Data Protection is a continuously growing research field. Personal data processing impacts not on... more Data Protection is a continuously growing research field. Personal data processing impacts not only the individuals, their dignity and autonomy, but also the society as a whole. In the words of Stefano Rodotà 'the democratic nature of any society can be also gauged by the extent to which personal data are actually protected'. 1 The COVID19 pandemic greatly illustrates the multi-faceted nature of data protection. Data concerning health became of paramount importance not only for the so-called social distancing measures, but also for medical research. At the same time, we all witnessed vast collection, commercialisation and often misuse of personal data. Health apps with the green certificates necessary for travelling, apps promising to limit the spreading rates of the virus by notifying citizens of infected persons in their proximity, and access policies involving temperature measuring of employees. 2 The necessity and proportionality of processing of all those data in the name of public health is questionable. Especially, given the false promises of many of those measures. 3 In parallel, Public Private Partnerships became the new norm, legitimising access to and use of data, often coupled with allegations on inappropriate data security guarantees. 4 The COVID19 example teaches us the importance of personal data and of rules on fair and proportionate processing, but also the relevance of data protection as a regulatory field, and consequently of data protection research. This Handbook aims at depicting the actual scholarly, state-of-the-art overview of research and the scope of current thinking in the field of European data protection in a multidisciplinary manner, and reflecting on current issues that will mark the next generation of research. Several reasons make the publication of this Research Handbook on European Data Protection so timely.
IFIP advances in information and communication technology, 2012
This book constitutes the thoroughly refereed post-conference proceedings of the 7th IFIP WG 9.2,... more This book constitutes the thoroughly refereed post-conference proceedings of the 7th IFIP WG 9.2, 9.6/11.7, 11.4, 11.6 International Summer School, held in Trento, Italy, in September 2011. The 20 revised papers were carefully selected from numerous submissions during two rounds of reviewing. The book also contains two invited talks. The papers are organized in topical sections on privacy metrics and comparison, policies, privacy transparency in the age of cloud computing, privacy for mobile applications, consumer privacy, privacy for online communities, privacy for eHealth and eID applications, privacy attacks and problems, and ethics.
IFIP advances in information and communication technology, 2011
The use of general descriptive names, registered names, trademarks, etc. in this publication does... more The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
Copyright and moral rights for the publications made accessible in the public portal are retained... more Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.
Blockchain is een fenomeen dat zich in recente jaren op een grote publieke belangstelling mag ver... more Blockchain is een fenomeen dat zich in recente jaren op een grote publieke belangstelling mag verheugen. Het is een innovatieve techniek die een aanvulling kan vormen op het internet om het mogelijk te maken partijen die elkaar niet kennen of (volledig) vertrouwen met elkaar zaken te laten doen. Blockchain technieken pretenderen een vertrouwensprobleem op te lossen. Het open karakter van de blockchain zou bovendien kunnen bijdragen aan transparantie, controleerbaarheid en legitimiteit van allerlei maatschappelijke processen. Tevens zou blockchain vele intermediairs die als een trusted third party functioneren overbodig kunnen maken en daarmee een grote efficientieslag mogelijk kunnen maken.Dit onderzoek beoogt een kader te ontwikkelen voor de aanvaardbaarheid van blockchain vanuit juridisch perspectief. Dit kader biedt een biedt de mogelijkheid om de kansen en risico’s die blockchains bieden met elkaar in verband te brengen en zo het inzicht te vergroten in de mogelijkheden voor het benutten van de kansen die blockchain technologie burgers, bedrijven en overheden biedt en voor het beheersen van risico’s en aandachtspunten in het licht van toekomstige wetgeving.De vraagstelling die centraal staat is: Wat zijn vanuit en perspectief van juridische aanvaardbaarheid de kansen en risico’s verbonden aan blockchaintechniek?
