Search

This paper argues that while the GDPR has arguably delivered positive outcomes by enhancing the protection afforded to data subjects, it has also had adverse effects on competition by strengthening the position of large online platforms in certain markets. In addition, the GDPR has given large platforms a tool to harm rivals by restricting access to the data they need to compete effectively. The present paper focuses on digital advertising and the ad tech industry, where the GDPR appears to have strengthened Google and Facebook. The purpose of this paper is not to call for the weakening of the GDPR, whose positive impact on users cannot be ignored. While from a policy standpoint regulators should thus maintain or even increase the level of protection offered by this legislation, it is vital that they take steps to mitigate its adverse effects on other dimensions of welfare, such as competition. [ABSTRACT FROM AUTHOR]

The Federal Trade Commission (FTC) levied its largest fine to date under the Children's Online Privacy Protection Act (COPPA) against YouTube in 2019. In addition to paying the fine, YouTube agreed to make several changes to its platform in an effort to improve compliance with the law. Almost simultaneously, the Commission announced its intent to revise the COPPA rule and requested comments from stakeholders. This Comment seeks to explain the shortcomings of the FTC's enforcement action against YouTube and offer some proposals for sensible COPPA reforms. [ABSTRACT FROM AUTHOR]

The article discusses updates to the California Consumer Privacy Act (CCPA) of 2018 as of March 2021 to offer new privacy rights and protection to Californians. Other topics include the final regulations issued by the California Attorney General's Office, the right of consumers to request the categories of personal information collected and sold by businesses, and the liability of businesses to consumers in cases of data breaches.

The article focuses on origins of data privacy laws in the U.S. and common law right and extending to congressional legislation across different sectors. It mentions internet's impact on consumer data privacy and the U.S. self-regulatory response to the European Union's General Data Protection Regulation (GDPR). It also mentions self-regulatory bodies and lays out potential factors a newly formed body of industry-leading companies could consider to serve both consumer and corporate interests.

The California Consumer Privacy Act (CCPA) was passed in response to a number of newsworthy data breaches with widespread impacts, and which revealed how little digital privacy consumers actually have. Despite the large market for consumer data, individual consumers generally do not earn money when their personal data are sold. Further, consumers have very little control over who collects their data, what information is collected, and with whom it is shared. To place control back in the hands of the consumer, affirmative consent should be required to collect and sell consumer's data, and consumers should have the ability to sell these data themselves. The CCPA provides a mechanism for consumers to monetize their own data, but it does not go far enough. The CCPA allows consumers to "opt-out" of sharing their data, but an "opt-in" framework would offer increased privacy and greater incentives for companies to pay consumers for their data. Despite these and many other issues, the CCPA represents a step towards improved digital privacy. However, it remains to be seen whether the CCPA will result in any meaningful change to consumer data monetization and digital privacy protection more broadly. [ABSTRACT FROM AUTHOR]

The article addresses statutory developments and court decisions in the area of cybersecurity and data privacy law in the U.S. from October 1, 2018 through September 30, 2019. Topics discussed include states that have enacted an Insurance Data Security Law, information on the California Consumer Privacy Act (CCPA) effective on January 1, 2020, and explanation on New York's Stop Hacks and Improve Electronic Data Security Act.

The article focuses on Homeland Advanced Recognition Technology (HART) system of the U.S. Department of Homeland Security (DHS). It mentions federal government has long touted broad-based biometric data collection as inherently "privacy enhancing" due to the data's efficiency and immutability and expand data-sharing capabilities. It also mentions the Fourth Amendment's prohibition on unreasonable searches and seizures and integration of biometric data.

The article presents an analysis of the General Data Protection Regulation (GDPR) impact on U.S. law and policy and its involvement in domestic and global litigation. It mentions future of data privacy laws and regulations relating to the GDPR within the U.S. and privacy of personal medical data is governed by the Health Insurance Availability and Affordability Act of 1996 (HIPAA) and internet protocol (IP) addresses and social media profile information.

