Search

Article 17 GDPR is about a right to have personal data deleted and not about any ‘right to be forgotten’: its paragraph 1 expressly states that ‘the data subject shall have the right to obtain from the controller the erasure of personal data con- cerning him or her without undue delay and the controller shall have the obligation to erase per- sonal data without undue delay’. The specificity of the wording leaves little doubt as to the exact scope of Article 17 of the GDPR.

Transparency has been at the centre of the debate on algorithmic governance. However, when the GDPR was adopted in 2016, the legislator preferred to establish accountability as the core of the Regulation's principles, rather than transparency. Unfortunately, accountability does not yet seem to be playing the role it was assigned in the data protection ecosystem, at least when it comes to algorithmic decision-making. To turn this scenario around, we propose a reflective exercise in which we look at the concept of accountability and how it was introduced in the GDPR. By emphasising on the human element in algorithmic decision-making, we find a systematic and process-oriented accountability present in the GDPR. Following arguments already made in the literature, we hold that this kind of accountability is well suited for algorithmic governance. Moreover, we argue that it could be strengthened by the Commission's proposal for a Regulation on Artificial Intelligence.

Introduction: Low grip work and high feelings of self-perceived fatigue could be an early characteristic of decline in reserve capacity, which comes to full expression as physical frailty in a later stage. When grip work and self-perceived fatigue can be identified as characteristics differentiating between robustness and pre-frailty it might allow to identify pre-frailty earlier. Therefore, this study aimed to investigate whether the combination of grip work and self-perceived fatigue is related to pre-frailty in well-functioning older adults aged 80 and over. Methods: Four-hundred and five community-dwelling older adults aged 80 and over (214 robust and 191 pre-frail) were assessed for muscle endurance (grip Work corrected for body weight (GW_bw)), self-perceived fatigue (MFI-20) and frailty state (Fried Frailty Index, FFI). A Capacity to Perceived Vitality ratio (CPV) was calculated by dividing GW_bw by the MFI-20 scores. ANCOVA analysis (corrected for age and gender) was used to compare robust and pre-frail older adults, and binary logistic regressions were applied to analyze the relationship between CPV and pre-frailty status. Results: Pre-frail older adults who scored negative on the exhaustion item of the FFI still showed significantly lower GW (p < 0.001), CPV ratios (p < 0.001) and higher self-perceived fatigue (p < 0.05) compared to the robust ones. The likelihood for pre-frailty related significantly to higher age, being men and lower CPV ratios. In women, every unit increase in CPV ratio decreased the likelihood for pre-frailty by 78% (OR 0.22; 95% CI: 0.11–0.44), for men this effect was less strong (34%, OR 0.66; 95% CI: 0.47–0.93). Conclusions: Pre-frail community-dwelling persons aged 80 years and over without clinical signs of exhaustion on the FFI still experience significantly higher fatigue levels (lower Grip Work, higher self-perceived fatigue and lower CPV levels) compared to robust ones. CPV ratio could therefore be a good tool to identify subclinical fatigue in the context of physical (pre-)frailty.

Creation of the European health data space is one of the core actions promoted by the European Commission in the EU Data Strategy. This task is challenging due to technical, organizational, economic and other issues that require different measures. This paper focuses on the issues in the legal field and identifies four key legal areas where the creation of a European health data space may face obstacles or may influence its development. These areas are: 1) rules on the provision of healthcare in the Member States; 2) protection of personal data in healthcare provision and medical research; 3) control and use of non-personal data and 4) the regulatory framework on AI. The article provides the analysis and comparison of these areas to submit the systemized view on causes and consequences of the identified issues and to suggest the vision of the further legislative process related to the European health data space.