ABSTRACT Artifacts are generally constructed on purpose and have intended and unintended effects ... more ABSTRACT Artifacts are generally constructed on purpose and have intended and unintended effects on the conduct of people. As such, architecture can be used in regulating society, as speed ramps convincingly show. But is this de facto regulating behaviour by means of technology, regulating society in a legal sense, or is it merely disciplining society? Individuals can decide not to comply with legislation but are generally forced to observe the norms imposed upon them by techno-regulation. Many prominent examples of techno-regulation can be found in the context of ICT, for instance DRM, content filtering, privacy enhancing technologies. Users in these contexts are typically bound by the norms embedded in the technology, without these norms being very transparent. Furthermore, techno-regulation in the ICT context is most prominently driven by industry, not government. The combination of the obscurity of the norms embedded in the technology, the strict enforcement of these norms and the process of their enactment raise many questions regarding the legal status and legal effects of techno-regulation. This paper explores the different forms of techno-regulation instituted by both public and private regulators in more detail and tries to answer the question how techno-regulation by public and private regulators should be understood from a legal point of view. The paper argues that state authored techno-regulation has to be seen as supplemental to regular regulation because legitimacy requires the norms to be transparent and the regulator to be accountable for the norms. With regards to non-state authored techno-regulation, the image is more diffuse. Some instances of techno-regulation have a clear legal status and the legal effects of transgressing the techno-norms are clear as well. In other cases, the legal status of the norms is unclear, yet their regulative effect real.
The HLEG has taken on the ambitious project of developing general guidelines for ethical AI and h... more The HLEG has taken on the ambitious project of developing general guidelines for ethical AI and has, a first step in this process, published a draft document for stakeholders to review and comment upon. In this draft document, the group builds upon, and rightly so, a range of existing frameworks, principles and manifestos. It proposes to centre the guidelines on the concept of Trustworthy AI. They elaborate this concept in three sections that each address different levels of abstraction: ethical purpose rooted in fundamental rights, technical and non-technical methods, and an assessment list. We would like to congratulate the HLEG on this first step in a complex and multifaceted process and complement the group on finding a shared basis to further build upon. In particular, we welcome the rights-based approach that HLEG chose to pursue, as it roots the guidelines in shared values and principles within Europe while at the same time aligning them with many of the existing guidelines. Moreover, we were pleased to see the substantive definition of AI as it is outlined in the document published in parallel with the guidelines and summarized in the draft document. In particular, by distinguishing between AI as a technology and artefact designed and deployed by human beings on the one hand and AI as a scientific discipline on the other, the authors have managed to highlight the extensiveness and heterogeneity of AI. They have also signalled the human agency and work that is involved in making these AI systems function. The focus in the definition on the pre-determined goals and parameters provides regulators something to work with. The HLEG also brings the discussions on ethical AI a step forward by not only focusing on rights, principles and values, but also on the implementation and embedding of the technology. The ambition to provide concrete tools and methods for policy makers, developers, and citizens is needed to bring ethical AI into practice and we encourage further work in this direction. As the HLEG has explicitly asked for critical feedback we would like to offer a few suggestions and comments for the further improvement of the document. We will first provide some general comments and then go into more specific comments per section of the guidelines document.
General Data Protection Regulation ('GDPR') • 9 Governance, Risk, and Compliance (GRC) • 6 H HP P... more General Data Protection Regulation ('GDPR') • 9 Governance, Risk, and Compliance (GRC) • 6 H HP Privacy Advisor (HP PA) • 7 I Information Commissioner's Office (ICO) • 6 O Organisation for Economic Cooperation and Development (OECD) • 10 P Privacy and Electronic Communications Regulations (PECR) • 7 Privacy Impact Assessments (PIAs) • 6 ''whether the establishment and use of the register in question may cause problems for the individual person'' (s.
The EU General Data Protection Regulation (GDPR), 2020
Article 5(2) (Principle of accountability); Article 24(3) (Responsibility of the controller); Art... more Article 5(2) (Principle of accountability); Article 24(3) (Responsibility of the controller); Article 25(3) (Data protection by design and by default); Article 28(5) (Responsibilities of the processor) (see too recital 81); Article 32(3) (Security of processing); Article 43 (Certification bodies); Article 46(2)(f) (Transfers subject to appropriate safeguards); Article 55 (Competence of the supervisory authorities); Article 56 (Tasks of the supervisory authorities); Articles 57(1)(n)–(q) (Tasks of the supervisory authorities) (see too recital 77); Article 58(h) (Powers of the supervisory authorities); Article 63 (Consistency mechanism); Article 64(1)(c) (Opinion of the Board); Article 70(1)(n)–(q) (Tasks of the Board); Article 93(4)(b) (General conditions for imposing administrative fines).
