European Union Data Protection Research Articles

Herpes zoster (HZ) vaccine coverage and confidence in Italy: a Nationwide cross-sectional study, the OBVIOUS project

BackgroundHerpes Zoster is an age dependent disease and as such it represents a problem in the Italian social context, where the demographic curve is characterized by an overrepresentation of the elderly population. Vaccines against Herpes Zoster are available, safe and effective, however coverage remains sub-optimal. This study was therefore conducted to examine the variations in Herpes Zoster vaccine uptake and confidence across different regions in Italy.MethodsThis study utilized a cross-sectional computer-assisted web interview (CAWI) methodology. The survey was conducted by Dynata, an online panel provider, and involved 10,000 respondents recruited in Italy between April 11 and May 29, 2022. The sample was stratified based on geographic region, gender, and age group. Data management adhered to European Union data protection regulations, and the survey covered demographics, living conditions, and vaccination against herpes zoster (HZ), following the BeSD framework.ResultsThe findings indicate regional disparities in herpes zoster vaccine uptake across Italy. Notably, the Islands region exhibits a particularly low vaccination rate (2.9%), highlighting the need for targeted interventions. The multivariate regression analysis showed that sociodemographic factors, limited access to healthcare services, and inadequate awareness of vaccine eligibility contribute to the lower uptake observed in this region.ConclusionIn conclusion, this research emphasizes regional disparities in herpes zoster (HZ) vaccination uptake in Italy. Demographic, socioeconomic, and geographic factors impact individuals’ willingness to receive the vaccine. The study highlights the importance of awareness of vaccine eligibility and accessible vaccination facilities in increasing uptake rates.

Manipulation by design

Human behaviour is affected by architecture, including how online user interfaces are designed. The purpose of this article is to provide insights into the regulation of behaviour modification by the design of choice architecture in light of the European Union data protection law (GDPR) and marketing law (UCPD). It has become popular to use the term ‘dark pattern’ (also ‘deceptive practices’) to describe such practices in online environments. The term provides a framework for identifying and discussing ‘problematic’ design practices, but the definitions and descriptions are not sufficient in themselves to draw the fine line between legitimate (lawful) persuasion and unlawful manipulation, which requires an inquiry into agency, self-determination, regulation and legal interpretation. The main contribution of this article is to place manipulative design, including ‘dark patterns’, within the framework of persuasion (marketing), technology (persuasive technology) and law (privacy and marketing).

Enabling Integrity and Compliance Auditing in Blockchain-Based GDPR-Compliant Data Management

The General Data Protection Regulation (GDPR) is a European Union (EU) data protection and privacy law. According to the GDPR, the data on a hosting platform must meet semantic consistency and data integrity requirements. Semantic consistency means that the data operation should comply with the GDPR, while data integrity is meant to ensure that the outsourcing data should be intact. The two terms are not interchangeable. For example, if a cloud service provider migrates data to foreign storage nodes without authorization of the data owner, the data integrity requirement of the GDPR is met but the semantic consistency requirement is not. How to ensure data integrity and compliance is the main challenge for a GDPR-compliant data supervision platform. To achieve this aim, we leverage a blockchain based data management framework to check the data compliance, which can break the black box of the data hosting platform and demonstrate its logic to data owners, allowing for inspection. We propose a new provable data possession (PDP) scheme for the aforementioned framework that can check for semantic consistency and data integrity simultaneously. The verifier does not need to hold any audited data, which can reduce bandwidth usage. The verification result can be regarded as the proof for subsequent data recovery and accountability. Experimental results show higher efficiency of the PDP scheme.

