Gap matrix¶
Read this first
- The matrix builds only on the source cards, primary cards, cluster pages and concept pages. Six sources have no PDF and are only listed.
- A ‘gap’ here means that something is missing or not connected in these 34 sources. It does not mean it is missing in the research.
- Gaps of type (b) and (c) must be checked against literature outside the list before they are used. Findings are noted in utenfor-listen.
- The matrix does not suggest what Rebekka should conclude.
Research question: How does the Norwegian state, through government documents, enact digital privacy – more specifically the use of private data?
Part 1 – Matrix¶
Documents, issues and publics¶
| Source | Claim | Perspective | Empirics/context | Method | Understanding of privacy | Own limitations | Not covered (relevant to the thesis) |
|---|---|---|---|---|---|---|---|
| Asdal 2015 | Documents transform issues; an issue can be closed down (pp. 74, 87) | STS, ANT, Foucault, pragmatism | Norwegian report on industrial pollution, 1958 | Close reading of one document | Not addressed | Authors of the report not examined (p. 87) | Privacy, digital technology |
| Asdal et al. 2023 | The bioeconomy is enacted as an expert issue (p. 1) | Valuation studies, Weber, Foucault | EU, OECD and Norwegian documents; 1970s and today | Document analysis with historical contrast | Not addressed | The perspective is not the only possible one (p. 19) | Privacy |
| Bear & Mathur 2015 | The public good must be recaptured from economics (p. 18) | Anthropology of bureaucracy | India; six other cases | Ethnography | Not addressed | Periodisation needs study (p. 21) | Privacy, the Nordic countries |
| Latour & Woolgar 1986 | Facts are constructed and then appear unconstructed (p. 240) | Laboratory studies | Neuroendocrinology laboratory | Participant observation | Not addressed | The noise concept is metaphorical (pp. 239–240) | State, politics, privacy |
| Marres 2005 | Publics are called into being by issues (p. 3) | Pragmatism (Lippmann, Dewey) | No empirical material | Conceptual analysis | Not addressed | Dewey must be updated (pp. 2, 11) | Documents, privacy |
| Marres 2007 | Issue formation is central to democratic politics (p. 759) | STS, pragmatism | Existing STS studies | Conceptual analysis | Not addressed | Fundamental questions unanswered (p. 773) | Documents, privacy |
| Marres 2025 | Tech trials weaken accountability (pp. 1, 3) | STS, sociology of testing | UK: automated vehicles, NHS data, facial recognition | Conceptual analysis with cases | Indirect: data, surveillance, accountability | Generative AI left out (p. 17) | Norway, documents |
Privacy as concept, right and regulation¶
| Source | Claim | Perspective | Empirics/context | Method | Understanding of privacy | Own limitations | Not covered (relevant to the thesis) |
|---|---|---|---|---|---|---|---|
| Solove 2011 | Nothing to hide rests on a mistaken view of privacy (p. 27) | Pragmatism, legal philosophy | USA after 2001 | Normative argument | Plurality of problems; societal value (pp. 24, 47) | The experts may be right (p. 46) | Europe, Norway; only one part of the book read |
| Fairfield & Engel 2015 | Privacy is a public good (p. 423) | Economics, law | USA; experimental economics | Normative argument | Public good; the group as unit (pp. 423, 456) | The literature does not inevitably lead to their conclusions (p. 435) | The state's own data use; pp. 385–420 missing |
| Vedder & Naudts 2017 | The GDPR's accountability mechanisms do not fit algorithms (p. 206) | Law and ethics | GDPR before entry into force | Legal analysis | Fundamental right; does not reach far enough (pp. 211, 219) | Only rough contours (p. 207) | Norway; empirical examples |
| Alegre 2021 | Freedom of thought needs its own protection (p. 2) | Human rights | Examples, regulation | Policy brief | Gateway right (p. 8) | A new and complex field (p. 6) | Norway |
| Abiteboul & Stoyanovich 2019 | Norms must be built in from the start (p. 1) | Computer science | GDPR, New York, net neutrality | Overview | GDPR data subject rights (p. 2) | User empowerment only mentioned (p. 8) | Norway; social science analysis |
