Provisions Of General Data Protection Regulation Research Articles

Unveiling the Black Box: Bringing Algorithmic Transparency to AI

Overall, algorithmic transparency is an important aspect of responsible AI development and deployment. Ensuring that AI systems are transparent and accountable will help build trust and confidence in these systems and ensure that they are used ethically and effectively. Artificial intelligence (AI) has emerged as a cutting-edge domain that is fundamentally redefining different areas of daily experiences, such as health care, transport, finance, education, and others. The systems are not created for making a judgment like human judgment of natural language, spotting patterns and problem-solving; rather AI produces machines that also have intelligence level same as that of human beings. AI having more influence over us, it is to be considered the ethical directions of these tools and see that they operate under principles of transparency and accountability. The element regarding algorithmic transparency, which means the process of understanding the functioning and explanation of how AI systems make their decisions is the one that is most crucial. The issue of algorithm transparency is of fundamental importance for many considerations. AI systems are not only supported by fairness but also by their non-discrimination. If we do not know how a system of AI arrives at the decisions made, it becomes impossible to determine if the provided results meet equal treatment for everybody. If used in delicate areas like recruitment, credit, and legal system- where the AI-machine must make choices which are life changing, then this aspect is very important. On top of fairness, algorithmic transparency is also an important factor for accountability. If we are ignorant about what an artificial intelligence algorithm does and what is the source of its decision-making process, we are unable to track and classify the mistakes or mishaps of the system. This has always mattered when central to the operation of systems with high stake, such as those used in self-driving vehicles or in health care. Algorithmic transparency may be reached using different instruments. The transparent AI systems can be made by a more transparent design, for example, the simple modelling tools, that use interpretable models. Another method is designing technologies and techniques that can help people why the artificial systems difficult to be decoded but easy to understand which they can utilize in making decisions. Therefore, algorithmic transparency is a key factor of the AI made responsibly and used by the society. It is crucial that AI machines are both transparent and accountable since this will lead to people building trust in the system and accepting its ethical and practical implications. This paper examines regulation of algorithmic transparency in the EU, specifically provisions under the General Data Protection Regulation (GDPR), it aims to situate analysis of the GDPR's provisions on explainability of AI systems within broader technology ethics and policy discourse. The paper's scope is limited to EU regulations applicable to AI data processing transparency.

A Multi-solution Study on GDPR AI-enabled Completeness Checking of DPAs

Specifying legal requirements for software systems to ensure their compliance with the applicable regulations is a major concern of requirements engineering. Personal data which is collected by an organization is often shared with other organizations to perform certain processing activities. In such cases, the General Data Protection Regulation (GDPR) requires issuing a data processing agreement (DPA) which regulates the processing and further ensures that personal data remains protected. Violating GDPR can lead to huge fines reaching to billions of Euros. Software systems involving personal data processing must adhere to the legal obligations stipulated both at a general level in GDPR as well as the obligations outlined in DPAs highlighting specific business. In other words, a DPA is yet another source from which requirements engineers can elicit legal requirements. However, the DPA must be complete according to GDPR to ensure that the elicited requirements cover the complete set of obligations. Therefore, checking the completeness of DPAs is a prerequisite step towards developing a compliant system. Analyzing DPAs with respect to GDPR entirely manually is time consuming and requires adequate legal expertise. In this paper, we propose an automation strategy that addresses the completeness checking of DPAs against GDPR provisions as a text classification problem. Specifically, we pursue ten alternative solutions which are enabled by different technologies, namely traditional machine learning, deep learning, language modeling, and few-shot learning. The goal of our work is to empirically examine how these different technologies fare in the legal domain. We computed F2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$_2$$\\end{document} score on a set of 30 real DPAs. Our evaluation shows that best-performing solutions yield F2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$_2$$\\end{document} score of 86.7% and 89.7% are based on pre-trained BERT and RoBERTa language models. Our analysis further shows that other alternative solutions based on deep learning (e.g., BiLSTM) and few-shot learning (e.g., SetFit) can achieve comparable accuracy, yet are more efficient to develop.

