Search

Earlier this year, the European Commission (EC) registered the ‘Civil society initiative for a ban on biometric mass surveillance practices’, a European Citizens’ Initiative. Citizens are thus given the opportunity to authorize the EC to suggest the adoption of legislative instruments to permanently ban biometric mass surveillance practices. This contribution finds the above initiative particularly promising, as part of a new development of bans in the European Union (EU). It analyses the EU’s approach to facial, visual and biometric surveillance,3 with the objective of submitting some ideas that the European legislator could consider when strictly regulating such practices.

Following up on previous research conducted on post-GDPR lawmaking, this chapter seeks to explore a second wave of post-GDPR lawmaking, particularly regarding the European Strategy for Data and its relation with the field of data protection. For this purpose, a selection of case studies is analysed to look at whether EU lawmakers seek integration, denial or mimetics of the GDPR in different data-intensive activities that have been recently regulated or are soon to be. Following this analysis, the chapter explores different paths to explain the reasons and rationale behind the adopted approach and argues for careful integration with the legal rules of a pre-existing framework of the GDPR and its principles and rules. Only then will boundaries of data protection law be able to function properly. The chapter ends with a perspective on regulatory change in EU lawmaking on the Digital Single Market and its subsequent regulatory strategies as a result of this process.

Can satisfactory explanations for complex machine learning models be achieved in high-risk automated decision-making? How can such explanations be integrated into a data protection framework safeguarding a right to explanation? This article explores from an interdisciplinary point of view the connection between existing legal requirements for the explainability of AI systems set out in the General Data Protection Regulation (GDPR) and the current state of the art in the field of explainable AI. It studies the challenges of providing human legible explanations for current and future AI-based decision-making systems in practice, based on two scenarios of automated decision-making in credit scoring risks and medical diagnosis of COVID-19. These scenarios exemplify the trend towards increasingly complex machine learning algorithms in automated decision-making, both in terms of data and models. Current machine learning techniques, in particular those based on deep learning, are unable to make clear causal links between input data and final decisions. This represents a limitation for providing exact, human-legible reasons behind specific decisions, and presents a serious challenge to the provision of satisfactory, fair and transparent explanations. Therefore, the conclusion is that the quality of explanations might not be considered as an adequate safeguard for automated decision-making processes under the GDPR. Accordingly, additional tools should be considered to complement explanations. These could include algorithmic impact assessments, other forms of algorithmic justifications based on broader AI principles, and new technical developments in trustworthy AI. This suggests that eventually all of these approaches would need to be considered as a whole.

The GEMS, the expert group that had to advise the government on corona management, has been disbanded, but its advice on the corona barometer still exists. In this contribution Marc-Antoine Gavray and Paul De Hert indicate where the absence of lawyers and philosophers in the GEMS made itself felt.

Article 17 GDPR is about a right to have personal data deleted and not about any ‘right to be forgotten’: its paragraph 1 expressly states that ‘the data subject shall have the right to obtain from the controller the erasure of personal data con- cerning him or her without undue delay and the controller shall have the obligation to erase per- sonal data without undue delay’. The specificity of the wording leaves little doubt as to the exact scope of Article 17 of the GDPR.

Reprint of an article of 1996 SUMMARY: Introduction; 1 Principles of the democratic constitutional state; 1.1 The Recognition of Human Rights in their Double Function; 1.2 The Rule of Law; 1.3 Democracy; 2 The democratic constitutional state and the invention of two complementary legal tools of power control; 2.1 Limiting power through opacity tools; 2.2 Channelling power through transparency tools; 3 Privacy as a tool for opacity (creating zones of non-interference); 3.1 The negative role of privacy; 3.2 The positive role of privacy; 3.3 The non-absolute nature of privacy; 4 Data protection as a tool for transparency; 4.1 Introduction; 4.2 The rationale behind data protection; 4.3 Data protection as an opacity tool?; 4.4 The charter of fundamental rights of the european union; 5 The shift from opacity towards transparency in european human rights law; 5.1 European human rights law and the legality requirement; 5.2 The success of the legality requirement; 5.3 A critical comment about the strasbourg focus on the legality requirement; 5.4 The danger of proceduralisation; 5.5 A requirement fundamental to opacity: necessary in a democratic state; 6. Combining privacy and data protection 6.1 Combining the tools; 6.2 Determining the switch; 6.3 An example: camera surveillance; 6.4 A second example: passenger profiling; 6.5 Workable criteria?; Conclusion.1