On 19 November 2019 the Council of Europe hosted an international conference, immediately preceding the annual plenary meeting of its Committee of Convention 108, on "Convention 108 + and the future data protection global standard". One of the authors made a presentation on "Comparing the EU and Council of Europe approach to Big Data", and it is its contents and findings that are further elaborated in this paper; Its aim is, in essence, to incorporate the feedback received and to adapt past research on Big Data, that was mostly relevant to the EU, also on the Council of Europe data protection system. After a few preliminary remarks on Big Data terminology and possible regulatory approaches, Big Data regulation is examined against the EU and the Council of Europe data protection systems. Particular emphasis is given to the Council of Europe regulatory approach both in terms of Convention 108 + and with regard to its Guidelines on Big Data and AI. The authors believe that, because both the EU and the Council of Europe have avoided to refer to Big Data in their basic data protection regulatory texts (a most likely intentional omission), guidance is indeed needed, and it may well come in the form of soft law. The Council of Europe has taken the lead in this through its Guidelines; Their timely, comprehensive and balanced approach showcases the Council's will for such processing to indeed take place, but within a well-regulated environment, albeit not under a rigid regulatory construction. (c) 2020 Paul de Hert and Vagelis Papakonstantinou. Published by Elsevier Ltd. All rights reserved.

Can we achieve an adequate level of explanation for complex machine learning models in high-risk AI applications when applying the EU data protection framework? In this article, we address this question, analysing from a multidisciplinary point of view the connection between existing legal requirements for the explainability of AI systems and the current state of the art in the field of explainable AI. We present a case study of a real-life scenario designed to illustrate the application of an AI-based automated decision making process for the medical diagnosis of COVID-19 patients. The scenario exemplifies the trend in the usage of increasingly complex machine-learning algorithms with growing dimensionality of data and model parameters. Based on this setting, we analyse the challenges of providing human legible explanations in practice and we discuss their legal implications following the General Data Protection Regulation (GDPR). Although it might appear that there is just one single form of explanation in the GDPR, we conclude that the context in which the decision-making system operates requires that several forms of explanation are considered. Thus, we propose to design explanations in multiple forms, depending on: the moment of the disclosure of the explanation (either ex ante or ex post); the audience of the explanation (explanation for an expert or a data controller and explanation for the final data subject); the layer of granularity (such as general, group-based or individual explanations); the level of the risks of the automated decision regarding fundamental rights and freedoms. Consequently, explanations should embrace this multifaceted environment. Furthermore, we highlight how the current inability of complex, deep learning based machine learning models to make clear causal links between input data and final decisions represents a limitation for providing exact, human-legible reasons behind specific decisions. This makes the provision of satisfactorily, fair and transparent explanations a serious challenge. Therefore, there are cases where the quality of possible explanations might not be assessed as an adequate safeguard for automated decision-making processes under Article 22(3) GDPR. Accordingly, we suggest that further research should focus on alternative tools in the GDPR (such as algorithmic impact assessments from Article 35 GDPR or algorithmic lawfulness justifications) that might be considered to complement the explanations of automated decision-making.

This article examines the changing balance established by the European Court of Human Rights (ECtHR) between human rights filters to extradition and the obligation to cooperate and how this shift of rationale brought the Court closer to the position of the Court of Justice of the European Union (CJEU) in that respect. The article argues that the ECtHR initially adopted a position whereby it prioritised human rights concerns over extraditions, but that it later nuanced that approach by establishing, in some cases, an obligation to cooperate to ensure proper respect of human rights. This refinement of its position brought the ECtHR closer to the approach adopted by the CJEU that traditionally put the obligation to cooperate above human rights concerns. In recent years, however, the CJEU also backtracked to some extent from its uncompromising attitude on the obligation to cooperate, which enabled a convergence of the rationales of the two Courts. Although this alignment of the Courts was necessary to mitigate the conflicting obligations of European Union Member States towards both Courts, this article warns against the danger of making too many human rights concessions to cooperation in criminal matters.

The Chapter deals with the use of sanctioning powers in the context of EU data protection law and reflects on the thorny relationship between different typologies of sanctions (criminal and administrative) in the light of the new administrative sanctioning powers of the Data Protection Authorities. The analysis starts form short historical presentation of the EU (secondary) laws dealing with data protection and, then it looks at changes to EU primary law brought about by the Treaty of Lisbon with an explicit imperative to improve EU data protection. The core of the analysis discusses the system of remedies in the GDPR and some examples of recent sanctioning practices by the national DPAs. The analysis is followed by three more reflective sections about supervisory convergence without creating new EU institutions, the administrative enforcement fray and defence rights and the role of criminal law in EU data protection law. The chapter also offers some guidance observations about the operationalisation of the threefold system of enforcement set up by EU data protection law.