Rescuing transparency in the digital economy: in search of a common notion in EU consumer and data protection law

Abstract Transparency remains a contested concept in European Union (EU) law and policy. All the main instruments of EU consumer and data protection law require that consumers be given access to and understand certain information about their relationships with traders. Improved transparency is also proposed as a response to a variety of problems associated with digital markets, including those experienced by consumers and data subjects. At the same time, transparency is increasingly challenged as ineffective and potentially even counterproductive from doctrinal and critical scholarship alike. First, transparency is seen as inherently unable to transform the economic reality on the ground and to address the power imbalances between consumers and traders. Secondly, it is argued that acts of representation involved in transparency suffer from complexity and are prone to exploitation by the actors who engage in it. This, in turn, casts doubt on the ability of transparency to steer the behaviour of businesses and transform markets to the benefit of consumers and society. This article builds upon prior critiques of transparency and connects them with a doctrinal analysis of EU consumer and data protection law and in particular the Unfair Contract Terms Directive, the Unfair Commercial Practices Directive, and the General Data Protection Regulation. Seven different notions of transparency are identified: (i) Transparency as access to the medium over time; (ii) Transparency as presentation of information that facilitates understanding; (iii) Transparency as formulations that facilitate understanding; (iv) Transparency as non-ambiguity and logical intelligibility; (v) Transparency as the absence of deception and confusion; (vi) Transparency as completeness and specificity; and (vii) Transparency as non-arbitrariness. The article submits that the acts of representation involved in transparency are already recognized in the three legal regimes and attempts are made to leverage the mediated nature of transparency to consumers’ advantage. Crucially, existing efforts to regulate mediation and improve its quality can, nowadays, be reinforced with the help of algorithmic systems geared toward supporting consumers. Moreover, some of the deployments of transparency identified—most notably transparency as non-arbitrariness—push its outer conceptual boundaries in ways that bring transparency very close to fairness. The article ultimately questions a vision of transparency as a necessarily softer-touch protective frame, which cannot alter business conduct. The conceptual richness of transparency offers opportunities for its deployment in more disruptive ways.

Preserving Consumer Autonomy through European Union Regulation of Artificial Intelligence: A Long-Term Approach

AbstractPersonal autonomy is at the core of liberal societies, and its preservation has been a focus of European Union (EU) consumer and data protection law. Professionals increasingly use artificial intelligence in consumer markets to shape user preferences and influence their behaviours. This paper focuses on the long-term impact of artificial intelligence on consumer autonomy by studying three specific commercial practices: (1) dark patterns in user interfaces; (2) behavioural advertising; and (3) personalisation through recommender systems. It explores whether and to what extent EU regulation addresses the risks to consumer autonomy of using artificial intelligence in markets in the long term. It finds that new EU regulation does bring novelties to protect consumer autonomy in this context but fails to sufficiently consider the long-term consequences of autonomy capture by professionals. Finally, the paper makes several proposals to integrate the long-term risks affecting consumer autonomy in EU consumer and data protection regulation. It does so through an interdisciplinary approach, drawing from legal research and findings in the study of long-term thinking, philosophy and ethics and computer science.

Are Joint Controllers Joint Trade Secret Owners? What EU Data Protection and US Information Privacy Law Tell Us About Trade Secret Law

The article focusses on (joint) trade secret ownership as a (neglected) aspect of European Union (EU) and United States (US) Trade Secret Law. The article shows that Information Privacy Law and Data Protection Law, respectively, and Trade Secret Law intersect. This intersection can be used to address not only the issue of unclear trade secret ownership in relation with personal data, but also the issue of power imbalance raised by considering two or more parties with entirely different bargaining positions as jointly responsible under Data Protection Law, in particular under the General Data Protection Regulation (GDPR). In this regard, US Information Privacy and Trade Secret Law as well as EU Data Protection and Trade Secret Law and the underlying ownership and liability concepts are analysed and compared to each other. The article shows that factors for (joint) control as developed by the Court of Justice of the European Union (CJEU) (Cases Wirtschaftsakademie, Jehovah’s Witnesses (JW), and Fashion ID) can be adapted by means of interpretation in essence under EU and US Trade Secret Law. Thus, joint controllers are often considered joint owners of the respective personal data as a trade secret. According to this approach, the parties are reciprocally entitled to prevent disclosures by each other beyond what is explicitly or implicitly agreed. Such right can act as a lever for weaker parties when bargaining with ‘stronger’ parties as necessary under Data Protection Law. At the same time, the essentially unified approach of determining trade secret ownership and data protection controllership provides for more clarity when it comes to the determination of trade secret ownership. Joint Control, Trade Secrets, Ownership, Joint Ownership, UTSA, Fashion ID, Trade Secret Directive, GDPR, FTCA, US

