Karen McCullagh
My research specialism is information rights: both the commercial and fundamental rights aspects of privacy and data protection particularly in the context of technology e.g. big data, biometrics, cloud computing and social media, and also Freedom of Information, as an aspect of public law.
I am a member of the Executive Committee of BILETA (British & Irish Law, Education & Technology Association), and the IT editor for the European Journal of Current Legal Interests (EJoCLI).
I am the Course Director for the LLM in Media Law, Policy & Practice at the University of East Anglia. I am module organiser for Internet Law & Governance and The Law of E-Commerce modules and teach on the Protection of Privacy & Reputation module on the LLM Programmes: Media Law Policy & Practice and IP & IT Law. I also teach on the Internet Law, Media Law and Constitutional & Administrative Law undergraduate modules. I also contributes to the 'Global Media and Communications Law' module as part of the University's International Summer School programmes.
I received a UEA Award for Excellence in Teaching in 2012-2013. The award panel praised my ‘extremely innovative approach to teaching, in particular the powerful effect of using multiple media approaches for teaching, which allows me to bring a highly personal approach to large class teaching, and noted that my feedback materials were models of clarity.’ They also commended my ‘impressive commitment to pastoral support and praised her exceptional and inspirational teaching.’
Address: UEA Law School
University of East Anglia
Norwich Research Park
Norwich
NR4 7TJ
I am a member of the Executive Committee of BILETA (British & Irish Law, Education & Technology Association), and the IT editor for the European Journal of Current Legal Interests (EJoCLI).
I am the Course Director for the LLM in Media Law, Policy & Practice at the University of East Anglia. I am module organiser for Internet Law & Governance and The Law of E-Commerce modules and teach on the Protection of Privacy & Reputation module on the LLM Programmes: Media Law Policy & Practice and IP & IT Law. I also teach on the Internet Law, Media Law and Constitutional & Administrative Law undergraduate modules. I also contributes to the 'Global Media and Communications Law' module as part of the University's International Summer School programmes.
I received a UEA Award for Excellence in Teaching in 2012-2013. The award panel praised my ‘extremely innovative approach to teaching, in particular the powerful effect of using multiple media approaches for teaching, which allows me to bring a highly personal approach to large class teaching, and noted that my feedback materials were models of clarity.’ They also commended my ‘impressive commitment to pastoral support and praised her exceptional and inspirational teaching.’
Address: UEA Law School
University of East Anglia
Norwich Research Park
Norwich
NR4 7TJ
less
InterestsView All (22)
Uploads
Papers by Karen McCullagh
UK is potentially on course to leave the European Union (EU), but to ensure continued economic success it will seek to maintain a favourable trading relationship with the EU.
This article identifies and critically evaluates the various types of trade deals the UK might negotiate upon exit with a particular focus on trade in
services since financial and digital services are key components of the UK economy.
It also offers both pre- and post-exit guidance on the data protection permutations of each type of trade deal and concludes that post-withdrawal, the UK should ensure that its data protection law
is fully compliant with Regulation (EU) 2016/679. Forging its own data protection path could lead to isolation.
in the U.S. Whilst developers originally intended for SNSs to be used by
adults—which they are—they have also become an integral communication
platform in the lives of many children in EU Member States. Sharing personal information on SNSs is now a routine activity for many children and, whilst they are computer literate in a way that their parents are often not, a number of concerns have emerged. One of these concerns is that children are vulnerable since they lack the capacity to consent to the terms of SNS membership agreements regarding the processing of their personal data. A further concern is that children’s naïve confidence sometimes leads them to take risks—by sharing information about themselves—that adults would not take. This is particularly concerning as children may be ignorant about the fact that their profile and behavioural data is sold to data brokers who use that information to produce targeted adverts—and that these adverts may display age inappropriate content or even may not by recognised by the children as adverts.1
Directive 95/46/EC2 regulates the processing of the personal data of
EU citizens, including personal data posted on SNSs. Problematically, it
was drafted in a pre-SNS era and neither makes reference to children nor
considers them vulnerable data subjects whose personal data should be
subject to more stringent processing rules. The absence of specific legal
protection for children’s data on SNSs sparked concerns that children were
ignorantly disclosing personal data and being exposed to profiling and
advertising without adequate privacy and data protection safeguards in place. In response to these concerns, provisions aimed at safeguarding children’s privacy and data protection rights have been included in Regulation (EU) 2016/679 (hereafter “GDPR”),3 which will come into force on 25 May 2018.