Case of Breyer v Germany Application no 50001/12 (ECtHR, 30 January 2020): The Breyer judgment concerns the storage of subscriber data by telecommunications service providers. To the Court, the collection and storage of such data amounted to interference of a rather limited nature. Additional safeguards were provided in the relevant German laws and there was independent supervision by the data protection authorities. The German lawmaker had not exceeded the margin of appreciation. There had been no violation of Article 8 of the European Convention on Human Rights.

In this chapter, we focus on developments with regard to the legality principle in the context of surveillance in the realm of criminal law and intelligence work by secret services. A more rigorous interpretation of the legality principle in post-Klass surveillance case law certainly qualifies as one of the most remarkable developments in the European Courts’ case law on surveillance. In particular, we will show that the strict approach towards the legality requirement enshrined in Article 8 ECHR and adopted by the ECtHR in Huvig v France in the context of telephone surveillance has been reapplied in all of the following judgments of the Strasbourg Court and even adopted by the CJEU in the context of other surveillance practices.

This contribution offers to steer a discussion on the constitutive stance of fundamental rights in Western legal systems. The story of the democratic constitutional state, a story of rule of law and human rights, is an already 250 year old utopia, which strangely persists despite long-standing patterns of slavery, war, torture, poverty, hunger, deportations, racism, and other unfavorable matters to human rights. This paper aims at questioning this perpetual paradox. After a historical assessment of human rights, we maintain that the traditional narrative emerges as the result of an interchangeable religious process: human rights as the gospel of a secular religion. Despite this, our perspectives on the rights apparatus can be adjusted by a more realistic vision of legal practices. Under certain conditions, human rights can function as legal crowbars in courts. With the crowbar metaphor, we adopt a constructive and pragmatic approach to human rights. Yet, what stands out is an expectation to move beyond the human rights axioms, rather than an endeavor to fix them. Ultimately, we suggest that other less toxic frameworks could replace traditional human rights narratives as constructs that may better realise our hopes.

The Law Enforcement Directive (EU) 2016/680 (LED) defines its basic principles, such as purpose limitation and data minimisation, differently than the General Data Protection Regulation (EU) 2016/679 (GDPR). This contribution is exploring the influence of those differences on new policing methods, in particular on the big data policing. After describing the data protection regulatory framework for law enforcement authorities in the EU, we explain our understanding of the notion of big data policing. We then critically interpret the purpose limitation and the data minimisation principle in the GDPR and the LED, thereby busting some myths about the LED, created by other academics. Finally, we explore the boundaries of the abovementioned basic LED principles, in an attempt to measure their success in finding the delicate balance between the high level of personal data protection and the contemporary law enforcement needs.Keywords: data protection, Law Enforcement Directive, criminal justice, big data, purpose limitation, data minimization

In October 2020 the European Parliament issued three Resolutions on the ethical and legal aspects of Artificial Intelligence software systems (“AI”): Resolution 2020/2012(INL) on a Framework of Ethical Aspects of Artificial Intelligence, Robotics and related Technologies (the “AI Ethical Aspects Resolution”), Resolution 2020/2014(INL) on a Civil Liability Regime for Artificial Intelligence (the “Civil Liability Resolution”), and Resolution 2020/2015(INI) on Intellectual Property Rights for the development of Artificial Intelligence Technologies (the “IPR for AI Resolution”). All three Resolutions acknowledge that AI will bring significant benefits for a number of fields (business, the labour market, public transport, the health sector). However, as identified in the AI Ethical Aspects Resolution, “there are concerns that the current Union legal framework, including the consumer law and employment and social acquis, data protection legislation, product safety and market surveillance legislation, as well as antidiscrimination legislation may no longer be fit for purpose to effectively tackle the risks created by artificial intelligence, robotics and related technologies” (K). Therefore, “in addition to adjustments to existing legislation, legal and ethical questions relating to AI technologies should be addressed through an effective, comprehensive and future-proof regulatory framework of Union law reflecting the Union’s principles and values as enshrined in the Treaties and the Charter of Fundamental Rights that should refrain from over-regulation, by only closing existing legal loopholes, and increase legal certainty for businesses and citizens alike, namely by including mandatory measures to prevent practices that would undoubtedly undermine fundamental rights” (L). It is in this context that the Parliament makes concrete legislative proposals in each Resolution within its respective subject-matter. However, all three Resolutions are also adamant on not providing AI software systems with legal personality.To our mind all three make a mistake, failing to see that their otherwise excellent assessment of the problems at hand would best be served by embracing change and not shying away from it.

