Search

Transparency has been at the centre of the debate on algorithmic governance. However, when the GDPR was adopted in 2016, the legislator preferred to establish accountability as the core of the Regulation's principles, rather than transparency. Unfortunately, accountability does not yet seem to be playing the role it was assigned in the data protection ecosystem, at least when it comes to algorithmic decision-making. To turn this scenario around, we propose a reflective exercise in which we look at the concept of accountability and how it was introduced in the GDPR. By emphasising on the human element in algorithmic decision-making, we find a systematic and process-oriented accountability present in the GDPR. Following arguments already made in the literature, we hold that this kind of accountability is well suited for algorithmic governance. Moreover, we argue that it could be strengthened by the Commission's proposal for a Regulation on Artificial Intelligence.

The European Public Prosecutor’s Office (the ‘EPPO’) necessarily processes personal data in order to fulfil its mission; As such, it falls squarely within the European Union (EU) data protection regulatory landscape. However, because the EU data protection regulatory landscape itself is currently found at a crossroads, an analysis of the EPPO data protection model may be twofold: First, placing it within the proper cross-organization dialogue currently taking place on the future regulatory model of personal data processing for law enforcement purposes carried out at EU level. Second, at an EPPO-specific level, whereby the actual data protection regime afforded to it may be assessed. This article purports to elaborate upon the above two data protection dimensions of EPPO personal data processing activities: It presents considerations and policy options during the lawmaking period that resulted in the establishment of the EPPO, it analyses the data protection regime ultimately awarded to it and attempts to, critically, place the EPPO data protection model within its proper operational and legislative environment.

Why is Big Data absent in the recent basic data protection documents of the European Union (EU) and the Council of Europe (CoE)? Why not one single reference to Big Data practices - be it to regulate or to prohibit it - in the recent General Data Protection Regulation (EU) 2016/679, the Data Protection Law Enforcement Directive (EU) 2016/680 and the Modernised CoE Convention 108 for the Protection of Individuals with Regard to the Processing of Personal Data (Convention 108+)? Some actors in the policy field considered Big Data too dan- gerous and counted on existing data protection principles to tame the beast. Others simply ignored the phenomenon or were not aware of the potential benefits of Big Data for economy and governments (the rendez-vous was missed). Our discussion of no less than six recent initiatives, - standalone laws and soft law instruments - is an indication that Europe is embracing Big Data but is seemingly hesitant to confront Big Data within the classical paradigm (field) of data protection law. Concrete guidance for Big Data practices is now spread over multiple texts emanating outside the data protection field.

On 19 November 2019 the Council of Europe hosted an international conference, immediately preceding the annual plenary meeting of its Committee of Convention 108, on "Convention 108 + and the future data protection global standard". One of the authors made a presentation on "Comparing the EU and Council of Europe approach to Big Data", and it is its contents and findings that are further elaborated in this paper; Its aim is, in essence, to incorporate the feedback received and to adapt past research on Big Data, that was mostly relevant to the EU, also on the Council of Europe data protection system. After a few preliminary remarks on Big Data terminology and possible regulatory approaches, Big Data regulation is examined against the EU and the Council of Europe data protection systems. Particular emphasis is given to the Council of Europe regulatory approach both in terms of Convention 108 + and with regard to its Guidelines on Big Data and AI. The authors believe that, because both the EU and the Council of Europe have avoided to refer to Big Data in their basic data protection regulatory texts (a most likely intentional omission), guidance is indeed needed, and it may well come in the form of soft law. The Council of Europe has taken the lead in this through its Guidelines; Their timely, comprehensive and balanced approach showcases the Council's will for such processing to indeed take place, but within a well-regulated environment, albeit not under a rigid regulatory construction. (c) 2020 Paul de Hert and Vagelis Papakonstantinou. Published by Elsevier Ltd. All rights reserved.

Case of Breyer v Germany Application no 50001/12 (ECtHR, 30 January 2020): The Breyer judgment concerns the storage of subscriber data by telecommunications service providers. To the Court, the collection and storage of such data amounted to interference of a rather limited nature. Additional safeguards were provided in the relevant German laws and there was independent supervision by the data protection authorities. The German lawmaker had not exceeded the margin of appreciation. There had been no violation of Article 8 of the European Convention on Human Rights.

Over the past few years big data analytics have forcefully entered the mainstream. Admittedly, modern life would be inconceivable without the services afforded by this type of processing in the field of electronic communications. At the same time public administrations are increasingly discovering the benefits of big data analytics afforded to them by telecommunications operators. Nevertheless, despite public attention and high volumes of expert analyses, the majority of approaches on the challenges to personal data protection by this type of data processing remains theoretical; Tellingly, the EDPS speaks of the “black box” of big data analytics. However, the authors were able to open, and stare into, the “black box” of big data analytics in the electronic communications field in 2017 and 2018 in the context of GDPR compliance assessments. Their analysis first attempts to set the legal scene today, answering two crucial questions on scope and applicable law, before presenting a typology for a scalable and granular approach that the authors feel is necessary but nevertheless is missing from the text of the draft ePrivacy Regulation. The authors therefore conclude that processing requirements and particularities, as evidenced under the big data analytics paradigm, make necessary a much more detailed approach than the one afforded by the draft ePrivacy Regulation today. Until these needs are met, through the introduction of a new, fundamentally amended text, the authors suggest that the current regulatory framework and the mechanisms afforded by it be extended for an interim period, so as to afford legislators with the necessary space and time to revise their work.

