This thesis has found a balance between individual data protection rights and the free flow of data. On the one hand, this balance serves to protect the individual and his data. On the other hand,... Show moreThis thesis has found a balance between individual data protection rights and the free flow of data. On the one hand, this balance serves to protect the individual and his data. On the other hand, health care and health research must take place using personal data.A balanced approach can be found in the following four ways. Firstly, a broad(-er) interpretation of the lawful basis of consent can facilitate secondary health research. Secondly, the use of other lawful bases can be a solution for the legitimation of secondary health research. Furthermore, a separate legal ground for secondary research can be a solution to resolve the issue of a lawful basis for health research.Thirdly, a balance can be found in the individual’s autonomy vis-à-vis the accountability of the health institution and the attention drawn to the free flow of data. The focus is shifted from the individual’s control over his data towards the health institution with other lawful bases than consent and a fair balance between data protection rights and the free flow of data.Fourthly, a risk-based approach to monitoring compliance contributes to balancing the rights and interests of individuals with data sharing for health care and research. Show less
AI-powered emotion recognition, typing with thoughts or eavesdropping virtual assistants: three non-fictional examples illustrate how AI may impact society. AI-related products and services... Show moreAI-powered emotion recognition, typing with thoughts or eavesdropping virtual assistants: three non-fictional examples illustrate how AI may impact society. AI-related products and services increasingly find their way into daily life. Are the EU's fundamental rights to privacy and data protection equipped to protect individuals effectively? In addressing this question, the dissertation concludes that no new legal framework is needed. Instead, adjustments are required. First, the extent of adjustments depends on the AI discipline. There is nothing like 'the AI'. AI covers various concepts, including the disciplines machine learning, natural language processing, computer vision, affective computing and automated reasoning. Second, the extent of adjustments depends on the type of legal problem: legal provisions are violated (type 1), cannot be enforced (type 2) or are not fit for purpose (type 3). Type 2 and 3 problems require either adjustments of current provisions or new judicial interpretations. Two instruments might be helpful for more effective legislation: rebuttable presumptions and reversal of proof. In some cases, the solution is technical, not legal. Research in AI should solve reasoning deficiencies in AI systems and their lack of common sense. Show less
Rigotti, C.; Puttick, A.; Fosch Villaronga, E.; Kurpicz-Briki, M. 2023
Gaming is an important pastime for young people to relax, socialize and have fun, but also to be challenged, show creativity and work together to achieve goals. The design of games can have an... Show moreGaming is an important pastime for young people to relax, socialize and have fun, but also to be challenged, show creativity and work together to achieve goals. The design of games can have an impact on their behavior. With the changing revenue models of games, we see that game design is increasingly taking forms that do not always have a positive impact on children and may interfere with, or even violate, children's rights. This article examines how evolving revenue models of games impact user's behavior via game design. Behavioral design in games thus raises questions about children's rights to play and recreation, to health, to protection from economic exploitation and to data protection. Show less
The overall aim of this chapter is to address the challenges that Asia and Europe face in digital connectivity in the field of taxation and to facilitate the exchange of best practices in the... Show moreThe overall aim of this chapter is to address the challenges that Asia and Europe face in digital connectivity in the field of taxation and to facilitate the exchange of best practices in the framework of Asia–Europe Meeting (ASEM) connectivity and cooperation. Show less
Upon receipt of a right to be forgotten request, private actors like Google are responsible for implementing the balancing test between competing rights of privacy and data protection and free... Show moreUpon receipt of a right to be forgotten request, private actors like Google are responsible for implementing the balancing test between competing rights of privacy and data protection and free expression and access to information. This amounts to private jurisprudence that data subjects, lawyers, and interested parties could, theoretically, game to their advantage. This paper critiques this process and argues two separate, but related points. (1) Search engines have become the sole arbiter of the rights to privacy and data protection under Articles 7 and of the Charter of Fundamental Rights and Articles 8 and 10 of the European Convention of Human Rights, when safeguarding should be a responsibility of state authorities. (2) As private actors face litigation if their decision is not acceptable to the data subject, the right to access information and the public's right to know is compromised. Search engines exert considerable power over access to and Internet usage, yet nevertheless benefit from frameworks that permit a lack of adherence to similar human rights