Over the past few years big data analytics have forcefully entered the mainstream. Admittedly, modern life would be inconceivable without the services afforded by this type of processing in the field of electronic communications. At the same time public administrations are increasingly discovering the benefits of big data analytics afforded to them by telecommunications operators. Nevertheless, despite public attention and high volumes of expert analyses, the majority of approaches on the challenges to personal data protection by this type of data processing remains theoretical; Tellingly, the EDPS speaks of the “black box” of big data analytics. However, the authors were able to open, and stare into, the “black box” of big data analytics in the electronic communications field in 2017 and 2018 in the context of GDPR compliance assessments. Their analysis first attempts to set the legal scene today, answering two crucial questions on scope and applicable law, before presenting a typology for a scalable and granular approach that the authors feel is necessary but nevertheless is missing from the text of the draft ePrivacy Regulation. The authors therefore conclude that processing requirements and particularities, as evidenced under the big data analytics paradigm, make necessary a much more detailed approach than the one afforded by the draft ePrivacy Regulation today. Until these needs are met, through the introduction of a new, fundamentally amended text, the authors suggest that the current regulatory framework and the mechanisms afforded by it be extended for an interim period, so as to afford legislators with the necessary space and time to revise their work.

The present deliverable outlines the TARES Impact Assessment method that the project intends to follow to conduct. This assessment is broader than just a data protection impact assessment (DPIA) pursuant to Article 35 of the General Data Protection Regulation (GDPR). It will not only include the objectives of the latter, but also refer to the ethical and societal concerns of the project (ethical impact assessment - ‘EIA’) and privacy aspects not falling under the data protection impact assessment (privacy impact assessment – ‘PIA’). The TARES impact assessment implies a proactive approach contributing to informed decision-making by considering potential consequences of the project, direct and indirect, to the rights and freedoms of natural persons, before its occurrence. An impact assessment evaluates the origin, nature and severity of impacts that the processing operations, real or hypothetical, of a specific project entail. The present impact assessment method intends to describe the steps to take in order to generate useful information to consortium partners and assist them in taking informed decisions about the development and deployment of the HR-Recycler technology. There is no one-size-fits all model for conducting impact assessments.

We start our contribution with a short section on the recent reforms to codify direct cooperation between law enforcement authorities and private actors (section II). After a discussion of the 2018 US CLOUD Act, we turn to the proposal of the European Union to facilitate cross-border access to electronic evidence, which was presented by the European Commission in April 2018 (e-evidence package) and the reform process at the Council of Europe to amend the 2001 Cybercrime Convention envisaging a similar mechanism and powers.The following section discusses the current MLA framework that regulates cooperation in criminal matters and exchange of evidence between the US and Europe (section III). The MLA system allows cooperation between enforcement authorities but does not foresee any basis for direct cooperation with private actors in other states. Nonetheless this practice was dubiously accepted by the regula- tory community on shaky interpretative grounds as permissible under Article 18 (on domestic production orders) and 32 (on extraterritorial data access relying on consent) of the Cybercrime Convention (see section IV).We then proceed in section V with the challenges this kind of relationship poses for state interests and for public international law and the individual concerned that is deprived by these informal practices of certain checks and guarantees built into the formal MLA system as stated above. This discussion includes issues surrounding data protection that arise from the kind of relationship that allows law enforcement authorities to have direct access to online evidence through cooperating directly with service providers and tech companies (see section VI). After a brief reflection on the weight of privacy and data protection in criminal law matters, we identify the relevant dos and don’ts in data protection law and clarify the relationship between our subject matter and the outcomes of the two Schrems judgments of the CJEU. In particular, the combination of the teachings of Schrems II (decided on 16July 2020) about the deficiencies in US law with those of the German Federal Constitutional Court on the proportionality of domestic produc- tion orders (BVerfG, 27 May 2020) might add to the relevance of data protection as an argument against informal trans-border co-operations (section VII). Lastly, we summarise our discussion and provide recommendations for further study and discussion (section VIII).

