European Data Protection Law Research Articles

Beyond ‘having a domestic'? Regulatory interpretation of European Data Protection Law and individual publication

Statutory Data Protection Authorities (DPAs) who act as the guardians of data protection across the European Economic Area (EEA) have faced unprecedented interpretative challenges as a result of the explosion of indeterminate publication by individuals in the form of blogs, social networking and other online forums. Through both a questionnaire and systematic review of EEA DPA websites, this article finds that these regulators have generally adopted a strict interpretation of the law here, although considerable internal variation is also present. Almost all see data protection as engaged, around half argue that publication in the general social networking context requires data subject consent and even when individual publication is targeted towards the collective public many DPAs demonstrate some reluctance to apply the special expressive purposes (aka the journalistic) derogation. This article argues for an alternative tripartite approach under the forthcoming Regulation which accommodates the competing free expression rights and also the limited capabilities reasonably to be expected of private individuals on a sounder and more consistent basis. The law's personal exemption should cover individual publication so long as this does not pose a serious prima facie risk to privacy or other fundamental data protection rights. The special expressive purposes derogation should protect individuals who are disseminating a message to the collective public without discrimination. Finally, the Regulation's new freedom of expression clause should ensure that individual publication which principally instantiates self-expression is subject only to the core of data protection's substantive and supervisory provisions.

European data protection laws: Learnings and implications for Indian business

India’s data protection law is grossly inadequate in terms of personal data protection and privacy. While India is contemplating a separate law on personal data protection, this subject is currently dealt with by various laws. Irrespective of the inadequacies, laws of other countries, specifically the GDPR, have direct bearing on the processing and handling of personal data in India given their exterritorial scope. This paper explores the implication of the EU General Data Protection Regulation (GDPR) on Indian business. The paper reviews the state of data protection laws in India, followed by a review of GDPR and the implications of GDPR for Indian business. The paper argues that since India aims to be counted among the best, it would be wise to ensure that data protection laws are in sync with the best practices from across the world to maintain business competitiveness and ensure a level of personal data protection for its citizens.

The Anonymisation of Research Data — A Pyric Victory for Privacy that Should Not Be Pushed Too Hard by the eu Data Protection Framework?

Abstract Personal health data is essential to many forms of scientific research. Such data may come from a large variety of sources including electronic health records (ehrs), datasets used for previous research and from data linked to biobanks. European data protection law recognises that in addition to using consent as a legal basis for the processing of personal health data for scientific research, such data may be used without consent where it is in the ‘public interest’. Despite the existence of such a legal option, ethics bodies in a number of states have shown reticence to utilise it, often pushing researchers into either obtaining consent or anonymising the data in question. Whilst the latter option may be appealing from a legal point of view, if carried out properly, the result may be that the research value of the data is reduced or even destroyed.

The Right Tools: Europe's Intermediary Liability Laws and the 2016 General Data Protection Regulation

The so-called “Right to Be Forgotten” established by the Court of Justice of the European Union in 2014 is about to change. The EU’s General Data Protection Regulation (GDPR), which goes into effect in 2018, introduces new notice-and-takedown rules for online information targeted by “Right to Be Forgotten” erasure requests. As drafted, the new rules make deliberate or accidental over-removal of online information far too likely. They give private Internet platforms powerful incentives to erase or de-list user-generated content – whether or not that content, or the intermediaries’ processing of the content, actually violates the law. They also create new data disclosure obligations that undermine privacy and Data Protection rights for people who post content online. These problems could be mitigated, without threatening the important privacy protections established by the GDPR, through procedural checks and balances in the platforms’ removal operations. This article details the problematic GDPR provisions, examines the convergence of European Data Protection and Intermediary Liability Law, and proposes ways that the EU’s own Intermediary Liability laws can restore balanced protections for privacy and information rights. Throughout, it focuses on the motivations and likely real-world behavior of online platforms, drawing on the author’s extensive experience as Google’s Associate General Counsel for Intermediary Liability and as Intermediary Liability Director at Stanford Law School’s Center for Internet and Society. It includes close examinations of Whether and how the “Right to Be Forgotten” may apply to user-generated content hosts like Twitter or Facebook; Free expression provisions in the GDPR; The GDPR’s extraterritorial reach and consequences for companies outside the EU; Doctrinal tensions between the EU’s Intermediary Liability law under the eCommerce Directive, and its Data Protection law under the 1995 Data Protection Directive and the new GDPR; and Human rights and fundamental rights laws governing online notice and takedown operations.