Understanding Public Perception of Internet Security in the European Union

Abstract This paper presents an extensive analysis of Internet security experiences and perceptions among European Union (EU) citizens, as detailed by data within commented graphics highlighting awareness of online privacy practices, security-related aspects and data tracking methods. The paper also examines the implications of the General Data Protection Regulation (GDPR) regarding businesses operating within the EU and the European Economic Area (EEA). Via a thorough investigation of Internet users' awareness of cookies as tracking tools and the prevalence of security-related incidents, the paper provides insights into the evolving landscape of online privacy and security. It elucidates the challenges and opportunities presented by GDPR compliance for businesses, compliance requirements, spanning core principles and broader implications of data processing practices. The findings mark the imperative to align businesses’ operations with GDPR provisions, addressing key aspects such as consent mechanisms, lawful bases and the importance of robust data security measures. The conclusion reveals the significance derived from the intersection of internet security perceptions, GDPR compliance, and business operations within the EU and EEA. Synthesizing empirical data with regulatory analysis, the paper provides a valuable understanding of the challenges and opportunities within the evolving regulatory landscape, thereby equipping businesses with actionable strategies in order to safeguard data privacy rights and uphold regulatory compliance in the digital age.

Arbitrability of Data Protection Disputes: Personal Data, Personalized Justice?

Abstract This article explores the interplay between international arbitration and data subject compensation claims under the General Data Protection Regulation (GDPR). The analysis focuses on the validity and enforcement of arbitration agreements and the resulting awards. The article argues that despite potential skepticism, arbitration can offer significant benefits to data subjects, and that compensation claims under the GDPR should be considered arbitrable under the New York Convention and CJEU case law. The article further argues that EU courts have a duty to refer disputes to arbitration, and that the mandatory provisions of EU law have limited means of interfering with this duty. Furthermore, it establishes that the misapplication of GDPR provisions does not automatically justify the denial of arbitral award recognition. The article argues that this is a natural extension of trust traditionally shown to arbitrators, and that such trust should not be easily cast aside.

The thin red line: Refocusing data protection law on ADM, a global perspective with lessons from case-law

This article explores existing data protection law provisions in the EU and in six other jurisdictions from around the world - with a focus on Latin America - that apply to at least some forms of the processing of data typically part of an Artificial Intelligence (AI) system. In particular, the article analyzes how data protection law applies to “automated decision-making” (ADM), starting from the relevant provisions of EU's General Data Protection Regulation (GDPR). Rather than being a conceptual exploration of what constitutes ADM and how “AI systems” are defined by current legislative initiatives, the article proposes a targeted approach that focuses strictly on ADM and how data protection law already applies to it in real life cases. First, the article will show how GDPR provisions have been enforced in Courts and by Data Protection Authorities (DPAs) in the EU, in numerous cases where ADM is at the core of the facts of the case considered. After showing that the safeguards in the GDPR already apply to ADM in real life cases, even where ADM does not meet the high threshold in its specialized provision in Article 22 (“solely” ADM which results in “legal or similarly significant effects” on individuals), the article includes a brief comparative law analysis of six jurisdictions that have adopted general data protection laws (Brazil, Mexico, Argentina, Colombia, China and South Africa) and that are visibly inspired by GDPR provisions or its predecessor, Directive 95/46/EC, including those that are relevant for ADM. The ultimate goal of this study is to support researchers, policymakers and lawmakers to understand how existing data protection law applies to ADM and profiling.11The authors thank the reviewers of the CPDP Latin America 2022 Conference and this journal for their suggestions to improve the draft paper. We also thank our colleague Stefania Medrano for her research and translation support into Latin American jurisdictions.

3D intraoral scan and diagnostic plaster model under General Data Protection Regulation – Legal protection

No legal subsumption of dental impressions, plaster models and intraoral scanning has been attempted yet. It should be examined to what extent the General Data Protection Regulation (GDPR) applies to them. The aim of this study is to legally classify 3D intraoral scans and plaster models prepared on the basis of alginate impressions within the context of personal data safety and determination of legal protection applicable to their use. The authors set the deliberations concerning legal protection of plaster models and 3D intraoral scans in the light of recently published articles regarding palatal rugae pattern stability, thus enabling accurate personal identification regardless of age or dental treatment. The deliberations concerning legal protection will be based on the analysis of the international legal acts, in particular GDPR. The intraoral scan constitutes biometric data, because it is information about a natural person – a patient is identifiable on the basis of elements defining physical identity. The plaster model itself does not constitute personal data. However, both of them constitutes medical documentation. The biometric data must be processed in a manner compliant with the GDPR provisions. The GDPR shapes only aims which should be attained. When creating a data safety system, ISO or NIST standards may help to ensure the proper level of protection against possible liability resulting from breaches in the scope of personal data processing.