In 2016 zorgde de GDPR voor een trilling in het landschap door op heldere wijze een hele reeks eisen te formuleren voor privacybeheer van data en die te koppelen aan streng toezicht door landelijke autoriteiten voor persoonsgegevens. Die gingen ook Europees meer en intens samenwerken. Met corona kwam vier jaar later de lakmoesproef.In de voorbije twee jaar heeft het rechtssysteem niet goed gefunctioneerd, met uitzondering van het GDPR-systeem. Er is te veel pragmatisme geweest en te weinig gekeken naar de rechtsprincipes.21 In het Engels spreken ze over democratic back sliding. Een rechtsprincipe onder vuur is dat van de verantwoordelijkheid van mensen met beleidspositie, zowel in het openbaar bestuur als in het middenveld. De democratie roert zich nu opnieuw, ook over privacy. De verlenging van de covidpas eind januari 2022 in België was een teleurstelling, want het draag- vlak voor dat instrument was tanend. Gelukkig en desondanks beweegt de politiek terug, zoals met de hoorzittingen in het Belgisch Parlement rond de vaccinatieplicht. Het Parlement moet duidelijk weer aan controle winnen en schijnt daar ook zin in te hebben, afgaande op de hoorzittingen over privacy, vaccinatie en CST. Opschonen wat er in de voorbije jaren, vaak tegen adviezen van de GBA, is opgebouwd in grote haast en top down zonder participatie en accountability. Reflecteren over de privacy-infrastructuur die het voor dit land wil

Transparency has been at the centre of the debate on algorithmic governance. However, when the GDPR was adopted in 2016, the legislator preferred to establish accountability as the core of the Regulation's principles, rather than transparency. Unfortunately, accountability does not yet seem to be playing the role it was assigned in the data protection ecosystem, at least when it comes to algorithmic decision-making. To turn this scenario around, we propose a reflective exercise in which we look at the concept of accountability and how it was introduced in the GDPR. By emphasising on the human element in algorithmic decision-making, we find a systematic and process-oriented accountability present in the GDPR. Following arguments already made in the literature, we hold that this kind of accountability is well suited for algorithmic governance. Moreover, we argue that it could be strengthened by the Commission's proposal for a Regulation on Artificial Intelligence.

Het Coronadebat en het gebruik van het Covid Safe Ticket (CST) heeft ons nieuwe inzichten gegeven in het fenomeen van nudges, ‘overheidsduwtjes in de gewenste richting’. Wat is het verschil tussen nudging en dwang en hoe verhoudt nudging zich met andere overheidsinterventies zoals drang, overreden, en advisering? Hebben de rechtsstaat en mensenrechten iet s te zeg gen over deze technieken, of beperkt het recht enkel dwang door de overheid en laat het nudging geheel over aan beleidsmakers? Waar staat het CST in dit breder verhaal over overheidstechnieken?, The Corona Debate and the use of the Covid Safe Ticket (CST) has given us new insights into the phenomenon of nudges, "government pushes in the desired direction". What is the difference between nudging and coercion and how does nudging relate to other government interventions such as coercion, persuasion, and counseling? Do the rule of law and human rights have anything to say about these techniques, or does the law only limit coercion by the government and leave nudging entirely to policy makers? Where does the CST stand in this broader story of government techniques?

