European Union Data Protection Law Research Articles

Manipulation by design

Human behaviour is affected by architecture, including how online user interfaces are designed. The purpose of this article is to provide insights into the regulation of behaviour modification by the design of choice architecture in light of the European Union data protection law (GDPR) and marketing law (UCPD). It has become popular to use the term ‘dark pattern’ (also ‘deceptive practices’) to describe such practices in online environments. The term provides a framework for identifying and discussing ‘problematic’ design practices, but the definitions and descriptions are not sufficient in themselves to draw the fine line between legitimate (lawful) persuasion and unlawful manipulation, which requires an inquiry into agency, self-determination, regulation and legal interpretation. The main contribution of this article is to place manipulative design, including ‘dark patterns’, within the framework of persuasion (marketing), technology (persuasive technology) and law (privacy and marketing).

Rescuing transparency in the digital economy: in search of a common notion in EU consumer and data protection law

Abstract Transparency remains a contested concept in European Union (EU) law and policy. All the main instruments of EU consumer and data protection law require that consumers be given access to and understand certain information about their relationships with traders. Improved transparency is also proposed as a response to a variety of problems associated with digital markets, including those experienced by consumers and data subjects. At the same time, transparency is increasingly challenged as ineffective and potentially even counterproductive from doctrinal and critical scholarship alike. First, transparency is seen as inherently unable to transform the economic reality on the ground and to address the power imbalances between consumers and traders. Secondly, it is argued that acts of representation involved in transparency suffer from complexity and are prone to exploitation by the actors who engage in it. This, in turn, casts doubt on the ability of transparency to steer the behaviour of businesses and transform markets to the benefit of consumers and society. This article builds upon prior critiques of transparency and connects them with a doctrinal analysis of EU consumer and data protection law and in particular the Unfair Contract Terms Directive, the Unfair Commercial Practices Directive, and the General Data Protection Regulation. Seven different notions of transparency are identified: (i) Transparency as access to the medium over time; (ii) Transparency as presentation of information that facilitates understanding; (iii) Transparency as formulations that facilitate understanding; (iv) Transparency as non-ambiguity and logical intelligibility; (v) Transparency as the absence of deception and confusion; (vi) Transparency as completeness and specificity; and (vii) Transparency as non-arbitrariness. The article submits that the acts of representation involved in transparency are already recognized in the three legal regimes and attempts are made to leverage the mediated nature of transparency to consumers’ advantage. Crucially, existing efforts to regulate mediation and improve its quality can, nowadays, be reinforced with the help of algorithmic systems geared toward supporting consumers. Moreover, some of the deployments of transparency identified—most notably transparency as non-arbitrariness—push its outer conceptual boundaries in ways that bring transparency very close to fairness. The article ultimately questions a vision of transparency as a necessarily softer-touch protective frame, which cannot alter business conduct. The conceptual richness of transparency offers opportunities for its deployment in more disruptive ways.

Are Joint Controllers Joint Trade Secret Owners? What EU Data Protection and US Information Privacy Law Tell Us About Trade Secret Law

The article focusses on (joint) trade secret ownership as a (neglected) aspect of European Union (EU) and United States (US) Trade Secret Law. The article shows that Information Privacy Law and Data Protection Law, respectively, and Trade Secret Law intersect. This intersection can be used to address not only the issue of unclear trade secret ownership in relation with personal data, but also the issue of power imbalance raised by considering two or more parties with entirely different bargaining positions as jointly responsible under Data Protection Law, in particular under the General Data Protection Regulation (GDPR). In this regard, US Information Privacy and Trade Secret Law as well as EU Data Protection and Trade Secret Law and the underlying ownership and liability concepts are analysed and compared to each other. The article shows that factors for (joint) control as developed by the Court of Justice of the European Union (CJEU) (Cases Wirtschaftsakademie, Jehovah’s Witnesses (JW), and Fashion ID) can be adapted by means of interpretation in essence under EU and US Trade Secret Law. Thus, joint controllers are often considered joint owners of the respective personal data as a trade secret. According to this approach, the parties are reciprocally entitled to prevent disclosures by each other beyond what is explicitly or implicitly agreed. Such right can act as a lever for weaker parties when bargaining with ‘stronger’ parties as necessary under Data Protection Law. At the same time, the essentially unified approach of determining trade secret ownership and data protection controllership provides for more clarity when it comes to the determination of trade secret ownership. Joint Control, Trade Secrets, Ownership, Joint Ownership, UTSA, Fashion ID, Trade Secret Directive, GDPR, FTCA, US