The paper intends to identify certain "rule of law" implications of Big Data analysis from a tech... more The paper intends to identify certain "rule of law" implications of Big Data analysis from a techno-regulatory perspective-namely, (i) the collapse of the normative enterprise, (ii) the erosion of moral enterprise and (iii) replacing of causative basis with correlative calculations. Although these implications are not completely specific to Big Data space but rather of general nature regarding techno-regulation, each of these rule of law implications become aggravated, and extend into deeper dimensions when techno-regulation is implemented through data-driven systems.
Techno-regulation is a prominent mechanism for regulating human behaviour. One type of techno-reg... more Techno-regulation is a prominent mechanism for regulating human behaviour. One type of techno-regulation concerns automated decision-making with legal effects. While automated decision-making (ADM) systems in the public domain have traditionally been based on conscious design of decisional norms, increasingly, Data Science methodologies are used to devise these norms. This data-driven approach causes frictions with the underlying principle of public-sector decision-making, namely adherence to the rule of law. In this paper we discuss three major challenges data-driven ADM poses to the Rule Law: law as a normative enterprise, law as a causative enterprise and law as a moral enterprise.
Data Protection is a continuously growing research field. Personal data processing impacts not on... more Data Protection is a continuously growing research field. Personal data processing impacts not only the individuals, their dignity and autonomy, but also the society as a whole. In the words of Stefano Rodotà 'the democratic nature of any society can be also gauged by the extent to which personal data are actually protected'. 1 The COVID19 pandemic greatly illustrates the multi-faceted nature of data protection. Data concerning health became of paramount importance not only for the so-called social distancing measures, but also for medical research. At the same time, we all witnessed vast collection, commercialisation and often misuse of personal data. Health apps with the green certificates necessary for travelling, apps promising to limit the spreading rates of the virus by notifying citizens of infected persons in their proximity, and access policies involving temperature measuring of employees. 2 The necessity and proportionality of processing of all those data in the name of public health is questionable. Especially, given the false promises of many of those measures. 3 In parallel, Public Private Partnerships became the new norm, legitimising access to and use of data, often coupled with allegations on inappropriate data security guarantees. 4 The COVID19 example teaches us the importance of personal data and of rules on fair and proportionate processing, but also the relevance of data protection as a regulatory field, and consequently of data protection research. This Handbook aims at depicting the actual scholarly, state-of-the-art overview of research and the scope of current thinking in the field of European data protection in a multidisciplinary manner, and reflecting on current issues that will mark the next generation of research. Several reasons make the publication of this Research Handbook on European Data Protection so timely.
IFIP advances in information and communication technology, 2012
This book constitutes the thoroughly refereed post-conference proceedings of the 7th IFIP WG 9.2,... more This book constitutes the thoroughly refereed post-conference proceedings of the 7th IFIP WG 9.2, 9.6/11.7, 11.4, 11.6 International Summer School, held in Trento, Italy, in September 2011. The 20 revised papers were carefully selected from numerous submissions during two rounds of reviewing. The book also contains two invited talks. The papers are organized in topical sections on privacy metrics and comparison, policies, privacy transparency in the age of cloud computing, privacy for mobile applications, consumer privacy, privacy for online communities, privacy for eHealth and eID applications, privacy attacks and problems, and ethics.
IFIP advances in information and communication technology, 2011
The use of general descriptive names, registered names, trademarks, etc. in this publication does... more The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
Copyright and moral rights for the publications made accessible in the public portal are retained... more Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.
