Search

The European Public Prosecutor’s Office (the ‘EPPO’) necessarily processes personal data in order to fulfil its mission; As such, it falls squarely within the European Union (EU) data protection regulatory landscape. However, because the EU data protection regulatory landscape itself is currently found at a crossroads, an analysis of the EPPO data protection model may be twofold: First, placing it within the proper cross-organization dialogue currently taking place on the future regulatory model of personal data processing for law enforcement purposes carried out at EU level. Second, at an EPPO-specific level, whereby the actual data protection regime afforded to it may be assessed. This article purports to elaborate upon the above two data protection dimensions of EPPO personal data processing activities: It presents considerations and policy options during the lawmaking period that resulted in the establishment of the EPPO, it analyses the data protection regime ultimately awarded to it and attempts to, critically, place the EPPO data protection model within its proper operational and legislative environment.

Why is Big Data absent in the recent basic data protection documents of the European Union (EU) and the Council of Europe (CoE)? Why not one single reference to Big Data practices - be it to regulate or to prohibit it - in the recent General Data Protection Regulation (EU) 2016/679, the Data Protection Law Enforcement Directive (EU) 2016/680 and the Modernised CoE Convention 108 for the Protection of Individuals with Regard to the Processing of Personal Data (Convention 108+)? Some actors in the policy field considered Big Data too dan- gerous and counted on existing data protection principles to tame the beast. Others simply ignored the phenomenon or were not aware of the potential benefits of Big Data for economy and governments (the rendez-vous was missed). Our discussion of no less than six recent initiatives, - standalone laws and soft law instruments - is an indication that Europe is embracing Big Data but is seemingly hesitant to confront Big Data within the classical paradigm (field) of data protection law. Concrete guidance for Big Data practices is now spread over multiple texts emanating outside the data protection field.

On 19 November 2019 the Council of Europe hosted an international conference, immediately preceding the annual plenary meeting of its Committee of Convention 108, on "Convention 108 + and the future data protection global standard". One of the authors made a presentation on "Comparing the EU and Council of Europe approach to Big Data", and it is its contents and findings that are further elaborated in this paper; Its aim is, in essence, to incorporate the feedback received and to adapt past research on Big Data, that was mostly relevant to the EU, also on the Council of Europe data protection system. After a few preliminary remarks on Big Data terminology and possible regulatory approaches, Big Data regulation is examined against the EU and the Council of Europe data protection systems. Particular emphasis is given to the Council of Europe regulatory approach both in terms of Convention 108 + and with regard to its Guidelines on Big Data and AI. The authors believe that, because both the EU and the Council of Europe have avoided to refer to Big Data in their basic data protection regulatory texts (a most likely intentional omission), guidance is indeed needed, and it may well come in the form of soft law. The Council of Europe has taken the lead in this through its Guidelines; Their timely, comprehensive and balanced approach showcases the Council's will for such processing to indeed take place, but within a well-regulated environment, albeit not under a rigid regulatory construction. (c) 2020 Paul de Hert and Vagelis Papakonstantinou. Published by Elsevier Ltd. All rights reserved.

This article examines the changing balance established by the European Court of Human Rights (ECtHR) between human rights filters to extradition and the obligation to cooperate and how this shift of rationale brought the Court closer to the position of the Court of Justice of the European Union (CJEU) in that respect. The article argues that the ECtHR initially adopted a position whereby it prioritised human rights concerns over extraditions, but that it later nuanced that approach by establishing, in some cases, an obligation to cooperate to ensure proper respect of human rights. This refinement of its position brought the ECtHR closer to the approach adopted by the CJEU that traditionally put the obligation to cooperate above human rights concerns. In recent years, however, the CJEU also backtracked to some extent from its uncompromising attitude on the obligation to cooperate, which enabled a convergence of the rationales of the two Courts. Although this alignment of the Courts was necessary to mitigate the conflicting obligations of European Union Member States towards both Courts, this article warns against the danger of making too many human rights concessions to cooperation in criminal matters.

The Chapter deals with the use of sanctioning powers in the context of EU data protection law and reflects on the thorny relationship between different typologies of sanctions (criminal and administrative) in the light of the new administrative sanctioning powers of the Data Protection Authorities. The analysis starts form short historical presentation of the EU (secondary) laws dealing with data protection and, then it looks at changes to EU primary law brought about by the Treaty of Lisbon with an explicit imperative to improve EU data protection. The core of the analysis discusses the system of remedies in the GDPR and some examples of recent sanctioning practices by the national DPAs. The analysis is followed by three more reflective sections about supervisory convergence without creating new EU institutions, the administrative enforcement fray and defence rights and the role of criminal law in EU data protection law. The chapter also offers some guidance observations about the operationalisation of the threefold system of enforcement set up by EU data protection law.