In/acceptable marketing and consumers' privacy expectations: four tests from EU data protection law

PurposeThis study aims to discover the legal borderline between licit online marketing and illicit privacy-intrusive and manipulative marketing, considering in particular consumers’ expectations of privacy.Design/methodology/approachA doctrinal legal research methodology is applied throughout with reference to the relevant legislative frameworks. In particular, this study analyzes the European Union (EU) data protection law [General Data Protection Regulation (GDPR)] framework (as it is one of the most advanced privacy laws in the world, with strong extra-territorial impact in other countries and consequent risks of high fines), as compared to privacy scholarship on the field and extract a compliance framework for marketers.FindingsThe GDPR is a solid compliance framework that can help to distinguish licit marketing from illicit one. It brings clarity through four legal tests: fairness test, lawfulness test, significant effect test and the high-risk test. The performance of these tests can be beneficial to consumers and marketers in particular considering that meeting consumers’ expectation of privacy can enhance their trust. A solution for marketers to respect and leverage consumers’ privacy expectations is twofold: enhancing critical transparency and avoiding the exploitation of individual vulnerabilities.Research limitations/implicationsThis study is limited to the European legal framework scenario and to theoretical analysis. Further research is necessary to investigate other legal frameworks and to prove this model in practice, measuring not only the consumers’ expectation of privacy in different contexts but also the practical managerial implications of the four GDPR tests for marketers.Originality/valueThis study originally contextualizes the most recent privacy scholarship on online manipulation within the EU legal framework, proposing an easy and accessible four-step test and twofold solution for marketers. Such a test might be beneficial both for marketers and for consumers’ expectations of privacy.

Extraterritorial Impact in Data Protection Law through an EU Law Lens

Data Protection is widely recognised as a field of European Union (EU) law that has significant traction beyond the EU’s borders, leading to allegations of data protection imperialism, protectionism and data localization on the EU’s part. This paper suggests an alternative narrative: one of consistency with the broader corpus of EU law. It illustrates, first, that extraterritoriality mechanisms such as those in EU data protection law are also applied in other fields of EU law. Second, using the example of data flows between the UK and the EU at the end of the transition period, this paper suggests that although protectionist motives might provide an explanation for such extraterritoriality a more plausible justification for this approach is to be found in existing and nascent general principles of EU law, such as mutual trust and the autonomy of the EU legal order. This internal consistency with EU law contradicts claims of data exceptionalism. What it offers is an explanation for, rather than a justification or legitimization of, the extraterritorial impact of EU data protection law.

Profiling Consumers Through Big Data Analytics: Strengths and Weaknesses of Article 22 GDPR

A new form of knowledge production that is flourishing in the Big Data age is profiling. In general, profiling means any form of discovering or constructing knowledge from large sets of data originating from a variety of sources. In a narrow sense, profiling is a way of making individual profiles, i.e. sets of characteristics, features, and attributes through which a person or group can be discerned from another person or group. Profiling is a relatively novel concept in European Union data protection law. It is defined in Article 4 (4) of the General Data Protection Regulation (GDPR). However, Article 22 of the GDPR determines the scope of protection in the case of profiling. This article focuses on an interpretation of Article 22. In addition, this article aims to give an overview of the wording, limitation and potential regulatory gaps, which exist in Article 22 of the GDPR. Big Data Analytics, algorithms, AI, GDPR, profiling, consent, contract

Privacy and Data Protection Constraints to Automated Decision-Making in the Judiciary