Online evidence has been indispensable in criminal matters but due to its transnational and volatile nature, there have been issues and challenges as regards access, transfer, and usage in criminal investigations and prosecutions. In recent years, practices have been established to overcome the hurdles of cross-border access to online evidence. One of these practices is direct cooperation between law enforcement authorities and data companies, the latter of which are mostly based in the US. While this cooperation has been less blatant and apparent in its earlier years due to the want of legal basis, law enforcement authorities have been less coy towards the practice more recently. The present contribution walks the reader through the recent developments on codifying the practice of direct cooperation between European law enforcement authorities and US data companies. These developments evince how law enforcement authorities are willingly and wittingly overlooking protective safeguards and issues that ought to be addressed and thoroughly discussed. By sanctioning a relationship of direct cooperation, not only are state interests affected, but likewise issues of trust, MLA rights, privacy and data protection are affected. There ought to be a thorough discussion on these issues and hopefully the lessons learned from the recent CJEU judgments and the German Federal Constitutional Court are taken into consideration.

Saudi Arabia grants nationality to an AI robot; the first “clash of robots” took place in Japan; and, Bill Gates suggests that robots start paying taxes. We believe that these developments justify new legal fiction interventions. Software has long now exceeded the intellectual property boundaries. It is no longer merely property; it has assumed life of its own. It does not matter that such life is imaginary today. Legal persons were brought to life through legal fiction intervention that was based on much less motivation – merely the human incentive for profit. Software is certainly connected today with profit, given that the world's most valued corporations are software companies. However, it has moved much further than that, to assume in many ways artificial life of its own. We think that it is time that the dichotomy between natural and legal persons, that has served humanity so well over the past centuries, now be trisected: A new, digital person, ought to be added to it.

After having reflected about technologies and the role of non-political guidance in EU data protection law in previous editorials, I now turn to the thorny question about the proper place of data protection law. In search of a substance, I use Murakami’s imaginary to prepare for the worst: not all things, concepts and beings are blessed with substance. After having managed (lowered) possible expectations about the essence of data protection law, I turn to a first approach to understanding data protection law as a bundle of principles. Principles are powerful legal topoi that create seriousness about legal domains. They are defended by the best scholars and much appreciated by courts in their role as judicial lawmakers. They look God-given, but are man-made. Unable to fix their number and precise nature, I will challenge them by inflating their number.

Careful to avoid uninformed positioning, I limited myself in my previous contribution to a Science & Technology Studies (STS)-flavoured stance about the need for closer scrutiny of existing or novel technologies when considering the role of law and regu- lation. Detailed accounts of individual technologies allow better assessments of pos- sible ethical dilemmas created by these technologies. Although authors disagree about the degree of moral agency of artefacts or things, most agree that these are more than simple passive instruments. Things influence us and our perceptions about good and bad. Things act and interact. They mediate and impact on our moral understandings.9 Knowledge about how things do that is not easy. Latour, in particular, criticises every ideal of knowledge and mastery in this area. Technologies simply escape mastery. They are the source of a continuous paradox for humans that praise technology for its functional utility, for its neutrality (neither good or bad) and for it being a means toan end, while these technologies never cease to introduce a history of enfoldings, detours, drifts, openings and translations that abolish ideas like ‘function’ and ‘neutrality’. Latour therefore sheds a critical light on modern humans that have acquired the habit to dominate but fail to see that there are no masters anymore, no clear distinctions between means and end that would allow to identify crazed technologies and ‘to bind back the hound of technology to its cage’. Morality and technology interact, often in unpredictable ways, and there is a need to conceive another history, another reassembly of morality and technology. How Latour conceives this reassembly in practice is not clear. A process with open- ness for predictable and unpredictable outcomes could bring about the necessary dig- nity of both morality and technology, whereby we renounce the idea of putting the first on the side of means and the second on the side of ends. Latour is no believer in contemporary mantras such as more transparency,or more accountability, assessment and evaluation of options. Wrongly applied, these approaches would lead us again to the impossible ideal of mastery and knowledge of things.