The objective of this analysis is not to list all existing issues and gaps related to informed consent and data protection in ICT research, but rather to highlight the most pressing and recently emerging issues and gaps. In particular, this Analysis focuses on several key issues, such as: the problematic role of informed and free consent in data processing for research purposes; definitory problems; consistency issues across the GDPR; and the most sensitive areas of data processing for research

After having reflected about technologies and the role of non-political guidance in EU data protection law in previous editorials, I now turn to the thorny question about the proper place of data protection law. In search of a substance, I use Murakami’s imaginary to prepare for the worst: not all things, concepts and beings are blessed with substance. After having managed (lowered) possible expectations about the essence of data protection law, I turn to a first approach to understanding data protection law as a bundle of principles. Principles are powerful legal topoi that create seriousness about legal domains. They are defended by the best scholars and much appreciated by courts in their role as judicial lawmakers. They look God-given, but are man-made. Unable to fix their number and precise nature, I will challenge them by inflating their number.

The NIS Directive is the first horizontal legislation undertaken at EU level for the protection of network and information systems across the Union. During the last decades e-services, new technologies, information systems and networks have become embedded in our daily lives. It is by now common knowledge that deliberate incidents causing disruption of IT services and critical infrastructures constitute a serious threat to their operation and consequently to the functioning of the Internal Market and the Union. This paper first discusses the Directive's addressees particularly with regard to their compliance obligations as well as Member States’ obligations as regards their respective national strategies and cooperation at EU level. Subsequently, the critical role of ENISA in implementing the Directive, as reinforced by the proposal for a new Regulation on ENISA (the EU Cybersecurity Act), is brought forward, before elaborating upon the, inevitable, relationship of the NIS Directive with EU's General Data Protection Regulation.

Summary Background To date, the accuracy of bio-impedance (BIA) to assess body composition & sarcopenia in persons aged 80 and over remains unclear. Objective We aimed to evaluate the agreement between dual energy X-ray absorptiometry (DXA) and BIA equations to determine lean mass, as well as their suitability to identify sarcopenia. Design 174 community dwelling well-functioning persons (83 women, 91 men) aged 80 and over were included. Appendicular lean mass (ALM) was predicted using BIA-based equations available in literature, and compared to DXA outcomes. Through cross-validation and stepwise multiple linear regression, a new ALM-formula was generated suitable for this population. Results Literature-based BIA equations systematically overestimated ALM. The new prediction formula that we propose for the 80+ is: ALM = 0,827+(0,19*Impedance Index)+(2,101*Sex)+(0,079*Weight); R2 = 0,888; SEE = 1,450 kg. Sarcopenia classification based on our new BIA equation for ALM showed better agreement with DXA (k ≥ 0,454) compared to literature-based BIA equations (k Conclusions Despite the high correlation between both methods, literature-based BIA equations consistently overestimate ALM compared to DXA in persons aged 80 and over. We proposed a new equation for ALM, reaching higher agreement with DXA and thus improving the accuracy of BIA for this specific age group.