Competent authorities of many countries around the world are deploying automation tools in decision-making processes in the judiciary. The scope of application of automated judicial systems, often based on artificial intelligence (AI), is broad, ranging from the improvement and acceleration of organisational or office-based court tasks to the automation of substantive judicial decisions. The ongoing or future judicial automation in the European Union (EU) requires an in-depth legal analysis from the perspectives of data protection and privacy law, which raise crucial legal issues in the judicial automation landscape. The paper, therefore, aims to identify the constraints created by the EU data protection and privacy law to the use of automated decision-making within judicial proceedings. It first describes two models of judicial automation, which need to be distinguished on the basis of the degree of automation and the level of human involvement in the decision-making process (fully and partially automated decision-making and two sub-models of the latter). The paper then discusses the legal bases for both models of automated personal data processing in the judiciary, with a particular emphasis on the French national regulation, based on Article 22 of the GDPR, which provides the sharpest restriction to judicial automation within the European Union. Even when there are lawful grounds for judicial automation, legal requirements will provide constraints and limits to the operation of any automated decision-making systems. Acknowledging this fact, the paper concludes with the analysis of three perspectives which introduce limits to automation — data protection regulation, privacy law, and technological constraints —, as well as the safeguards that these viewpoints provide to the rights and interests of those affected by judicial automation.

Next generation privacy

ABSTRACTIn recent years, research within and outside the European Union (EU) has focused on the expanding scope of personal data. The analysis provided has primarily supported the conclusions that in time, personal data will become so ubiquitous that the EU data protection law would become meaningless, unreasonable, or even discredited and ignored. Notwithstanding these criticisms, EU law is promoted as the ‘gold standard' for data protection laws and the law, including its definition of personal data, is being rapidly adopted by many non-EU countries. The objective of this article is to analyse the concept of personal data under EU law and to explore its continued relevance within a data protection framework that is rapidly globalised and in which technology is continuously evolving. The article argues that far from reflecting a universal notion of data protection, the EU law and particularly its definition of personal data reflects a perception of privacy that is peculiarly European. It further argues that recent developments in technology call for a re-examination of the concept of personal data and a more critical approach by countries with nascent data protection regimes. The article proposes the ‘objective risk of contextual harm’ as a new approach for formulating an alternative definition of personal data. It concludes that this approach better articulates the construction of data protection as a social good and a mechanism for (consumer) protection.

Cross-border issues under EU data protection law with regards to personal data protection

ABSTRACTWe are living in an inter-connected, global digital society where the services of different operating systems are universal in nature, but many Internet activities are still being tackled by national laws and regulations. A long-existing question is which law is applicable in cases of Internet activities because the online world does not have any physical boundaries. How the European Union (EU) approaches this duality has become a concern for data protection laws. By analysing some recent Court of Justice of the European Union case laws, this article seeks to discover how the EU data protection law tackles disputes involving transnational issues online, which includes its extra-territorial application and cross-border data transfers. The article also indicates that there is an enormous gap between legislation and practice.

The Best of Both Worlds? Free Trade in Services and EU Law on Privacy and Data Protection

The article focuses on the interplay between European Union (EU) law on privacy and data protection and international trade law, in particular the General Agreement on Trade in Services (GATS) and the WTO dispute settlement system. The argument distinguishes between the effects of international trade law in the EU legal order on the one hand, and, on the other hand, how EU data protection law would fare in a hypothetical challenge under the GATS. The contribution will apply international trade law and the general exception in GATS Article XIV to typical requirements stemming from EU data protection law, especially on transfers of personal data to third countries. The article enumerates the specific legal risks for defending EU law on privacy and data protection and explains the practical implications of its hypothetical challenge under the GATS. These insights could be useful for the EU’s negotiators of the future bi- or multilateral free trade agreements, notably the Transatlantic Trade and Investment Partnership and the Trade in Services Agreement.

Search engine liability for autocomplete suggestions: personality, privacy and the power of the algorithm

This article is concerned with the liability of search engines for algorithmically produced search suggestions, such as through Google’s ‘autocomplete’ function. Liability in this context may arise when automatically generated associations have an offensive or defamatory meaning, or may even induce infringement of intellectual property rights. The increasing number of cases that have been brought before courts all over the world puts forward questions on the conflict of fundamental freedoms of speech and access to information on the one hand, and personality rights of individuals— under a broader right of informational self-determination—on the other. In the light of the recent judgment of the Court of Justice of the European Union (EU) in Google Spain v AEPD, this article concludes that many requests for removal of suggestions including private individuals’ information will be successful on the basis of EU data protection law, even absent prejudice to the person concerned.

