Search

How to protect people from algorithmic harms? A promising solution, although in its infancy, is algorithmic impact assessment (AIA). AIAs are iterative processes used to investigate the possible short and long terms societal impacts of AI systems before their use, but with ongoing monitoring and periodic revisiting even after their implementation. When conducted in a participatory and transparent fashion, they could create bridges across the legal, social and computer science domains, promoting the accountability of the entity performing them as well as public scrutiny. They could enable to re-attach the societal and regulatory context to the mathematical definition of fairness, thus expanding the formalistic approach thereto. Whilst the regulatory framework in the European Union currently lacks the obligation to perform such AIA, some other provisions are expected to play a role in AI development, leading the way towards more widespread adoption of AIA. These include the Data Protection ImpactAssessment (DPIA) under the General Data Protection Regulation (GDPR), the risk assessment process under the Digital Services Act (DSA) and the Conformity Assessment (CA) foreseen under the AI Regulation proposal. In this paper, after briefly introducing the plurality of definitions of fairness in the legal, social and computer science domains, and explaining to which extent the current and upcoming legal framework mandates the adoption of fairness metrics, we will illustrate how AIA could create bridges between all these disciplines, allowing us to build fairer AI solutions.We will then recognise the role of DPIA, DSA risk assessment and CA by discussing the contributions they can offer towards AIA but also identify the aspects lacking therein. We will then identify how these assessment provisions could aid the overall technical discussion of introducing and assessing fairness in AI-based models and processes.

When reflecting upon the role of law as an instrument influencingurban planning and shaping urban environments, the mostimmediate link is to environmental and urban legislation. Nevertheless, data protection law is increasingly expected to affectthe future development of urban realities in the European Union(EU). Being actual “data cities”, current smart cities have beensignificantly affected by the entry into force of the General DataProtection Regulation (GDPR). In particular, the Data ProtectionImpact Assessment (DPIA) is increasingly portraited as a solution toaddress the countless fundamental rights challenges arising from thepersonal data processing operations occurring in the context of smart cities, inter alia due to its participatory element. However, is DPIA asuitable approach to making smart cities more inclusive, andspecifically to empower women of diverse races, backgrounds, sexualorientations and abilities? Enquiry into the ways in which smartcities, where urban and data protection challenges merge, mightexacerbate dynamics of oppression against women, and howEuropean data protection law could address these challenges, is still lacking. The objective of this article is to begin such a discussion.

The purpose of this Chapter is to provide sufficiently detailed explanations to enable the completion of the Template for reporting the integrated impact assessment process (Annex 1). The assessors consult this Chapter’s instructions in conjunction with Annex 1, whose structure firmly corresponds to the structure herein. The Template for reporting the integrated impact assessment process in Annex 1 is organised into tables and matrices. Following the 11-step method, consecutive steps are marked in brown and the ongoing steps in orange, as presented in the diagram below. The assessors are to fill in only the fields coloured in light brown or light orange. A field for any further remarks or comments, if necessary, is provided at the end of each step. The assessors fill in, in an easily understandable language, the empty rows in the tables and/or other fields assigned to each step. To the greatest extent possible, each answer is exhaustive and sufficiently motivated (described, explained, justified, etc.), as is equally the case for the criteria/explanations ‘fulfilled’ and ‘not fulfilled’. Further rows can be added in each table, should there be a need, or, should the space be insufficient, each element can be moved to attachments. Alternatively, any of the tables and/or fields may be removed, and the same information presented in some other format if the assessors deem it appropriate. Provision of an explanation is required whether the box is ticked or not. After the receipt of the filled-in report, the sponsoring organisation, in turn, fills in the light green fields only, facilitating the final decision (of whether or not to proceed with the envisaged initiative). The Template assumes the team of assessors is familiar with the legal framework for personal data protection and privacy in the European Union, as well as the principles of ethics and social acceptance. (References to legal provisions without any further specification pertain to the General Data Protection Regulation [GDPR].) It also assumes mini-mum familiarity with the process of risk appraisal and with the criteria limiting the enjoyment of human rights, in particular those of necessity and proportionality. Furthermore, it is expected that all relevant stakeholders, be they the data controller(s), the data protection officer (DPO), the pertinent EU agencies and border control authorities, among others, are involved in the entirety of the assessment process. As the assessment process concerns an as-yet-unimplemented initiative, the assessors may have to rely on estimations and, at times, incomplete information.

The need to respond to COVID-19 pandemics brought to the spotlight the multiple possibilities that the use of technology – and (big) data – in smart cities offer to address disasters and emergencies. All over the world, local governments – more or less successfully – partnered with private companies and deployed new and old technologies (e.g. drones, heath sensors, CCTV cameras, (contact tracing) apps) to make sure that the population complied with government advice to limit the spread of the virus. Nevertheless, the response to COVID-19 pandemics also demonstrated how the data protection challenges arising from smart cities are far from being just theoretical. Certain smart cities initiatives concretised dystopian scenarios, proving that, unless controls are in place, the detrimental effects deriving from the large-scale deployment of smart city technologies can easily become tangible. The objective of this paper is to pinpoint how the data protection challenges already existing in smart cities have been exacerbated by the need to respond to the COVID-19 pandemics and to propose solutions to minimise the negative impacts of technologies on fundamental rights and promote citizens empowerment. The structure of the paper is the following. In the first section, to give the reader some background information, the concept of the smart city will be introduced. Then, an overview of the challenges arising from smart cities, both data protection-related and beyond, will be provided. After describing some of the smart city initiatives adopted all over the world, the paper will illustrate how the COVID-19 pandemics exacerbated the challenges identified in the previous sections. Finally, solutions to minimise the negative impacts of technologies on fundamental rights and promote citizens’ empowerment will be proposed.