Third Country PNR Mechanisms After the CJEU’s Schrems II Judgment

The article illustrates how the Court of Justice of the European Union (CJEU)’s Schrems II judgment solidified the European court’s approach to European Union (EU) data protection and the issues of data collection and transfer outside EU borders. The judgment rebalances how to arrange the issues containing the collection of private information and the risk to the public without surveillance. Thus, invalidating previously used EU-Third Country data sharing frameworks. Included in this are the Passenger Name Records (PNR), which are used in day-to-day mechanisms of the air industry when sharing bulk data sets with other countries to provide crucial information for anti-terrorism with border protection agencies. Not only does it protect national security, but makes flying safer. Though the EU argues it cannot sacrifice the integrity of individual data autonomy. Due to the Schrems II judgment, most other countries will be unable to pass new EU standards, and data transfer has to be judged on a case-by-case basis, which when looking at the international air industry is unfeasible. By exploring the Schrems II judgment, this article will analyze the third-country data transfer mechanisms and the impact the judgment had on third countries. Air law, PNR, CJEU, Schrems II, Privacy Shield, national security, European Data Protection, data transfer mechanisms, GDPR, Standard Contractual Clauses (SCC)

Forbidden fruit or soured grapes? Long-term effects of the temporary unavailability and rationing of US news websites on their consumption from the European Union

In May 2018, hundreds of websites located outside the European Union (EU), including USAToday.com, became completely or partially unavailable to EU citizens as a number of publishers decided to comply with an EU data protection regulation (GDPR) by blocking access. Several of the sites that started to exclude EU users continued to do so for months or years, even though some of their competitors, like the New York Times, never adopted a policy of exclusion. These differing strategies allowed us to conduct a quasi-experimental study on the effects of temporary product unavailability and temporary rationing. We find that both temporary product withdrawal and temporary rationing can have long-term effects. In our case, monthly unique visitors in the months and even years after full access was restored were between 44% and 61% lower than they had been before the restrictions were imposed, with a wider market contraction explaining only part of these falls. We also find distinct differences between the effects of temporarily rationing and temporarily withdrawing websites. Although both strategies lead to a long-term loss in visitors, rationing appears to increase a website's desirability for some consumers. After rationing was lifted, USAToday.com's reduced audience consumed the title more deeply and frequently than had been the case before rationing was imposed.

Artificial Intelligence and Data Protection: A Comparative Analysis of AI Regulation through the Lens of Data Protection in the EU and Brazil

Abstract Artificial intelligence (AI) is already a major part of our daily lives. From unlocking our smartphones with our faces to receiving film recommendations on streaming platforms, AI is part of our routines. In recent years, a widespread adoption of AI technologies both by public and private agencies has been observed. Notwithstanding the many conveniences it has created, the use of AI also involves many risks for people individually and for society as a whole. For instance, it may jeopardise fundamental rights such as privacy and data protection or even intensify existing discrimination against minorities. For this reason, various nations are now facing the challenge of regulating AI without limiting its development. In terms of data protection, the European General Data Protection Regulation (GDPR) has been consistently applied and enforced in the European Union (EU) and has inspired many other data protection laws that came after it, such as the one in Brazil. In Brazil, the General Data Protection Law (LGPD) has finally come into force and is slowly being enforced. In 2021, a series of legislative initiatives concerning the development and use of AI systems drew the attention of governments, academics and the tech industry around the world. In the EU, the European Commission released a proposal for regulation in April that presents harmonised rules on AI. Meanwhile, in Brazil, in September, the Chamber of Deputies approved a rather superficial bill aiming to regulate AI in the country. Thus, one can wonder: what is the impact of data protection laws on AI regulations? And how could Brazil benefit once again from following the EU’s lead on regulating AI? In order to answer these questions, this article begins by explaining the concept of AI. It then presents the relation between AI and privacy and data protection as well as the main principles that guide privacy and data protection under both EU and Brazilian data protection laws. Subsequently, it introduces the EU legal framework for AI and focuses on the risk-based approach. Later, it presents the proposed Brazilian bill, focusing on its main principles from a comparative perspective with the EU. Finally, it will conclude how Brazil can benefit from taking inspiration from the EU experience on AI regulation.

