argue that the actual challenge is the exact opposite: our data does not flow well enough, cultivating a reliance on questionable and often unlawful shortcuts in a desperate bid to survive within today's data-driven economy. Exclusively punitive interpretations of protective legislation such as the GDPR throw out the baby with the bathwater through barriers that equally hinder "doing the right thing" and "doing the wrong thing", in an abject mistranslation of how ethical choices correspond to financial cost. As long as privacy-friendly data treatment proves more expensive or complicated than readily available alternatives, economic imperatives will continue to outrank their legal counterparts. We examined existing legislation with the aim of facilitating mutually beneficial interactions, rather than more narrowly focusing on the prevention of undesired behaviors. In this article, we propose the implementation of evolvable trust systems as a scalable alternative to the omnipresent yet deeply broken delusion of ill-informed consent. We describe personalized, technology-assisted legal processes for initiating and maintaining long-term trust relationships, which enable parties to reliably and sustainably exchange data, goods, and services. Our proposal encourages a redirection of additional efforts towards the techno-legal alignment of economical incentives with societal ones, reminding us that - while trust remains an inherently human concept - technology can support people in evolving and scaling their relationships to meet the increasingly complex demands of current and future data landscapes.

Figures (5)

• Figure 1: The CIA triad samonas2014cia of Confidentiality, Integrity, and Availability illustrates that personal data requirements involve nuance and complexity beyond what any one-dimensional privacy lever can model. One can never maximize all three; the appropriate degree of compromise is a case-specific choice.
• Figure 2: Cookie dialogs are up-front agreements of mutual distrust. The above specimen (courtesy of Sky News) presents one of the more recent fads where, in a most creative interpretation of the GDPR, visitors can seemingly "consent" to the use of legitimate interest as a legal basis for data processing.
• Figure 3: Timeline of European data and digital services regulations in the awake of the European strategy for data.
• Figure 4: The dominant timeline for digital trust relationships starts with the Brief Explosion Of Trust (BEOT), at which point a data subject is asked to agree to an exhausting list of demands, in stark contrast to the absence of a factual trust relationship that would normally serve as collateral. Informed decision or negotiation is impossible as the relationship itself has not yet commenced, leaving no opportunities to assess trustworthiness. All needed and unneeded conditions are established beforehand, as the consent dialog model disregards the evolutive character of real-world relationships.
• Figure 5: In an evolvable trust model, no decision or exchange happens at the first moment of interaction; rather, the relationship is allowed and encourage to grow. Every act of exchanging data is encapsulated in a trust context pertaining to this specific data point and exchange, reflecting the status of the relationship at that moment in time. This model aligns with the dynamics of real-world relationships, notably due do its elimination of widely scoped prior agreements regarding abstract future interactions that cannot be meaningfully decided yet.