The NIS Directive is the first horizontal legislation undertaken at EU level for the protection of network and information systems across the Union. During the last decades e-services, new technologies, information systems and networks have become embedded in our daily lives. It is by now common knowledge that deliberate incidents causing disruption of IT services and critical infrastructures constitute a serious threat to their operation and consequently to the functioning of the Internal Market and the Union. This paper first discusses the Directive's addressees particularly with regard to their compliance obligations as well as Member States’ obligations as regards their respective national strategies and cooperation at EU level. Subsequently, the critical role of ENISA in implementing the Directive, as reinforced by the proposal for a new Regulation on ENISA (the EU Cybersecurity Act), is brought forward, before elaborating upon the, inevitable, relationship of the NIS Directive with EU's General Data Protection Regulation.

This Contribution focuses on the use made by the Belgian Constitutional Court, the Cour de Cassation and the ordinary courts of the right to privacy and the right to have personal data protected as anchored in the Belgian Constitution, the Belgian Data Protection Act and the European sources. A selection of their judgements, all dating from the era before the new EU Data Protection Regulation, are discussed along the lines of their impact on health privacy, workplace privacy, surveillance and social media privacy. Our analysis shows a great deal of European loyalty on behalf of the Belgian Constitutional Court towards European trends to favour privacy and data protection. In stark contrast stands the case law of the Cour de Cassation mainly focused at preserving prosecutorial interests and employer’s interests at the detriment of privacy and data protection interests. In our conclusions we discuss tendencies towards cosmopolitanism and tribalism, the dramatic impact of evidence law and patterns of litigation. Our analysis covers the data protection era where Belgian law was indirectly governed by EU Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23 November 1995, 31). The Directive contributed to the roll-out of data protection and harmonized the data protection provision in the EU Member States but suffered from implementation weaknesses and lack of recognition. A certain lack of recognition of the importance of data protection in the European (and Belgian legal) landscape disappeared with the the EU General Data Protection Regulation 2016/679 (“GDPR”) (OJ L 119, 5 Ma.2016, 1–88 ) that repealed Directive 95/46/EC and came into force on 25 May 2018 with direct applicable provisions. Further studies are needed to study the impact of the new European provisions on the work and output of the Belgian courts.

This contribution looks at the legal grounds for data processing (‘when is one allowed to collect and use data on others?’) according to the General Data Protection Regulation (GDPR). It then addresses the specific regime for profiling both by solely automated and non-automated means. What is the most suitable lawful basis for this specific, sometimes controversial kind of processing? The vagueness and subjectivity of various relevant GDPR provisions in this matter can undermine legal certainty. Data protection principles such as transparency and overall fairness as enshrined in Article 5 GDPR may in this case serve as a resort to identify appropriate checks and balances. Additional understanding can be found outside data protection legislation—for instance, in competition law.

Recent advancements in human-computer interaction, machine learning and in artificial intelligence hold the potential to influence both the curriculum and the pedagogy of school children. While the impacts of new technologies remain uncertain, ongoing research and innovation projects are already developing and testing such technologies in schools. This article builds on the experience of the authors as advisors for a Horizon 2020 (H2020) project conducting research with schoolchildren in twenty schools across the United Kingdom, Italy and Spain (the project MaTHiSiS). This contribution presents and discusses how the authors lived up to the obligation of conducting research in line with “ethical principles”.

The right to data portability is one of the most important novelties within the EU General Data Protection Regulation, both in terms of warranting control rights to data subjects and in terms of being found at the intersection between data protection and other fields of law (competition law, intellectual property, consumer protection, etc.). It constitutes, thus, a valuable case of development and diffusion of effective user-centric privacy enhancing technologies and a first tool to allow individuals to enjoy the immaterial wealth of their personal data in the data economy. Indeed, a free portability of personal data from one controller to another can be a strong tool for data subjects in order to foster competition of digital services and interoperability of platforms and in order to enhance controllership of individuals on their own data. However, the adopted formulation of the right to data portability in the GDPR could benefit from further clarification: several interpretations are possible, particularly with regard to the object of the right and its interrelation with other rights, potentially leading to additional challenges within its technical implementation. The aim of this article is to propose a first systematic interpretation of this new right, by suggesting a pragmatic and extensive approach, particularly taking advantage as much as possible of the interrelationship that this new legal provision can have with regard to the Digital Single Market and the fundamental rights of digital users. In sum, the right to data portability can be approximated under two different perspectives: the minimalist approach (the adieu scenario) and the empowering approach (the fusing scenario), which the authors consider highly preferable.

This article provides a critical analysis of the Council of Europe Cybercrime Convention Committee's Guidance Note of Production Orders, published on 1 March 2017. The article looks at the legal controversies surrounding production orders with a cross-border element. It explains the Guidance Note's background and origins, the basic provisions in the Cybercrime Convention allowing the law enforcement authorities to order and obtain certain information and discusses the requirements that follow from the relevant provisions of the Convention. This analysis is complemented by four critical remarks on the way the Guidance Note pushes the boundaries of acceptable treaty interpretation on the necessity of the Guidance Note, its position in regard to extraterritorial enforcement jurisdiction and sovereignty, its reticence towards fundamental rights and its refusal to define or clarify the important notion of “subscriber information”. The article argues that unilateralism is not a solution. Instead of soft law plumbing, what is needed is an agreement between sovereign states checked by their constituencies.