| Cloos et al. 2019 | No conclusive evidence for or against the privacy paradox (p. 10) | Experimental economics | 105 students in Kassel | Experiment | Something with a price (pp. 1–3) | No real-world counterpart (p. 10) | The state, Norway |
| Bennett 2018 | No PDF | ||||||
| van Dijk et al. 2016 | No PDF |
Governance and surveillance¶
| Source | Claim | Perspective | Empirics/context | Method | Understanding of privacy | Own limitations | Not covered (relevant to the thesis) |
|---|---|---|---|---|---|---|---|
| Bauman et al. 2014 | More than surveillance versus privacy is at stake (p. 121) | Critical security studies | Snowden documents; Norway mentioned (pp. 133–134) | Collective essay | Human right; data protection derived (pp. 131–132) | Little analysis yet (p. 141) | Welfare and administration |
| Gros et al. 2017 | The hearings turned the files into evidence (p. 73) | STS (Marres), international studies | European Parliament hearings 2013–14 | Analysis of video archive | Right; part of European identity (pp. 85–86) | The files are incompletely known (p. 76) | Norway |
| Foucault 2008 | The Panopticon is a generalisable model of power (p. 9) | Foucault | 17th–19th centuries | Historical analysis | Not addressed; permanent registration (p. 2) | Not found in the text | Digital technology; excerpt with OCR errors |
| Fourcade 2017 | Value is extracted both from alignment and deviation (p. 661) | Moral economy | Examples, interviews in Silicon Valley | Essay | Data as a source of value (pp. 669–670) | Examples are metaphors (p. 674) | The state |
| Ruckenstein & Granroth 2020 | Consumers want contradictory things (p. 12) | Surveillance studies | 25 interviews in Helsinki | Qualitative interviews | Violated when boundaries of autonomy are crossed (p. 13) | Limited to the material (p. 17) | The state |
| Foucault 2007 | No PDF | ||||||
| Stahl & Kaempf 2019 | No PDF |
Democracy, trust and influence¶
| Source | Claim | Perspective | Empirics/context | Method | Understanding of privacy | Own limitations | Not covered (relevant to the thesis) |
|---|---|---|---|---|---|---|---|
| Warren 2018 | Forms of trust must be distinguished (p. 76) | Democratic theory | Examples, mostly USA | Conceptual analysis | Not addressed | Large variation between countries (p. 76) | Data, the Nordic countries |
| Grimmelikhuijsen et al. 2013 | Expect no wonders from transparency (p. 584) | Public administration | Netherlands and South Korea | Experiments | Only background (p. 581) | Student samples (pp. 580, 584) | Personal data, Norway |
| Steiger 2019 | International law can protect democracy (p. 74) | International law | NSA, Project Lakhta, Cambridge Analytica | Doctrinal analysis | Human right linked to democracy (pp. 79, 88) | Only three examples (p. 74) | Norway; welfare |
| Hankey et al. 2018 | Political influence with data presupposes the sale of personal data (p. 11) | Law, rights | UK, Cambridge Analytica | Review of sources and law | Data rights as human rights (p. 43) | Little evidence of efficacy (p. 23) | Norway; the state's data use |
| Richardson et al. 2019 | Unregulated political use of data is not acceptable (p. 14) | Multidisciplinary, mostly law | Canada, Australia, USA, UK, EU | Edited volume | Individual and democratic; group privacy (pp. 4–5) | Group data not discussed in detail (p. 5) | The Nordic countries; only the introduction read |
| Aytac 2024 | Citizen boards can control Big Tech (p. 1431) | Normative political theory | No empirical material | Normative theory | Not in focus (pp. 1432, 1438) | The proposal is utopian (p. 1432) | The state's data use |
| EEAS 2025 | FIMI is a strategic instrument (p. 38) | Security policy | 505 incidents in 2024 | Open source monitoring, network analysis | Only as a limit on data access (p. 18) | A limited subset of activity (pp. 6, 9) | Norway; the state's data use |
| Karlsen 2021 | No PDF | ||||||
| OECD 2022 | No PDF |
State and politics¶
| Source | Claim | Perspective | Empirics/context | Method | Understanding of privacy | Own limitations | Not covered (relevant to the thesis) |
|---|---|---|---|---|---|---|---|
