Big data analysis systems in IoE environments for managing privacy and data protection: pseudonymity, de-anonymization and the right to be forgotten

The thesis represents the conclusive outcome of the European Joint Doctorate programmein Law, Science & Technology funded by the European Commission with the instrument Marie Skłodowska-Curie Innovative Training Networks actions inside of the H2020, grantagreement n. 814177. The tension between data protection and privacy from one side, and the need of granting further uses of processed personal datails is investigated, drawing the lines of the technological development of the de-anonymization/re-identification risk with an explorative survey. After acknowledging its span, it is questioned whether a certain degree of anonymity can still be granted focusing on a double perspective: an objective and a subjective perspective. The objective perspective focuses on the data processing models per se, while the subjective perspective investigates whether the distribution of roles and responsibilities among stakeholders can ensure data anonymity.

Security and privacy of resource constrained devices

The thesis aims to present a comprehensive and holistic overview on cybersecurity and privacy & data protection aspects related to IoT resource-constrained devices. Chapter 1 introduces the current technical landscape by providing a working definition and architecture taxonomy of ‘Internet of Things’ and ‘resource-constrained devices’, coupled with a threat landscape where each specific attack is linked to a layer of the taxonomy. Chapter 2 lays down the theoretical foundations for an interdisciplinary approach and a unified, holistic vision of cybersecurity, safety and privacy justified by the ‘IoT revolution’ through the so-called infraethical perspective. Chapter 3 investigates whether and to what extent the fast-evolving European cybersecurity regulatory framework addresses the security challenges brought about by the IoT by allocating legal responsibilities to the right parties. Chapters 4 and 5 focus, on the other hand, on ‘privacy’ understood by proxy as to include EU data protection. In particular, Chapter 4 addresses three legal challenges brought about by the ubiquitous IoT data and metadata processing to EU privacy and data protection legal frameworks i.e., the ePrivacy Directive and the GDPR. Chapter 5 casts light on the risk management tool enshrined in EU data protection law, that is, Data Protection Impact Assessment (DPIA) and proposes an original DPIA methodology for connected devices, building on the CNIL (French data protection authority) model.

Ex ante contracts to arbitrate tort claims - A law and economics perspective

This research addresses the use of ex ante contracts to arbitrate tort claims in domestic settings using law and economics research methodologies. Potential economic benefits from using arbitration, particularly between informed and knowledgeable parties and in international business transactions, are not guaranteed in domestic disputes. Arbitration can potentially be used to manipulate the adjudication process. This research has several findings. There is a lack of information available concerning the use of arbitration to adjudicate tort claims. Proxy measurements concerning the demand for third party adjudication and other legal indicators are a poor substitute for the information hidden behind the veil of arbitration. There is the potential for the strategic use of ex ante contracts to arbitrate tort claims by repeat player tortfeasors to domestic tort claims, both individually and in concert with other repeat player firms. These strategic efforts aim to: manipulate enforcement errors for tort claims, avoid procedural rules which have the effect of lowering enforcement errors, enable a unique type of domestic forum arbitrage, shirk from taking due care, capture the economic benefit of using arbitration, manipulate the stock of precedents and production of public goods from courts, collude in these underlying efforts, restrain competition, indirectly fix prices, and other aims which increase the repeat player tortfeasor’s or their industries economic gains related to their underlying contracts and tort disputes. This research also demonstrates how this subject is appropriate for further academic research and why states should be cautious of giving carte blanche to arbitrate all domestic tort claims.