standards as public actors or agencies. As such, empowering search engines as decision-makers over conflicting fundamental rights is problematic. Rather than allow the content of the right to be forgotten to be fleshed out by private actors, the significant body of existing jurisprudence should form the basis for public guidelines on how to implement the right to be forgotten. An analysis of case law of national courts, the European Court of Human Rights and the CJEU reveals two related matters: it is possible to reverse engineer how search engines determine which requests will be actioned and those which will be denied. This paper argues a) collectively the body of jurisprudence is of sufficient standing to develop a public and transparent balancing test that is fair to all stakeholders and b) private actors should no longer be resolving the conflict between competing fundamental rights. The paper closes by positing a framework, loosely based on ICANN's Uniform Domain Resolution Procedure for resolving conflict between conflicting cyber property rights that provides transparency and accountability to the right to be forgotten and removes search engines as arbiters of the balancing test in select cases. Show less
This paper confronts assertions made by Dr Michael Veale, Dr Reuben Binns, and Professor Lilian Edwards in “Algorithms that remember: Model Inversion Attacks and Data Protection Law”, as well as... Show moreThis paper confronts assertions made by Dr Michael Veale, Dr Reuben Binns, and Professor Lilian Edwards in “Algorithms that remember: Model Inversion Attacks and Data Protection Law”, as well as the general trend by the courts to broaden the definition of ‘personal data’ under Article 4(1) GDPR to include ‘everything data-related’. Veale et al use examples from computer science to suggest some models, subject to certain attacks, reveal personal data. Accordingly, Veale et al argue that data subject rights could be exercised against the model itself. A computer science perspective, as well as case law from the Court of Justice of the European Union, is used to argue that effective machine-learning model governance can be achieved without widening the scope of personal data and that the governance of machine-learning models is better achieved through already existing provisions of data protection and other areas of law. Extending the scope of personal data to machine-learning models would render the protections granted to intelligent endeavours within the black box ineffectual. Show less
This research focuses on data subject rights – a set of data protection provisions that directly linked to the concept of individual control. In 2018, the European Parliament adopted the... Show moreThis research focuses on data subject rights – a set of data protection provisions that directly linked to the concept of individual control. In 2018, the European Parliament adopted the Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR). The new law also introduced some substantial improvements in the section on data subject rights. However, in the light of the fast-changing economic and technological environment, it is possible to notice a gap between data subject rights when understood as law in the books and when applied in practice. By using the analysis of legal sources and academic literature, this thesis explored whether the data subject rights under the GDPR are effective in the data-driven economy, and if not, what are possible solutions to overcome the shortcomings. Show less
Web Privacy Measurement (WPM) has been established as an academic research field since 2012. WPM scholars observe websites and services to detect, characterize, and quantify privacy-impacting... Show moreWeb Privacy Measurement (WPM) has been established as an academic research field since 2012. WPM scholars observe websites and services to detect, characterize, and quantify privacy-impacting behaviors. The main goal of the research field is to increase transparency through measurement.Robbert J. van Eijk investigates the advertisements online that seem to follow you. The technology enabling the advertisements is called Real-Time Bidding (RTB). An RTB system is defined as a network of partners enabling big data applications within the organizational field of marketing. The system aims to improve sales by real-time data-driven marketing and personalized (behavioral) advertising. The author applies network science algorithms to arrive at measuring the privacy component of RTB. In the thesis, it is shown that cluster-edge betweenness and node betweenness support us in understanding the partnerships of the ad-technology companies. From his research it transpires that the interconnection between partners in an RTB network is caused by the data flows of the companies themselves due to their specializations in ad technology. Furthermore, the author provides that a Graph-Based Methodological Approach (GBMA) controls the situation of differences in consent implementations in European countries. The GBMA is tested on a dataset of national and regional European news websites. Show less
Mahieu, R.; Eck, N.J.P. van; Van Putten, D.; Van den Hoven, J. 2018