Purpose To identify the different fatigue items in existing frailty scales. Methods PubMed, Web of Knowledge and PsycINFO were systematically screened for frailty scales. 133 articles were included, describing 158 frailty scales. Fatigue items were extracted and categorized in 4 fatigue constructs: “mood state related tiredness”, “general feeling of tiredness”, “activity based feeling of tiredness” and “resistance to physical tiredness”. Results 120 fatigue items were identified, of which 100 belonged to the construct “general feeling of tiredness” and only 9 to the construct “resistance to physical tiredness”. 49,4% of the frailty scales included at least 1 fatigue item, representing 15 ± 9,3% of all items in these scales. Fatigue items have a significantly higher weight in single domain (dominantly physical frailty scales) versus multi domain frailty scales (21 ± 3.2 versus 10.6 ± 9.8%, p= Conclusion Fatigue is prominently represented in frailty scales, covering a great diversity in fatigue constructs and underlying pathophysiological mechanisms by which fatigue relates to frailty. Although fatigue items were more prevalent and had a higher weight in physical frailty scales, the operationalization of fatigue leaned more towards psychological constructs. This review can be used as a reference for choosing a suitable frailty scale depending on the type of fatigue of interest.

Data protection is an EU law field that has undergone substantial change over the past few years. In April 2016 a five-year law-making process finally came to an end, with the adoption of the General Data Protection Regulation and the Police and Criminal Justice Data Protection Directive. The Directive, upon which this analysis is focused, is an ambitious text, aimed at assuming the data protection standard-setting role within the EU Justice and Home Affairs field at Member State level. At EU level Regulation 45/2001/EC is generally applicable on personal data processing by most of the EU agencies and bodies in the field. Its provisions are “particularised” and “complemented” by ad hoc substantive data protection law per each such actor. All of them, however, are to be aligned with the provisions of the Directive. Although supervision tasks are uniformly entrusted to the EDPS, the different mandates for each of the actors continue to apply. This, unnecessarily, complex legal architecture is found detrimental to the data protection purposes and ultimately against the requirements of Article 16 TFEU

This contribution looks at the legal grounds for data processing (‘when is one allowed to collect and use data on others?’) according to the General Data Protection Regulation (GDPR). It then addresses the specific regime for profiling both by solely automated and non-automated means. What is the most suitable lawful basis for this specific, sometimes controversial kind of processing? The vagueness and subjectivity of various relevant GDPR provisions in this matter can undermine legal certainty. Data protection principles such as transparency and overall fairness as enshrined in Article 5 GDPR may in this case serve as a resort to identify appropriate checks and balances. Additional understanding can be found outside data protection legislation—for instance, in competition law.

In light of the ongoing story on the regulatory steps towards electronic evidence and transnational production orders, civil rights organizations have expressed both alarm and astonishment on the regulatory initiatives in the Council of Europe regarding transnational production orders. Member states of the European Union (EU) engage actively in soft law entrepreneurship by allowing themselves to obtain directly from service providers subscriber and other communications content. This has not only been done domestically through national laws but likewise on a multilateral level as EU member states are now seen drawn towards the Council of Europe. Within said Council of Europe, member states are now enabled to stretch the extraterritorial powers exercised by their law enforcement authorities in obtaining electronic evidence through a controversial Guidance Note and soon, a Second Additional Protocol. Interestingly, throughout these developments, the EU remained passive but as of late, has come up with proposals for the European Production and Preservation Orders, among others. The mixture of alarm and astonishment among civil liberties representatives about the decision making procedures at the level of the Council of Europe can be best understood in a broader regulatory context of policy enterpreneurship, rent-seeking behaviour and, overall, rational choice institutionalism. Comparing the Council of Europe with the EU, the structure of the former makes it the more attractive venue for policy actors such as law enforcement authorities to maximize their benefits at the least amount of costs. Being competitors in policymaking vis-à-vis cooperation in criminal matters, the EU can however lose its sociopolitical ascendancy over time as an institutional venue to discuss cooperation matters. In light of this, one should not forget that two Europes coexist. These coexisting realities are now being used to the advantage of laundering policies, testing which forum would maximize benefits the most. These developments should caution us that there might be a systemic failure in ensuring safeguards in criminal investigations are always in place.