| Mazzucato 2018 | The state must shape and create markets (p. 803) | Innovation systems, evolutionary economics | Examples (NASA, DARPA, KfW) | Conceptual and policy-oriented | Not addressed | The changes are not trivial (p. 813) | Privacy, Norway |
Primary documents (descriptive, not analysis)¶
| Source | What the document says | Author | Empirics/context | Method | Privacy in the document | Own limitations | Read |
|---|---|---|---|---|---|---|---|
| NOU 2022:11 | Digitalisation happens at the expense of privacy (p. 9) | Privacy Commission, to the ministry | Norway, 2020–2022 | Official report | Individual right and societal good (pp. 9–10, 31) | Not updated after 18 July 2022 (p. 23) | Ch. 1–3 and 6 |
| Sivertsen et al. 2026 | Foreign influence around the 2025 election (p. 3) | FFI et al., for the ministry | 22 million posts | Data collection and analysis of social media | Framework for its own data collection (p. 20) | Only known profiles and four platforms (p. 20) | Ch. 1–3 and 6; summaries in ch. 4 |
Part 2 – Possible gaps¶
Theoretical gaps¶
T1. The document and issue perspective is barely connected to privacy - Asdal 2015 and Marres 2005/2007 are not about privacy (see the cards). Solove and Fairfield & Engel are not about documents. - Gros et al. 2017 apply Marres to surveillance (pp. 73, 75), and Marres 2025 is about data and accountability (pp. 1, 3). - Both Solove and Marres build on Dewey (Solove 2011, pp. 24, 49–50; Marres 2005, pp. 1–3), but for different purposes. - Type (b) – derived by comparing sources. - Check with: ‘privacy’ AND ‘issue formation’; ‘material publics’ data protection; ‘document analysis’ privacy policy. Seeds: Marres 2007, Gros et al. 2017, Asdal 2015.
T2. Collective understandings of privacy stand side by side without discussing each other - Solove (pragmatism, p. 47), Fairfield & Engel (economics, p. 456), Vedder & Naudts (algorithms and groups, p. 218) and NOU 2022:11 (societal good, p. 31). - Richardson et al. themselves write that the book does not discuss the challenges of group data in detail (p. 5), and cite literature on group privacy (p. 5, note 19). - Type (a) for Richardson's delimitation; type (b) for the lack of connection. - Check with: ‘group privacy’; ‘privacy as a collective good’; ‘relational privacy’. Seeds: Fairfield & Engel 2015, Vedder & Naudts 2017, Solove 2011.
T3. The governmentality perspective has a thin basis in the list - Foucault 2007 has no PDF. Asdal 2015 (pp. 84–85), Asdal et al. 2023 (p. 5) and Fourcade (p. 663) use the concept, but no source applies it to privacy (see governmentality). - Type (b). - Check with: governmentality AND privacy; ‘data governance’ Foucault; ‘governable objects’ personal data. Seeds: Asdal 2015, Bauman et al. 2014.
Empirical gaps¶
E1. Little secondary literature on Norway - No secondary source with a card is about privacy in Norway. Bauman et al. mention Norway only in connection with the UN resolution (pp. 133–134). Asdal 2015 and Asdal et al. 2023 analyse Norwegian documents, but not on privacy. Ruckenstein & Granroth are from Finland. - Karlsen 2021 and OECD 2022 have no PDF and may change the picture. NOU 2022:11 refers to NOU 2009: 1 and to Norwegian legal literature (p. 29). - Type (b) – Norwegian literature likely exists outside the list. - Check with: personvern AND ‘offentlig forvaltning’; personvern AND digitalisering AND Norge; Schartum. Search Oria. Seeds: Asdal et al. 2023, NOU 2022:11 (reference list).
E2. The state's use of data in welfare and administration is little covered - Most sources concern intelligence (Bauman et al., Gros et al., Steiger), companies (Fourcade, Ruckenstein & Granroth, Hankey et al.) or elections (Richardson et al., Hankey et al.). - Exceptions: Solove on government information processing (pp. 26–28), Marres 2025 on the NHS and police (pp. 1–2), Alegre on predictive policing (p. 5) and Vedder & Naudts on public decision-makers (p. 206). - Chapter 6 of NOU 2022:11 is about this (pp. 59–85), but it is a primary document. - Type (b). - Check with: ‘digital welfare state’; ‘automated decision-making’ public administration privacy; profiling welfare Nordic. Seeds: Marres 2025, Vedder & Naudts 2017, Solove 2011.