One component of the newly implemented European Union General Data Protection Regulation (GDPR), a revision of a 1995 directive, is mandatory breach notification. The US has no such federal law. This means companies must satisfy multiple US laws and that makes it more challenging to comply. This study is a comparison of the GDPR with the statutes of the 50 US states, highlights the challenges companies face and reveals the types of decisions companies must make to be in compliance with these statutes. [ABSTRACT FROM AUTHOR]

This paper introduces the strategic approach to regulating personal data and the normative foundations of the European Union's General Data Protection Regulation ('GDPR'). We explain the genesis of the GDPR, which is best understood as an extension and refinement of existing requirements imposed by the 1995 Data Protection Directive; describe the GDPR's approach and provisions; and make predictions about the GDPR's implications. We also highlight where the GDPR takes a different approach than U.S. privacy law. The GDPR is the most consequential regulatory development in information policy in a generation. The GDPR brings personal data into a detailed regulatory regime, that will influence personal data usage worldwide. Understood properly, the GDPR encourages firms to develop information governance frameworks, to in-house data use, and to keep humans in the loop in decision making. Companies with direct relationships with consumers have strategic advantages under the GDPR, compared to third party advertising firms on the internet. To reach these objectives, the GDPR uses big sticks, structural elements that make proving violations easier, but only a few carrots. The GDPR will complicate and restrain some informationintensive business models. But the GDPR will also enable approaches previously impossible under less-protective approaches. [ABSTRACT FROM AUTHOR]

The article focuses on laws governing internet privacy in the U.S. It mentions about the ability of Internet Service Providers (ISP) to implement a process known as data-mining; efforts of Federal Communications Commission in maintaining users privacy on the internet by creating ISP regulations; and enactment of Telecommunications Act and Communications Act for the same. It also mentions about Carpenter v. United States court case on the same.

As our lives become more driven by technology, California's privacy laws fall short of protecting our personally identifiable information. Vehicles in particular present an increasing privacy concern, as our automobiles become more computer and less car. Cars today have increasingly sophisticated capabilities, stemming from connected technology and sensors, and their ability to capture geolocation and biometric data. This data can be used to make inferences about drivers' behavioral patterns and daily habits. This Article analyzes whether California's privacy laws--California Online Privacy Protection Act ("COPPA") and Shine the Light--adequately address privacy concerns regarding driver data collected by the connected car. This Article considers how notice and consent can effectively protect connected car drivers, and concludes that consumers need a more effective way to manage how connected car data is collected, retained, and used. [ABSTRACT FROM AUTHOR]

The article discusses the General Data Protection Regulation in the European Union (EU) and its possible legal effects to businesses in Georgia. Other topics include the EU-U.S. Privacy Shield, which regulates personal data flow from EU to the U.S., the Georgia-specific data privacy laws, and U.S. data privacy laws like the Federal Trade Commission Act, Children's Online Privacy Protection Act, and Fair Credit Reporting Act.

As shown in Part One of this overview (CRi 2018, p. 97 para. 246 and p. 116), not all EU Member States had adjusted their domestic data privacy law to the GDPR. This Part Two presents the national data privacy laws of the EU Member States which have introduced specific domestic laws supplementing GDPR during the third quarter of 2018. Also for these "late-comer" EU Member States the GDPR granted the option not only to maintain or introduce national provisions to further specify the application of GDPR in specific areas but also to modify certain rules of the GDPR itself. The article provides an overview of how these "late-comer" EU Member States have adjusted their domestic data privacy laws in the following core areas of the new EU privacy law regime: (1) domestic legislation; (2) definitions; (3) relevant authority; (4) registration requirements; (5) data protection officers (DPO); (6) collection and processing; (7) data subject rights; (8) data transfer to third counties; (9) security of personal data; (10) data breach notification; (11) enforcement; (12) data processing in employment context; (13) provisions relating to specific processing situations (chapter 9 GDPR); (14) electronic marketing; (15) online privacy; (16) other notable domestic regulations. Finally, the article presents the updated list of EU Member States not having yet implemented domestic data privacy laws. Although the list indicates the current status of the domestic legislative process for each of these EU Member States, it appears safe to say that 2018 will not see these national data privacy laws adjusted to GDPR. [ABSTRACT FROM AUTHOR]

The article deals with the application of privacy policies in California in the use of social media phone applications. It highlights the effect of the state's Online Privacy Protection Act of 2003 (CalOPPA) and its amendment for higher consumer protections. The creation of the burden of disclosure on app developers by privacy policies is discussed, as well as the regulation of mobile apps by the U.S. Federal Communications Commission (FCC).