This contribution reflects on recent cases involving cross-border data production orders such as Yahoo Belgium, Skype Belgium and Microsoft Ireland. Cross-border data production orders are found to generally involve conflicts regarding sovereignty and enforcement jurisdiction and to frequently include voluntary cooperation of companies for which the legal framework is lacking (Introduction). The Lotus principle, which recognizes a broad extraterritorial jurisdiction to prescribe and limits extraterritorial enforcement jurisdiction, is reconsidered concerning those issues (see the ‘International law pragmatism for jurisdiction to prescribe, but not for jurisdiction to enforce’ section) and the use of mutual legal assistances, which should be the rule, is discussed with four caveats (see the ‘Four caveats to territorial sovereignty and the need for MLAs: Unclarities and politics’ section). Twelve typical arguments are identified, which are employed in courtrooms when cross-border data production orders are discussed, for example, arguments regarding territorial sovereignty, the location of servers, the virtual presence of businesses via the Internet or the nationality of the data subject (see the ‘Arguments in courtrooms in favour or against informal-based cross-border investigations’ section). Subsequently, from fourth to seventh sections, those arguments are investigated regarding their context in the cases Yahoo! Belgium (2007–2015), Skype Belgium (2012–2017), Microsoft Ireland (2013–2018) and Google in re Search Warrant (2017). Finally, a first step to evaluate and test the strength of those arguments is undertaken (see the ‘Assessing the arguments: From logically weak, to unpractical to law enforcement utilitarianism (give us everything)’ section).

The proceduralisation of data protection remedies under EU data protection law: towards a more effective and data subject-oriented remedial system? The right to remedy breaches of data protection is laid down in both Directive 95/46/EC (Art. 22) and the Council of Europe Data Protection Convention no. 108 (Art. 8 (d)). Although data protection violations are remedied mainly at the national level, it is possible to identify a set of procedural rules on how to remedy data protection violations under EU law. Currently, there is a three-layered remedial system in place (composed of access rights, the administrative system and the court system). Worthy of attention are the EU’s data protection reforms which will introduce new provisions aimed at ‘proceduralising’ data protection remedies. This paper investigates how data protection breaches are remedied in the EU and under EU law in light of Directive 95/46/EC and the proposed reforms.

The two European Courts (the European Court of Human Rights, ECtHR and, to a lesser degree, the European Union Court of Justice, EUCJ) have contributed greatly to the development of a legal framework for surveillance by either law enforcement agencies in the criminal law area or by secret services. Both courts put great emphasis on a system of control ex ante and post hoc by independent supervisory authorities. A complex and controversial issue remains whether the human rights to privacy, respect of communications, and to an effective remedy (enshrined in Article 8 and 13 of European Convention on Human Rights (ECHR)), requires judicial review as a necessary safeguard for secret surveillance or alternatively, at which conditions, parallel systems of non-judicial review can be accepted as adequate safeguards against illegitimate interference in citizens’ private life. The European Courts have not yet established a clear doctrine in determining suitable thresholds and parameters. In particular, the ECtHR has a flexible approach in interpreting article 8 and 13 ECHR, depending on several factors (“vital” interests at stake, political considerations, etc.). In general terms, the Court has shown a preference towards judiciary oversight, but in the European legal order there are several examples of alternative oversight systems assessed positively by the Court, such as the quasi-judiciary systems (where the independency of the supervisory body, its wide jurisdiction, its power to data access and its power to effective reactions are proved) or the system of oversight set by Data Protection Authorities in the EU member states. However, in recent judgements of the ECtHR and the EUCJ we see an increasing emphasis on declaring the necessity of a “good enough” judicial (ex ante or post hoc) control over surveillance, meaning not simply a judicial control, but a system of oversight (judicial, quasi-judicial, hybrid) which can provide an effective control over surveillance, supported by empirical checks in the national legal system at issue.

The die is cast. At the time of drafting this paper the so-called Brexit, the exit of the UK from the EU, seems like a certainty after the poll results of 23 June 2016. Within such historic, indeed seismic, developments data protection seems but a minor issue, a footnote to a world-changing chapter waiting to be written. Yet, from our modest vantage point, undertaken after this Journal's kind invitation, we submit that data protection, although one out of the myriad legal aspects pertaining to Brexit that urgently await consideration, may prove to be a crucial issue in this process. Notwithstanding what happens in the immediate future, when attention will presumably be focused on coordinating the dates when Brexit may potentially occur and the GDPR comes into effect, long-term thinking is critical. We believe that, because developments in this field of law will be among those felt directly by individuals on both sides of the Channel, data protection has the potential to be among the issues that “make” or “break” a possibly successful Brexit – if success is perceived as minimal disturbance to an already functioning system. UK and EU data protection are intrinsically connected by now, by osmosis, after decades of mutual exchanges and intensive collaboration. If indeed, contrary to our wishes, a data protection Brexit does take place, the preferred way forward for the authors would be for the UK to unreservedly and permanently adhere to the EU data protection model. If this will not be the case, then we feel that a high-level principle-driven solution would serve data protection purposes better than a detailed and technical solution; the latter, if ever achievable, would essentially attempt the impossible: to surgically severe what is today an integral part of a living and functioning system.

