“A Mirror, Not a Glass Door”: Legal Code and Software Code in Practice
Published in Just Code: Power, Inequality, and the Political Economy of IT, 2025
Petelka, J., Finn, M., Srinivasan, J., Oreglia, E., and Janani, A.P. (2025) "A Mirror, Not a Glass Door": Legal Code and Software Code in Practice. Just Code: Power, Inequality, and the Political Economy of IT. Johns Hopkins University Press. 87-108. https://muse.jhu.edu/pub/1/oa_edited_volume/chapter/4268030
Abstract - In this chapter, we explore the uneven and shifting practices of data access rights through the experiences of people requesting their data from different companies in India, the United Kingdom, and the United States in 2019-21. This is the period after the General Data Protection Regulation (GDPR) of the European Union (EU) went into effect in 2018 and during a period of legal change, in the United States with the implementation of the California Consumer Privacy Act (CCPA) in June 2020, and in India with the drafting of the 2019 Digital Personal Data Protection Bill. While the GDPR applies to data processed within the EU or from EU residents, we argue that GDPR’s scope in this period extended beyond EU borders because multinational company infrastructures extended from the EU to countries with different regulations, compliance and enforcement protocols, and even cultural conceptions of data privacy. Building on analyses of written laws, we evaluate the influence of the GDPR beyond the EU (called the Brussels Effect) and the CCPA’s influence within the United States (called the California Effect) by analyzing data infrastructure outputs. We explored the byproducts of both legal code and software code by working with research participants in the three countries to request, and to examine the process of requesting and accessing, their personal data from the same multinational companies and regionally operating companies. Our research articulates what we call trickle-down GDPR, an important mapping of the ways corporations translate national laws into their technical infrastructure and then how people ultimately experience those laws in different regions.