Introduction: Low grip work and high feelings of self-perceived fatigue could be an early characteristic of decline in reserve capacity, which comes to full expression as physical frailty in a later stage. When grip work and self-perceived fatigue can be identified as characteristics differentiating between robustness and pre-frailty it might allow to identify pre-frailty earlier. Therefore, this study aimed to investigate whether the combination of grip work and self-perceived fatigue is related to pre-frailty in well-functioning older adults aged 80 and over. Methods: Four-hundred and five community-dwelling older adults aged 80 and over (214 robust and 191 pre-frail) were assessed for muscle endurance (grip Work corrected for body weight (GW_bw)), self-perceived fatigue (MFI-20) and frailty state (Fried Frailty Index, FFI). A Capacity to Perceived Vitality ratio (CPV) was calculated by dividing GW_bw by the MFI-20 scores. ANCOVA analysis (corrected for age and gender) was used to compare robust and pre-frail older adults, and binary logistic regressions were applied to analyze the relationship between CPV and pre-frailty status. Results: Pre-frail older adults who scored negative on the exhaustion item of the FFI still showed significantly lower GW (p < 0.001), CPV ratios (p < 0.001) and higher self-perceived fatigue (p < 0.05) compared to the robust ones. The likelihood for pre-frailty related significantly to higher age, being men and lower CPV ratios. In women, every unit increase in CPV ratio decreased the likelihood for pre-frailty by 78% (OR 0.22; 95% CI: 0.11–0.44), for men this effect was less strong (34%, OR 0.66; 95% CI: 0.47–0.93). Conclusions: Pre-frail community-dwelling persons aged 80 years and over without clinical signs of exhaustion on the FFI still experience significantly higher fatigue levels (lower Grip Work, higher self-perceived fatigue and lower CPV levels) compared to robust ones. CPV ratio could therefore be a good tool to identify subclinical fatigue in the context of physical (pre-)frailty.

Creation of the European health data space is one of the core actions promoted by the European Commission in the EU Data Strategy. This task is challenging due to technical, organizational, economic and other issues that require different measures. This paper focuses on the issues in the legal field and identifies four key legal areas where the creation of a European health data space may face obstacles or may influence its development. These areas are: 1) rules on the provision of healthcare in the Member States; 2) protection of personal data in healthcare provision and medical research; 3) control and use of non-personal data and 4) the regulatory framework on AI. The article provides the analysis and comparison of these areas to submit the systemized view on causes and consequences of the identified issues and to suggest the vision of the further legislative process related to the European health data space.

The European Public Prosecutor’s Office (the ‘EPPO’) necessarily processes personal data in order to fulfil its mission; As such, it falls squarely within the European Union (EU) data protection regulatory landscape. However, because the EU data protection regulatory landscape itself is currently found at a crossroads, an analysis of the EPPO data protection model may be twofold: First, placing it within the proper cross-organization dialogue currently taking place on the future regulatory model of personal data processing for law enforcement purposes carried out at EU level. Second, at an EPPO-specific level, whereby the actual data protection regime afforded to it may be assessed. This article purports to elaborate upon the above two data protection dimensions of EPPO personal data processing activities: It presents considerations and policy options during the lawmaking period that resulted in the establishment of the EPPO, it analyses the data protection regime ultimately awarded to it and attempts to, critically, place the EPPO data protection model within its proper operational and legislative environment.

Why is Big Data absent in the recent basic data protection documents of the European Union (EU) and the Council of Europe (CoE)? Why not one single reference to Big Data practices - be it to regulate or to prohibit it - in the recent General Data Protection Regulation (EU) 2016/679, the Data Protection Law Enforcement Directive (EU) 2016/680 and the Modernised CoE Convention 108 for the Protection of Individuals with Regard to the Processing of Personal Data (Convention 108+)? Some actors in the policy field considered Big Data too dan- gerous and counted on existing data protection principles to tame the beast. Others simply ignored the phenomenon or were not aware of the potential benefits of Big Data for economy and governments (the rendez-vous was missed). Our discussion of no less than six recent initiatives, - standalone laws and soft law instruments - is an indication that Europe is embracing Big Data but is seemingly hesitant to confront Big Data within the classical paradigm (field) of data protection law. Concrete guidance for Big Data practices is now spread over multiple texts emanating outside the data protection field.

