Daniel Solove argues that granting individuals control over their personal data is not an effective method for regulating privacy in the current era. Instead, he proposes holding corporations accountable for their actions, drawing a parallel to how food and drug companies are regulated. The proposed regulatory measures include implementing strict data minimization practices, establishing fiduciary duties for data stewardship, assigning liability for negligent or reckless technological design, imposing liability for algorithms that cause harm, and requiring multi-stakeholder review of new technologies.

The discussion pivots on a fundamental disagreement about the mechanism of privacy regulation: shifting control to the individual versus imposing accountability onto the entity. Solove’s argument suggests that informational control alone is insufficient; effective governance requires incorporating traditional liability and fiduciary concepts into the technological sphere, treating data systems as products subject to similar legal obligations as physical goods. This framework implies that existing legal structures—designed for consumer protection in regulated industries like pharmaceuticals—must be adapted to address harms caused by opaque algorithmic design. The pattern suggests a resistance to purely libertarian or self-regulatory solutions when systemic risks are present; instead, the focus moves toward enforceable duties and liability structures. The core implication is that technological advancement necessitates an evolution of legal responsibility that mandates proactive design choices rather than reactive consent management. What institutional structures are necessary to enforce these liabilities against complex, distributed AI systems? How can fiduciary concepts be operationalized in multi-stakeholder technology reviews?