Children’s rights law is often studied and perceived in isolation from the broader field of human rights law. This contribution explores the inter-relationship between children’s rights law and human rights law on older persons in order to see whether elements from each could successfully inform the other. Children’s rights law has a number of distinctive characteristics, such as the emphasis on the ‘best interests of the child’, the use of general principles, and the inclusion of ‘third parties’ (e.g. parents and other care-takers) in treaty provisions. In this contribution we ask two questions: whether these features could be a source of inspiration for elderly human rights law? And Whether children’s rights law could draw inspiration from developments with regard to the rights of older persons?

It is argued that McDonald is to be considered a missed opportunity to integrate two areas of human rights law in the judgment: disability human rights law and elderly human rights law. During the last decade, the area of disability rights has seen important developments at both the regional and international level. The adoption of several soft law instruments and particularly the high number of ratifications of the UN Convention on the Rights of Persons with Disabilities (CRPD) reflect an evolving perception of the status of this group within society. The CRPD is considered ground breaking in the sense that it creates clear positive obligations for member states regarding the enjoyment of socio-economic rights, such as the provision of care services. The recognition and enforcement of such rights, however, remains a delicate and complicated issue before the Strasbourg Court.

Gary Becker died on 3 May 2014. He was an economist, Noble prize winner and author. He was declared by Milton Friedman as the “the greatest social scientist who has lived and worked in the last half century”. His work focused on economics and sociology, and through the lenses of these disciplines he looked at many subjects, including crime and the criminal law. His crucial finding that crime is the sum of rational actors still has a lot to off er to criminologists and practitioners working in the area of criminal law. This editorial pays tribute to his analytical spirit by embracing it when assessing the EU legislation to combat human trafficking.

This article is primarily concerned with stigmatization resulting from public information campaigns such as public health information campaigns. Stigmatization as a concept has received much attention from social scientists but conversely little from the legal world, including the European Court of Human Rights. Stigmatization can be distinguished from other similar concepts, e.g. discrimination, stereotyping and marginalization, by its ability to induce a sense of “self-loathing.” The court’s limited discourse thus far raises questions as to whether it recognizes stigmatization as being capable of engaging human rights principles where no other engaging factors are present. Even if the court is willing to find engagement in such cases, it is likely that in most instances the court would find any incidental stigmatization justified given the potential benefits available. The lack of judicial engagement with such cases thus far may reflect the possibility that stigmatization occurring through expressive acts of public officials is located within a “nexus of non-justiciability” whereby the European Convention on Human Rights is generally not applicable.

Owing to the unique qualities of genetic data, there have been numerous criticisms of the current data protection framework's ability to protect genetic data. It has been suggested that the Directive did not recognise the sensitivity of genetic data and that it ignored a number of legitimate interests in this data (in particular interests which multiple data subjects may have and those which may remain in anonymous data). In 2012, the first results of a reform process of EU data protection law were released. These results included a draft Regulation (to replace the Directive) which introduced a new framework for the protection of genetic data. This Article considers whether the innovative approach to genetic data in the Regulation will provide a more adequate framework for the protection of genetic data. It concludes that the Regulation has rectified the lack of recognition of sensitivity, but still stutters in recognising a number of legitimate interests.

Jurisdiction based solely on the territoriality principle is becoming less evident in the digital age This article engages in a discussion with authors such as Kuner and Svantesson, that have expressed a critical view on expansive jurisdiction of the EU data protection regime in issue 4, November 2015, of this Journal. Our contribution focuses on the choices with regard to scope and jurisdiction made by the EU co-legislators in Article 3 of the new EU General Data Protection Regulation (hereinafter, ‘General Regulation’ or ‘GDPR’),6 which will apply from 25 May 2018, and compares this to the current regime under Article 4 of the Data Protection Directive. It also assesses whether the modernized Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (No 108) is heading in a similar direction and highlights the Court of Justice of the European Union (CJEU) position on the territorial scope of the EU data protection law.