Proportionate response to the COVID-19 threat? Use of apps and other technologies for monitoring employees under the European Union's data protection framework.

This article explores the potential uses by employers of contact‐tracing apps and other monitoring technologies to mitigate the spread of COVID‐19, and the potential concerns that these raise in the context of the European Union's General Data Protection Regulation. Given the imbalance of power in the employment relationship, the authors call for national laws to strengthen employees' ability to refuse the use of such apps and technologies after the end of the COVID‐19 pandemic. When such tools are no longer needed to keep employees safe, additional regulations and guidance will be necessary to prevent future problems, such as function creep and other misuse by employers.

Asserting Europe's technological sovereignty amid American platform finance: Countering financial sector dependence on Big Tech?

Spearheaded by major technology companies (Big Tech), digital platforms have rapidly become key infrastructures for accumulation under global financialized capitalism, with consumer convenience and underlying practices of data collection, control and analysis giving rise to platform finance. While financial institutions are partnering with financial technology (FinTech) start-ups to digitally enclose customers, American and Chinese Big Techs increasingly mobilize their platforms to offer payment services, next to expanding their platformed services to financial incumbents. Observing the growing dependence of finance on American Big Tech platforms, this paper investigates how the shift toward platform finance in the European Union (EU) unfolds as a state-mediated and power-laden process between mostly ‘domestic’ (EU) financial incumbents and ‘foreign’ (non-EU) Big Tech firms. The starting point of the analysis is the European Strategy for Data launched by the European Commission in 2020. Through document analysis, we reconstruct the circulation of code words within ‘the Brussels Bubble’ in anticipation of- and in direct response to the proposal. We find that, despite its implication in the global financial crisis, incumbent EU finance presents itself as a fix for non-EU platform domination by Big Tech. The ‘technological sovereignty’ of the EU is marshalled by incumbent finance to defend market share as would-be pan-European digital financial champions. The Big Tech ‘threat’ is thereby transformed into an argument for strategic deregulation and forced data sharing by Big Tech for the sake of maintaining a ‘level playing field’. The outcome of these processes of strategic coupling is an alignment between the interests of EU data protection and the commercial interests of platformizing European banks.

Exchange of Human Data Across International Boundaries.

There is a need to share personal data across jurisdictional boundaries. However, the laws regulating such transfers are not harmonized, and sometimes even conflict, causing challenges and occasional data stalls. This review describes the legal landscape for transfer of human data across international boundaries. The European Union's data protection legislation is used as the starting point for illustrating the legislation of countries across the world, how these diverge, and one's options for exchanging human data internationally in a legally compliant manner.

Data Protection Compliance Organizations (DPCO) Under the NDPR, and Monitoring Bodies Under the GDPR: Two Sides of the Same Compliance Coin?