AI-Enabled Automation for Completeness Checking of Privacy Policies

Technological advances in information sharing have raised concerns about data protection. Privacy policies contain privacy-related requirements about how the personal data of individuals will be handled by an organization or a software system (e.g., a web service or an app). In Europe, privacy policies are subject to compliance with the General Data Protection Regulation (GDPR). A prerequisite for GDPR compliance checking is to verify whether the content of a privacy policy is complete according to the provisions of GDPR. Incomplete privacy policies might result in large fines on violating organization as well as incomplete privacy-related software specifications. Manual completeness checking is both time-consuming and error-prone. In this paper, we propose AI-based automation for the completeness checking of privacy policies. Through systematic qualitative methods, we first build two artifacts to characterize the privacy-related provisions of GDPR, namely a conceptual model and a set of completeness criteria. Then, we develop an automated solution on top of these artifacts by leveraging a combination of natural language processing and supervised machine learning. Specifically, we identify the GDPR-relevant information content in privacy policies and subsequently check them against the completeness criteria. To evaluate our approach, we collected 234 real privacy policies from the fund industry. Over a set of 48 unseen privacy policies, our approach detected 300 of the total of 334 violations of some completeness criteria correctly, while producing 23 false positives. The approach thus has a precision of 92.9% and recall of 89.8%. Compared to a baseline that applies keyword search only, our approach results in an improvement of 24.5% in precision and 38% in recall.

An Analysis of the GDPR Compliance Issues Posed by New Emerging Technologies

AbstractNew emergent technologies, like cloud computing, blockchain, the ‘internet of things’, and artificial intelligence (AI), have received significant attention from research and industry. Public and private organisations benefit from these technologies, but the privacy of individuals is threatened. This research paper, by Varda Mone and CLV Sivakumar, analyses the existing data protection laws with respect to new emerging technologies like AI, big data, and algorithms. The purpose is first, to discuss and analyse the impact and emergence of modern concepts like big data, algorithms and artificial intelligence (AI), Cloud computing, and the ‘internet of things’, etc mainly in light of GDPR (General Data Protection Regulation) provisions. The article examines the challenges of GDPR compliance posed by the features of these technologies, both individually and collectively. Due to the unique features of these technologies, we are able to identify areas of compliance that needed attention. With regard to the compliance issues identified, we discuss possible solutions as well as raise new questions for further investigation. It is not an exhaustive assessment of these fields but an attempt is made to shed light on a few of them from a data protection perspective.

Complying with the GDPR when vulnerable people use smart devices

Abstract • The number of smart home devices is increasing. They are used by vulnerable people regardless of whether they are designed specifically for them or for the general population (eg, smart door locks, smart alarms, or voice assistants). • This article focuses on children and inherently vulnerable adults, and analyses how to comply with the General Data Protection Regulation (GDPR) when the latter use smart products, with a particular focus on the UK through references made to the Information Commissioner’s Office guidelines and reports. • Complying with the GDPR provisions related to the processing of vulnerable people’s data would be beneficial not only for the latter but also for organizations developing and deploying smart devices. • This article argues in favour of protecting vulnerable people’s data by design and default in every smart product. • The objective of this work is also to draw attention to the need of thinking about vulnerability across all data protection principles and to propose solutions on how to effectively comply with the GDPR in this context.

Processing Data to Protect Data: Resolving the Breach Detection Paradox

By Andrew Cormack. Most privacy laws contain two obligations: that processing of personal data must be minimised, and that security breaches must be detected and mitigated as quickly as possible. These two requirements appear to conflict, since detecting breaches requires additional processing of logfiles and other personal data to determine what went wrong. Fortunately Europe’s General Data Protection Regulation (GDPR) – considered the strictest such law – recognises this paradox and suggests how both requirements can be satisfied. This paper assesses security breach detection in the light of the principles of purpose limitation and necessity, finding that properly-conducted breach detection should satisfy both principles. Indeed the same safeguards that are required by data protection law are essential in practice for breach detection to achieve its purpose. The increasing use of automated breach detection is then examined, finding opportunities to further strengthen these safeguards as well as those that might be required by the GDPR provisions on profiling and automated decision-making. Finally we consider how processing for breach detection relates to the context of providing and using on-line services concluding that, far from being paradoxical, it should be expected and welcomed by regulators and all those whose data may be stored in networked computers.