Copyright of Policy & Internet is the property of Wiley-Blackwell and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

U.S. technology companies face growing uncertainty over whether and how they can be compelled to turn foreign-stored user content over to law enforcement officials. In July 2016, the Second Circuit ruled that the government could not require Microsoft to produce user content stored on its server in Ireland because the execution of the government's warrant constituted an impermissible extraterritorial application of the Stored Communications Act (SCA). But after the Second Circuit declined to rehear Microsoft Corp. v. United States, (formally titled In the Matter of a Warrant to Search a Certain EMail Account Controlled and Maintained by Microsoft Corporation, also known as the "Microsoft Ireland" case) en banc in January 2017, the Supreme Court granted the DOJ's petition for certiorari and heard oral argument on the case in February 2018. Throughout this litigation, other courts have issued orders compelling Google to produce foreign-stored data requested by SCA warrants. Two fundamental questions have divided these courts: (1) whether the physical location of the data at the time it is accessed should determine whether it is within the reach of the SCA, and (2) whether other countries' data privacy laws and search-and-seizure protections apply. This Article argues that basing government jurisdiction over data on the data's physical location threatens user privacy. It also creates unworkable and unpredictable results for technology companies by failing to account for the significant differences in how they divide, store, and transmit their users' data around the world. In the context of digital searches, the data location test has two potential effects. First, it will create bottlenecks in the already-burdensome mutual legal assistance system, hindering intergovernmental cooperation on law enforcement investigations. Second, it may embolden foreign governments to circumvent the system by adopting similar, or even more extreme, positions on jurisdiction over data, such as data localization and mandatory encryption backdoor laws. These policies have dangerous consequences for privacy, free expression, and innovation around the world. While some have written about the data location test in Microsoft Ireland in the abstract, this Article takes a step further and considers its role in the rulings conflicting with Microsoft Ireland that have been issued by federal judges over the past two years. It also evaluates several recent legislative and non-legislative proposals to solve the problems arising from the data location test. In particular, this Article highlights the pressing need for Congress to reform the Stored Communications Act, incorporating an alternative test for jurisdiction over user data and provisions that would clarify companies' data disclosure obligations under conflicting legal regimes. Finally, while much of the literature on this topic focuses solely on legislative proposals rather than the real-world impact of the uncertainty creating a need for statutory reform, this Article focuses on what companies should do while they await a resolution from Congress or the Supreme Court. To that end, this Article offers some practical recommendations for how companies can navigate the issues arising from the data location test, particularly as they make decisions about their global operations and data storage architecture. [ABSTRACT FROM AUTHOR]

The article focuses on well-established rights and powers of the U.S. Federal Trade Commission (FTC) in performing the duties of the federal government's privacy watchdog. It informs on regulation of internet privacy in light of the immense power wielded by court case such as FTC v. AT&T court case. It also informs on regulatory gap established by the Ninth Circuit's decision if the decision stands and the Supreme Court does not take up the case.

The article highlights challenges and limitations related to current privacy and data protection rights in the U.S., as of January, 2018. Topics discussed include various conceptions of domination; concerns about surveillance, the collection of information, and power; and approaches made for encoding obscurity into law and the design of technological artifacts.

Online shops could offer each website customer a different price. Such personalized pricing can lead to advanced forms of price discrimination based on individual characteristics of consumers, which may be provided, obtained, or assumed. An online shop can recognize customers, for instance through cookies, and categorize them as price-sensitive or price-insensitive. Subsequently, it can charge (presumed) price-insensitive people higher prices. This paper explores personalized pricing from a legal and an economic perspective. From an economic perspective, there are valid arguments in favour of price discrimination, but its effect on total consumer welfare is ambiguous. Irrespectively, many people regard personalized pricing as unfair or manipulative. The paper analyses how this dislike of personalized pricing may be linked to economic analysis and to other norms or values. Next, the paper examines whether European data protection law applies to personalized pricing. Data protection law applies if personal data are processed, and this paper argues that that is generally the case when prices are personalized. Data protection law requires companies to be transparent about the purpose of personal data processing, which implies that they must inform customers if they personalize prices. Subsequently, consumers have to give consent. If enforced, data protection law could thereby play a significant role in mitigating any adverse effects of personalized pricing. It could help to unearth how prevalent personalized pricing is and how people respond to transparency about it. [ABSTRACT FROM AUTHOR]