This chapter provides a critical evaluation of the forthcoming measures to
address a knowledge gap that exists because of the novelty of these provisions and the fact that scholarship in this area is currently underdeveloped.4 It begins by providing an overview of SNSs and the problems posed by underage children’s access to them. In this regard, it will illustrate that the biological and psychosocial developmental changes that children experience as they progress through their teenage years and develop their capacity for freedom of expression makes them vulnerable to impulsive personal information disclosures and privacy invasions. After this, an exploration of the current legal protections for children’s privacy on SNSs from the perspective of privacy as information control will highlight deficiencies in Directive 95/46/EC. This leads to an analysis of the measures in the GDPR to determine whether they will, when introduced, realise the twin goals of legitimising the processing of children’s personal data and, at the same time, protecting their fundamental privacy and data protection rights. The compatibility of measures in the GDPR with provisions in the United
Nations Convention on the Rights of the Child (1989) (“the UNCRC”)
and the Charter of Fundamental Rights of the European Union (2000)
(“the EU Charter”) is considered as these provide a normative framework
for evaluating children’s legal rights. To comply with both legal frameworks,
data protection measures in the GDPR governing children’s activities on
SNSs should recognise their evolving capacity for freedom of expression
and privacy. This would allow them to express themselves with appropriate
safeguards in place, ensuring that their best interests are protected and that they are not subject to economic exploitation through activities such as profiling and advertising without consent. Specifically, the analysis presents a critical evaluation of the introduction of an age threshold, below which children are deemed to lack capacity to consent to the processing of their personal data; the conceptual coherence of relying on parental consent for children under the threshold age; the practical implications of Member States being permitted to set the threshold age within a range of ages; and the practical challenges posed by relying on verified parental consent.
The chapter concludes that measures in the GDPR are compatible
with provisions in the UNCRC and the EU Charter but that a number of
practical challenges remain unsolved. For instance, allowing Member States to set the threshold age means that the goal of simplifying and harmonising the regulatory environment for SNSs operating on a transnational basis will not be fully realised. Equally, reliance on parental consent and the consent of children over the threshold age is conceptually coherent, but it is dependent on the introduction of low-cost age-verification mechanisms being integrated into SNSs. It is also dependent on child data subjects (or their parents) being digitally literate enough to give unambiguous, specific consent to the processing of their personal data. Relatedly, whilst the GDPR includes measures to promote and increase the digital literacy of both parents and children, it remains to be seen how effective these will be in practice. For these reasons, the GDPR is an improvement on Directive 95/46/EC, but only a partial success.
Edinburgh Law Review: http://www.euppublishing.com/doi/10.3366/elr.2017.0389
system (hereafter referred to as ‘clickers’) in large group Undergraduate Public Law
lectures.
The paper begins reflecting upon my current lecture practice in the context of existing
literature and by reviewing feedback from previous cohorts of students. This reveals that the traditional, didactic lecture style, commonly employed by law lecturers in the UK has been criticized for fostering student passivity and resulting in surface learning
(Ramsden, 1992). In contrast, studies carried out in pure science disciplines; medicine, engineering and mathematics (Hake, 1998; Crouch and Mazur, 2001) indicate positive results from use of clicker quizzes, in terms of increasing student interaction and engagement.