After outlining the relevant regulatory provisions governing access to the Internet in the EU (section 2) and its Member States (section 3), and after summarizing arguments supporting the introduction of the right to Internet access, the authors seek to broaden the scope of social and legal debates on Internet access in the EU. In particular, they question (a) whether the Internet is a vital element to achieve a decent standard of living in the Gigabit society (section 4); and (b) whether it deserves a place alongside the fundamental rights or human rights (section 5) and under what conditions it could be incorporated among the EU fundamental rights (section 6). The following sections of the chapter reflect on the potential scope of a right to Internet access (sections 7 and 8) and how eGovernment could facilitate the introduction of such a right (section 9). Considerations about limitations of a right to Internet access are addressed in section 10. Access to the Internet is inherently an Internet governance matter and therefore its regulation should entail a multi-stakeholder debate. Access to the Internet then would be seen not only in a technical way as a communication service but as ‘the set of devices, services, facilities and skills that allow people to connect to and use Internet services, applications and content’. Perhaps, this shift in approach could strengthen the EU’s role within the broader context of Internet governance. The authors suggest that the EU debate on Internet access should employ a human rights-based approach to Internet access because the social benefits brought by the Internet cannot be defined by numbers. The authors conclude that acknowledgment or recognition of Internet access as a fundamental right would be valuable as it would encourage policy- and law-makers, as well as civil society, to reconsider the scope and limitations imposed on this right.

Online evidence has been indispensable in criminal matters but due to its transnational and volatile nature, there have been issues and challenges as regards access, transfer, and usage in criminal investigations and prosecutions. In recent years, practices have been established to overcome the hurdles of cross-border access to online evidence. One of these practices is direct cooperation between law enforcement authorities and data companies, the latter of which are mostly based in the US. While this cooperation has been less blatant and apparent in its earlier years due to the want of legal basis, law enforcement authorities have been less coy towards the practice more recently. The present contribution walks the reader through the recent developments on codifying the practice of direct cooperation between European law enforcement authorities and US data companies. These developments evince how law enforcement authorities are willingly and wittingly overlooking protective safeguards and issues that ought to be addressed and thoroughly discussed. By sanctioning a relationship of direct cooperation, not only are state interests affected, but likewise issues of trust, MLA rights, privacy and data protection are affected. There ought to be a thorough discussion on these issues and hopefully the lessons learned from the recent CJEU judgments and the German Federal Constitutional Court are taken into consideration.

Saudi Arabia grants nationality to an AI robot; the first “clash of robots” took place in Japan; and, Bill Gates suggests that robots start paying taxes. We believe that these developments justify new legal fiction interventions. Software has long now exceeded the intellectual property boundaries. It is no longer merely property; it has assumed life of its own. It does not matter that such life is imaginary today. Legal persons were brought to life through legal fiction intervention that was based on much less motivation – merely the human incentive for profit. Software is certainly connected today with profit, given that the world's most valued corporations are software companies. However, it has moved much further than that, to assume in many ways artificial life of its own. We think that it is time that the dichotomy between natural and legal persons, that has served humanity so well over the past centuries, now be trisected: A new, digital person, ought to be added to it.

After having reflected about technologies and the role of non-political guidance in EU data protection law in previous editorials, I now turn to the thorny question about the proper place of data protection law. In search of a substance, I use Murakami’s imaginary to prepare for the worst: not all things, concepts and beings are blessed with substance. After having managed (lowered) possible expectations about the essence of data protection law, I turn to a first approach to understanding data protection law as a bundle of principles. Principles are powerful legal topoi that create seriousness about legal domains. They are defended by the best scholars and much appreciated by courts in their role as judicial lawmakers. They look God-given, but are man-made. Unable to fix their number and precise nature, I will challenge them by inflating their number.

Data protection is an EU law field that has undergone substantial change over the past few years. In April 2016 a five-year law-making process finally came to an end, with the adoption of the General Data Protection Regulation and the Police and Criminal Justice Data Protection Directive. The Directive, upon which this analysis is focused, is an ambitious text, aimed at assuming the data protection standard-setting role within the EU Justice and Home Affairs field at Member State level. At EU level Regulation 45/2001/EC is generally applicable on personal data processing by most of the EU agencies and bodies in the field. Its provisions are “particularised” and “complemented” by ad hoc substantive data protection law per each such actor. All of them, however, are to be aligned with the provisions of the Directive. Although supervision tasks are uniformly entrusted to the EDPS, the different mandates for each of the actors continue to apply. This, unnecessarily, complex legal architecture is found detrimental to the data protection purposes and ultimately against the requirements of Article 16 TFEU

