Search

Over the past few years big data analytics have forcefully entered the mainstream. Admittedly, modern life would be inconceivable without the services afforded by this type of processing in the field of electronic communications. At the same time public administrations are increasingly discovering the benefits of big data analytics afforded to them by telecommunications operators. Nevertheless, despite public attention and high volumes of expert analyses, the majority of approaches on the challenges to personal data protection by this type of data processing remains theoretical; Tellingly, the EDPS speaks of the “black box” of big data analytics. However, the authors were able to open, and stare into, the “black box” of big data analytics in the electronic communications field in 2017 and 2018 in the context of GDPR compliance assessments. Their analysis first attempts to set the legal scene today, answering two crucial questions on scope and applicable law, before presenting a typology for a scalable and granular approach that the authors feel is necessary but nevertheless is missing from the text of the draft ePrivacy Regulation. The authors therefore conclude that processing requirements and particularities, as evidenced under the big data analytics paradigm, make necessary a much more detailed approach than the one afforded by the draft ePrivacy Regulation today. Until these needs are met, through the introduction of a new, fundamentally amended text, the authors suggest that the current regulatory framework and the mechanisms afforded by it be extended for an interim period, so as to afford legislators with the necessary space and time to revise their work.

The right to data portability is one of the most important novelties within the EU General Data Protection Regulation, both in terms of warranting control rights to data subjects and in terms of being found at the intersection between data protection and other fields of law (competition law, intellectual property, consumer protection, etc.). It constitutes, thus, a valuable case of development and diffusion of effective user-centric privacy enhancing technologies and a first tool to allow individuals to enjoy the immaterial wealth of their personal data in the data economy. Indeed, a free portability of personal data from one controller to another can be a strong tool for data subjects in order to foster competition of digital services and interoperability of platforms and in order to enhance controllership of individuals on their own data. However, the adopted formulation of the right to data portability in the GDPR could benefit from further clarification: several interpretations are possible, particularly with regard to the object of the right and its interrelation with other rights, potentially leading to additional challenges within its technical implementation. The aim of this article is to propose a first systematic interpretation of this new right, by suggesting a pragmatic and extensive approach, particularly taking advantage as much as possible of the interrelationship that this new legal provision can have with regard to the Digital Single Market and the fundamental rights of digital users. In sum, the right to data portability can be approximated under two different perspectives: the minimalist approach (the adieu scenario) and the empowering approach (the fusing scenario), which the authors consider highly preferable.

The die is cast. At the time of drafting this paper the so-called Brexit, the exit of the UK from the EU, seems like a certainty after the poll results of 23 June 2016. Within such historic, indeed seismic, developments data protection seems but a minor issue, a footnote to a world-changing chapter waiting to be written. Yet, from our modest vantage point, undertaken after this Journal's kind invitation, we submit that data protection, although one out of the myriad legal aspects pertaining to Brexit that urgently await consideration, may prove to be a crucial issue in this process. Notwithstanding what happens in the immediate future, when attention will presumably be focused on coordinating the dates when Brexit may potentially occur and the GDPR comes into effect, long-term thinking is critical. We believe that, because developments in this field of law will be among those felt directly by individuals on both sides of the Channel, data protection has the potential to be among the issues that “make” or “break” a possibly successful Brexit – if success is perceived as minimal disturbance to an already functioning system. UK and EU data protection are intrinsically connected by now, by osmosis, after decades of mutual exchanges and intensive collaboration. If indeed, contrary to our wishes, a data protection Brexit does take place, the preferred way forward for the authors would be for the UK to unreservedly and permanently adhere to the EU data protection model. If this will not be the case, then we feel that a high-level principle-driven solution would serve data protection purposes better than a detailed and technical solution; the latter, if ever achievable, would essentially attempt the impossible: to surgically severe what is today an integral part of a living and functioning system.

The five-year wait is finally over; a few days before expiration of 2015 the “trilogue” that had started a few months earlier between the Commission, the Council and the Parliament suddenly bore fruit and the EU data protection reform package has finally been concluded. As planned since the beginning of this effort a Regulation, the General Data Protection Regulation is going to replace the 1995 Directive and a Directive, the Police and Criminal Justice Data Protection Directive, the 2008 Data Protection Framework Decision. In this way a long process that started as early as in 2009, peaked in early 2012, and required another three years to pass through the Parliament's and the Council's scrutiny is finished. Whether this reform package and its end-result is cause to celebrate or to lament depends on the perspective, the interests and the expectations of the beholder. Four years ago we published an article in this journal under the title “The proposed data protection Regulation replacing Directive 95/46/EC: A sound system for the protection of individuals”. This paper essentially constitutes a continuation of that article: now that the General Data Protection Regulation's final provisions are at hand it is possible to present differences with the first draft prepared by the Commission, to discuss the issues raised through its law-making passage over the past few years, and to attempt to assess the effectiveness of its final provisions in relation to their declared purposes.

This article presents the findings of interviews with representatives from the majority of EU data protection authorities in the context of the ongoing data protection reform process. It identifies commonalities between the authorities to the extent it is possible to speak about a EU DPA perspective, but also identifies areas of tension and disagreement as well as future intentions. The focus of the article is upon the impact of the data protection reform process on the way that these independent bodies, located in EU Member States will increasingly have to cooperate at an EU-level. Capturing these perspectives at this moment in the reform process provides insight into the process from a group of concerned stakeholders, but also insight into how these stakeholders are (re-)positioning themselves, planning, and anticipating the impacts of the reform. This article is based upon research conducted as part of the PHAEDRA II project ("Improving practical and helpful cooperation between data protection authorities" and the article is possible due to the assistance and contribution of all project partners. The project is co-funded by the European Union and the Fundamental Rights and Citizenship Programme (JUST/2013/FRAC/AG6068), however the contents of this article are the sole responsibility of the authors and cannot be taken to represent the views of the European Commission. More information on the project can be found at http://www.phaedra-project.eu/

Owing to the unique qualities of genetic data, there have been numerous criticisms of the current data protection framework's ability to protect genetic data. It has been suggested that the Directive did not recognise the sensitivity of genetic data and that it ignored a number of legitimate interests in this data (in particular interests which multiple data subjects may have and those which may remain in anonymous data). In 2012, the first results of a reform process of EU data protection law were released. These results included a draft Regulation (to replace the Directive) which introduced a new framework for the protection of genetic data. This Article considers whether the innovative approach to genetic data in the Regulation will provide a more adequate framework for the protection of genetic data. It concludes that the Regulation has rectified the lack of recognition of sensitivity, but still stutters in recognising a number of legitimate interests.

This article offers a critical examination of the court judgements in a recent Belgian case against Yahoo!. It examines the challenges related to the establishment of jurisdiction for Internet-based services and the role that procedures of mutual legal assistance should play. Belgian law obliges providers of "electronic communications services/electronic communications networks" to cooperate with Belgian law-enforcement authorities and to handle over communication and personal data. Although the terms are derived from the EU Electronic Communications Regulatory Framework, a much broader interpretation to them was finally given by the Belgian Supreme Court. Seemingly this implies that, from now on, a US-based company such as Yahoo! is, at least under Belgian law, under a legal obligation to directly comply with an order issued by Belgian law-enforcement authorities. Keywords: Belgian Yahoo! case; International mutual assistance; ECN operator; ECS provider; e-privacy directive