Advocates of digital privacy law believe it is necessary to correct failures in the market for digital privacy. Though legislators allegedly craft digital privacy regulation to protect consumers, some advocates have understated the dangers that digital privacy law may engender. This paper provides evidence for Kirzner's 'perils of regulation' in the digital privacy arena. The regulatory process fails to simulate the market process, stifles entrepreneurial discovery, and creates opportunities for superfluous discovery. My research suggests that policy-makers should consider a more holistic accounting of the costs before imposing additional digital privacy regulation. [ABSTRACT FROM AUTHOR]

The concept of Privacy by Design is rooted in systems engineering. Yet, it is the legal framework of global privacy that gives new color to this concept as applied to Big Data. Increasingly, the long arm of the law is reaching into Big Data, but it is not simply by matter of regulatory enforcement or civil legal developments that Privacy by Design (PbD) is being thrust into the spotlight once more. Given that Big Data is considered miniscule in contrast to future data environments, 1 PbD is simply the right thing to do. This paper aims to explore the origin of PbD, the current and future state of Big Data and regulatory enforcement, and the methodology of PbD applied to Big Data. As a cornerstone of organizational culture, PbD is a concept that allows organizations of any size to embrace the privacy interests of the data they collect, store, and use at the forefront of their approach. [ABSTRACT FROM AUTHOR]

Social media platforms aggregate large amounts of personal information as "social data" that can be easily downloaded as a complete archive. Litigants in civil cases increasingly seek out broad access to social data during the discovery process, often with few limits on the scope of such discovery. But unfettered access to social data implicates unique privacy concerns-concerns that should help define the proper scope of discovery. The Federal Rules of Civil Procedure, as amended in 2015, already contain the tools for crafting meaningful limits on intrusive social data discovery. In particular, the proportionality test under Rule 26 weighs the burdens of discovery against its benefits, creating important boundaries on discovery's scope. Privacy burdens should be part of the proportionality analysis. By considering the privacy implications of social data discovery, courts can fashion fair and meaningful limits on the scope of social data discovery. [ABSTRACT FROM AUTHOR]

Digital giants, enabled by America's courts, Congress, and the Federal Trade Commission, devise click-through, clickwrap, browsewrap, "I Agree" waivers, and other legal fictions that purport to evidence user "consent" to consumer privacy erosions. It is no longer enough to justify privacy invasions as technologically inevitable or as essential to the American economy. As forced consent is no consent at all, privacy policies must advance with the technology. This article discusses adhesion waivers, the potential for FTC corrective action, and a comparison to privacy policies of the European Union. [ABSTRACT FROM AUTHOR]

Privacy on the Internet is a multi-faceted issue that requires attention on the user's part, both to protect information from third-party data collection and to manage personal impressions across a variety of contexts and relationships (Ellison, et al, 2011). This study investigated the notion of online anonymity, as a privacy issue, among young Internet users in Nigeria. Situated within the framework of the deindividuation, uses and gratifications, and technological determinism theories, the research was designed as a survey. A sample of 400 respondents was selected from the study population (which was the undergraduate students of Nnamdi Azikiwe University, Awka, Anambra State, in South-East Nigeria) and a structured questionnaire employed as the data collection instrument. Findings showed that online anonymity is common among a significant part of the users; and that they utilise online anonymity mainly for the purposes of protecting their privacy, shielding themselves against fraud and other Internet harms and abuses, and for fun. Similarly, it was found that while the youths perceive online anonymity as socially beneficial, they at the same time view it as potentially destructive. The study also discovered that anonymity has not had significant impact on the Internet use habit of the respondents. This means that it is not a motivating factor that draws them to the Internet, and that it has neither made them feel free to communicate nor lured majority of them towards communications that are ethically and legally undesirable. [ABSTRACT FROM AUTHOR]

The paper delves into the intricacies of communication via social media platforms. The manner in which mediation on social media has come to influence norms of interpersonal communication is discussed in detail. How the relationships and their parameters have come to get transformed in the modern age of social media is explored. Moreover, the ethical concerns that problematize the domain of communication on social media are explicated in relation to interpersonal dynamics on social media. The paper also explores the issue of privacy that comes across to be a paradoxical thing on the platform of mediation. As such, the ethical parameters that govern interpersonal communication on the present day have come to be more complicated to the degree of not being comprehensible to the common people in general. Apart from this, the social ill of cyber-bullying is also explored in the course of the paper as it further complicates interpersonal dynamics leaving a lasting impression on the minds of people who are victimized. The ethics of communication thereby seem to have changed drastically in the age of social media and internet mediated communication. [ABSTRACT FROM AUTHOR]