Blockchain is een fenomeen dat zich in recente jaren op een grote publieke belangstelling mag ver... more Blockchain is een fenomeen dat zich in recente jaren op een grote publieke belangstelling mag verheugen. Het is een innovatieve techniek die een aanvulling kan vormen op het internet om het mogelijk te maken partijen die elkaar niet kennen of (volledig) vertrouwen met elkaar zaken te laten doen. Blockchain technieken pretenderen een vertrouwensprobleem op te lossen. Het open karakter van de blockchain zou bovendien kunnen bijdragen aan transparantie, controleerbaarheid en legitimiteit van allerlei maatschappelijke processen. Tevens zou blockchain vele intermediairs die als een trusted third party functioneren overbodig kunnen maken en daarmee een grote efficientieslag mogelijk kunnen maken.Dit onderzoek beoogt een kader te ontwikkelen voor de aanvaardbaarheid van blockchain vanuit juridisch perspectief. Dit kader biedt een biedt de mogelijkheid om de kansen en risico’s die blockchains bieden met elkaar in verband te brengen en zo het inzicht te vergroten in de mogelijkheden voor het benutten van de kansen die blockchain technologie burgers, bedrijven en overheden biedt en voor het beheersen van risico’s en aandachtspunten in het licht van toekomstige wetgeving.De vraagstelling die centraal staat is: Wat zijn vanuit en perspectief van juridische aanvaardbaarheid de kansen en risico’s verbonden aan blockchaintechniek?
ABSTRACT Artifacts are generally constructed on purpose and have intended and unintended effects ... more ABSTRACT Artifacts are generally constructed on purpose and have intended and unintended effects on the conduct of people. As such, architecture can be used in regulating society, as speed ramps convincingly show. But is this de facto regulating behaviour by means of technology, regulating society in a legal sense, or is it merely disciplining society? Individuals can decide not to comply with legislation but are generally forced to observe the norms imposed upon them by techno-regulation. Many prominent examples of techno-regulation can be found in the context of ICT, for instance DRM, content filtering, privacy enhancing technologies. Users in these contexts are typically bound by the norms embedded in the technology, without these norms being very transparent. Furthermore, techno-regulation in the ICT context is most prominently driven by industry, not government. The combination of the obscurity of the norms embedded in the technology, the strict enforcement of these norms and the process of their enactment raise many questions regarding the legal status and legal effects of techno-regulation. This paper explores the different forms of techno-regulation instituted by both public and private regulators in more detail and tries to answer the question how techno-regulation by public and private regulators should be understood from a legal point of view. The paper argues that state authored techno-regulation has to be seen as supplemental to regular regulation because legitimacy requires the norms to be transparent and the regulator to be accountable for the norms. With regards to non-state authored techno-regulation, the image is more diffuse. Some instances of techno-regulation have a clear legal status and the legal effects of transgressing the techno-norms are clear as well. In other cases, the legal status of the norms is unclear, yet their regulative effect real.
The HLEG has taken on the ambitious project of developing general guidelines for ethical AI and h... more The HLEG has taken on the ambitious project of developing general guidelines for ethical AI and has, a first step in this process, published a draft document for stakeholders to review and comment upon. In this draft document, the group builds upon, and rightly so, a range of existing frameworks, principles and manifestos. It proposes to centre the guidelines on the concept of Trustworthy AI. They elaborate this concept in three sections that each address different levels of abstraction: ethical purpose rooted in fundamental rights, technical and non-technical methods, and an assessment list. We would like to congratulate the HLEG on this first step in a complex and multifaceted process and complement the group on finding a shared basis to further build upon. In particular, we welcome the rights-based approach that HLEG chose to pursue, as it roots the guidelines in shared values and principles within Europe while at the same time aligning them with many of the existing guidelines. Moreover, we were pleased to see the substantive definition of AI as it is outlined in the document published in parallel with the guidelines and summarized in the draft document. In particular, by distinguishing between AI as a technology and artefact designed and deployed by human beings on the one hand and AI as a scientific discipline on the other, the authors have managed to highlight the extensiveness and heterogeneity of AI. They have also signalled the human agency and work that is involved in making these AI systems function. The focus in the definition on the pre-determined goals and parameters provides regulators something to work with. The HLEG also brings the discussions on ethical AI a step forward by not only focusing on rights, principles and values, but also on the implementation and embedding of the technology. The ambition to provide concrete tools and methods for policy makers, developers, and citizens is needed to bring ethical AI into practice and we encourage further work in this direction. As the HLEG has explicitly asked for critical feedback we would like to offer a few suggestions and comments for the further improvement of the document. We will first provide some general comments and then go into more specific comments per section of the guidelines document.