This Contribution focuses on the use made by the Belgian Constitutional Court, the Cour de Cassation and the ordinary courts of the right to privacy and the right to have personal data protected as anchored in the Belgian Constitution, the Belgian Data Protection Act and the European sources. A selection of their judgements, all dating from the era before the new EU Data Protection Regulation, are discussed along the lines of their impact on health privacy, workplace privacy, surveillance and social media privacy. Our analysis shows a great deal of European loyalty on behalf of the Belgian Constitutional Court towards European trends to favour privacy and data protection. In stark contrast stands the case law of the Cour de Cassation mainly focused at preserving prosecutorial interests and employer’s interests at the detriment of privacy and data protection interests. In our conclusions we discuss tendencies towards cosmopolitanism and tribalism, the dramatic impact of evidence law and patterns of litigation. Our analysis covers the data protection era where Belgian law was indirectly governed by EU Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23 November 1995, 31). The Directive contributed to the roll-out of data protection and harmonized the data protection provision in the EU Member States but suffered from implementation weaknesses and lack of recognition. A certain lack of recognition of the importance of data protection in the European (and Belgian legal) landscape disappeared with the the EU General Data Protection Regulation 2016/679 (“GDPR”) (OJ L 119, 5 Ma.2016, 1–88 ) that repealed Directive 95/46/EC and came into force on 25 May 2018 with direct applicable provisions. Further studies are needed to study the impact of the new European provisions on the work and output of the Belgian courts.

In light of the ongoing story on the regulatory steps towards electronic evidence and transnational production orders, civil rights organizations have expressed both alarm and astonishment on the regulatory initiatives in the Council of Europe regarding transnational production orders. Member states of the European Union (EU) engage actively in soft law entrepreneurship by allowing themselves to obtain directly from service providers subscriber and other communications content. This has not only been done domestically through national laws but likewise on a multilateral level as EU member states are now seen drawn towards the Council of Europe. Within said Council of Europe, member states are now enabled to stretch the extraterritorial powers exercised by their law enforcement authorities in obtaining electronic evidence through a controversial Guidance Note and soon, a Second Additional Protocol. Interestingly, throughout these developments, the EU remained passive but as of late, has come up with proposals for the European Production and Preservation Orders, among others. The mixture of alarm and astonishment among civil liberties representatives about the decision making procedures at the level of the Council of Europe can be best understood in a broader regulatory context of policy enterpreneurship, rent-seeking behaviour and, overall, rational choice institutionalism. Comparing the Council of Europe with the EU, the structure of the former makes it the more attractive venue for policy actors such as law enforcement authorities to maximize their benefits at the least amount of costs. Being competitors in policymaking vis-à-vis cooperation in criminal matters, the EU can however lose its sociopolitical ascendancy over time as an institutional venue to discuss cooperation matters. In light of this, one should not forget that two Europes coexist. These coexisting realities are now being used to the advantage of laundering policies, testing which forum would maximize benefits the most. These developments should caution us that there might be a systemic failure in ensuring safeguards in criminal investigations are always in place.

This contribution aims to better understand how and why International Criminal Law (ICL) is pluralistic and how this pluralism is at least partly the result of the contesting actions, interests and backgrounds of the various ICL users and the context in which they operate. The hypothesis is that the adoption of a users’ perspective helps to understand ICL pluralism. After a discussion of the various dimensions of pluralism in ICL, this chapter identifies the most important ICL users. Nevertheless, it will also be demonstrated, through the example of the case against the former Chadian dictator Hissène Habré, that pluralism can be overcome, as ICL is also often a collaborative ingenious effort of various users which are able to align their interests in the pursuit international criminal justice

The General Data Protection Regulation provides new tools and concepts such as Data Protection Impact Assessments, accountability and certification, but to a large extent retains the rationale of the Data Protection Directive for a principles-driven legislation. One of the cornerstones of both the reformed and new EU data protection legislation is the grounds for lawful processing. Much debate has taken place over consent and the conditions for a meaningful informed choice of the data subject, while other grounds have not been at the spotlight of academia and practitioners. The legitimate interest of the controller has been one of the least discussed legal grounds for lawful processing, with a few exceptions, mainly the opinion of the Article 29 Data Protection Working Party, despite its significance as equally binding ground for processing. This contribution analyses the concept of legitimate interest of the controller of art. 6 (f) GDPR in relation to art. 7 (f) of the Data Protection Directive 95/46/EC and the interpretations of the concept by the Court of Justice of the EU and the Article 29 Data Protection Working Party.

This article provides a critical analysis of the Council of Europe Cybercrime Convention Committee's Guidance Note of Production Orders, published on 1 March 2017. The article looks at the legal controversies surrounding production orders with a cross-border element. It explains the Guidance Note's background and origins, the basic provisions in the Cybercrime Convention allowing the law enforcement authorities to order and obtain certain information and discusses the requirements that follow from the relevant provisions of the Convention. This analysis is complemented by four critical remarks on the way the Guidance Note pushes the boundaries of acceptable treaty interpretation on the necessity of the Guidance Note, its position in regard to extraterritorial enforcement jurisdiction and sovereignty, its reticence towards fundamental rights and its refusal to define or clarify the important notion of “subscriber information”. The article argues that unilateralism is not a solution. Instead of soft law plumbing, what is needed is an agreement between sovereign states checked by their constituencies.