The five-year wait is finally over; a few days before expiration of 2015 the “trilogue” that had started a few months earlier between the Commission, the Council and the Parliament suddenly bore fruit and the EU data protection reform package has finally been concluded. As planned since the beginning of this effort a Regulation, the General Data Protection Regulation is going to replace the 1995 Directive and a Directive, the Police and Criminal Justice Data Protection Directive, the 2008 Data Protection Framework Decision. In this way a long process that started as early as in 2009, peaked in early 2012, and required another three years to pass through the Parliament's and the Council's scrutiny is finished. Whether this reform package and its end-result is cause to celebrate or to lament depends on the perspective, the interests and the expectations of the beholder. Four years ago we published an article in this journal under the title “The proposed data protection Regulation replacing Directive 95/46/EC: A sound system for the protection of individuals”. This paper essentially constitutes a continuation of that article: now that the General Data Protection Regulation's final provisions are at hand it is possible to present differences with the first draft prepared by the Commission, to discuss the issues raised through its law-making passage over the past few years, and to attempt to assess the effectiveness of its final provisions in relation to their declared purposes.

Allegedly the Police and Criminal Justice Data Protection Directive (henceforth, the “Directive”) is the little-known, much overlooked part of the EU data protection reform package that stormed into the EU legislative agenda towards the end of 2015. Its counterpart, regulating all other personal data processing activities, the General Data Protection Regulation (henceforth, the “Regulation”), is undoubtedly the text that fascinated legislators, legal scholars and even journalists over the four years since their simultaneous release in first draft formats, with its numerous noteworthy novelties: the right to be forgotten, the right to data portability, data protection impact assessments, privacy by design, consistency and one-stop-shop mechanisms among EU Data Protection Authorities etc. Compared to this impressive list the text of the Directive indeed sounds mundane and unimaginative. However, we firmly believe that the repercussions it will have in the EU personal data processing scene surrounding the work of law enforcement authorities, once it comes into effect, will be fundamental and will be equally felt by everybody exactly in the same way that its famous sibling intends to do.

This article presents the findings of interviews with representatives from the majority of EU data protection authorities in the context of the ongoing data protection reform process. It identifies commonalities between the authorities to the extent it is possible to speak about a EU DPA perspective, but also identifies areas of tension and disagreement as well as future intentions. The focus of the article is upon the impact of the data protection reform process on the way that these independent bodies, located in EU Member States will increasingly have to cooperate at an EU-level. Capturing these perspectives at this moment in the reform process provides insight into the process from a group of concerned stakeholders, but also insight into how these stakeholders are (re-)positioning themselves, planning, and anticipating the impacts of the reform. This article is based upon research conducted as part of the PHAEDRA II project ("Improving practical and helpful cooperation between data protection authorities" and the article is possible due to the assistance and contribution of all project partners. The project is co-funded by the European Union and the Fundamental Rights and Citizenship Programme (JUST/2013/FRAC/AG6068), however the contents of this article are the sole responsibility of the authors and cannot be taken to represent the views of the European Commission. More information on the project can be found at http://www.phaedra-project.eu/

The recent release by the European Commission of the first drafts for the amendment of the EU data protection regulatory framework is the culmination of a consulting and preparation process that lasted more than two years. At the same time, it opens up a law-making process that is intended to take at least as much time. The Commission has undertaken the herculean task to amend the whole EU data protection edifice, through the introduction of a General Data Protection Regulation, intended to replace the EU Data Protection Directive 95/46/EC, and a Police and Criminal Justice Data Protection Directive, intended to replace the Framework Decision 2008/977/JHA. This paper shall focus at the replacement of the EU Data Protection Directive by the draft General Data Protection Regulation. Due to the fact that the draft Regulation is a long (and ambitious) text, a selection has been made, with the aim of highlighting its treatment of basic data protection principles and elements, in order to identify merits and shortcomings for the general data protection purposes.

This paper undertakes a contextual analysis of the main aims of Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare, commonly known as the Patients’ Rights Directive (the PRD). The PRD itself does not aim to provide a new system for coordinating social security entitlements, leaving the regime laid down in (EEC) 1408/71 and later (EC) 883/2004 unaffected. Rather, it is intended that the PRD will supplement the rights that these instruments were intended to provide. The main aims of the PRD instead concern matters related to the prior authorisation of healthcare, the reimbursement of healthcare and the removal of unjustified obstacles from doing so. This paper explores how the Directive sets out to achieve these aims and analyses it within the context of other related European Union legislation and jurisprudence in the area. Alongside this primary aim of codifying European Court of Justice case law, the PRD also introduces novel initiatives aimed at fostering cross-border cooperation between various elements of national healthcare systems. These issues will be dealt with in detail in a subsequent paper.

This article offers a critical examination of the court judgements in a recent Belgian case against Yahoo!. It examines the challenges related to the establishment of jurisdiction for Internet-based services and the role that procedures of mutual legal assistance should play. Belgian law obliges providers of “electronic communications services/electronic communications networks” to cooperate with Belgian law-enforcement authorities and to handle over communication and personal data. Although the terms are derived from the EU Electronic Communications Regulatory Framework, a much broader interpretation to them was finally given by the Belgian Supreme Court. Seemingly this implies that, from now on, a US-based company such as Yahoo! is, at least under Belgian law, under a legal obligation to directly comply with an order issued by Belgian law-enforcement authorities.