On 19 November 2019 the Council of Europe hosted an international conference, immediately preceding the annual plenary meeting of its Committee of Convention 108, on "Convention 108 + and the future data protection global standard". One of the authors made a presentation on "Comparing the EU and Council of Europe approach to Big Data", and it is its contents and findings that are further elaborated in this paper; Its aim is, in essence, to incorporate the feedback received and to adapt past research on Big Data, that was mostly relevant to the EU, also on the Council of Europe data protection system. After a few preliminary remarks on Big Data terminology and possible regulatory approaches, Big Data regulation is examined against the EU and the Council of Europe data protection systems. Particular emphasis is given to the Council of Europe regulatory approach both in terms of Convention 108 + and with regard to its Guidelines on Big Data and AI. The authors believe that, because both the EU and the Council of Europe have avoided to refer to Big Data in their basic data protection regulatory texts (a most likely intentional omission), guidance is indeed needed, and it may well come in the form of soft law. The Council of Europe has taken the lead in this through its Guidelines; Their timely, comprehensive and balanced approach showcases the Council's will for such processing to indeed take place, but within a well-regulated environment, albeit not under a rigid regulatory construction. (c) 2020 Paul de Hert and Vagelis Papakonstantinou. Published by Elsevier Ltd. All rights reserved.

Can we achieve an adequate level of explanation for complex machine learning models in high-risk AI applications when applying the EU data protection framework? In this article, we address this question, analysing from a multidisciplinary point of view the connection between existing legal requirements for the explainability of AI systems and the current state of the art in the field of explainable AI. We present a case study of a real-life scenario designed to illustrate the application of an AI-based automated decision making process for the medical diagnosis of COVID-19 patients. The scenario exemplifies the trend in the usage of increasingly complex machine-learning algorithms with growing dimensionality of data and model parameters. Based on this setting, we analyse the challenges of providing human legible explanations in practice and we discuss their legal implications following the General Data Protection Regulation (GDPR). Although it might appear that there is just one single form of explanation in the GDPR, we conclude that the context in which the decision-making system operates requires that several forms of explanation are considered. Thus, we propose to design explanations in multiple forms, depending on: the moment of the disclosure of the explanation (either ex ante or ex post); the audience of the explanation (explanation for an expert or a data controller and explanation for the final data subject); the layer of granularity (such as general, group-based or individual explanations); the level of the risks of the automated decision regarding fundamental rights and freedoms. Consequently, explanations should embrace this multifaceted environment. Furthermore, we highlight how the current inability of complex, deep learning based machine learning models to make clear causal links between input data and final decisions represents a limitation for providing exact, human-legible reasons behind specific decisions. This makes the provision of satisfactorily, fair and transparent explanations a serious challenge. Therefore, there are cases where the quality of possible explanations might not be assessed as an adequate safeguard for automated decision-making processes under Article 22(3) GDPR. Accordingly, we suggest that further research should focus on alternative tools in the GDPR (such as algorithmic impact assessments from Article 35 GDPR or algorithmic lawfulness justifications) that might be considered to complement the explanations of automated decision-making.

This article examines the changing balance established by the European Court of Human Rights (ECtHR) between human rights filters to extradition and the obligation to cooperate and how this shift of rationale brought the Court closer to the position of the Court of Justice of the European Union (CJEU) in that respect. The article argues that the ECtHR initially adopted a position whereby it prioritised human rights concerns over extraditions, but that it later nuanced that approach by establishing, in some cases, an obligation to cooperate to ensure proper respect of human rights. This refinement of its position brought the ECtHR closer to the approach adopted by the CJEU that traditionally put the obligation to cooperate above human rights concerns. In recent years, however, the CJEU also backtracked to some extent from its uncompromising attitude on the obligation to cooperate, which enabled a convergence of the rationales of the two Courts. Although this alignment of the Courts was necessary to mitigate the conflicting obligations of European Union Member States towards both Courts, this article warns against the danger of making too many human rights concessions to cooperation in criminal matters.