Protección de Datos Personales, ¿Responsabilidad de la Empresa?

On this occasion, ADVOCATUS had the opportunity to interview Alejandro Touriño Peña, leader of the European Personal Data Protection Law field. Throughout the following interview, we offer an analysis of the European Union regional regulations, protection measures offered, addressing the issue from the perspective of Corporate Responsibility, culminating in the analysis of a practical case.

Reform des europäischen Datenschutzrechts : ein Überblick unter besonderer Berücksichtigung des Datenaustausches zwischen Polizei-, Strafjustiz- und Geheimdienstbehörden

Data protection is one of today’s most important challenges. Cross-border crime, terrorist risks, and new technologies all contribute to an increase in the collection and movement of personal data. This contribution first gives an overview of the content of the recently reformed European data protection law, i.e. the General Data Protection Regulation (GDPR). It also provides an analysis of Directive 2016/680, which regulates the specific protection of personal data in the prevention, investigation, detection and prosecution of criminal offences as well as the enforcement of criminal penalties. The article further outlines current projects and new developments regarding data transmission between intelligence agencies and prevention/prosecution authorities. It also focuses on the principle of limitation for the purpose of data use as well as the “compatibility” of operation purposes as rules for restricting data processing. The paper concludes by recommending the creation of harmonised and clear rules for data transmission with the intelligence agencies.

Beyond Having a Domesticc? Regulatory Interpretation of European Data Protection Law and Individual Publication

Statutory Data Protection Authorities (DPAs) who act as the guardians of data protection across the European Economic Area (EEA) have faced unprecedented interpretative challenges as a result of the explosion of indeterminate publication by individuals in the form of blogs, social networking and other online forums. Through both a questionnaire and systematic review of EEA DPA websites, this paper finds that these regulators have general adopted a strict interpretative of the law here, although considerable internal variation is also present. Almost all see data protection as engaged, around half argue that publication in the general social networking context requires data subject consent and even when individual publication is targeted towards the collective public many DPAs demonstrate some reluctance to apply the special expressive purposes (aka the journalistic) derogation. The paper argues for an alternative tripartite approach under the forthcoming Regulation which better and more consistently accommodates the competing free expression rights and also the limited capabilities reasonably to be expected of private individuals. The law’s personal exemption should cover individual publication so long as this does not pose a serious prima facie risk to privacy or other fundamental data protection rights. The special expressive purposes derogation should protect individuals who are disseminating a message to the collective public without discrimination. Finally, the Regulation’s new freedom of expression clause should ensure that individual publication which principally instantiates self-expression is subject only to the core of data protection’s substantive and supervisory provisions.

Brexit: Is This the End for the General Data Protection Regulation?

The confirmed exit of the United Kingdom from the European Union (EU) coincides with significant reform of European data protection law. Such reform will arise through the European General Data Protection Regulation (GDPR) which is on course for direct enforcement in all EU Member States as of May 2018. Separation negotiations must be endured before finalization of an EU-UK divorce, the product of which will determine the role of GDPR in Britain’s future.

Face and Emotion Recognition on Commercial Property under EU Data Protection Law

ABSTRACTThis paper integrates and cuts through domains of privacy law and biometrics. Specifically, this paper presents a legal analysis on the use of Automated Facial Recognition Systems (the AFRS) in commercial (retail store) settings within the European Union data protection framework. The AFRS is a typical instance of biometric technologies, where a distributed system of dozens of low‐cost cameras uses psychological states, sociodemographic characteristics, and identity recognition algorithms on thousands of passers‐by and customers. Current use cases and theoretical possibilities are discussed due to the technology's potential of becoming a substantial privacy issue. First, this paper introduces the AFRS and EU data protection law. This is followed by an analysis of European Data protection law and its application in relation to the use of the AFRS, including requirements concerning data quality and legitimate processing of personal data, which, finally, leads to an overview of measures that traders can take to comply with data protection law, including by means of information, consent, and anonymization.