Legal and Technical Feasibility of the GDPR’s Quest for Explanation of Algorithmic Decisions: of Black Boxes, White Boxes and Fata Morganas

Understanding of the causes and correlations for algorithmic decisions is currently one of the major challenges of computer science, addressed under an umbrella term “explainable AI (XAI)”. Being able to explain an AI-based system may help to make algorithmic decisions more satisfying and acceptable, to better control and update AI-based systems in case of failure, to build more accurate models, and to discover new knowledge directly or indirectly. On the legal side, the question whether the General Data Protection Regulation (GDPR) provides data subjects with the right to explanation in case of automated decision-making has equally been the subject of a heated doctrinal debate. While arguing that the right to explanation in the GDPR should be a result of interpretative analysis of several GDPR provisions jointly, the authors move this debate forward by discussing the technical and legal feasibility of the explanation of algorithmic decisions. Legal limits, in particular the secrecy of algorithms, as well as technical obstacles could potentially obstruct the practical implementation of this right. By adopting an interdisciplinary approach, the authors explore not only whether it is possible to translate the EU legal requirements for an explanation into the actual machine learning decision-making, but also whether those limitations can shape the way the legal right is used in practice.

A Tale of Two Privacy Laws: The GDPR and the International Right to Privacy

The European Union's General Data Protection Regulation (GDPR) is widely viewed as setting a new global standard for the protection of data privacy that is worthy of emulation, even though the relationship between the GDPR and existing international legal protections for the right to privacy remain unexplored. Correspondingly, this essay examines the relationship between these two bodies of law, and finds that the GDPR's provisions are neither necessary nor sufficient to protect the right to privacy as enshrined in Article 17 of the International Covenant on Civil and Political Rights (ICCPR). It argues that there are other equally valid and effective approaches that states can pursue to protect the right to privacy in an increasingly digital world, including the much-maligned American approach of regulating data privacy on a sectoral basis.

Regulacje praw osób, których dane są przetwarzane - regulacje na tle autonomicznej ochrony danych osobowych w Kościele katolickim

The paper presents an important topic of personal data protection. The relevant EU normative acts of 2016 made the Catholic Church adjust her policy with the national law contained in the General Data Protection Regulation (GDPR). The aim of this article is to examine the legal protection measures imposed by the provisions of GDPR and the Personal Data Protection Act in the context of the regulatory autonomy of the Catholic Church. The analysis is based on the dogma- tic and the legal method. As a result, it was found that the regulatory autonomy of the Catholic Church provided for in the Decree is of exclusive in character, in the remaining issues – not excluded by it – one ought to apply GDPR regulations. The GDPR does not violate the status granted to churches and religious associations or communities under the constitutional law of the Member States, but cannot grant more regulatory autonomy than that resulting from the current, in this case, Polish constitutional regulation.

When Does GDPR Act as a Blocking Statute: The Relevance of a Lawful Basis for Transfer