The entry into force of the Lisbon Treaty has suspended discussions over the release of a EU PNR processing system. Plans to introduce an intra-EU PNR processing system initiated since 2007, although strongly supported by the Commission and the Council, did not bear fruit before the ratification of the Lisbon Treaty and the, institutional, involvement of the Parliament. While discussions have been suspended since October 2009 and most probably a new draft proposal will be produced, it is perhaps useful to present in brief the proposal currently in place so as to highlight its shortcomings for European data protection and suggest ways individual protection may be strengthened in future drafts.

Les enjeux de l’échange et de la protection des données personnelles ne sont pas une nouveauté dans les débats sur la gestion de la sécurité transatlantique et l’impact de certaines mesures sur les libertés fondamentales. La publication, en juin 2008, du Rapport final du groupe de contact à haut niveau, composé d’experts de l’Union Européenne et des Etats-Unis, ainsi que sa réception par les dirigeants politiques, a contribué à relancer le débat. Il paraît donc important de saisir cette occasion pour esquisser une première étude sur les systèmes européen et étatsunien de protection de données personnelles couvrant les activités de justice et affaires intérieures. Sans prétention à l’exhaustivité, cet article analyse les principes et les législations européenne et étatsunienne, en soulignant les limites implicites à chaque système et à la mise en relation des deux, ainsi que la nécessité d’un véritable débat politique et parlementaire pour les dépasser. Issues concerning information sharing and data protection are not a novelty in the debates on transatlantic security management and the impact of security measures on fundamental liberties. The debate has been re-launched by the publication, in June 2008, of the Final Report of the High Level Contact Group, formed by European Union and United States experts, as well as by its reception by political leaders. Therefore, this is an important occasion to draft a first study on the EU and US data protection systems covering the activities of justice and internal affairs. Surely not exhaustively, this article analyses EU and US relevant principles and legislations and it underlines the implicit limits in each system and in the set up of an agreement. Finally, it highlights the need for a real political and parliamentary debate in order to overcome the main differences and limits.

After more than three years in the making, that have witnessed much controversy, several working texts and at least two altogether different versions, the Data Protection Framework Decision “on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters” (hereafter, the DPFD) was finally adopted on 27 November 2008. The DPFD was supposed to be celebrated as the Data Protection Directive equivalent in European law enforcement (Third Pillar) processing. However, since its formal adoption, and even before that, data protection proponents (the European Data Protection Supervisor, the Article 29 Working Party, national Data Protection Commissioners, NGOs) lamented its adoption as the result of changes that ultimately compromised data protection. Is the DPFD a disappointment to the great expectations that accompanied its first draft, back in 2006? An attempt to address this question shall be undertaken in this paper.

The ageing society poses significant challenges to Europe's economy and society. In coming to grips with these issues, we must be aware of their ethical dimensions. Values are the heart of the European Union, as Article 1a of the Lisbon Treaty makes clear: "The Union is founded on the values of respect for human dignity?". The notion of Europe as a community of values has various important implications, including the development of inclusion policies. A special case of exclusion concerns the gap between those people with effective access to digital and information technology and those without access to it, the "digital divide", which in Europe is chiefly age-related. Policies to overcome the digital divide and, more generally speaking, e-inclusion policies addressing the ageing population raise some ethical problems. Among younger senior citizens, say those between 65 and 80 years old, the main issues are likely to be universal access to ICT and e-participation. Among the older senior citizens, say those more than 80 years old, the main issues are mental and physical deterioration and assistive technology. An approach geared towards the protection of human rights could match the different needs of senior citizens and provide concrete guidance to evaluate information technologies for them.

On the 17th of February an old data protection acquaintance, the EU PNR Directive1, returned to life. On that date the Parliament’s LIBE Committee released its Report2 on its rst (re-)reading of a dra that was otherwise presumed dead since 2011, when that same Committee found it unacceptable because of fundamental rights concerns and asked the Commission to withdraw it. The fact remains that the general data protection environment has in the meantime substantially changed: the PNR Directive’s provisions must now be reconciled with the latest case law of the Court of Justice on acceptable surveillance and with the EU data protection reform package, in particular with its dra Police and Criminal Justice Directive8 that is to replace the 2008 Framework Decision. is applies both to substantive law and supervision model

This in-depth analysis was commissioned by the European Parliament’s Policy Department for Citizens’ Rights and Constitutional Affairs at the request of the LIBE Committee. One cannot talk of a proper data protection regime in China, at least not as it is perceived in the EU. The international data protection fundamentals that may be derived from all relevant regulatory instruments in force today, namely the personal data processing principles and the individual rights to information, access and rectification, are not unequivocally granted under Chinese law. An efficient enforcement mechanism, also required under European standards, is equally not provided for. China has no comprehensive data protection act but several relevant sectorial laws that, under a combined reading together with basic criminal and civil law provisions, may add up to a data protection ‘cumulative effect’. This assertion is examined and assessed in the analysis that follows. A list of realistic policy recommendations has been drawn up in order to establish whether China’s recent data protection effort is part of a persistent, yet concise, policy.