The Microsoft Ireland case brought before the Supreme Court in 2018 and dropped the very same year has attracted attention world-wide from policymakers and scholars. This contri- bution focusses on two important features of the case: the conflicting and often chaotic ap- proaches to the notion of sovereignty of many of the players and the remarkable move of a private company to trigger regulation in a world where companies, technologies, data flows and governments transgress borders with growing acceptance of the inadequacy of older territorial com- prehensions of the world order.

This contribution reflects on recent cases involving cross-border data production orders such as Yahoo Belgium, Skype Belgium and Microsoft Ireland. Cross-border data production orders are found to generally involve conflicts regarding sovereignty and enforcement jurisdiction and to frequently include voluntary cooperation of companies for which the legal framework is lacking (Introduction). The Lotus principle, which recognizes a broad extraterritorial jurisdiction to prescribe and limits extraterritorial enforcement jurisdiction, is reconsidered concerning those issues (see the ‘International law pragmatism for jurisdiction to prescribe, but not for jurisdiction to enforce’ section) and the use of mutual legal assistances, which should be the rule, is discussed with four caveats (see the ‘Four caveats to territorial sovereignty and the need for MLAs: Unclarities and politics’ section). Twelve typical arguments are identified, which are employed in courtrooms when cross-border data production orders are discussed, for example, arguments regarding territorial sovereignty, the location of servers, the virtual presence of businesses via the Internet or the nationality of the data subject (see the ‘Arguments in courtrooms in favour or against informal-based cross-border investigations’ section). Subsequently, from fourth to seventh sections, those arguments are investigated regarding their context in the cases Yahoo! Belgium (2007–2015), Skype Belgium (2012–2017), Microsoft Ireland (2013–2018) and Google in re Search Warrant (2017). Finally, a first step to evaluate and test the strength of those arguments is undertaken (see the ‘Assessing the arguments: From logically weak, to unpractical to law enforcement utilitarianism (give us everything)’ section).

The two European Courts (the European Court of Human Rights, ECtHR and, to a lesser degree, the European Union Court of Justice, EUCJ) have contributed greatly to the development of a legal framework for surveillance by either law enforcement agencies in the criminal law area or by secret services. Both courts put great emphasis on a system of control ex ante and post hoc by independent supervisory authorities. A complex and controversial issue remains whether the human rights to privacy, respect of communications, and to an effective remedy (enshrined in Article 8 and 13 of European Convention on Human Rights (ECHR)), requires judicial review as a necessary safeguard for secret surveillance or alternatively, at which conditions, parallel systems of non-judicial review can be accepted as adequate safeguards against illegitimate interference in citizens’ private life. The European Courts have not yet established a clear doctrine in determining suitable thresholds and parameters. In particular, the ECtHR has a flexible approach in interpreting article 8 and 13 ECHR, depending on several factors (“vital” interests at stake, political considerations, etc.). In general terms, the Court has shown a preference towards judiciary oversight, but in the European legal order there are several examples of alternative oversight systems assessed positively by the Court, such as the quasi-judiciary systems (where the independency of the supervisory body, its wide jurisdiction, its power to data access and its power to effective reactions are proved) or the system of oversight set by Data Protection Authorities in the EU member states. However, in recent judgements of the ECtHR and the EUCJ we see an increasing emphasis on declaring the necessity of a “good enough” judicial (ex ante or post hoc) control over surveillance, meaning not simply a judicial control, but a system of oversight (judicial, quasi-judicial, hybrid) which can provide an effective control over surveillance, supported by empirical checks in the national legal system at issue.

The die is cast. At the time of drafting this paper the so-called Brexit, the exit of the UK from the EU, seems like a certainty after the poll results of 23 June 2016. Within such historic, indeed seismic, developments data protection seems but a minor issue, a footnote to a world-changing chapter waiting to be written. Yet, from our modest vantage point, undertaken after this Journal's kind invitation, we submit that data protection, although one out of the myriad legal aspects pertaining to Brexit that urgently await consideration, may prove to be a crucial issue in this process. Notwithstanding what happens in the immediate future, when attention will presumably be focused on coordinating the dates when Brexit may potentially occur and the GDPR comes into effect, long-term thinking is critical. We believe that, because developments in this field of law will be among those felt directly by individuals on both sides of the Channel, data protection has the potential to be among the issues that “make” or “break” a possibly successful Brexit – if success is perceived as minimal disturbance to an already functioning system. UK and EU data protection are intrinsically connected by now, by osmosis, after decades of mutual exchanges and intensive collaboration. If indeed, contrary to our wishes, a data protection Brexit does take place, the preferred way forward for the authors would be for the UK to unreservedly and permanently adhere to the EU data protection model. If this will not be the case, then we feel that a high-level principle-driven solution would serve data protection purposes better than a detailed and technical solution; the latter, if ever achievable, would essentially attempt the impossible: to surgically severe what is today an integral part of a living and functioning system.