This paper addresses an important practical topic – when does the EU General Data Protection Regulation (GDPR) act as a “blocking statute,” to prohibit transfers of personal data in response to requests by non-EU law enforcement agencies? Since the GDPR went into effect in 2018, there has been considerable discussion of this issue, most notably when there is a request from US law enforcement for emails and other records held by cloud service providers. This paper builds upon Theodore Christakis’ recent article on the effects of Article 48 and 49 of GDPR on when the GDPR acts as a blocking statute. This paper expands the discussion by addressing the full set of GDPR legal provisions that govern such transfers of personal data from the EU to a non-member country, including the lawful bases for transfer under Articles 45 and 46 of GDPR. This paper concludes, in certain circumstances, that there is a “lawful basis” for transferring personal data out of the EU, without a blockage by Article 48. This article examines the text and legislative history of the GDPR, and provides an overall interpretation that is consistent with all of the GDPR provisions that govern such cross-border transfers. The European Data Protection Supervisor (EDPS) and European Data Protection Board (EDPB), by contrast, omitted any analysis of GDPR Articles 45 and 46 from their “initial legal assessment” of these issues. Part 1 of this paper presents the relevant EU and US legal texts. Part 2 explains why a US court order would be effective on a company headquartered in the US when the data is already in the US. Part 3 presents insights from the legislative history of Article 48. The GDPR narrowed the earlier proposed version of the blocking provision in at least five respects. Part 4 explains one significant blocking effect that does exist under Article 48 as adopted – where there is no pre-existing lawful basis for transfer, then Article 48 clearly acts as a blocking statute. Part 5 provides a 2x2 table that summarizes the legal conclusions. Overall, the paper supports the conclusion that Article 48 likely blocks in situations where there is a lawful basis for transfer but the data is in the EU. By contrast, there are strong reasons why Article 48 does not block when there is a lawful basis for transfer but the data is in the US, including the lack of extra-territoriality when a US court orders a US company to produce evidence held in the US. Part 6 examines a separate piece of the EDPS/EDPB initial legal assessment, concerning GDPR Article 6. That legal assessment took a surprisingly narrow view of what constitutes legal processing under GDPR with respect to transfers to third countries. The discussion here queries whether this narrow view is consistent with Article 6. In sum, overall, the GDPR has a narrower blocking effect than prior analysis have suggested.

Data Protection, Artificial Intelligence and Cognitive Services: Is the General Data Protection Regulation (GDPR) ‘Artificial Intelligence-Proof’?

AI - in its interplay with Big Data, ambient intelligence, ubiquitous computing and cloud computing - augments the existing major, qualitative and quantitative, shift with regard to the processing of personal information. The questions that arise are of crucial importance both for the development of AI and the efficiency of data protection arsenal: Is the current legal framework AI-proof ? Are the data protection and privacy rules and principles adequate to deal with the challenges of AI or do we need to elaborate new principles to work alongside the advances of AI technology? Our research focuses on the assessment of GDPR that, however, does not specifically address AI, as the regulatory choice consisted more in what we perceive as “technology – independent legislation. The paper will give a critical overview and assessment of the provisions of GDPR that are relevant for the AI-environment, i.e. the scope of application, the legal grounds with emphasis on consent, the reach and applicability of data protection principles and the new (accountability) tools to enhance and ensure compliance.

Understanding the legal provisions that allow processing and profiling of personal data—an analysis of GDPR provisions and principles

This contribution looks at the legal grounds for data processing (‘when is one allowed to collect and use data on others?’) according to the General Data Protection Regulation (GDPR). It then addresses the specific regime for profiling both by solely automated and non-automated means. What is the most suitable lawful basis for this specific, sometimes controversial kind of processing? The vagueness and subjectivity of various relevant GDPR provisions in this matter can undermine legal certainty. Data protection principles such as transparency and overall fairness as enshrined in Article 5 GDPR may in this case serve as a resort to identify appropriate checks and balances. Additional understanding can be found outside data protection legislation—for instance, in competition law.

The Secondary Use of Paediatric Data Under GDPR: Looking for New Safeguards for Research

Secondary use of personal data is particularly challenging for research, especially in paediatrics. The new EU General Data Protection Regulation (GDPR) enables a new legal framework for the data protection and personal data processing. This article analyses the GDPR provisions with the aim to verify if paediatric peculiarities are taken into account in the new framework and if GDPR provides adequate and clear rules to favour the secondary use of paediatric data for research purpose in international contexts. The analysis points out the lack of specific provisions covering paediatric peculiarities in the rules introduced by the GDPR, especially in the case of secondary use of data in international research projects. It concludes underlying the importance to develop new overall governance of personal data processing for health research in order to reduce the risk of infringements of fundamental and child’ rights. The need of further safeguards and tools for the standardisation of practices is also emphasised.