This book presents the theory and practice of impact assessment tailored to new border control technologies that are increasingly employed at state borders with the aim of facilitating border checks. Experience has shown that their use often comes into conflict with societal values such as the respect for fundamental rights to privacy and personal data protection. As a result, there is a growing need to accommodate two requirements, the first being the deployment of new border control technologies and the second being the respect for relevant societal values. This book introduces a tool that seeks to accommodate both requirements: impact assessment. Impact assessment is an evaluation technique used to analyse the potential future consequences of a given measure for societal values. The main objective of the assessment process is to support informed decision-making about whether or not, and under what conditions, to deploy a given measure. Border Control and New Technologies. Addressing Integrated Impact Assessment is addressed predominantly to border control authorities in the European Union and in the Schengen Area who wish to ensure that new technologies for controlling state borders respect the principles of democracy, the rule of law and human rights. The handbook will be of interest also for border control officials elsewhere in the world as well as for anyone dealing with the theory and practice of impact assessment.

This Policy Brief proposes a template for a report from a process of data protection impact assessment (DPIA) in the European Union (EU). Grounded in the previously elaborated framework (cf. Policy Brief No. 1/2017) and method for impact assessment (cf. Policy Brief No. 1/2019), the proposed template conforms to the requirements of Articles 35–36 of the General Data Protection Regulation (GDPR) and reflects best practices for impact assessment, offering at the same time five novel aspects. First, it aims at comprehensiveness to arrive at the most robust advice for decision making. Second, it aims at efficiency, that is, to produce effects with the least use of resources. Third, it aims at exploring and accommodating the perspectives of various stakeholders, although the perspective of individuals dominates; it, therefore, fosters fundamental rights thinking by, for example, requiring justification for each choice, hence going beyond a mere ‘tick-box’ exercise. Fourth, it aims at adhering to the legal design approach to guide the assessors in a practical, easy and intuitive manner throughout the 11-step assessment process, providing necessary explanations for each step, while being structured in expandable and modifiable tables and fields to fill in. Fifth, it assumes its lack of finality as it will need to be revised as experience with its use grows. The template is addressed predominantly to assessors entrusted by data controllers to perform the assessment process, yet it may also assist data protection authorities (DPA) in the EU to develop (tailored down) templates for DPIA for their own jurisdictions.

This Policy Brief proposes a template for a report from a process of data protection impact assessment (DPIA) in the European Union (EU). Grounded in the previously elaborated framework (cf. Policy Brief No. 1/2017) and method for impact assessment (cf. Policy Brief No. 1/2019), the proposed template conforms to the requirements of Articles 35–36 of the General Data Protection Regulation (GDPR) and reflects best practices for impact assessment, offering at the same time five novel aspects. First, it aims at comprehensiveness to arrive at the most robust advice for decision making. Second, it aims at efficiency, that is, to produce effects with the least use of resources. Third, it aims at exploring and accommodating the perspectives of various stakeholders, although the perspective of individuals dominates; it, therefore, fosters fundamental rights thinking by, for example, requiring justification for each choice, hence going beyond a mere ‘tick-box’ exercise. Fourth, it aims at adhering to the legal design approach to guide the assessors in a practical, easy and intuitive manner throughout the 11-step assessment process, providing necessary explanations for each step, while being structured in expandable and modifiable tables and fields to fill in. Fifth, it assumes its lack of finality as it will need to be revised as experience with its use grows. The template is addressed predominantly to assessors entrusted by data controllers to perform the assessment process, yet it may also assist data protection authorities (DPA) in the EU to develop (tailored down) templates for DPIA for their own jurisdictions.

This Policy Brief proposes a template for a report from a process of data protection impact assessment (DPIA) in the European Union (EU). Grounded in the previously elaborated framework (cf. Policy Brief No. 1/2017) and method for impact assessment (cf. Policy Brief No. 1/2019), the proposed template conforms to the requirements of Articles 35–36 of the General Data Protection Regulation (GDPR) and reflects best practices for impact assessment, offering at the same time five novel aspects. First, it aims at comprehensiveness to arrive at the most robust advice for decision making. Second, it aims at efficiency, that is, to produce effects with the least use of resources. Third, it aims at exploring and accommodating the perspectives of various stakeholders, although the perspective of individuals dominates; it, therefore, fosters fundamental rights thinking by, for example, requiring justification for each choice, hence going beyond a mere ‘tick-box’ exercise. Fourth, it aims at adhering to the legal design approach to guide the assessors in a practical, easy and intuitive manner throughout the 11-step assessment process, providing necessary explanations for each step, while being structured in expandable and modifiable tables and fields to fill in. Fifth, it assumes its lack of finality as it will need to be revised as experience with its use grows. The template is addressed predominantly to assessors entrusted by data controllers to perform the assessment process, yet it may also assist data protection authorities (DPA) in the EU to develop (tailored down) templates for DPIA for their own jurisdictions.

This user-friendly Handbook offers guidance and practical suggestions for small and medium-sized enterprises (SMEs) that could facilitate compliance with the General Data Protection Regulation (GDPR). Being primarily addressed to enterprises for which personal data processing is an auxiliary activity, the Handbook explains how to navigate the barrage of resources available on GDPR. In doing so it provides an overview of the main actors in the European data protection landscape. It also clarifies the scope of data protection law and the scope of its application to SMEs. The Handbook introduces concepts and principles that form the crux of personal data protection legal framework and then it unpacks the theory and practice of the risk-based approach to personal data protection. The Handbook seeks to go beyond a mere description of GDPR provisions and obligations stemming from them. It includes a set of proactive measures that were put forward by European DPAs and bodies. In addition, it provides references toother publicly available (open access) resources that also provide practical suggestions.