Search

Technology is getting increasingly complicated. If complex technologies have the potential to cause harm, people may need protection. Such legal protection is increasingly available, but it is only effective if it can also be enforced in courts. If people do not understand what is happening, for instance, with their personal data, they may not go to court at all. When people go to court, they may encounter another problem: if also courts and judges have a limited understanding of how the complex technologies work, this can affect the right to a fair trial. In this paper, it is argued that a fair trial requires that courts and judges need to have sufficient understanding of the technology in cases on which they are ruling. Since not all judges can be trained to have deep understanding of technology, other ways to address this are proposed. [ABSTRACT FROM AUTHOR]

As algorithms are increasingly enlisted to make critical determinations about human actors, the more frequently we see these algorithms appear in sensational headlines crying foul on discrimination. There is broad consensus among computer scientists working on this issue that such discrimination can be reduced by intentionally collecting and consciously using sensitive information about demographic features like sex, gender, race, religion etc. Companies implementing such algorithms might, however, be wary of allowing algorithms access to such data as they fear legal repercussions, as the promoted standard has been to omit protected attributes, otherwise dubbed "fairness through unawareness". This paper asks whether such wariness is justified in light of EU data protection and anti-discrimination laws. In order to answer this question, we introduce a specific case and analyze how EU law might apply when an algorithm accesses sensitive information to make fairer predictions. We review whether such measures constitute discrimination, and for who, arriving at different conclusions based on how we define the harm of discrimination and the groups we compare. Finding that several legal claims could arise regarding the use of sensitive information, we ultimately conclude that the proffered fairness measures would be considered a positive (or affirmative) action under EU law. As such, the appropriate use of sensitive information in order to increase the fairness of an algorithm is a positive action, and not per se prohibited by EU law. [ABSTRACT FROM AUTHOR]

It is widely recognised that the first binding legal act regarding the protection of personal data of an international nature is Convention 108, adopted on 28 January 1981. By virtue of the Convention, the Parties are required to apply in their domestic legal order the principles introduced by the Council of Europe to ensure guarantees for the fundamental human rights of all individuals with regard to the processing of personal data. This paper refers to Convention 108 as the foundation for European and international data protection laws in a number of European countries. It has influenced policies and legislation far beyond Europe’s borders. However, due to the development of ICT tools that permit establishing new data-driven business models based on data-processing systems, Convention 108 has become subject to modernisation. At the same time, intensive negotiations were conducted in the EU concerning a new data-protection package to reform the data-protection system, and many other countries around the world have introduced provisions related to the processing of personal data. This paper analyses the impact of the standards set out in Convention 108 on the decision-making process and its global dimension.

Algorithmic decision-making and other types of artificial intelligence (AI) can be used to predict who will commit crime, who will be a good employee, who will default on a loan, etc. However, algorithmic decision-making can also threaten human rights, such as the right to non-discrimination. The paper evaluates current legal protection in Europe against discriminatory algorithmic decisions. The paper shows that non-discrimination law, in particular through the concept of indirect discrimination, prohibits many types of algorithmic discrimination. Data protection law could also help to defend people against discrimination. Proper enforcement of non-discrimination law and data protection law could help to protect people. However, the paper shows that both legal instruments have severe weaknesses when applied to artificial intelligence. The paper suggests how enforcement of current rules can be improved. The paper also explores whether additional rules are needed. The paper argues for sector-specific – rather than general – rules, and outlines an approach to regulate algorithmic decision-making. [ABSTRACT FROM AUTHOR]

As data analytics become prevalent in industries in Malaysia to draw predictions about individuals' habits and behaviour, it is important that certainty exists about the legal status of predictions vis-à-vis data protection law. The predictions can be privacy-intrusive and threaten individuals' autonomy, although this may not always be so. The Malaysian Personal Data Protection Act 2010 is silent on the legal status of predictions. This paper examines whether the Malaysian Parliament should extend the Act to provide control to individuals over predictions about themselves. In doing so, the paper explores the position in the EU, Japan, Australia and the USA. The finding is that in those jurisdictions, predictions are within the remit of data protection law. It is argued that this is an over-generalisation and is inconsonant with commercial realities. The author advocates that a different approach be adopted to achieve a balance between individuals' interest to control their data and commercial needs to use predictions without undue hindrance. [ABSTRACT FROM AUTHOR]

