Search

ispartof: pages:1813-1830 ispartof: PROCEEDINGS OF THE 31ST USENIX SECURITY SYMPOSIUM pages:1813-1830 ispartof: 31st USENIX Security Symposium location:MA, Boston date:10 Aug - 12 Aug 2022 status: published

Contains fulltext : 237222.pdf (Publisher’s version ) (Closed access) 13 september 2021

Contains fulltext : 233199.pdf (Publisher’s version ) (Closed access) 17 mei 2021

Contains fulltext : 230674.pdf (Publisher’s version ) (Closed access) 29 januari 2021

In the European Union, the General Data Protection Regulation (GDPR) provides comprehensive rules for the processing of personal data. In addition, the EU lawmaker intends to adopt specific rules to protect confidentiality of communications, in a separate ePrivacy Regulation. Some have argued that there is no need for such additional rules for communications confidentiality. This paper discusses the protection of the right to confidentiality of communications in Europe. We look at the right’s origins as a fundamental right to assess the rationale for protecting the right. We also analyse how the right is currently protected under the European Convention on Human Rights and under EU law. We show that the right to communications confidentiality protects three values: trust in communication services, privacy, and freedom of expression. The right aims to ensure that individuals and businesses can safely entrust communication to service providers. Initially, the right protected only postal letters, but it has gradually developed into a strong safeguard for the protection of confidentiality of communications, regardless of the technology used. Hence, the right does not merely serve individual privacy interests, but also other interests that are crucial for the functioning of our information society. We conclude that separate EU rules to protect communications confidentiality, next to the GDPR, are justified and necessary to protect trust, privacy and freedom and expression.

Contains fulltext : 226685.pdf (Publisher’s version ) (Closed access) 18 november 2020

Voor online politieke microtargeting wordt het online-gedrag van mensen in kaart gebracht en worden de verzamelde gegevens gebruikt om mensen gerichte politieke advertenties te tonen. Microtargeting is vanuit de VS komen overwaaien naar Europa en heeft voor- en nadelen voor de democratie. Microtargeting kan politieke partijen helpen om mensen effectief te bereiken en kan politieke betrokkenheid stimuleren. Maar microtargeting kan ook een bedreiging vormen voor de democratie. Zo kan een politieke partij zich verschillend voordoen aan verschillende mensen. Bovendien bedreigt het verzamelen van persoonsgegevens onze privacy. Dit artikel brengt de beloftes en bedreigingen van microtargeting voor de democratie in kaart en schetst mogelijkheden voor beleidsmakers om het gebruik van microtargeting te reguleren.

Webwinkels zijn technisch in staat om elke consument een andere prijs aan te bieden: online prijsdiscriminatie. Dit artikel bespreekt twee enquêtes over dergelijke praktijken die zijn gehouden onder de Nederlandse bevolking en onderzoekt de implicaties van de Algemene Verordening Gegevensbescherming (AVG) voor online prijsdiscriminatie.

Contains fulltext : 221082.pdf (Publisher’s version ) (Open Access)

Contains fulltext : 216859.pdf (Publisher’s version ) (Open Access) 09 mei 2019

Beleidsmakers, wetenschappers en anderen vrezen dat gepersonaliseerd nieuws kan leiden tot filter bub- bles, unieke informatieruimtes voor iedereen. Filter bubbles zouden een gevaar vormen voor onze democratie. Op basis van de politieke voorkeuren van een gebruiker kan een gepersonaliseerde nieuwssite bepaalde onderwerpen of meningen bijvoorbeeld een meer of minder prominente plek geven. Er wordt gedacht dat personalisatie tot een nieuwe vorm van verzuiling kan leiden, waarbij gebruikers van online gepersonaliseerd nieuws weinig verschillende politieke ideeën tegenkomen. In deze bijdrage bespreken we empirisch onderzoek naar de omvang en effecten van personalisatie. Hierbij onderscheiden we zelfge- selecteerde personalisatie, waarbij mensen expliciet aangeven over welke onderwerpen zij informatie willen ontvangen, en vooraf geselecteerde personalisatie, waarbij algoritmes bepalen over welke onder- werpen gebruikers informatie ontvangen. We concluderen dat er tot nu toe weinig empirisch bewijs is dat de zorgen over filter bubbles rechtvaardigt.

Singling Out People Without Using Their Names - Behavioural Targeting, Privacy, and Personal Data

Behavioural targeting, or online profiling, is at the core of many privacy problems on the Internet. Behavioural targeting involves monitoring people’s online behaviour and using the data obtained to expose people to individually targeted advertisements. In the process, firms gather information, store it, analyse it, and disclose it to other firms. Firms compile detailed profiles, based on what Internet users read, what videos they watch, what they search for, etc. People have litlle control over what happens to information concerning them. There is wide agreement that EU data protection law - and similar regimes in countries worldwide - offers insufficient protection of privacy on the Internet. This publication examines how the law could improve online privacy protection, and is among the first legal studies to discuss the implications of behavioural sciences for privacy law. A detailed analysis is presented of the problematic role of informed consent in data protection law, emphasising the tension in the law between protecting and empowering the individual. [...] Given the limited potential of informed consent as a privacy protection measure, the publication argues that policymakers can improve legal privacy protection by focusing less on empowering people and more on protecting people. Practitioners, businesspersons, policymakers, and regulators will find much here to help them develop a more cogent, socially responsible, and reasonable approach to privacy law and policy - not only in Europe but anywhere in the world."