General Data Protection Regulation ('GDPR') • 9 Governance, Risk, and Compliance (GRC) • 6 H HP P... more General Data Protection Regulation ('GDPR') • 9 Governance, Risk, and Compliance (GRC) • 6 H HP Privacy Advisor (HP PA) • 7 I Information Commissioner's Office (ICO) • 6 O Organisation for Economic Cooperation and Development (OECD) • 10 P Privacy and Electronic Communications Regulations (PECR) • 7 Privacy Impact Assessments (PIAs) • 6 ''whether the establishment and use of the register in question may cause problems for the individual person'' (s.
The EU General Data Protection Regulation (GDPR), 2020
Article 5(2) (Principle of accountability); Article 24(3) (Responsibility of the controller); Art... more Article 5(2) (Principle of accountability); Article 24(3) (Responsibility of the controller); Article 25(3) (Data protection by design and by default); Article 28(5) (Responsibilities of the processor) (see too recital 81); Article 32(3) (Security of processing); Article 43 (Certification bodies); Article 46(2)(f) (Transfers subject to appropriate safeguards); Article 55 (Competence of the supervisory authorities); Article 56 (Tasks of the supervisory authorities); Articles 57(1)(n)–(q) (Tasks of the supervisory authorities) (see too recital 77); Article 58(h) (Powers of the supervisory authorities); Article 63 (Consistency mechanism); Article 64(1)(c) (Opinion of the Board); Article 70(1)(n)–(q) (Tasks of the Board); Article 93(4)(b) (General conditions for imposing administrative fines).
The paper intends to identify certain "rule of law" implications of Big Data analysis from a tech... more The paper intends to identify certain "rule of law" implications of Big Data analysis from a techno-regulatory perspective-namely, (i) the collapse of the normative enterprise, (ii) the erosion of moral enterprise and (iii) replacing of causative basis with correlative calculations. Although these implications are not completely specific to Big Data space but rather of general nature regarding techno-regulation, each of these rule of law implications become aggravated, and extend into deeper dimensions when techno-regulation is implemented through data-driven systems.
Techno-regulation is a prominent mechanism for regulating human behaviour. One type of techno-reg... more Techno-regulation is a prominent mechanism for regulating human behaviour. One type of techno-regulation concerns automated decision-making with legal effects. While automated decision-making (ADM) systems in the public domain have traditionally been based on conscious design of decisional norms, increasingly, Data Science methodologies are used to devise these norms. This data-driven approach causes frictions with the underlying principle of public-sector decision-making, namely adherence to the rule of law. In this paper we discuss three major challenges data-driven ADM poses to the Rule Law: law as a normative enterprise, law as a causative enterprise and law as a moral enterprise.
Mr. drs. B. van der Sloot, M. Paun LLM en prof. dr. R. Leenes * De Wet uitvoering antidopingbelei... more Mr. drs. B. van der Sloot, M. Paun LLM en prof. dr. R. Leenes * De Wet uitvoering antidopingbeleid: de gespannen relatie tussen antidopingmaatregelen en gegevens-bescherming Deel 1: de antidopingwereld 2 Trefwoorden: antidoping, gegevensbescherming, Wet uitvoering antidopingbeleid Sporters kunnen worden onderworpen aan zeer verre-gaande maatregelen in verband met de strijd tegen doping. Zo kunnen zij worden verplicht per dag hun verblijfplaatsen door te geven en kunnen er bloed-en urinemonsters worden verzameld en opgeslagen in het geval zij worden onderworpen aan een dopingtest. Deze gegevens worden gedeeld met partijen in het buitenland, die onder andere gevestigd zijn in Zwitser-land en Canada, maar ook daarbuiten. Deze maatrege-len treffen vooral professionele atleten, maar kunnen onder omstandigheden ook worden opgelegd aan amateursporters. De vraag is of deze grootschalige gegevensverwerking en-doorvoer legitiem en propor-tioneel is in het kader van het recht op privacy en ge-gevensbescherming. De Nederlandse regering heeft onlangs een wet naar de Kamer gestuurd om deze ge-spannen relatie in te kaderen en bij wet te regelen. Dit artikel beschrijft de antidopingwereld, de betrokken partijen en de gegevensverzameling en-doorvoer die plaatsheeft. Een tweede artikel, dat in het volgende nummer van P&I verschijnt, zal de juridische haken en ogen in het algemeen en van de thans aanhangige wet in het bijzonder bespreken.
Uploads
Papers by Ronald Leenes