Empirical data show that increasingly younger children are engaging in online activities. Many children lack experience and knowledge of the implications and practices related to personal data management. However, under the current Euro- pean data protection regime, children become data subjects on the same legal basis as adults, with consent being the most popular method of obtaining personal data. The proposed EU Data Protection Regulation tackles this problem by introducing a requirement for data controllers providing information society services directed at children: the controllers should obtain parental consent in cases where the personal data of a child under the age of 13 are being processed in the online environment. In the view of the European Commission, this requirement will reduce online risks for children and prevent them from making ‘youthful’ indiscretions.

This book on privacy and data protection offers readers conceptual analysis as well as thoughtful discussion of issues, practices, and solutions. It features results of the seventh annual International Conference on Computers, Privacy, and Data Protection, CPDP 2014, held in Brussels January 2014.The book first examines profiling, a persistent core issue of data protection and privacy. It covers the emergence of profiling technologies, on-line behavioral tracking, and the impact of profiling on fundamental rights and values. Next, the book looks at preventing privacy risks and harms through impact assessments. It contains discussions on the tools and methodologies for impact assessments as well as case studies.The book then goes on to cover the purported trade-off between privacy and security, ways to support privacy and data protection, and the controversial right to be forgotten, which offers individuals a means to oppose the often persistent digital memory of the web. Written during the process of the fundamental revision of the current EU data protection law by the Data Protection Package proposed by the European Commission, this interdisciplinary book presents both daring and prospective approaches. It will serve as an insightful resource for readers with an interest in privacy and data protection.

The proposed data protection regulation2 includes mention of the use of criminal and administrative sanctions. Both were possible in EU data protection law but, after the reform, the use of administrative sanctions will become mandatory. With regard to criminal sanctions to address data protection wrongs, nothing changes: member states can choose to create them or not. Why is the new EU, with its enhanced post-Lisbon powers, so timid and '1995-ish' with regard to criminal law? How is it possible that, to reform a set of rules created by a directive, a regulation is chosen with the aim of harmonising just about everything in EU data protection law, but not the chapter on sanctions and enforcement? This contribution lists some explanatory factors and reflects on future regulatory choices in member states.

The year 2010 set an important milestone in the development of data protection law in Europe: both Europe's basic regulatory texts, the EU Data Protection Directive and the Council's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), were placed at an amendment process, having served individual data protection for many years and witnessed in the meantime technological developments that threatened to make their provisions obsolete. After briefly presenting Convention 108, the analysis that follows will highlight the Council's data protection system currently in effect as well as developments relating to the Convention's amendment so far with the aim of identifying improvements and shortcomings. While doing this two separate points of view shall be adopted: at first a micro point of view will attempt to identify improvements and shortcomings through an ‘insider’ perspective, that is, judging only the merits and difficulties of the draft text at hand. Afterwards a macroscopic view will be adopted, whereby strategic issues will be discussed pertaining to the important issue of the relationship of the suggested draft with the EU data protection system, as well as, the same draft's potential to constitute the next global information privacy standard.

If one looks at the case law of the European Court of Human Rights on surveillance matters, a well mature set of principles emerge, namely: legality, legitimacy, proportionality (the standard check) and, if the Court is "on it", also necessity and subsidiarity (the closer scrutiny check). We pass the surveillance case law and the principles developed therein in review and note that 1) not all surveillance is considered relevant to the right to privacy (the threshold problem); 2) when surveillance is subjected to a privacy right analysis, concerns about rights contained in other provisions, such as Articles 6, 13 and 14 of the Convention, are added; 3) not all surveillance that interferes with privacy is considered as problematic, hence differences in the Court's view with regard to the legality requirement and intensity of the scrutiny arise. Beyond this analysis of the Court's surveillance case law, in the second part of this contribution we carry out further the research initiated by Murphy and Ó Cuinn about the existence of a 'new technology' approach in the Court's case law and on principles that apply to a wide range of technology-related issues (from surveillance, over biomedicine, to polluting technologies). We focus in particular on the case law of the Court on environmental matters. We find that greater coherence could be reached in the Court's case law on surveillance by integrating the environmental law principles of participation, precaution, access to information and to access justice into surveillance matters. Nevertheless, such move would be very desirable and give new momentum to the Court's case law on surveillance-related interferences.

This study aims, fi rst, at identifying data protection shortcomings in the inter-agency cooperation regime in the EU criminal justice and law enforcement area and, second, at outlining, under six possible scenarios, the interplay among the data protection legal instruments in the law-making process today in fi eld, as well as, the response each could provide to such shortcomings.