Learning from internal models of reality: The case of data protection and consumer protection in financial services

Data protection law has been one of the intensely discussed legal domains in relation to new data technologies such as Big Data and Machine Learning. Arguments have even been made that due to its wide scope (both material and personal), it may apply to everything and everyone. However, criticism has arisen that the GDPR might not achieve what it was set out to do when it comes to new data technologies. This paper takes a step in investigating the reorganization of data protection law, by looking for lessons in the field of EU consumer protection in financial services. It does so by using a theoretical framework which structures the comparison between the two domains in two layers: internal model of reality and legal protection. Therefore, the aim of this paper is twofold: first, to establish the potential of using the concept of internal model of reality in legal analysis, and second, to draw future directions for research in the area of data protection law, by establishing the potential of cross-fertilisation between the two legal domains (consumer protection in financial services and data protection law).