On information markets, we can identify different relations between sellers and their customers, with some users paying with money, some paying with attention, and others paying with their personal data. For the description of these different market relations, this article introduces the notion of arity into the scientific discussion. On unary information markets, customers pay with their money; examples include commercial information suppliers. Binary information markets are characterized by one market side paying with attention (e.g., on the search engine Google) or with personal data (e.g., on most social media services) and the other market side (mainly advertisers) paying with money. Our example of a ternary market is a social media market with the additional market side of influencers. If customers buy on unary markets, they know what to pay (in terms of money). If they pay with attention or with their personal data, they do not know what they have to pay exactly in the end. On n-ary markets (n greater than 1), laws should regulate company's abuse of money and which is new abuse of data streams with the aid of competition (or anti-trust) laws, and by modified data protection laws, which are guided by fair use of end users' attention and data. [ABSTRACT FROM AUTHOR]

In this academic survey a group of Constitutional Law Professors answer some questions about personal data protection and its challenges in the digital society, the recognition of a fundamental right of data protection and its possibilities against the transnational threats, the way of recognition of that right in a national and supranational process, the role played by the legislators and the judges, and about the data protection agencies and its functions. [ABSTRACT FROM AUTHOR]

Copyright of Istanbul Commerce University Journal of Social Sciences / İstanbul Ticaret Üniversitesi Sosyal Bilimler Dergisi is the property of Istanbul Commerce University Journal of Social Sciences and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Background: The existing literature has not examined how Chinese direct-to-consumer (DTC) genetic testing providers navigate the issues of informed consent, privacy, and data protection associated with testing services. This research aims to explore these questions by examining the relevant documents and messages published on websites of the Chinese DTC genetic test providers. Methods: Using Baidu.com, the most popular Chinese search engine, we compiled the websites of providers who offer genetic testing services and analyzed available documents related to informed consent, the terms of services, and the privacy policy. The analyses were guided by the following inquiries as they applied to each DTC provider: the methods available for purchasing testing products; the methods providers used to obtain informed consent; privacy issues and measures for protecting consumers' health information; the policy for third-party data sharing; consumers right to their data; and the liabilities in the event of a data breach. Results: 68.7% of providers offer multiple channels for purchasing genetic testing products, and that social media has become a popular platform to promote testing services. Informed consent forms are not available on 94% of providers' websites and a privacy policy is only offered by 45.8% of DTC genetic testing providers. Thirty-nine providers stated that they used measures to protect consumers' information, of which, 29 providers have distinguished consumers' general personal information from their genetic information. In 33.7% of the cases examined, providers stated that with consumers' explicit permission, they could reuse and share the clients' information for non-commercial purposes. Twenty-three providers granted consumer rights to their health information, with the most frequently mentioned right being the consumers' right to decide how their data can be used by providers. Lastly, 21.7% of providers clearly stated their liabilities in the event of a data breach, placing more emphasis on the providers' exemption from any liability. Conclusions: Currently, the Chinese DTC genetic testing business is running in a regulatory vacuum, governed by self-regulation. The government should develop a comprehensive legal framework to regulate DTC genetic testing offerings. Regulatory improvements should be made based on periodical reviews of the supervisory strategy to meet the rapid development of the DTC genetic testing industry. [ABSTRACT FROM AUTHOR]

The paper focuses on how computational models and methods impact on current legal systems, and in particular, on criminal justice. While the discussion about the suitabilty of the exploitation of learning machines and Artificial Intelligence (AI) either as surveillance means and human substitutes in the judicial decision-making process is arising, the authors reflect upon the risk of using AI and algorithm-based evidence in criminal proceedings. The claim of the paper is twofold: on the one hand, we should reinterpret todays legal frameworks, e. g. the European Convention of Human Rights, shifting the attention from possible violations of the right to privacy to potential infringements on a basic fair trial feature, the Equality of Arms. On the other hand, we should aknowledge that main legal issues, triggered by the breathtaking advancements in AI, can properly be addressed mainly through technical solutions (e. g. methods for assessing the completeness and correctness of digital evidence related to mobile devices and conversations). No legal theory, which overlooks the crossover of juridical and computational expertise, will survive the present time. [ABSTRACT FROM AUTHOR]