Children’s rights law is often studied and perceived in isolation from the broader field of human rights law. This contribution explores the inter-relationship between children’s rights law and human rights law on older persons in order to see whether elements from each could successfully inform the other. Children’s rights law has a number of distinctive characteristics, such as the emphasis on the ‘best interests of the child’, the use of general principles, and the inclusion of ‘third parties’ (e.g. parents and other care-takers) in treaty provisions. In this contribution we ask two questions: whether these features could be a source of inspiration for elderly human rights law? And Whether children’s rights law could draw inspiration from developments with regard to the rights of older persons?

It is argued that McDonald is to be considered a missed opportunity to integrate two areas of human rights law in the judgment: disability human rights law and elderly human rights law. During the last decade, the area of disability rights has seen important developments at both the regional and international level. The adoption of several soft law instruments and particularly the high number of ratifications of the UN Convention on the Rights of Persons with Disabilities (CRPD) reflect an evolving perception of the status of this group within society. The CRPD is considered ground breaking in the sense that it creates clear positive obligations for member states regarding the enjoyment of socio-economic rights, such as the provision of care services. The recognition and enforcement of such rights, however, remains a delicate and complicated issue before the Strasbourg Court.

This article is primarily concerned with stigmatization resulting from public information campaigns such as public health information campaigns. Stigmatization as a concept has received much attention from social scientists but conversely little from the legal world, including the European Court of Human Rights. Stigmatization can be distinguished from other similar concepts, e.g. discrimination, stereotyping and marginalization, by its ability to induce a sense of “self-loathing.” The court’s limited discourse thus far raises questions as to whether it recognizes stigmatization as being capable of engaging human rights principles where no other engaging factors are present. Even if the court is willing to find engagement in such cases, it is likely that in most instances the court would find any incidental stigmatization justified given the potential benefits available. The lack of judicial engagement with such cases thus far may reflect the possibility that stigmatization occurring through expressive acts of public officials is located within a “nexus of non-justiciability” whereby the European Convention on Human Rights is generally not applicable.

Jurisdiction based solely on the territoriality principle is becoming less evident in the digital age This article engages in a discussion with authors such as Kuner and Svantesson, that have expressed a critical view on expansive jurisdiction of the EU data protection regime in issue 4, November 2015, of this Journal. Our contribution focuses on the choices with regard to scope and jurisdiction made by the EU co-legislators in Article 3 of the new EU General Data Protection Regulation (hereinafter, ‘General Regulation’ or ‘GDPR’),6 which will apply from 25 May 2018, and compares this to the current regime under Article 4 of the Data Protection Directive. It also assesses whether the modernized Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (No 108) is heading in a similar direction and highlights the Court of Justice of the European Union (CJEU) position on the territorial scope of the EU data protection law.

The chapter first offers a background analysis to EU fundamental rights law, recalling the historical affirmation of the protection of fundamental rights as a EU concern, and the important innovation brought about by the Lisbon Treaty (section 2) and the multiplicity of actors involved in the system of fundamental rights protection in the EU (section 3). The aim is to demonstrate that the EU indeed has an important tradition and a great number of actors involved in the field. Subsequently the chapter turns to the main instrument of protection of fundamental rights, namely the Charter of Fundamental Rights of the European Union (‘the Charter’). First, it explains its scope of application, and its interaction with other sources of fundamental rights protection, and it shows that the system is potentially very protective (section 4). Moving on, the chapter examines the practical application of the Charter, and its interaction with EU criminal law norms, demonstrating that in fact the Court of Justice of the European union (CJEU) tends to give precedence to the effectiveness of EU criminal law over fundamental rights (section 5). Furthermore, the chapter addresses the content of the Charter (section 6) and then goes deeper into the criminal law related provision in the Charter, in particular the presumption of innocence (section 7), the right to a fair trial (section 8), privacy and data protection (section 10), and proportionality and legality (section 10). The last section (section 11) provides some conclusive remarks, evaluating the interaction between fundamental rights and EU criminal law, and calling for a further refinement of this interaction.

Genomic research relies on the availability of genomic data. Detached biological samples, stored in facilities known as biobanks, are the source of this data. Donors have interests in these samples. In particular, donors have interests in samples by virtue of the personal data they contain. In relation to this observation, this article puts forward three arguments. First: The current European legislative framework relating to samples is inadequate. This inadequacy results from not understanding samples in terms of the information they contain. Second: European data protection law, in particular as outlined in the forthcoming Data Protection Regulation, might be looked as a source of solutions. However, whether data protection law can apply to samples at all remains a subject of debate. One key argument supports the position that it cannot: Samples are not data, but rather are physical mater, and therefore can only a source of data. Third: The assertion that ‘samples are not data, but rather only physical matter’ is flawed. Samples do contain data – DNA is data. DNA is understood as information both popularly and in the genetic sciences. In fact, even in informatics, DNA can be understood as data.