Accordingly, I decided to incorporate clicker quizzes into lectures, and measure student
responses to this change in teaching practice. The findings indicate that clicker usage
increased student interaction and engagement. This study concludes that clickers
should be used on an ongoing basis in Public law lectures, and also indicates positive
support from students regarding the use clickers in other undergraduate law subjects.
Furthermore, although the findings from this action research study are not
generalisable, the responses suggest that clickers could be an effective teaching tool in
large group sessions in other disciplines, since they replicate findings from previous
studies in other disciplines.
Importantly, we start from the position that in order to compete successfully in the marketplace it will be necessary for information providers to understand how the legal market place utilises legal information at present and what users perceive as being of potential ‘added value’. We will briefly use the conceptual structure of the ‘technology acceptance model’ to analyse our interview material.
We will also note that a tension exists between the private and public sector over the dissemination of public sector information and that the Directive needed to resolve several issues if the eContent programme of the information society is to succeed. Such issues include: access rights, copyright,
competition rules and pricing policies. These have not been attacked in the Directive and we thus feel that it - in comparison to the Proposal for a Directive - offers little to either the public or to commercial re-users of information that is not already on offer at present. The Directive is, perhaps, a failed project in terms of the ultimate aims of the Information Society.
UK is potentially on course to leave the European Union (EU), but to ensure continued economic success it will seek to maintain a favourable trading relationship with the EU.
This article identifies and critically evaluates the various types of trade deals the UK might negotiate upon exit with a particular focus on trade in
services since financial and digital services are key components of the UK economy.
It also offers both pre- and post-exit guidance on the data protection permutations of each type of trade deal and concludes that post-withdrawal, the UK should ensure that its data protection law
is fully compliant with Regulation (EU) 2016/679. Forging its own data protection path could lead to isolation.
in the U.S. Whilst developers originally intended for SNSs to be used by
adults—which they are—they have also become an integral communication
platform in the lives of many children in EU Member States. Sharing personal information on SNSs is now a routine activity for many children and, whilst they are computer literate in a way that their parents are often not, a number of concerns have emerged. One of these concerns is that children are vulnerable since they lack the capacity to consent to the terms of SNS membership agreements regarding the processing of their personal data. A further concern is that children’s naïve confidence sometimes leads them to take risks—by sharing information about themselves—that adults would not take. This is particularly concerning as children may be ignorant about the fact that their profile and behavioural data is sold to data brokers who use that information to produce targeted adverts—and that these adverts may display age inappropriate content or even may not by recognised by the children as adverts.1
Directive 95/46/EC2 regulates the processing of the personal data of
EU citizens, including personal data posted on SNSs. Problematically, it
was drafted in a pre-SNS era and neither makes reference to children nor
considers them vulnerable data subjects whose personal data should be
subject to more stringent processing rules. The absence of specific legal
protection for children’s data on SNSs sparked concerns that children were
ignorantly disclosing personal data and being exposed to profiling and
advertising without adequate privacy and data protection safeguards in place. In response to these concerns, provisions aimed at safeguarding children’s privacy and data protection rights have been included in Regulation (EU) 2016/679 (hereafter “GDPR”),3 which will come into force on 25 May 2018.