Our lives are increasingly intertwined with the digital realm, and with new technology, new ethical problems emerge. The academic field that addresses these problems—which we tentatively call ... Show moreOur lives are increasingly intertwined with the digital realm, and with new technology, new ethical problems emerge. The academic field that addresses these problems—which we tentatively call ‘digital ethics’—can be an important intellectual resource for policy making and regulation. This is why it is important to understand how the new ethical challenges of a digital society are being met by academic research. We have undertaken a scientometric analysis to arrive at a better understanding of the nature, scope and dynamics of the field of digital ethics. Our approach in this paper shows how the field of digital ethics is distributed over various academic disciplines. By first having experts select a collection of keywords central to digital ethics, we have generated a dataset of articles discussing these issues. This approach allows us to generate a scientometric visualisation of the field of digital ethics, without being constrained by any preconceived definitions of academic disciplines. We have first of all found that the number of publications pertaining to digital ethics is exponentially increasing. We furthermore established that whereas one may expect digital ethics to be a species of ethics, we in fact found that the various questions pertaining to digital ethics are predominantly being discussed in computer science, law and biomedical science. It is in these fields, more than in the independent field of ethics, that ethical discourse is being developed around concrete and often technical issues. Moreover, it appears that some important ethical values are very prominent in one field (e.g., autonomy in medical science), while being almost absent in others. We conclude that to get a thorough understanding of, and grip on, all the hard ethical questions of a digital society, ethicists, policy makers and legal scholars will need to familiarize themselves with the concrete and practical work that is being done across a range of different scientific fields to deal with these questions. Show less
The GDPR poses special requirements for the processing of sensitive data, but it is not clear whether these requirements are sufficient to prevent the risk associated with this processing because...
The GDPR poses special requirements for the processing of sensitive data, but it is not clear whether these requirements are sufficient to prevent the risk associated with this processing because this risk is not clearly defined.
Furthermore, the GDPR’s clauses on the processing of—and profiling based on—sensitive data do not sufficiently account for the fact that individual data subjects are parts of complex systems, whose emergent properties betray sensitive traits from non-sensitive data.
The algorithms used to process big data are largely opaque to both controllers and data subjects: if the output of an algorithm has discriminatory effects coinciding with sensitive traits because the algorithm accidentally discerns an emergent property, this may remain unnoticed. At the moment, there are no remedies that can prevent the discovery of sensitive traits from non-sensitive data.
Managing the risks resulting from processing data that can reveal sensitive traits requires a strategy combining precautionary measures, public discourse, and enforcement until the risks are more completely understood. Insights from complex systems science are likely to be useful in better understanding these risks.
The era of big data brings with it increasing challenges to privacy. China witnessed a lack of data protection law. It wants to upgrade its legal arrangement on personal data protection.... Show moreThe era of big data brings with it increasing challenges to privacy. China witnessed a lack of data protection law. It wants to upgrade its legal arrangement on personal data protection. Accordingly, Chinese legislators consider cloning European data protection law. The plan raises a number of questions: Can European data protection law improve the quality of data protection in China? If so, how do the historic and cultural contexts matter for data protection laws unfolding in Europe and in China? Chinese policymakers assume that the european data protection law is complete, but it is not. How should China process the EU experiences to achieve a positive impact for how personal data are deployed and protected in the commercial world? In this book, these questions are examined. The book synthesizes dogmatic and empirical discussions and establishes that the subject matter of data protection law exhibits the characteristics of a complex adaptive system. It is aruged that complexity and legal theories provide a toolbox to improve exploration of data protection laws, its functions and its dynamics. The book ventures to open doors to help legal scholarship facing problems now, that threaten to trouble data protection law arrangements for decades to come. Show less
This book deals with the collision of two fundamental rights within the European legal order: the right to access to documents and the right to data protection. If a document which is kept by one... Show moreThis book deals with the collision of two fundamental rights within the European legal order: the right to access to documents and the right to data protection. If a document which is kept by one of the European Union institutions contains personal data the two right collide. Although this possible collision is apparent, it is not sufficiently addressed in the two regulations in which both rights are further elaborated (Regulation 1049/2001 and Regulation 45/2001). After an analysis of legal developments within the EU, case law of the European Court of Human Rights and the relevant national legislation of the 27 Member States, the author presents his views on how the balance between the two rights should be struck. This leads to a concrete proposal for amending both regulations. Show less