Allegedly the Police and Criminal Justice Data Protection Directive (henceforth, the “Directive”) is the little-known, much overlooked part of the EU data protection reform package that stormed into the EU legislative agenda towards the end of 2015. Its counterpart, regulating all other personal data processing activities, the General Data Protection Regulation (henceforth, the “Regulation”), is undoubtedly the text that fascinated legislators, legal scholars and even journalists over the four years since their simultaneous release in first draft formats, with its numerous noteworthy novelties: the right to be forgotten, the right to data portability, data protection impact assessments, privacy by design, consistency and one-stop-shop mechanisms among EU Data Protection Authorities etc. Compared to this impressive list the text of the Directive indeed sounds mundane and unimaginative. However, we firmly believe that the repercussions it will have in the EU personal data processing scene surrounding the work of law enforcement authorities, once it comes into effect, will be fundamental and will be equally felt by everybody exactly in the same way that its famous sibling intends to do.

This article’s focus is on how the advent of big data technology and practices has been understood and addressed by policy makers in the EU. We start with a reflection on of how big data affects business processes and how it contributes to the creation of a data economy. Then we look at EU policy making on big data and its understanding of the role and impact of ICT in the economy. We study 3 major legal frameworks affecting data flows and uses: intellectual property rights, access to and re-use of PSI and the protection of personal data. We explore how these frameworks affect the use of big data and how this is perceived and dealt with in the policy documents. In order to widen our perspective, we also take a comparative look at similar legal frameworks and policies in the US.

This article presents the findings of interviews with representatives from the majority of EU data protection authorities in the context of the ongoing data protection reform process. It identifies commonalities between the authorities to the extent it is possible to speak about a EU DPA perspective, but also identifies areas of tension and disagreement as well as future intentions. The focus of the article is upon the impact of the data protection reform process on the way that these independent bodies, located in EU Member States will increasingly have to cooperate at an EU-level. Capturing these perspectives at this moment in the reform process provides insight into the process from a group of concerned stakeholders, but also insight into how these stakeholders are (re-)positioning themselves, planning, and anticipating the impacts of the reform. This article is based upon research conducted as part of the PHAEDRA II project ("Improving practical and helpful cooperation between data protection authorities" and the article is possible due to the assistance and contribution of all project partners. The project is co-funded by the European Union and the Fundamental Rights and Citizenship Programme (JUST/2013/FRAC/AG6068), however the contents of this article are the sole responsibility of the authors and cannot be taken to represent the views of the European Commission. More information on the project can be found at http://www.phaedra-project.eu/

This paper undertakes a contextual analysis of the main aims of Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare, commonly known as the Patients’ Rights Directive (the PRD). The PRD itself does not aim to provide a new system for coordinating social security entitlements, leaving the regime laid down in (EEC) 1408/71 and later (EC) 883/2004 unaffected. Rather, it is intended that the PRD will supplement the rights that these instruments were intended to provide. The main aims of the PRD instead concern matters related to the prior authorisation of healthcare, the reimbursement of healthcare and the removal of unjustified obstacles from doing so. This paper explores how the Directive sets out to achieve these aims and analyses it within the context of other related European Union legislation and jurisprudence in the area. Alongside this primary aim of codifying European Court of Justice case law, the PRD also introduces novel initiatives aimed at fostering cross-border cooperation between various elements of national healthcare systems. These issues will be dealt with in detail in a subsequent paper.

This article offers a critical examination of the court judgements in a recent Belgian case against Yahoo!. It examines the challenges related to the establishment of jurisdiction for Internet-based services and the role that procedures of mutual legal assistance should play. Belgian law obliges providers of “electronic communications services/electronic communications networks” to cooperate with Belgian law-enforcement authorities and to handle over communication and personal data. Although the terms are derived from the EU Electronic Communications Regulatory Framework, a much broader interpretation to them was finally given by the Belgian Supreme Court. Seemingly this implies that, from now on, a US-based company such as Yahoo! is, at least under Belgian law, under a legal obligation to directly comply with an order issued by Belgian law-enforcement authorities.

The entry into force of the Lisbon Treaty has suspended discussions over the release of a EU PNR processing system. Plans to introduce an intra-EU PNR processing system initiated since 2007, although strongly supported by the Commission and the Council, did not bear fruit before the ratification of the Lisbon Treaty and the, institutional, involvement of the Parliament. While discussions have been suspended since October 2009 and most probably a new draft proposal will be produced, it is perhaps useful to present in brief the proposal currently in place so as to highlight its shortcomings for European data protection and suggest ways individual protection may be strengthened in future drafts.

Le 8 decembre 2008, la Cour Europeenne des Droits de l’Homme (CEDH) a prononce un arret decisif concernant la requete d’effacement des donnees personnelles (empreintes digitales, echantillons et profils ADN) des deux citoyens britanniques S. et Marper, conservees dans les banques des donnees de la police. La conservation illimitee des donnees de personnes non condamnees est reconnue comme une violation du droit a la protection de la vie privee. Or, compte tenu du systeme technologique mobilise et des pratiques policieres dont il est question, l’arret devient encore plus important car il fixe des limites a la « simple conservation » des donnees privees et en souligne le caractere stigmatisant. Ainsi, la CEDH parait identifier une possibilite de limiter les effets de la surveillance, aussi « soft » ou « smart » soit-elle.

