The IRB?

This does seem to me a valuable beginning. Improving the draft means focusing the draft on the idea more, on the background less. What does "the IRB" stand for here? Institutional review boards mostly evaluate methodology, determining whether the conduct of research is appropriate, primarily against the background of an "informed consent" standard. If this is not a subset of what "data protection authorities" are supposed to do under the various European schemes arising from the GDPR, what are the differences in concept to which you want to call our attention? To the extent that "consent" is not a sufficient basis for privacy regulation, how do IRB-like institutions get at the larger problems? Critics of the research governance culture think that review boards are standardless bodies unaccountable to law. If they are even partly right, what sort of substantive privacy law should back whatever entities you are imagining?