The European Union (EU) Data Protection Directive (DPD) was repealed for its failure to achieve the anticipated level of regulatory compliance thereby paving the way for General Data Protection Regulation (GDPR) which came with a number of novelties including the introduction of monitoring bodies (MBs) as another layer of compliance enforcement with provisions of the GDPR through sector-specific codes of conduct (CoC). While the DPD also had a provision on CoC, it was bereft of its enforcement mechanism, success indicators and workability, hence the introduction of MBs as an additional player in the GDPR-enforcement ecosystem to ensure compliance with the CoC on the one hand and sanction violations on the other. Conversely, on the other side of the Mediterranean Sea, Nigeria issued its own version of the GDPR as ‘Nigeria Data Protection Regulation’ (NDPR) and introduced its own peculiar MB styled ‘Data Protection Compliance Organization’ (DPCO) to, interestingly, on behalf of the National Information Technology Development Agency (NITDA) ensure and monitor compliance with the NDPR and at the same time forge a fiduciary relationship with the controllers as their paid auditors. This article places the European concept of MBs and Nigerian novelty of DPCOs side by side while examining the relationship between the two similar yet asymmetric concepts. The article analyses the varying issues surrounding the nature, appointment or creation, powers, and functionalities of MBs and DPCOs under the European and Nigerian regulations. Nigeria, Nigeria Data Protection Regulation, NDPR, National Information Technology Development Agency, NITDA, Data Protection Compliance Organization, DPCO

Creating standards for Canadian health data protection during health emergency – An analysis of privacy regulations and laws

Health emergencies require unprecedented measures to protect the public from the health disaster. Such measures may require limiting the exercise of personal freedom and other rights like the right to data privacy. The limitation, however, should be temporary and proportionate so that privacy rights are not compromised superfluously. In this aspect, the European Union (EU) implemented better data protection measures and guided the government and various entities on the acceptable ways of handling data during a pandemic, though the measures taken were not very comprehensive. Canadian privacy laws in general are sector driven and not harmonised at the national level and there is no new guidance on the usage of data during emergencies. Hence, this research will analyse laws and regulation in EU and Canada with a view to understanding the necessity of amending privacy laws in Canada to make it relevant, up-to-date and in compliance with EU data protection requirements so data sharing from EU countries could be made easy. It further encapsulates appropriate standards for Canada health data protection for better management of health data privacy.

Application of the principle of transparency in processing of European national libraries patrons' personal data

PurposeThe purpose of this paper is to examine the relationship between the legal obligation of European libraries to ensure the transparent personal data processing and respect for user privacy. This paper will examine how libraries use privacy notices on websites to communicate with patrons about the processing of personal data and in what manner have libraries been guided by applicable transparency guidelines.Design/methodology/approachThe method used is the analysis of privacy policies and other privacy documents found on the websites of national libraries. The analysis sample includes documents of 45 European national libraries, 28 out of those being national libraries of European Union (EU) Member States. The elements for this analysis are derived from the mandatory elements of the General Data Protection Regulation and the recommendations of the WP29/EDPB Transparency Guidelines.FindingsThe findings suggest that European national libraries largely adhere to EU data protection standards. In total, 60% libraries use a separate privacy page, and 53% of the EU Member State national libraries websites managed to comply with publishing all necessary data protection information in a way recommended by the Guidelines, compared to 47% of non-Member State national libraries.Originality/valueThe research contributes to the understanding of the importance of the principle of transparency and its operationalization.

In/acceptable marketing and consumers' privacy expectations: four tests from EU data protection law

PurposeThis study aims to discover the legal borderline between licit online marketing and illicit privacy-intrusive and manipulative marketing, considering in particular consumers’ expectations of privacy.Design/methodology/approachA doctrinal legal research methodology is applied throughout with reference to the relevant legislative frameworks. In particular, this study analyzes the European Union (EU) data protection law [General Data Protection Regulation (GDPR)] framework (as it is one of the most advanced privacy laws in the world, with strong extra-territorial impact in other countries and consequent risks of high fines), as compared to privacy scholarship on the field and extract a compliance framework for marketers.FindingsThe GDPR is a solid compliance framework that can help to distinguish licit marketing from illicit one. It brings clarity through four legal tests: fairness test, lawfulness test, significant effect test and the high-risk test. The performance of these tests can be beneficial to consumers and marketers in particular considering that meeting consumers’ expectation of privacy can enhance their trust. A solution for marketers to respect and leverage consumers’ privacy expectations is twofold: enhancing critical transparency and avoiding the exploitation of individual vulnerabilities.Research limitations/implicationsThis study is limited to the European legal framework scenario and to theoretical analysis. Further research is necessary to investigate other legal frameworks and to prove this model in practice, measuring not only the consumers’ expectation of privacy in different contexts but also the practical managerial implications of the four GDPR tests for marketers.Originality/valueThis study originally contextualizes the most recent privacy scholarship on online manipulation within the EU legal framework, proposing an easy and accessible four-step test and twofold solution for marketers. Such a test might be beneficial both for marketers and for consumers’ expectations of privacy.