This paper investigates the digital privacy provisions in the island of Jersey. This is mainly done by examining the two key pieces of legislation with which any workplace must comply with. Those legislations are: The Employment (Jersey) Law 2003, and the Data Protection (Jersey) Law 2005. Neither law has digital privacy provisions per se, but these are the two prevalent pieces of legislation governing employer-employee relations in the island of Jersey at present. The study relates the local legislation in the island of Jersey to its UK and European counterparts identifying the missing parts. To investigate how much compliance to those legislations in the island's workplace, a typical workplace of Lysaght's, the current employer for the second author, is chosen as a case study. The study highlights the areas of concerns and provides specific recommendations for the employer. This work can be used as the basis for steering the future judicial review of this area, to ensure the island of Jersey remains in compliance with its peers both domestically and internationally. [ABSTRACT FROM AUTHOR]

The article reports on the decision of the U.S. and Canadian regulators to increase the spectre of privacy law infringements by devices using the Internet of Things (IoT Devices). The U.S. Federal Trade Commission released a report which outlines recommended steps for businesses to take to enhance and protect the privacy and security of consumer. The Office of the Privacy Commissioner of Canada released two reports that addressed privacy issues of IoT.

Privacy policies are supposed to provide transparency about a service's data practices and help consumers make informed choices about which services to entrust with their personal information. In practice, those privacy policies are typically long and complex documents that are largely ignored by consumers. Even for regulators and data protection authorities privacy policies are difficult to assess at scale. Crowdsourcing offers the potential to scale the analysis of privacy policies with microtasks, for instance by assessing how specific data practices are addressed in privacy policies or extracting information about data practices of interest, which can then facilitate further analysis or be provided to users in more effective notice formats. Crowdsourcing the analysis of complex privacy policy documents to non-expert crowdworkers poses particular challenges. We discuss best practices, lessons learned and research challenges for crowdsourcing privacy policy analysis. [ABSTRACT FROM AUTHOR]

The article discusses the need for protection of employees' online information in order to avoid employers rejecting job applications courtesy emplopyees' specific online activities , and explains the laws committed towards online privacy.

The article explores developments in cybersecurity in the U.S. driven by the rise of the Internet and the need for free flow of information. The security regulations' evolution is examined through four periods starting with pre-9/11 terrorism and through the cyber era. It looks at executive orders regarding cybersecurity as well as offers information on several legislation on cybersecurity pending in the 114th Congress.

The article discusses the lack of a coordinated network of laws that promote cybersecurity and prevent the occurrence of data breaches in the U.S. A definition of cybersecurity from a legal standpoint is given, along with its distinction from concepts such as privacy and data security. It looks at state and federal privacy laws and data security laws that are linked with cybersecurity as well as suggests a unity framework for adaptable cybersecurity laws and policies.

The article examines the laws related to privacy protection in New Zealand in relation to the media and discusses several court cases that shaped the laws in the country such as "C v Holland" and "Hosking v Ranting."

The article examines the laws related to intellectual property protection and copyrights of digital materials in Australia; reports the enactment of Copyright Act 1968 in the country; and mentions the laws aimed to prevent online privacy.

Modern society is driven by data. Data storage is practically unlimited with today's technology, and analytical tools make it easy to find patterns and make predictions in a way that is very useful for private businesses and governments. These uses of digital data can raise considerable privacy issues that are of great concern to consumers. In this Article, we present and analyze the results of an extensive survey that we conducted to explore what people know, what people do, and what people want when it comes to privacy online. Our survey is the first comprehensive examination of the intersection of knowledge and opinions on topics including online privacy, law, and the data practices of both the private sector and the government. Our survey results indicate that consumers often want more options than the market gives them. Over 80% of our survey participants, for example, indicated that on some occasion they have submitted information online when they wished that they did not have to do so. One of the possible reasons why consumers still participate in these markets is that they do not have any meaningful alternatives. The private sector currently has very little incentive to provide these alternatives because consumers have been responding to unattractive business practices with complacency. Responses to our survey also indicate a low level of trust of the government as a data collector and data keeper. Our results indicate that significant changes are needed to increase consumer engagement in the online marketplace and improve trust between the government and its citizens. These improvements should begin by empowering users and giving them more control over their digital data, and we present ambitious proposals to this end. The long-term solution that we propose would involve an overhaul of current data privacy laws and the creation of a centralized profile repository that would serve a purpose similar to credit reporting bureaus. Through this repository, consumers could view and challenge most information that private businesses and the government hold about them. Dramatic changes are necessary in order to ensure that consumers can have empowering and engaging experiences in today's world oj digital data. [ABSTRACT FROM AUTHOR]