The European Union and the Search for an International Data Protection Framework

The European Union (EU) has supported the growing calls for the creation of an international legal framework to safeguard data protection rights. At the same time, it has worked to spread its data protection law to other regions, and recent judgments of the Court of Justice of the European Union (CJEU) have reaffirmed the autonomous nature of EU law and the primacy of EU fundamental rights law. The tension between initiatives to create a global data protection framework and the assertion of EU data protection law raises questions about how the EU can best promote data protection on a global level, and about the EU’s responsibilities to third countries that have adopted its system of data protection.

The European Union and the Search for an International Data Protection Framework

The European Union (EU) has supported the growing calls for the creation of an international legal framework to safeguard data protection rights. At the same time, it has worked to spread its data protection law to other regions, and recent judgments of the Court of Justice of the European Union (CJEU) have reaffirmed the autonomous nature of EU law and the primacy of EU fundamental rights law. The tension between initiatives to create a global data protection framework and the assertion of EU data protection law raises questions about how the EU can best promote data protection on a global level, and about the EU’s responsibilities to third countries that have adopted its system of data protection.

Fundamentally Off Balance: European Union Data Protection Law and Media Expression

The European Data Protection Directive 95/46/EC requires all European Economic Area (EEA) jurisdictions to provide an equivalent regime protecting the privacy and other fundamental rights and freedoms of natural persons in relation to personal data processing, whilst also shielding media expression from the default substantive requirements as necessary to ensure a balance between fundamental rights. Through a comprehensive coding of the derogations set out in each jurisdiction’s data protection laws, this paper provides the first systematic analysis whether this has in fact been achieved. It is demonstrated that there is a total lack of even minimal harmonization in this area, with many laws providing for patently unbalanced results especially as regards the publication of sensitive information, including criminal convictions and political opinion, and the collection of information without notice direct from the data subject. This reality radically undermines European data protection’s twin purposes of ensuring the free flow of personal data and protecting fundamental rights, an outcome which remains unaddressed by the current proposed new Data Protection Regulation. Practical suggestions are made to ameliorate these troubling inconsistencies within the current process of reform.

European Union Data Protection Law and the Friend Finder Service in Social Networks

This paper addresses the legal implications of the Friend Finder, an online service, which is provided by Social Networking Site (SNS). In particular, this paper aims to examine what issues an entity engaged in operating an internet website that provides the registered users from the European Union (EU) territory the Friend Finder service must adhere to in light of the provisions of the EU data protection law. An Investigation procedure opened by the local data protection authority in Hamburg, Germany, against Facebook (one of the largest Social Networking Sites in the world), claimed, inter alia, that the Friend Finder feature, allowing the site to contact individual person which are not subscribed yet to the SNS violating Germany's data protection law, raises three important legal issues concerning data protection law: Firstly, whether the SNS provider is allowed to collect personal data such as electronic mail addresses from individuals using the SNS services, and from unregistered individuals (Friend), and what are the limitations under EU data protection law for using such data for commercial purposes. Second, whether national data protection authorities of EU Member States have jurisdiction over global Internet entities located outside of the EU that are processing personal data of individuals inside the EU. Third, whether it should be considered as illegal marketing practice for the SNS provider to use the “Friend Finder” service to send email messages to the Friend, inviting him or her to join the SNS. Part I provides the legal framework of data protection law in the European Union and introduces the main legal principles for processing the personal data of individuals inside the EU. In addition, part I provides a legal analysis for questions of jurisdiction and conflict of law. Part II provides a brief overview on the General Directive, and on the provisions of the e-privacy Directive. In addition, part II provides an overview on the implementation of the General Directive and the e-Privacy Directive in the German legal system. Part III analyses the EU data protection law provisions, which are applicable to the use of the Friend Finder service. The last part of this Master's Thesis concludes that SNS providers using the Friend Finder service in a social networking sites for commercial purposes, are held fully reliable for compliance with the EU data protection law provisions.A thesis submitted to the Bucerius/WHU Master of Law and Business Program in partial fulfillment of the requirements for the award of the Master of Law and Business (“MLB”) Degree.