Broad consent – the act of gaining one consent for multiple potential future research projects – sits at the core of much current genomic research practice. Since the 25th May 2018, the General Data Protection Regulation (GDPR) has applied as valid law concerning genomic research in the EU and now occupies a dominant position in the legal landscape. Yet, the position of the GDPR concerning broad consent has recently been cause for concern in the genomic research community. Whilst the text of the GDPR apparently supports the practice, recent jurisprudence contains language which is decidedly less positive. This article takes an in-depth look at the situation concerning broad consent under the GDPR and – despite the understandable concern flowing from recent jurisprudence – offers a positive outlook. This positive outlook is argued from three perspectives, each of which is significant in defining the current, and ongoing, legitimacy and utility of broad consent under the GDPR: the principled, the legal technical, and the practical. [ABSTRACT FROM AUTHOR]

The reason on writing this paper is based on the fact that nowadays civil and administrative sanctions and fines have become huge from a financial standing point, making a significant issue on the matters of the constitutionality – the right to property. ECHR and the European Court of Justice also have talking points on this. The Romanian Courts and mostly judges form second tier courts such as Tribunals or Courts of Appeal have become more aware of the fines they are presented with to be cancelled or at least diminished and regard some of them to be exaggerated. The research has been done on the basis on European and national Romanian law and, also on the basis of cases presented in front of the courts and their outcome. The fines in competition law can be negotiated but are a percentage of your annual income, the ones regarding labor law for working without a contract are 10.000 lei per person (about 2100 euros) and the ones in data protection law are also based on a fix sum and a percentage. Thus the results with which we came up are amazing, regarding that some cases have been won, but most of the fines and sanctions remained in place, some companies even agreeing to pay in advance or asking for a payment plan without going to trial. In other cases we noticed that Romanian national law is more rigorous and at some times even more severe than that of other EU member states. In conclusion, there should be a more strict revision on fines and sanctions throughout the whole European legal system and to ensure a more transparent and equitable framework in which companies and even natural persons can be aware of the fines and sanctions and if they are not contrary to Constitutional and European Law. [ABSTRACT FROM AUTHOR]

The article focuses on advertising for online gambling products on social media platforms and examines advertising practices from the viewpoint of consumer fairness. It shows how online advertising is fundamentally different from traditional advertising in print media, offline media sites (such as billboards) and broadcasting. The growth of social media usage has created an opportunity for online advertising to exploit ways of advertising which are only beginning to be understood fully and receive regulatory attention, and which, therefore, may exploit current regulatory loopholes. In this article, we identify two major issues in respect of online advertising of online gambling: first the potential for unethical placing of gambling advertising targeted at vulnerable users, and secondly the opaque use of commercial advertising in user-generated content on social media platforms. Having identified these two problems of gambling advertising, we take stock of how the existing regulatory structures deal with gambling advertising online, with a view to making recommendations on how to tackle these problems. We argue that data protection law and gambling regulation have not yet satisfactorily addressed these issues and that a much more radical approach is needed, as set out in the article. [ABSTRACT FROM AUTHOR]

This paper explains how the concept of personal data should be delimited. Certainty on this matter is crucial, as it determines the material scope of the data protection obligations. The primary boundary delimiting the scope of personal data is the requirement that personal data 'relate to' an individual. The courts of the UK and the EU have sought to delineate this boundary, but there are serious difficulties in the present approaches that have emerged thus far. Two possible ways forward are suggested, taking into account the implications of the direct application of the GDPR in the UK. [ABSTRACT FROM AUTHOR]

Copyright of Revista Română de Drept European is the property of Wolters Kluwer Romania and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