In March 2015, the Federal Communications Commission reclassi-fied broadband Internet access service providers as "common carriers" subject to obligations under Title II of the Communications Act. One such obligation is to comply with the Act's section 222 privacy provisions. As a result of reclassification, the Federal Communications Commission claims privacy enforcement jurisdiction over a broad swath of companies that formerly fell within the Federal Trade Commission's regulatory reach. The Federal Trade Commission and industry players have been outwardly critical of this effect. This Note explores the resulting tension between the two agencies and proposes potential resolutions for it. [ABSTRACT FROM AUTHOR]

‘The Digital Citizen’ has become a buzzword in recent years as part of the social and economic agendas of many countries and as a key theme in the strategy for Europe 2020. In 2014, the Vice-President of the European Commission and Commissioner for the Digital Agenda, Neelie Kroes, described its emergence as “people with greater access to information, people empowered to shape the world around them. More able to both learn: and participate”. 1 Yet, while the benefits of this vision are clear, harnessing the opportunities on offer requires confronting significant challenges. In seeking to explore what this empowering concept means for law and policy-makers today, this Seminar is intended to encourage reflection upon how increasing digitisation and hyper-connectivity affects our day-to-day interactions with those in power, as well as the security and privacy issues arising from them. For example, in many countries the development of new forms of digital identity management enables citizens to assert their identity electronically in order to access public services (such as online access to their medical data). However, these can only work optimally when supported by citizen-centric policy and legal frameworks that are technology-neutral, trust enhancing and mutually recognised across borders. New data-driven and virtual relationships with governments also necessitate a reconsideration of the rights that digital citizen deserve. On the one hand, the ease with which increasing amounts of accessible personal data can be collected – overtly or covertly – and analysed by states about their citizens' raises concerns about lost privacy controls and substantial power imbalances (such as regarding storage and access rights to such data). On the other hand, massive improvements in accessing information permit opportunities for greater engagement with government by individuals, yet assume the rollout of better and faster internet connectivity for all citizens to participate. In turn, social media has demonstrated how ICT can facilitate collective citizen activism to pressure for societal change, alongside the power of sousveillance to act as a countervailing force to pervasive state monitoring. Also ripe for discussion is the notion of reciprocal responsibilities between citizens and governments. In the physical space, for example, concerns are mounting over the implications of the advent of cheap wearable computers and drones. In the virtual domain, the borderless nature of the online world and its distributed control has connotations for a wider concept of networked citizenship with attendant rights. This led the creator of the Web – Sir Tim Berners-Lee – to call for a Bill of Rights (a ‘Magna Carta for the Web’) in 2014, the Web's 25th birthday, to protect its users. Citizen rights that already exist relevant to the online environment are scattered across various laws and are not always easy to understand. The roles of transnational institutions in fostering closer international cooperation on ICT policy, as well as strengthening confidence in privacy, consumer and data protection rights online, are also topics for discussion in this respect. Questions for discussion include: What does digital citizenship mean today? What rights, obligations and responsibilities should be associated with digital citizenship? What types of legal solutions are fit for purpose to protect digital citizenship interests? What should be the role of public sectors in e-identity assurance schemes, such as regarding liability? Should e-identity management be regulated? How does digital citizenship relate to novel rights, such as a right to public-sector data and a right to be forgotten online, and how might these rights be enforced effectively? To what extent can law and policy support increase transparency and trust by citizens in the actions of their governments? How can privacy and security be guaranteed to citizens where automated technologies affect their rights and civil liberties? How are biometrics and location-tracking devices used by states in body surveillance changing the digital citizenship landscape? How can individuals be more empowered to control their personal data held by governments and give informed consent to its use? What are the global drivers of digital citizenship policies and international cooperation in rule making and standard setting, especially in relation to emerging sensor-embedded technologies that will change the lives of citizens dramatically in the future? [ABSTRACT FROM AUTHOR]