Privacy, data protection and ethics for civil drone practice: A survey of industry, regulators and civil society organisations

This article presents results of a survey of primarily, although not exclusively, European drone industry representatives, regulators and civil society organisations that examined privacy, data protection and ethics with respect to civil drone operations. The article provides snapshot information about the diversity of the drone industry, including information about the types of companies, the types of drones being manufactured and operated, their payloads, capabilities and applications. Using self-reported information from industry representatives, it also demonstrates that these stakeholders do not have a clear understanding of European privacy and data protection law, which can impact their levels of liability and protections for individuals on the ground. With respect to regulators and civil society watchdogs, the results demonstrate that law enforcement, commercial and private (or recreational) drone operators are all thought to be associated with significant privacy, data protection and ethical risks, and that recreational operators are thought to carry the highest risks. However, perceptions of high-risk operators vary among different organisations, raising a potential for regulatory fragmentation. The article concludes with a consideration of the implications of these findings for the regulation of privacy, data protection and ethics for civil drone operations.

A Data Protection Framework for Learning Analytics

Most studies on the use of digital student data adopt an ethical framework derived from human-studies research, based on the informed consent of the experimental subject. However consent gives universities little guidance on the use of learning analytics as a routine part of educational provision: which purposes are legitimate and which analyses involve an unacceptable risk of harm. Obtaining consent when students join a course will not give them meaningful control over their personal data three or more years later. Relying on consent may exclude those most likely to benefit from early interventions. This paper proposes an alternative framework based on European Data Protection law. Separating the processes of analysis (pattern-finding) and intervention (pattern-matching) gives students and staff continuing protection from inadvertent harm during data analysis; students have a fully informed choice whether or not to accept individual interventions; organisations obtain clear guidance: how to conduct analysis, which analyses should not proceed, and when and how interventions should be offered. The framework provides formal support for practices that are already being adopted and helps with several open questions in learning analytics, including its application to small groups and alumni, automated processing and privacy-sensitive data.

International Trade Agreements and European Data Protection Law

International Trade Agreements and European Data Protection Law

Challenges Posed by Big Data to European Data Protection Law

The cost of storing and processing vast quantities of digital data has dropped significantly in recent years. Cloud computing services, such as those provided by Amazon, have commodified data processing so that applications that once required supercomputers are now available to anyone with an internet connection and a credit card. When the Data Protection Directive was issued in 1995 the World Wide Web as we understand it today barely existed. The scale and scope of data gathering on citizens could not have been foreseen and so the existing legal framework is challenged by the widespread collection of data on individuals as they surf the web and when they interact with businesses in the real world. Despite the confidence of the Article 29 Working Party established to monitor the effectiveness of the Directive, big data poses challenges that may prove unsurmountable for the existing legal framework.

Learning Lessons from Cloud Investigations in Europe: Bargaining Enforcement and Multiple Centers of Regulation in Data Protection

The race is on for businesses and consumers to join the cloud. From increased efficiency to low operational costs to scalability, reasons abound as to why we are adopting cloud solutions. However, unleashing the potential of cloud ecosystems for companies and individuals has not been without difficulties. Industry research has highlighted that data protection and privacy concerns, in particular, can often be one of the main inhibitors to the widespread adoption of cloud-based systems. Lately, some US-based cloud companies have been required to comply with European data protection laws through the regulatory process of investigation by European data protection authorities (“Cloud Investigations”).In this article, I analyze selected empirical findings from my recent qualitative socio-legal research project where I have examined the investigations of cloud providers by European data protection authorities (“EU DPAs”) to reflect on the roles of data protection laws during such investigations. I advance two arguments. Firstly, a decentralized perspective on Cloud Investigations sheds a more comprehensive light on the roles of data protection laws during Cloud Investigations without assuming a priority that such laws have a privileged and static role in the regulatory process. Secondly, and relatedly, I argue that by “cutting off the King’s head”, we can understand more fully the dynamic and context-dependent roles of data protection laws during Cloud Investigations. From time to time, law can be deployed to achieve the aims of the law-makers or enforcers. At other times, law can also be used as bargaining chips by EU DPAs and Cloud Providers to obstruct or facilitate the negotiations during Cloud Investigations. At other times still, law can often retreat from the field of action as other actors carry out the “act of government” to determine if and to what extent Cloud Providers are “accountable in reality.”