In the YS. and M. and S. judgment, the Court of Justice of the European Union ruled on three procedures in which Dutch judges asked for clarification on the right of asylum seekers to have access to the documents regarding the decision on asylum applications. The judgment is relevant for interpreting the concept of personal data and the scope of the right of access under the Data Protection Directive, and the right to good administration in the EU Charter of Fundamental Rights. At first glance, the judgment seems disappointing from the viewpoint of individual rights. Nevertheless, in our view the judgment provides sufficient grounds for effective access rights to the minutes in future asylum cases.

Online tracking is the subject of heated debates. In Europe, policy debates focus on the e-Privacy Directive, which requires firms to obtain the consumer’s consent for the use of tracking cookies and similar technologies. A common complaint about the Directive is that clicking "I agree" to hundreds of separate cookie notices is not user-friendly. Meanwhile, there has been discussion about a Do Not Track (DNT) standard, which should enable people to express their wishes regarding tracking with a simple button in their browser. This paper outlines the requirements that are needed for DNT, or a similar system, to be able to help website publishers and other firms to comply with European privacy law. The three main points of the paper are as follows. First, a DNT system for Europe (eDNT) is possible, and the work of the W3C World Wide Web Consortium on the DNT standard was originally designed to support European compliance. Second, an eDNT standard could emerge from W3C, or from elsewhere. Third, implementers do not need to wait for a standard, and there are current DNT implementations that are almost compliant with European law. We analyse the requirements for DNT that follow from European data privacy law. We give examples of current implementations of DNT, and show that some implementations could almost be used to comply with EU law. The interdisciplinary paper is written by a European legal scholar and a US scholar of engineering and public policy.

This PhD thesis discusses how European law could improve privacy protection in the area of behavioural targeting. Behavioural targeting, also referred to as online profiling, involves monitoring people’s online behaviour, and using the collected information to show people individually targeted advertisements. To protect privacy in the area of behavioural targeting, the EU lawmaker mainly relies on the consent requirement for the use of tracking technologies in the e-Privacy Directive, and on general data protection law. With informed consent requirements, the law aims to empower people to make choices in their best interests. But behavioural studies cast doubt on the effectiveness of the empowerment approach as a privacy protection measure. Many people click "I agree" to any statement that is presented to them. Therefore, to mitigate privacy problems such as chilling effects, this study argues for a combined approach of protecting and empowering the individual. Compared to the current approach, the lawmaker should focus more on protecting people. The PhD thesis is a legal study, but it also incorporates insights from other disciplines, such as computer science, behavioural economics, and media studies. This study is among the first to discuss the implications of behavioural research for European data protection policy. The topic of whether data protection law should apply to pseudonymous data is discussed in depth. The study contains a detailed analysis of the role of informed consent in data protection law, and gives much attention to the tension between protecting and empowering the individual within data protection law.

May a company photograph the daily lives of people all over the world, store those photos, and publish them on the internet? This article assesses which obligations Google has to fulfil in order to respect the European data protection rules. The focus lies on three questions. First, which data processed for the Street View service are personal data? Second, does Google have a legitimate ground for processing personal data? Third, does Google comply with its transparency obligations and does it respect the rights of the data subjects, specifically their right to information?

Om het zoek- en klikgedrag van een internetgebruiker te monitoren plaatsen bedrijven vaak een cookie op de computer van die gebruiker. Volgens de geamendeerde e-Privacyrichtlijn mogen cookies die niet noodzakelijk zijn voor communicatie of om een aangevraagde dienst te leveren voortaan slechts worden geplaatst nadat de internetgebruiker zijn geïnformeerde toestemming heeft gegeven. Volgens de Nederlandse wetgever kan deze toestemming onder meer blijken uit de instellingen van de browser. In dit artikel wordt nagegaan in hoeverre toestemming middels browserinstellingen in de praktijk zal voldoen aan de eisen die de Dataprotectierichtlijn stelt aan ‘toestemming’: een vrije, specifieke, op informatie berustende wilsuiting. Geconcludeerd wordt dat ‘browsertoestemming’ in de praktijk waarschijnlijk niet aan deze eisen zal voldoen.

Het Wetsvoorstel Wijziging van de Telecommunicatiewet ter implementatie van de herziene telecommunicatierichtlijnen introduceert een meldplicht voor inbreuken in verband met persoonsgegevens. Aanbieders van openbare elektronische communicatiediensten moeten zulke datalekken voortaan melden aan de OPTA.

De e-Privacyrichtlijn, betreffende de verwerking van persoonsgegevens en de bescherming van de persoonlijke levenssfeer in de sector elektronische communicatie, is onlangs gewijzigd door de Richtlijn Burgerrechten. De wijzigingen worden in dit artikel benoemd en becommentarieerd. Enkele van de belangrijkste wijzigingen zijn de introductie van een opt-in-regel voor cookies, een meldplicht voor datalekken, de mogelijkheid voor providers om spammers in rechte aan te spreken en een artikel betreffende de implementatie en publiekrechtelijke handhaving van de e-Privacyrichtlijn.