The Right Tools: Europe's Intermediary Liability Laws and the EU 2016 General Data Protection Regulation

The so-called “Right to Be Forgotten” established by the Court of Justice of the European Union in 2014 is about to change. The EU’s General Data Protection Regulation (GDPR), which goes into effect in 2018, introduces new notice-and-takedown rules for online information targeted by “Right to Be Forgotten” erasure requests. As drafted, the new rules make deliberate or accidental over-removal of online information far too likely. They give private Internet platforms powerful incentives to erase or de-list user-generated content – whether or not that content, or the intermediaries’ processing of the content, actually violates the law. They also create new data disclosure obligations that undermine privacy and Data Protection rights for people who post content online. These problems could be mitigated, without threatening the important privacy protections established by the GDPR, through procedural checks and balances in the platforms’ removal operations. This article details the problematic GDPR provisions, examines the convergence of European Data Protection and Intermediary Liability Law, and proposes ways that the EU’s own Intermediary Liability laws can restore balanced protections for privacy and information rights. Throughout, it focuses on the motivations and likely real-world behavior of online platforms, drawing on the author’s extensive experience as Google’s Associate General Counsel for Intermediary Liability and as Intermediary Liability Director at Stanford Law School’s Center for Internet and Society. It includes close examinations of Whether and how the “Right to Be Forgotten” may apply to user-generated content hosts like Twitter or Facebook; Free expression provisions in the GDPR; The GDPR’s extraterritorial reach and consequences for companies outside the EU; Doctrinal tensions between the EU’s Intermediary Liability law under the eCommerce Directive, and its Data Protection law under the 1995 Data Protection Directive and the new GDPR; and Human rights and fundamental rights laws governing online notice and takedown operations.

Viewing the GDPR through a de-identification lens: a tool for compliance, clarification, and consistency

In May 2018, the General Data Protection Regulation (GDPR) will become enforceable as the basis for data protection law in the European Economic Area (EEA). Compared to the 1995 Data Protection Directive that it will replace, the GDPR reflects a more developed understanding of de-identification as encompassing a spectrum of different techniques and strengths. And under the GDPR, different levels of de-identification have concrete implications for organizations’ compliance obligations – including, in some cases, relief from certain obligations. Thus, organizations subject to the GDPR can and should consider de-identification as a key tool for GDPR compliance. Nevertheless, there are many respects in which GDPR obligations remains unclear. Regulators and policymakers can help advance the rights of data subjects and further the objectives of the GDPR, while providing additional clarity, by interpreting, applying, and enforcing these GDPR provisions in a way that encourages and rewards the appropriate use of de-identification. This article examines how the GDPR addresses de-identification. It reviews several substantive obligations under the GDPR, including notice, consent, data subject rights to access or delete personal data, data retention limitations, data security, breach notification, privacy by design and by default, and others. In each case, it describes how the use of different levels of de-identification can play a role in complying with the relevant obligations. It proposes that the incentives to apply de-identification found in these provisions should be reinforced by guidance and enforcement decisions that will reward the use of de-identification and encourage the highest practical level of de-identification. Such an approach will bring clarity to the rules, enable practical tools for compliance, help foster greater consistency with data protection regimes in other jurisdictions, and advance the purposes of the regulation.

The Right Tools: Europe's Intermediary Liability Laws and the 2016 General Data Protection Regulation

The so-called “Right to Be Forgotten” established by the Court of Justice of the European Union in 2014 is about to change. The EU’s General Data Protection Regulation (GDPR), which goes into effect in 2018, introduces new notice-and-takedown rules for online information targeted by “Right to Be Forgotten” erasure requests. As drafted, the new rules make deliberate or accidental over-removal of online information far too likely. They give private Internet platforms powerful incentives to erase or de-list user-generated content – whether or not that content, or the intermediaries’ processing of the content, actually violates the law. They also create new data disclosure obligations that undermine privacy and Data Protection rights for people who post content online. These problems could be mitigated, without threatening the important privacy protections established by the GDPR, through procedural checks and balances in the platforms’ removal operations. This article details the problematic GDPR provisions, examines the convergence of European Data Protection and Intermediary Liability Law, and proposes ways that the EU’s own Intermediary Liability laws can restore balanced protections for privacy and information rights. Throughout, it focuses on the motivations and likely real-world behavior of online platforms, drawing on the author’s extensive experience as Google’s Associate General Counsel for Intermediary Liability and as Intermediary Liability Director at Stanford Law School’s Center for Internet and Society. It includes close examinations of Whether and how the “Right to Be Forgotten” may apply to user-generated content hosts like Twitter or Facebook; Free expression provisions in the GDPR; The GDPR’s extraterritorial reach and consequences for companies outside the EU; Doctrinal tensions between the EU’s Intermediary Liability law under the eCommerce Directive, and its Data Protection law under the 1995 Data Protection Directive and the new GDPR; and Human rights and fundamental rights laws governing online notice and takedown operations.