According to both whistle blowers and public reports, some commercial and governmental practices concerning personal data do not even appear to notice the law as a regulatory force. We are not satisfied by what mainstream legal scholarship has on offer in this context. Positivists consider the issue outside their domain. Realists (including their critical branch) focus on the behavior of legal institutions, ignoring many of the diverse institutions that have regulatory force. We need an additional, complementary perspective to help us, legal scholars, earn and hold serious positions in the diverse disciplinary teams that we need to participate in, in order to adequately investigate (and inform on) persistent problems concerning personal-data protection as faced by legislators. In this article we investigate whether the subject matter of data protection law, identified as Personal Data Community (hereinafter PDC), can be treated as a complex adaptive system (hereinafter CAS). This proposition is premised on the argument that the PDC exhibits key traits of CAS, including systemic, dynamic and complex characteristics. And we further show how complexity theory can help legal scholarship (without losing its identity) to join and add value to diverse disciplinary research and advisory teams. In this article, we aim for a stepping-stone (establishing that data protection law addresses a complex adaptive system with all of its corollaries), rather than for final solutions. [ABSTRACT FROM AUTHOR]

This column provides a country by country analysis of the latest legal developments, cases and issues relevant to the IT, media and telecommunications' industries in key jurisdictions across the Asia Pacific region. The articles appearing in this column are intended to serve as ‘alerts’ and are not submitted as detailed analyses of cases or legal developments. [ABSTRACT FROM AUTHOR]

The aim of this article 1 is to make suggestions that could empower different socio-political groups to question surveillance. It does so by formulating sets of questions that different stakeholders can ask of themselves, of the private sector and of government, including intelligence agencies. It is divided into three main parts. The first part provides some background on resilience in surveillance societies. It defines the terms and identifies features of resilience and today's surveillance society. The second part lays out a set of questions addressed to each of the stakeholder groups. The questions are intended to promote consideration of a proposed or existing surveillance system, technology, practice or other initiative in terms of the necessity and proportionality of the system, and of whether stakeholders are being consulted. The third part offers a list of measures that can be taken to increase resilience in a surveillance society, to restrict the scope of surveillance systems to what can be legitimately justified, and to minimise the impacts of surveillance systems on the individual, groups and society. [ABSTRACT FROM AUTHOR]

Increasingly, data protection laws and the concept of privacy are subjected to manifold challenges created through advancing new technologies such as Big Data, digital identity, biometrics and social media sites. Such technological shifts, although being immensely beneficial to society at large, create problems for the protection of an individual's privacy. This article addresses the arising issues and suggests innovative technological solutions for minimizing privacy infringements and negative impacts on the private sphere of individuals. [ABSTRACT FROM AUTHOR]

From the early days of the information economy, personal data has been its most valuable asset. Despite data protection laws and an acknowledged right to privacy, trading personal information has become a business equated with “trading oil”. Most of this business is done without the knowledge and active informed consent of the people. But as data breaches and abuses are made public through the media, consumers react. They become irritated about companies' data handling practices, lose trust, exercise political pressure and start to protect their privacy with the help of technical tools. As a result, companies' Internet business models that are based on personal data are unsettled. An open conflict is arising between business demands for data and a desire for privacy. As of 2015 no true answer is in sight of how to resolve this conflict. Technologists, economists and regulators are struggling to develop technical solutions and policies that meet businesses' demand for more data while still maintaining privacy. Yet, most of the proposed solutions fail to account for market complexity and provide no pathway to technological and legal implementation. They lack a bigger vision for data use and privacy. To break this vicious cycle, we propose and test such a vision of a personal information market with privacy. We accumulate technical and legal measures that have been proposed by technical and legal scholars over the past two decades. And out of this existing knowledge, we compose something new: a four-space market model for personal data. [ABSTRACT FROM AUTHOR]

A strong information protection culture is required in organisations where the confidentiality, sensitivity and privacy of information are understood and handled accordingly. This is necessary to reduce the risk of human behaviour to the protection of information as well as to uphold privacy requirements from a regulatory perspective. This research explores the concept of an information security culture and how information privacy can be incorporated to define an information protection culture. Next, the researchers explain information attributes relating to information security and information privacy to derive information attributes that can be considered when referring to an information protection culture. The information attributes are used to evaluate an existing information security culture assessment instrument that can potentially be used to assess an information protection culture. The research reveals that the information security culture assessment (ISCA) instrument can be used, but that it can be further improved by incorporating additional privacy concepts. An information protection culture assessment (IPCA) is conducted as part of a case study in an organisation. This allowed for a factor and reliability analysis to validate the IPCA. The analysis indicated that the IPCA is valid and reliable when grouping the items into the newly identified factors, but can further be enhanced by aligning it to information privacy attributes. [ABSTRACT FROM AUTHOR]