Les enjeux de l’échange et de la protection des données personnelles ne sont pas une nouveauté dans les débats sur la gestion de la sécurité transatlantique et l’impact de certaines mesures sur les libertés fondamentales. La publication, en juin 2008, du Rapport final du groupe de contact à haut niveau, composé d’experts de l’Union Européenne et des Etats-Unis, ainsi que sa réception par les dirigeants politiques, a contribué à relancer le débat. Il paraît donc important de saisir cette occasion pour esquisser une première étude sur les systèmes européen et étatsunien de protection de données personnelles couvrant les activités de justice et affaires intérieures. Sans prétention à l’exhaustivité, cet article analyse les principes et les législations européenne et étatsunienne, en soulignant les limites implicites à chaque système et à la mise en relation des deux, ainsi que la nécessité d’un véritable débat politique et parlementaire pour les dépasser. Issues concerning information sharing and data protection are not a novelty in the debates on transatlantic security management and the impact of security measures on fundamental liberties. The debate has been re-launched by the publication, in June 2008, of the Final Report of the High Level Contact Group, formed by European Union and United States experts, as well as by its reception by political leaders. Therefore, this is an important occasion to draft a first study on the EU and US data protection systems covering the activities of justice and internal affairs. Surely not exhaustively, this article analyses EU and US relevant principles and legislations and it underlines the implicit limits in each system and in the set up of an agreement. Finally, it highlights the need for a real political and parliamentary debate in order to overcome the main differences and limits.

On the 17th of February an old data protection acquaintance, the EU PNR Directive1, returned to life. On that date the Parliament’s LIBE Committee released its Report2 on its rst (re-)reading of a dra that was otherwise presumed dead since 2011, when that same Committee found it unacceptable because of fundamental rights concerns and asked the Commission to withdraw it. The fact remains that the general data protection environment has in the meantime substantially changed: the PNR Directive’s provisions must now be reconciled with the latest case law of the Court of Justice on acceptable surveillance and with the EU data protection reform package, in particular with its dra Police and Criminal Justice Directive8 that is to replace the 2008 Framework Decision. is applies both to substantive law and supervision model

The EU plays an increasingly important role in issues such as the fight against organised crime and the management of migration flows, transforming the Area of Freedom, Security and Justice (AFSJ) into a priority of the EU's political and legislative agenda. This book investigates whether institutional change - the gradual communitarisation of the AFSJ - has triggered policy change, and in doing so, explores the nature and direction of this policy change. By analysing the role of the EU's institutions in a systematic, theory-informed and comparative way, it provides rich insights into the dynamics of EU decision-making in areas involving high stakes for human rights and civil liberties. Each chapter contains three sections examining: * the degree of policy change in the different AFSJ fields, ranging from immigration and counter-terrorism to data protection * the role of EU institutions in this process of change * a case study determining the mechanisms of change. The book will be of interest to practitioners, students and scholars of European politics and law, EU policy-making, security and migration studies, as well as institutional change.

The proposed data protection regulation2 includes mention of the use of criminal and administrative sanctions. Both were possible in EU data protection law but, after the reform, the use of administrative sanctions will become mandatory. With regard to criminal sanctions to address data protection wrongs, nothing changes: member states can choose to create them or not. Why is the new EU, with its enhanced post-Lisbon powers, so timid and '1995-ish' with regard to criminal law? How is it possible that, to reform a set of rules created by a directive, a regulation is chosen with the aim of harmonising just about everything in EU data protection law, but not the chapter on sanctions and enforcement? This contribution lists some explanatory factors and reflects on future regulatory choices in member states.

The year 2010 set an important milestone in the development of data protection law in Europe: both Europe's basic regulatory texts, the EU Data Protection Directive and the Council's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), were placed at an amendment process, having served individual data protection for many years and witnessed in the meantime technological developments that threatened to make their provisions obsolete. After briefly presenting Convention 108, the analysis that follows will highlight the Council's data protection system currently in effect as well as developments relating to the Convention's amendment so far with the aim of identifying improvements and shortcomings. While doing this two separate points of view shall be adopted: at first a micro point of view will attempt to identify improvements and shortcomings through an ‘insider’ perspective, that is, judging only the merits and difficulties of the draft text at hand. Afterwards a macroscopic view will be adopted, whereby strategic issues will be discussed pertaining to the important issue of the relationship of the suggested draft with the EU data protection system, as well as, the same draft's potential to constitute the next global information privacy standard.