The Chapter deals with the use of sanctioning powers in the context of EU data protection law and reflects on the thorny relationship between different typologies of sanctions (criminal and administrative) in the light of the new administrative sanctioning powers of the Data Protection Authorities. The analysis starts form short historical presentation of the EU (secondary) laws dealing with data protection and, then it looks at changes to EU primary law brought about by the Treaty of Lisbon with an explicit imperative to improve EU data protection. The core of the analysis discusses the system of remedies in the GDPR and some examples of recent sanctioning practices by the national DPAs. The analysis is followed by three more reflective sections about supervisory convergence without creating new EU institutions, the administrative enforcement fray and defence rights and the role of criminal law in EU data protection law. The chapter also offers some guidance observations about the operationalisation of the threefold system of enforcement set up by EU data protection law.

The COVID crisis was tackled in Belgium with an emergency procedure of ministerial decrees, relying on the 2007 Civil Security Law, a law that is actually intended to allow for quick and temporary intervention in case of disasters such as large explosions or fires. Despite the Council of State’ findings (“this law allows curfews”), this law is both inappropriate and dangerous: without parliamentary debate, it allows far-reaching restrictions on fundamental rights for long periods of time. In the Netherlands, too, the curfew was socially and legally controversial. There, too, there were calls for new legislation on lockdown and other police measures in the event of health crises. The discussions in Belgium and the Netherlands are therefore similar, although the Dutch Constitution and legislation is clearer, (but not enough) with regard to the possibility of declaring a state of emergency and combating infections on a large scale. Obviously, it makes sense, from a concern for the rule of law, to rewrite the Constitution and legislation. New safeguards for new, far-reaching infectious disease control measures for the unhealthy and healthy part of the population .... Who can be against that? This contribution is cautious about the usefulness of exemption legislation. Looking at the health crisis, and older crises such as the 9/11 crisis (terrorism), we pay attention to processes of power accumulation of the government, and the executive in particular, made visible by such a crisis, but made possible by inconspicuous processes such as technology thinking (the head) and digitization processes (the practice). This diagnosis draws on insights from Arendt, Ellul, and Jonas about modern, often subtle coercive mechanisms for which the traditional legal-state framework is not or hardly equipped although they have been frequently applied in recent years. For this reason, the traditional legal-state framework has been contaminated not only by digitization processes and power growth of police and government, but also by mobilization of mechanisms such as fear, peer pressure and techno-hypnosis. After an exploration of the concepts of individual and collective emergency (sections 1 & 2), I emphasize the international obligation to shape a balanced constitutional and legal system on emergency states. In- deed, fundamental rights oppose an “emergency breaks law” police system (section 3). Smart pandemic laws and other exception laws are sector-specific, time-limited, and based on the requirements of crisis management (on cyclical management) and the rule of law (including a role for reviewing judges) (section 4). Nevertheless, the times are not suitable for building a balanced constitutional and legal system on emergency situations. In a second part of the contribution (sections 5 to 9), I explain what makes these times an unfavorable codification time for good practices. There are simply too many bad practices, (I use the term “infections”). In that examination of legal infections, I dwell, as I said, on mechanisms of fear, peer pressure, and techno-hypnosis, and on increases in government and police power through digitization and through “ordinary” laws enabling “extraordinary” police powers. Brand new legislation on health crises (‘the Pandemic Law’) turned out to be no more than a plaster on a deeply festering legal wound, and this explains why the ‘new’ Belgian Pandemic Law is only briefly mentioned at the and as a post scriptum., The Contaminated Rule of LawThe COVID crisis was tackled in Belgium with an emergency procedure of ministerial decrees, relying on the 2007 Civil Security Law, a law that is actually intended to allow for quick