Disproportionate Surveillance: Technology-Assisted and Automated Decisions in Asylum Applications in the EU?

Abstract Since the terrorist attacks of 11 September 2001 in the United States, the association between migration and security has been continuously strengthened, with multiple States working to tighten their border controls. In the European Union (EU), this trend has been shown by the frequent overlap between asylum application and migration policies and the agenda concerning border control, security, and terrorism. This securitization of migration discourse is claimed to justify the use of controversial practices to examine asylum applications. Against this background, the article reflects on the use of technology-assisted and automated decisions in this area. In particular, it questions whether the existing safeguards provided in the EU data protection framework ensure asylum seekers’ rights to privacy and the protection of personal data. In doing so, the article seeks to offer a more nuanced understanding of European asylum policy and the potential flaws therein that allow individuals’ fundamental rights – enshrined in the EU Charter and the European Convention on Human Rights – to be infringed. In conclusion, the article engages with the debate relating to the use of automated decisions, in particular those based on artificial intelligence, and whether they should be excluded from certain policy areas, such as migration.

The EU Digital COVID Certificate: A Preliminary Data Protection Impact Assessment

On 20 May 2021, the European Commission, Council and Parliament announced a breakthrough in the trialogue negotiations to establish the European Union (EU) Digital COVID Certificate. Originally, this standardisation effort was labelled as “Digital Green Certificate” and – “[i]n view of the urgency” – presented without a data protection impact assessment. It should allow citizens and residents of Member States to prove that they are either vaccinated against COVID-19, have recently tested negative or are currently immune against the virus. This article considers the proposal from a privacy perspective, taking into account the opinion of EU data protection authorities, ongoing negotiations in the EU institutions and relevant developments on the national and international level. While the European Parliament and others tried to improve the original Commission proposal, questions around the appropriateness and effectiveness of the framework remain. The technological and organisational implementation is essentially left to Member States, who already have started to develop their own tracing and identification systems.

Smart Cities, Big Data, Artificial Intelligence and Respect for the European Union Data Protection Rules

Abstract The importance of cities and their populations grow more and more, as well as the need to apply ICT in their management to reduce their environmental impact and improve the services they offer to their citizens. Hence the concept of smart city arises, a transformation of urban spaces that the European Union is strongly promoting which is largely based on the use of data and its treatment using Big data and Artificial Intelligence techniques based in algorithms. For the development of smart cities it is basic, from a legal point of view, EU rules about open data and the reuse of data and the reconciliation of the massive processing of citizens’ data with the right to privacy, non-discrimination and protection of personal data. The use of Big data and AI needed for the development of smart city projects requires a particular respect to data protection regulations. In this sense, the research explores in depth the specific hazards of vulnerating this fundamental right in the framework of smart cities due to the use of Big Data and AI.

The EU Digital COVID Certificate: A Preliminary Data Protection Impact Assessment

On 20 May 2021 the European Commission, Council and Parliament announced a breakthrough in the trialogue negotiations to establish the EU Digital Covid Certificate. Originally, this standardisation effort was labelled as ‘Digital Green Certificate’ and -‘[i]n view of the urgency’ - presented without a data protection impact assessment. It should allow citizens and residents of Member States to prove that they are either vaccinated against COVID-19, have recently tested negative, or are currently immune against the virus. This article considers the proposal from a privacy perspective, taking into account the opinion of EU data protection authorities, ongoing negotiations in the EU institutions and relevant developments on the national and international level. While the European Parliament and others tried to improve the original Commission proposal, questions around the appropriateness and effectivity of the framework remain. The technological and organisational implementation is essentially left to Member States, who already have started to develop their own tracing and identification systems.