If one looks at the case law of the European Court of Human Rights on surveillance matters, a well mature set of principles emerge, namely: legality, legitimacy, proportionality (the standard check) and, if the Court is "on it", also necessity and subsidiarity (the closer scrutiny check). We pass the surveillance case law and the principles developed therein in review and note that 1) not all surveillance is considered relevant to the right to privacy (the threshold problem); 2) when surveillance is subjected to a privacy right analysis, concerns about rights contained in other provisions, such as Articles 6, 13 and 14 of the Convention, are added; 3) not all surveillance that interferes with privacy is considered as problematic, hence differences in the Court's view with regard to the legality requirement and intensity of the scrutiny arise. Beyond this analysis of the Court's surveillance case law, in the second part of this contribution we carry out further the research initiated by Murphy and Ó Cuinn about the existence of a 'new technology' approach in the Court's case law and on principles that apply to a wide range of technology-related issues (from surveillance, over biomedicine, to polluting technologies). We focus in particular on the case law of the Court on environmental matters. We find that greater coherence could be reached in the Court's case law on surveillance by integrating the environmental law principles of participation, precaution, access to information and to access justice into surveillance matters. Nevertheless, such move would be very desirable and give new momentum to the Court's case law on surveillance-related interferences.

This study aims, fi rst, at identifying data protection shortcomings in the inter-agency cooperation regime in the EU criminal justice and law enforcement area and, second, at outlining, under six possible scenarios, the interplay among the data protection legal instruments in the law-making process today in fi eld, as well as, the response each could provide to such shortcomings.

The make a comparison between European anti-discrimination law and data protection law. Both the differences and the overlap are discussed. They show that both rights have the same structure and increasingly turn to the same mode of operation in the information society, even though their content is far from identical. They show that this is because both rights are grounded in the notion of negative freedom as evidenced by I. Berlin, and thus aim at safeguarding the autonomy of the citizen in the information society. Finally, they analyze two cases where both rights apply, and draw conclusions on how to best articulate the two tools. Departing from the ECJ's Huber case where Germany was condemned for discriminatory processing of personal data and which suggests that there is a strong kin between data protection and discrimination issues, this chapter is an attempt to further compare the two fundamental rights (i.e., non-discrimination, and data protection). Beyond their place in the EU legal order, their respective object or scope, this chapter will contend that these two human rights increasingly turn to the same mode of operation, including, inter alia, reliance upon administrative structures and procedures, or the endowment of citizens with a bundle of individual rights. We will argue that this similarity can be understood in the light of their nature as regulatory human rights, that is, embodying the logic of negative freedom (cf. Berlin). The final section will examine situations of overlap between the rights, building upon the Huber and Test-Achats cases. This will lead to final conclusions on how to best articulate these rights.

This report calls for regulation. With biometric applications gradually rolling out in the public and private sector, legislation, even detailed legislation, on the use of biometrics might make compliance to general data protection principles more likely than it is today. A regulatory distinction needs to be made between large scale information systems at EU level and others. The former are in need of tailor made data protection solutions and require (with every new system added or altered) a separate parliamentary and democratic debate. The latter are in need of guidance and best practices, which once found, should be better enforced. Today codification of best practices as developed by DPA’s and other regulatory or supervisory authorities becomes a possibility. We see no good reason not to affirm that public or private controllers of data should not store raw data (because it is unique and therefore dangerous), not collect fingerprints (because fingerprints leave traces and are not accepted by many), not store biometrics in a central database (there are alternatives), or should encrypt biometric data used for processing, should use multiple authentications, should offer alternative schemes of authentication when biometrics are asked on basis of consent, should in case of a rejection, as a result of a biometric system, be obliged to re-examine the case and should, where necessary, offer appropriate alternative solutions. It is true that the technical possibilities of biometrics make its assessment complex, but by making the right regulatory distinctions this can be overcome.

In their recent European criminal policy documents, the Institutions have highlighted the relevance of subsidiarity for European criminal law. In this paper we demonstrate that such principle, in its current institutional understanding, cannot adequately address issues related to the distribution of criminalisation powers between the EU and the Member States. Article 5(3) TEU describes subsidiarity as an efficiency based-criterion aimed at tackling technical competence-exercise issues (instrumental subsidiarity). Such a restricted perspective is not desirable for the penal field. As a matter of fact, when shifting criminal issues up to the Brussels agenda, aspects related to democracy, legitimacy, internal coherence of the criminal law system, and risks of hyper-repressive developments must also be considered along with efficiency concerns. Moreover, such interpretation cuts off from the discussion all normative competence-attribution issues (substantive subsidiarity), which are raised by the most relevant criminal law provisions, such as Article 83(1) TFEU and Article 83(2) TFEU.

What is the current legal data protection framework for the Area of Freedom, Security and Justice (AFSJ) personal data processing and what framework could be created in the near future? These two questions are constantly recurring in the EU data protection field, particularly after the ratification of the Lisbon Treaty. The amendment of the EU data protection regulatory framework currently under way offers a unique opportunity to re-evaluate past regulatory options and plan for the future.

This contribution will focus on the facet of International Criminal Justice where the influence of global law is the most apparent, namely the hybrid or internationalized criminal tribunals. Since many of these tribunals have closed their doors or are in the advanced stage of the proceedings, the time is ripe for a preliminary evaluation. Furthermore, the future necessity and viability of hybrid tribunals will be assessed, both for crimes that fall within and without the jurisdictional regime established by the International Criminal Court (ICC).