This article analyses the rules on regulatory competence, jurisdiction and applicable in European Union (EU) data protection law in the light of recent case law of the Court of Justice of the EU and national courts and in the light of the changes that were introduced by the General Data Protection Regulation (GDPR). It finds that, in the regulatory context, the rules on applicable law effectively become rules of regulatory competence (jurisdiction in the narrower sense) and that a crucial distinction should be made between internal conflicts of law (between the Member States) and external conflicts of law (Member States vs third countries). It argues that Member States should trust each other sufficiently to apply the law of the main establishment for internal conflicts but welcomes the wide interpretation of the establishment rules in Google Spain. It argues that this wide interpretation should apply to external conflicts of law only. Finally, the article finds that enforcement cooperation has been improved through the detailed provisions in the GDPR (compared to the Data Protection Directive) but that an opportunity has been missed in not creating a single EU enforcement authority. This is unfortunate since the coordination procedure established in the GDPR is likely to be cumbersome and fraught with political wrangling. [ABSTRACT FROM AUTHOR]

This article asks the extent to which the concept of the ‘right to be forgotten’ has been received by Japanese law – or whether, to the contrary, Japan is challenging the EU's concept. In a 2017 judgment, the Japanese Supreme Court rejected a request for injunctive relief to delete search results from the search engine Google. The decisive argument focused on the public interest around the facts concerned: a crime committed by the applicantseveral years earlier. The court did not just award the right to freedom of expression to Google, but centred its decision on society's right to know – thereby putting society's interest before that of the individual. In the light of the pending adoption of the EU-Japan adequacy decision, this divergence from the EU concept raises doubts as to whether 'adequacy' can be achieved between legal systems founded on cultural differences. Can we still afford to base our legal regimes on different social consciousness in the era of a borderless Internet? [ABSTRACT FROM AUTHOR]

The paper focuses on concerns and legal challenges brought on by the use of algorithms. A particular class of algorithms that augment or replace analysis and decision-making by humans, i.e. data analytics and machine learning, is under scrutiny. Taking into account Balkin's work on "the laws of an algorithmic society", attention is drawn to obligations of transparency, matters of due process, and accountability. This US-centric analysis on drawbacks and loopholes of current legal systems is complemented with the analysis of norms and principles of the EU data protection law, or "GDPR". The aim is twofold. On the one hand, the intent is to shed light on some crucial differences between the US and EU law on the regulation of algorithmic operators, both public and private. Whereas, in the USA, scholars debate whether and to what extent new duties and responsibilities of algorithmic operators, e.g. information fiduciaries, have to amend the current framework of self-regulation and light government—as shown by the White House's Office of Science and Technology Policy report from November 2016—in EU law much of the new duties and responsibilities of algorithmic operators have been passed upon them as data controllers. Whether such approaches will successfully tackle the normative challenges of the algorithmic society is, on the other hand, an open issue that will likely represent the main topic of debate over the next years. Disagreement may concern: (i) the terms framing the legal question in e.g. statistical purposes of the data processing; (ii) how such terms are related to each other in legal reasoning (e.g. a right to explanation as valid law in the EU); and (iii) legal hard cases that will increasingly have to do with the principles that are at stake also but not only in data protection (e.g. informational self-determination). By entrusting such legal hard cases to algorithms, or some sort of smart artificial agent, humans still bear full responsibility for the judgment of what is socially, ethically, and legally "plain" and "hard" in social affairs. The balance between delegation of decisions to algorithms and non-delegation will be the leitmotiv of the algorithmic society. Since the devil is in the detail, the current paper is devoted to some of them. [ABSTRACT FROM AUTHOR]