Un-mapping Personal Data Transfers

European data protection law channels data processing in many ways: it fabricates spaces within which personal data can move freely, circumscribes borders that personal data shall not cross unless following ad-hoc paths and erects legal routes through which personal data might move. These seemingly discordant gestures of personal data liberation and blocking at borders, of data confinement and data release, appear to presuppose that personal data can be managed almost materially, let loose, stopped or conveyed for specific destinations through delimited channels. More generally, the recurrent notion of data transfers hints that data are effectively being sent or received, pull or pushed, across existing tracks, and only through them. This contribution explores the tensions between this viewpoint and the acknowledgement, by EU personal data protection law itself, of the legal irrelevance of data location. To do so, it investigates the definition of the territorial scope of European data protection laws, as well as the fictional aspects of regulating personal data protection in terms of a co-existence of areas of free movement of data and spaces where data flows, depicting hermetic transfers. Discussing jurisprudential developments such as the Schrems judgment, the paper gives special attention to the definition of the territorial scope of application of the proposed General Data Protection Regulation. Ultimately, this article aims to move beyond current discussions about the territoriality and extra-territoriality of EU data protection law by critically inquiring into the tensions between these notions and data (re-)location.

Risk to the Right to the Protection of Personal Data:

One of the novelties of the General Data Protection Regulation (GDPR) will be the application of the risk-based approach in European data protection law on a larger scale. Although the Regulation uses the term ‘risk’ in numerous provisions, it does not answer the question ‘What is risk to a right and how should it be assessed?’. Although Article 35 (Data Protection Impact Assessment, DPIA) provides a tool to assess these risks, to keep the GDPR suitable for assessing new technologies, the conduct of a DPIA should be based on solid and clear understanding of the provisions. The applicability and suitability of a risk assessment process is yet to be discovered if the risk relates to a fundamental right. A unified perception of risk to a right is necessary as it is the core element of the risk-based approach, furthermore, a varying perception of risk to a right would undermine the endeavours of the GDPR relating to harmonisation. This contribution elaborates on the attributes of risk to a right and advises a unified understanding of risk to a right and risk to the right to the protection of personal data.

Is the Subject Access Right Now Too Great a Threat to Privacy?

Legal and technological developments have brought new classes of data controller within the scope of European data protection law. Most of these have no direct relationship with the data subjects whose data they may process. This article considers the implications for the subject access duty: whether it still fulfils its original purposes and whether it creates new threats to privacy. Treating subject access as involving a conflict between the fundamental rights to data protection and privacy, the paper identifies a better balance and considers whether General Data Protection Regulation’s modified subject access right will achieve it.

Micro-Targeting, Voter Intelligence and Data Protection Law: Can Candidates and Political Parties Do in Europe What They Do in North America?

To what extent are the micro-targeting techniques entering the election campaigns of other democratic countries, particularly in Europe? And what are the implications for privacy laws and for the data protection authorities (DPAs)? Very little has been written about these issues in the privacy literature. And with few exceptions, DPAs have been reluctant to provide guidance to parties and candidates, and less still to regulate their activities. The paper surveys the state of the law in Europe with respect to data on 'political affiliation.' The pressures for political parties to find more efficient methods to reach voters with their messages will increase as a result of social networking and other technologies, the influence of political consultants, the break down of traditional bases of support and the inherent competitiveness between parties within any political system. This brief survey suggests that the lessons from the United States have not been lost on their counterparts in many European countries, despite obvious and fundamental differences in data protection law, election rules, and political cultures. These practices will continue to put pressure on European data protection law, and on the DPAs.

Privacy-preserving surveillance: an interdisciplinary approach

Increasing capabilities of intelligent video surveillance systems impose new threats to privacy while, at the same time, offering opportunities for reducing the privacy invasiveness of surveillance measures as well as their selectivity. We show that aggregating more data about observed people can increase the selectivity of surveillance measures. In the case of video surveillance in a company environment, if we enable the system to authenticate employees and to know their current positions, we can ensure that no data about employees leave the surveillance system, ie, it is being visualized or made accessible to an operator. We discuss the legal implications of such a system with regard to German as well as European data protection law. Some weaknesses of § 6b BDSG (the German Federal Data Protection Act) concerning intelligent video surveillance are identified.

Online Price Discrimination and Data Protection Law

Online shops can offer each website customer a different price - a practice called first degree price discrimination, or personalised pricing. An online shop can recognise a customer, for instance through a cookie, and categorise the customer as a rich or a poor person. The shop could, for instance, charge rich people higher prices. From an economic perspective, there are good arguments in favour of price discrimination. But many regard price discrimination as unfair or manipulative. This paper examines whether European data protection law applies to personalised pricing. Data protection law applies if personal data are processed. This paper argues that personalised pricing generally entails the processing of personal data. Therefore, data protection law generally applies to personalised pricing. That conclusion has several implications. For instance, data protection law requires a company to inform people about the purpose of processing their personal data. A company must inform customers if it personalises prices.