This chapter provides a critical evaluation of the forthcoming measures to
address a knowledge gap that exists because of the novelty of these provisions and the fact that scholarship in this area is currently underdeveloped.4 It begins by providing an overview of SNSs and the problems posed by underage children’s access to them. In this regard, it will illustrate that the biological and psychosocial developmental changes that children experience as they progress through their teenage years and develop their capacity for freedom of expression makes them vulnerable to impulsive personal information disclosures and privacy invasions. After this, an exploration of the current legal protections for children’s privacy on SNSs from the perspective of privacy as information control will highlight deficiencies in Directive 95/46/EC. This leads to an analysis of the measures in the GDPR to determine whether they will, when introduced, realise the twin goals of legitimising the processing of children’s personal data and, at the same time, protecting their fundamental privacy and data protection rights. The compatibility of measures in the GDPR with provisions in the United
Nations Convention on the Rights of the Child (1989) (“the UNCRC”)
and the Charter of Fundamental Rights of the European Union (2000)
(“the EU Charter”) is considered as these provide a normative framework
for evaluating children’s legal rights. To comply with both legal frameworks,
data protection measures in the GDPR governing children’s activities on
SNSs should recognise their evolving capacity for freedom of expression
and privacy. This would allow them to express themselves with appropriate
safeguards in place, ensuring that their best interests are protected and that they are not subject to economic exploitation through activities such as profiling and advertising without consent. Specifically, the analysis presents a critical evaluation of the introduction of an age threshold, below which children are deemed to lack capacity to consent to the processing of their personal data; the conceptual coherence of relying on parental consent for children under the threshold age; the practical implications of Member States being permitted to set the threshold age within a range of ages; and the practical challenges posed by relying on verified parental consent.
The chapter concludes that measures in the GDPR are compatible
with provisions in the UNCRC and the EU Charter but that a number of
practical challenges remain unsolved. For instance, allowing Member States to set the threshold age means that the goal of simplifying and harmonising the regulatory environment for SNSs operating on a transnational basis will not be fully realised. Equally, reliance on parental consent and the consent of children over the threshold age is conceptually coherent, but it is dependent on the introduction of low-cost age-verification mechanisms being integrated into SNSs. It is also dependent on child data subjects (or their parents) being digitally literate enough to give unambiguous, specific consent to the processing of their personal data. Relatedly, whilst the GDPR includes measures to promote and increase the digital literacy of both parents and children, it remains to be seen how effective these will be in practice. For these reasons, the GDPR is an improvement on Directive 95/46/EC, but only a partial success.
Edinburgh Law Review: http://www.euppublishing.com/doi/10.3366/elr.2017.0389
system (hereafter referred to as ‘clickers’) in large group Undergraduate Public Law
lectures.
The paper begins reflecting upon my current lecture practice in the context of existing
literature and by reviewing feedback from previous cohorts of students. This reveals that the traditional, didactic lecture style, commonly employed by law lecturers in the UK has been criticized for fostering student passivity and resulting in surface learning
(Ramsden, 1992). In contrast, studies carried out in pure science disciplines; medicine, engineering and mathematics (Hake, 1998; Crouch and Mazur, 2001) indicate positive results from use of clicker quizzes, in terms of increasing student interaction and engagement.
Accordingly, I decided to incorporate clicker quizzes into lectures, and measure student
responses to this change in teaching practice. The findings indicate that clicker usage
increased student interaction and engagement. This study concludes that clickers
should be used on an ongoing basis in Public law lectures, and also indicates positive
support from students regarding the use clickers in other undergraduate law subjects.
Furthermore, although the findings from this action research study are not
generalisable, the responses suggest that clickers could be an effective teaching tool in
large group sessions in other disciplines, since they replicate findings from previous
studies in other disciplines.
Importantly, we start from the position that in order to compete successfully in the marketplace it will be necessary for information providers to understand how the legal market place utilises legal information at present and what users perceive as being of potential ‘added value’. We will briefly use the conceptual structure of the ‘technology acceptance model’ to analyse our interview material.
We will also note that a tension exists between the private and public sector over the dissemination of public sector information and that the Directive needed to resolve several issues if the eContent programme of the information society is to succeed. Such issues include: access rights, copyright,
competition rules and pricing policies. These have not been attacked in the Directive and we thus feel that it - in comparison to the Proposal for a Directive - offers little to either the public or to commercial re-users of information that is not already on offer at present. The Directive is, perhaps, a failed project in terms of the ultimate aims of the Information Society.
The session focused on the potential advantages of using an online survey to collect data, as if it is used innovatively, for example, promoted through YouTube and through high-profile bloggers and discussion boards, it can become self-promoting and generate high levels of responses