This is the latest edition of the DLA Piper column on developments in EU law relating to IP, IT and telecommunications. This news article summarises recent developments that are considered important for practitioners, students and academics in a wide range of information technology, e-commerce, telecommunications and intellectual property areas. It cannot be exhaustive but intends to address the important points. This is a hard copy reference guide, but links to outside websites are included where possible. No responsibility is assumed for the accuracy of information contained in these links. [ABSTRACT FROM AUTHOR]

This article discusses the nature and functions of digital identity or e-ID as it is sometimes known, as an emergent legal concept and explores whether personality rights which exist under French law are conceptually suitable as a model for recognising and protecting an individual's rights in his/her assigned digital identity. Digital identity is an identity which is composed of information stored and transmitted in digital form. As governments around the world move services and transactions online, one digital identity is being embedded in processes fundamental to economic and social order. A natural person must use this government – assigned digital identity to access these services and to transact under the government e-ID scheme. As borne out by international experience, the e-ID scheme is likely to set the standard so that the same digital identity is used for private sector dealings. This means that, in effect, this digital identity becomes the primary means by which an individual transacts in the digital age. As digital identity becomes increasingly significant from both commercial and legal perspectives, the law is searching for ways to adequately protect this new concept and the individual's interests in it. The law generally, and especially the common law, currently strains to find an effective way to recognise reciprocal rights and duties in relation to digital identity. Considering the legal and commercial significance of digital identity and the impact of its compromise on an individual, the two main areas of law, privacy and the criminal law, do not provide adequate recognition and protection of an individual's rights and interests. By contrast, civil law personality rights, such as those recognised in France and in other jurisdictions which have inherited French legal concepts, fit better with the nature and functions of digital identity. These rights can readily apply to recognise and protect an individual's rights and interests in his/her assigned digital identity under a government e-ID scheme. This article examines these French extrapatrimonial and patrimonial rights and discusses their conceptual application to digital identity. The discussion shows that each class of right applies to digital identity but each protects in different ways. The argument presented is that, in combination, these personality rights can protect the interests of an individual in his/her assigned digital identity under a government e-ID scheme. That protection is important considering the nature and functions of this digital identity and the harm caused to an individual by its compromise. Conceptually, these civil law personality rights provide a sounder basis for protection than the current reliance on privacy and the criminal law. The nature of these rights and their historical international influence makes them a workable model for both civil and common law legal systems. [ABSTRACT FROM AUTHOR]

The article focuses on the data privacy laws for the business's objectives. Topics discussed include data privacy laws in India and Brazil for the prevention of data breaching, regulations proposed in each country since the U.S. National Security Agency (NSA) revelations and effects of the laws on individuals and businesses. It also mentions a solution to the disjoined Internet privacy laws on an international scale.

This Article considers how Fourth Amendment law should adapt to the global nature of Internet surveillance. It focuses on two types of problems not yet addressed by courts. First, the Supreme Court's decision in United States v. Verdugo- Urquidez prompts several puzzles about how the Fourth Amendment treats monitoring on a worldwide network where many lack Fourth Amendment rights. For example, can online contacts help create those rights? What if the government mistakenly believes that a target lacks Fourth Amendment rights? How does the law apply to monitoring of communications between those who have and those who lack Fourth Amendment rights? The second category of problems follows from different standards of reasonableness that apply outside the United States and at the international border. Does the border search exception apply to purely electronic transmission? And if reasonableness varies by location, is the relevant location the search, the seizure, or the physical person? This Article explores and answers these questions using equilibrium adjustment, a method of applying the Fourth Amendment to technological changes to maintain the preexisting balance of constitutional protection. Fourth Amendment doctrine is heavily territorial: connections to the United States impact the scope or existence of constitutional protection. This Article aims to adapt existing principles for the transition from a domestic, physical environment to a global, networked world. It concludes that courts should reject online contacts as a basis for Fourth Amendment protection; allow monitoring when the government wrongly but reasonably believes that a target lacks Fourth Amendment rights; and limit monitoring between those who have and those who lack Fourth Amendment rights. It also contends that the border search exception should not apply to electronic transmission and that reasonableness should follow the location of data seizure. Taken together, the solutions offered in this Article provide a set of Fourth Amendment rules tailored to the reality of global computer networks. [ABSTRACT FROM AUTHOR]