E3. The sources themselves acknowledge limited empirics - Grimmelikhuijsen et al.: student samples (pp. 580, 584). Cloos et al.: no real-world counterpart (p. 10). EEAS: only a limited subset of activity (pp. 6, 9). Hankey et al.: little evidence that data techniques work (p. 23). - Type (a) – explicitly acknowledged. - Check with: follow-up studies of each source (cited-by search in Google Scholar).
E4. Few sources on data protection law in practice after 2018 - Vedder & Naudts wrote before the GDPR entered into force (p. 206). Hankey et al. wrote when the UK 2018 Act was new (p. 34). Bennett 2018 has no PDF. - Type (a) for the timing; type (b) for the overall lack of material on practice after 2018. - Check with: GDPR implementation evaluation; GDPR enforcement public sector. Seeds: Vedder & Naudts 2017, Abiteboul & Stoyanovich 2019.
Methodological gaps¶
M1. Few sources analyse state documents - Asdal 2015 (one report), Asdal et al. 2023 (policy documents) and Gros et al. 2017 (parliamentary hearings) are the only ones analysing official documents or fora. None of them is about privacy. - Type (b). - Check with: ‘policy document analysis’ privacy; ‘white paper’ data protection discourse; NOU document analysis. Seeds: Asdal 2015, Asdal et al. 2023.
M2. Effects are hard to measure - Hankey et al. (p. 23), EEAS (p. 11) and Grimmelikhuijsen et al. (p. 584) say that effects are uncertain or hard to establish. - Type (a). - Check with: relevant only if the thesis is to say something about effects.
Gaps in concepts and assumptions¶
B1. ‘Good’ is used in at least four ways - Fairfield & Engel (p. 423), Bear & Mathur (pp. 20–21), Mazzucato (pp. 807, 809) and NOU 2022:11 (pp. 9–10, 31). See public good. - Type (b). - Check with: ‘privacy’ ‘public good’ ‘common good’ conceptual. Seeds: Fairfield & Engel 2015, Bear & Mathur 2015.
B2. The assumption that transparency produces trust - Abiteboul & Stoyanovich link transparency and trust (p. 4). Grimmelikhuijsen et al. find a subdued and sometimes negative effect (p. 575). Warren points to costs (p. 91). Vedder & Naudts distinguish transparency from accountability (p. 215). - Type (b). - Check with: transparency trust government meta-analysis; ‘transparency paradox’. Seeds: Grimmelikhuijsen et al. 2013, Warren 2018.
B3. Personvern, privacy and data protection - Bauman et al. distinguish the right to privacy from data protection (pp. 131–132). NOU 2022:11 distinguishes personvern from personopplysningsvern (p. 30). The other sources rarely distinguish. - Type (b). - Check with: ‘privacy’ versus ‘data protection’ distinction EU Charter. Seeds: Bauman et al. 2014, Steiger 2019.
B4. The language of ‘balance’ - Solove (pp. 34–37) and Bauman et al. (p. 137) criticise weighing privacy against security as a balance. NOU 2022:11 asks for a privacy policy that can ‘balance’ the digitalisation policy (p. 73). - Whether the NOU uses balance in the same sense that Solove and Bauman et al. criticise is a question for Rebekka's analysis, not a claim. - Type (b). - Check with: privacy balancing critique; proportionality privacy. Seeds: Solove 2011, Bauman et al. 2014.
Ideas not supported by the sources¶
C1. Change over time in Norwegian documents - NOU 2022:11 builds on NOU 2009: 1 (p. 29), and Asdal et al. 2023 use historical contrast (p. 4). A comparison of Norwegian privacy documents over time is an idea, not something the sources do. - Type (c) – must be checked. - Check with: NOU 2009:1 reception; history of the privacy commissions. Search Oria.
C2. Information influence and privacy seen together - EEAS 2025 and the FFI report treat privacy only as a framework for data access (EEAS, p. 18; Sivertsen et al. 2026, p. 20). Whether the relationship between protection against influence and privacy has been studied cannot be known from the list. - Type (c) – must be checked. - Check with: disinformation countermeasures privacy; ‘platform data access’ researchers privacy. Seeds: EEAS 2025, Steiger 2019.
Open questions for Rebekka¶
- Which gaps are relevant to the research question, and which can be set aside?
- Should the six sources without PDFs be obtained before the gaps are assessed?
- Who will run the searches in Research Rabbit / Litmaps and Oria, and when?