Article 17 of the General Data Protection Regulation (GDPR) contains a right for the data subject to obtain the erasure of personal data. The right to erasure in the GDPR gives, however, little clear guidance on how controllers processing personal data should erase the personal data to meet the requirements set out in Article 17. Machine Learning (ML) models that have been trained on personal data are downstream derivatives of the personal data used in the training data set of the ML process. A characteristic of ML is the non-deterministic nature of the learning process. The non-deterministic nature of ML poses significant difficulties in determining whether the personal data in the training data set affects the internal weights and adjusted parameters of the ML model. As a result, invoking the right to erasure in ML and to erase personal data from a ML model is a challenging task. This paper explores the complexities of enforcing and complying with the right to erasure in a ML context. It examines how novel developments in machine unlearning methods relate to Article 17 of the GDPR. Specifically, the paper delves into the intricacies of how personal data is processed in ML models and how the right to erasure could be implemented in such models. The paper also provides insights into how newly developed machine unlearning techniques could be applied to make ML models more GDPR compliant. The research aims to provide a functional understanding and contribute to a better comprehension of the applied challenges associated with the right to erasure in ML. [ABSTRACT FROM AUTHOR]

The Czech Academy of Sciences and Czech universities are in the beginning of the implementation of the General Data Protection Regulation (GDPR). How to deal successfully with the GDPR in a specific environment that is often international, funded by many resources (a mixture of various national and international, public and private funds and companies, with their own financial and administrative rules), having their specific tasks, missions and cultures (academic freedoms, scientific excellence, competitive environment)? This article focuses on the GDPR's impact on the life of the research entities, such are research institutes and universities. The GDPR is an EU regulation that should have equal legal effect over the entire European Union; however, in certain specific parts of the GDPR specific implementing legislative measures are expected of the EU member states. Moreover, due to different history of the legislation regulating personal data protection in each EU member state, the article focuses mainly on the area of the Czech Republic. The scope of this article is limited to specific issues of scientific life (e.g. open access, open data, peer review), other general aspects of the GDPR (e.g. handling the employees' personal data, the personal data of research subjects) are not the objects of this text. [ABSTRACT FROM AUTHOR]

Copyright of Réseaux (07517971) is the property of Editions La Decouverte and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Online shops could offer each website customer a different price. Such personalized pricing can lead to advanced forms of price discrimination based on individual characteristics of consumers, which may be provided, obtained, or assumed. An online shop can recognize customers, for instance through cookies, and categorize them as price-sensitive or price-insensitive. Subsequently, it can charge (presumed) price-insensitive people higher prices. This paper explores personalized pricing from a legal and an economic perspective. From an economic perspective, there are valid arguments in favour of price discrimination, but its effect on total consumer welfare is ambiguous. Irrespectively, many people regard personalized pricing as unfair or manipulative. The paper analyses how this dislike of personalized pricing may be linked to economic analysis and to other norms or values. Next, the paper examines whether European data protection law applies to personalized pricing. Data protection law applies if personal data are processed, and this paper argues that that is generally the case when prices are personalized. Data protection law requires companies to be transparent about the purpose of personal data processing, which implies that they must inform customers if they personalize prices. Subsequently, consumers have to give consent. If enforced, data protection law could thereby play a significant role in mitigating any adverse effects of personalized pricing. It could help to unearth how prevalent personalized pricing is and how people respond to transparency about it. [ABSTRACT FROM AUTHOR]

The right to personal data protection is, without doubt, an important right in the jurisprudence of rights in the contemporary information society. It is becoming as crucial as other orthodox human rights and also attracting significant attention from academics, lawyers, human rights activists and policy makers. In spite of the growing attention data protection receives at international and regional levels, Nigeria is still lagging behind many competitor states like South Africa in establishing an effective legal framework to protect personal data. Individuals' personal data is being collected and used without any serious form of control to check against abuse. This paper reflects on opportunities, option and challenges to legal reforms on data protection in Nigeria. It contends that certain legislative and practical challenges stand in the way of an effective legal regime on personal data protection. The paper suggests appropriate legal reforms that are needed to enable prevent the increasing risks of violating the right to data protection in a country that is making rapid advances in Information and Communication Technology but hamstrung by an outdated regulatory framework. [ABSTRACT FROM AUTHOR]

Copyright of Acta Universitatis George Bacovia. Juridica is the property of George Bacovia University, Faculty of Sciences Economics, Juridical & Administrative and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)