and temporary intervention in case of disasters such as large explosions or fires. Despite the Council of State' findings ("this law allows curfews"), this law is both inappropriate and dangerous: without parliamentary debate, it allows far-reaching restrictions on fundamental rights for long periods of time. In the Netherlands, too, the curfew was socially and legally controversial. There, too, there were calls for new legislation on lockdown and other police measures in the event of health crises. The discussions in Belgium and the Netherlands are therefore similar, although the Dutch Constitution and legislation is clearer, (but not enough) with regard to the possibility of declaring a state of emergency and combating infections on a large scale. Obviously, it makes sense, from a concern for the rule of law, to rewrite the Constitution and legislation. New safeguards for new, far-reaching infectious disease control measures for the unhealthy and healthy part of the population .... Who can be against that? This contribution is cautious about the usefulness of exemption legislation. Looking at the health crisis, and older crises such as the 9/11 crisis (terrorism), we pay attention to processes of power accumulation of the government, and the executive in particular, made visible by such a crisis, but made possible by inconspicuous processes such as technology thinking (the head) and digitization processes (the practice). This diagnosis draws on insights from Arendt, Ellul, and Jonas about modern, often subtle coercive mechanisms for which the traditional legal-state framework is not or hardly equipped although they have been frequently applied in recent years. For this reason, the traditional legal-state framework has been contaminated not only by digitization processes and power growth of police and government, but also by mobilization of mechanisms such as fear, peer pressure and techno-hypnosis. After an exploration of the concepts of individual and collective emergency (sections 1 & 2), I emphasize the international obligation to shape a balanced constitutional and legal system on emergency states. Indeed, fundamental rights oppose an "emergency breaks law" police system (section 3). Smart pandemic laws and other exception laws are sector-specific, time-limited, and based on the requirements of crisis management (on cyclical management) and the rule of law (including a role for reviewing judges) (section 4). Nevertheless, the times are not suitable for building a balanced constitutional and legal system on emergency situations. In a second part of the contribution (sections 5 to 9), I explain what makes these times an unfavorable codification time for good practices. There are simply too many bad practices, (I use the term "infections"). In that examination of legal infections, I dwell, as I said, on mechanisms of fear, peer pressure, and techno-hypnosis, and on increases in government and police power through digitization and through "ordinary" laws enabling "extraordinary" police powers. Brand new legislation on health crises ('the Pandemic Law') turned out to be no more than a plaster on a deeply festering legal wound, and this explains why the 'new' Belgian Pandemic Law is only briefly mentioned at the and as a post scriptum.Key words: rule of law – crisis- COVID crisis and 9/11 – codifying best practices today or wait - mechanisms of fear, peer pressure, and techno-hypnosis -increases in government and police power through digitization

Politieoptreden kan raken aan meerdere door het Europees Verdrag voor de Rechten van de Mens beschermde mensenrechten. Dit uit zich in de rechtspraak van het Europees Hof voor de Rechten van de Mens, dat waakt over het Verdrag. Deze bijdrage overloopt de voornaamste uitspraken van het Hof over politie voor het jaar 2019. Dit gebeurt aan de hand van de voornaamste thema’s die in deze arresten aan bod kwamen, zoals politieoptreden tijdens arrestaties, verhoren en detenties, het zwijgrecht en recht op juridische bijstand, openbare ordehand- having tijdens manifestaties, surveillance en zoekingen, de horizontale werking van de verdragsbepalingen bij politiewerk, en het ne bis in idem-beginsel.

Case of Breyer v Germany Application no 50001/12 (ECtHR, 30 January 2020): The Breyer judgment concerns the storage of subscriber data by telecommunications service providers. To the Court, the collection and storage of such data amounted to interference of a rather limited nature. Additional safeguards were provided in the relevant German laws and there was independent supervision by the data protection authorities. The German lawmaker had not exceeded the margin of appreciation. There had been no violation of Article 8 of the European Convention on Human Rights.