Big data analysis systems in IoE environments for managing privacy and data protection: pseudonymity, de-anonymization and the right to be forgotten

The thesis represents the conclusive outcome of the European Joint Doctorate programmein Law, Science & Technology funded by the European Commission with the instrument Marie Skłodowska-Curie Innovative Training Networks actions inside of the H2020, grantagreement n. 814177. The tension between data protection and privacy from one side, and the need of granting further uses of processed personal datails is investigated, drawing the lines of the technological development of the de-anonymization/re-identification risk with an explorative survey. After acknowledging its span, it is questioned whether a certain degree of anonymity can still be granted focusing on a double perspective: an objective and a subjective perspective. The objective perspective focuses on the data processing models per se, while the subjective perspective investigates whether the distribution of roles and responsibilities among stakeholders can ensure data anonymity.

Internet of healthcare (law): privacy and data protection aspects in an internet of everything

The purpose of this research study is to discuss privacy and data protection-related regulatory and compliance challenges posed by digital transformation in healthcare in the wake of the COVID-19 pandemic. The public health crisis accelerated the development of patient-centred remote/hybrid healthcare delivery models that make increased use of telehealth services and related digital solutions. The large-scale uptake of IoT-enabled medical devices and wellness applications, and the offering of healthcare services via healthcare platforms (online doctor marketplaces) have catalysed these developments. However, the use of new enabling technologies (IoT, AI) and the platformisation of healthcare pose complex challenges to the protection of patient’s privacy and personal data. This happens at a time when the EU is drawing up a new regulatory landscape for the use of data and digital technologies. Against this background, the study presents an interdisciplinary (normative and technology-oriented) critical assessment on how the new regulatory framework may affect privacy and data protection requirements regarding the deployment and use of Internet of Health Things (hardware) devices and interconnected software (AI systems). The study also assesses key privacy and data protection challenges that affect healthcare platforms (online doctor marketplaces) in their offering of video API-enabled teleconsultation services and their (anticipated) integration into the European Health Data Space. The overall conclusion of the study is that regulatory deficiencies may create integrity risks for the protection of privacy and personal data in telehealth due to uncertainties about the proper interplay, legal effects and effectiveness of (existing and proposed) EU legislation. The proliferation of normative measures may increase compliance costs, hinder innovation and ultimately, deprive European patients from state-of-the-art digital health technologies, which is paradoxically, the opposite of what the EU plans to achieve.

Big data and AI applications for health and research. Co-regulation mechanisms as a prosed solution for data protection law issues

Big data and AI are paving the way to promising scenarios in clinical practice and research. However, the use of such technologies might clash with GDPR requirements. Today, two forces are driving the EU policies in this domain. The first is the necessity to protect individuals’ safety and fundamental rights. The second is to incentivize the deployment of innovative technologies. The first objective is pursued by legislative acts such as the GDPR or the AIA, the second is supported by the new data strategy recently launched by the European Commission. Against this background, the thesis analyses the issue of GDPR compliance when big data and AI systems are implemented in the health domain. The thesis focuses on the use of co-regulatory tools for compliance with the GDPR. This work argues that there are two level of co-regulation in the EU legal system. The first, more general, is the approach pursued by the EU legislator when shaping legislative measures that deal with fast-evolving technologies. The GDPR can be deemed a co-regulatory solution since it mainly introduces general requirements, which implementation shall then be interpretated by the addressee of the law following a risk-based approach. This approach, although useful is costly and sometimes burdensome for organisations. The second co-regulatory level is represented by specific co-regulatory tools, such as code of conduct and certification mechanisms. These tools are meant to guide and support the interpretation effort of the addressee of the law. The thesis argues that the lack of co-regulatory tools which are supposed to implement data protection law in specific situations could be an obstacle to the deployment of innovative solutions in complex scenario such as the health ecosystem. The thesis advances hypothesis on theoretical level about the reasons of such a lack of co-regulatory solutions.

Sustainable linguistic repository built on DSpace

Presentation at Open Repositories 2014, Helsinki, Finland, June 9-13, 2014

Global Standards: Recent Developments betweend the Poles of Privacy and Cloud Computing

The development of the Internet has made it possible to transfer data ‘around the globe at the click of a mouse’. Especially fresh business models such as cloud computing, the newest driver to illustrate the speed and breadth of the online environment, allow this data to be processed across national borders on a routine basis. A number of factors cause the Internet to blur the lines between public and private space: Firstly, globalization and the outsourcing of economic actors entrain an ever-growing exchange of personal data. Secondly, the security pressure in the name of the legitimate fight against terrorism opens the access to a significant amount of data for an increasing number of public authorities.And finally,the tools of the digital society accompany everyone at each stage of life by leaving permanent individual and borderless traces in both space and time. Therefore, calls from both the public and private sectors for an international legal framework for privacy and data protection have become louder. Companies such as Google and Facebook have also come under continuous pressure from governments and citizens to reform the use of data. Thus, Google was not alone in calling for the creation of ‘global privacystandards’. Efforts are underway to review established privacy foundation documents. There are similar efforts to look at standards in global approaches to privacy and data protection. The last remarkable steps were the Montreux Declaration, in which the privacycommissioners appealed to the United Nations ‘to prepare a binding legal instrument which clearly sets out in detail the rights to data protection and privacy as enforceable human rights’. This appeal was repeated in 2008 at the 30thinternational conference held in Strasbourg, at the 31stconference 2009 in Madrid and in 2010 at the 32ndconference in Jerusalem. In a globalized world, free data flow has become an everyday need. Thus, the aim of global harmonization should be that it doesn’t make any difference for data users or data subjects whether data processing takes place in one or in several countries. Concern has been expressed that data users might seek to avoid privacy controls by moving their operations to countries which have lower standards in their privacy laws or no such laws at all. To control that risk, some countries have implemented special controls into their domestic law. Again, such controls may interfere with the need for free international data flow. A formula has to be found to make sure that privacy at the international level does not prejudice this principle.

Oblivion, Erasure and Forgetting in the Digital Age

In light of the recent European Court of Justice ruling (ECJ C-131/12, Google Spain v Spanish Data Protection Agency),the “right to be forgotten” has once again gained worldwide media attention. Already in 2012, whenthe European Commission proposed aright to be forgotten,this proposal received broad public interest and was debated intensively. Under certain conditions, individuals should thereby be able todelete personal data concerning them. More recently – in light of the European Parliament’s approval of the LIBE Committee’samendments onMarch 14, 2014 – the concept seems tobe close to its final form.Although it remains, for the most part,unchanged from the previously circulated drafts, it has beenre-labelled as a“right of erasure”. This article argues that, despite its catchy terminology, the right to be forgotten can be understood as a generic term, bringing together existing legal provisions: the substantial right of oblivion and the rather procedural right to erasure derived from data protection. Hereinafter, the article presents an analysis of selected national legal frameworks and corresponding case law, accounting for data protection, privacy, and general tort law as well as defamation law. This comparative analysis grasps the practical challenges which the attempt to strengthen individual control and informational self-determination faces. Consequently, it is argued that narrowing the focus on the data protection law amendments neglects the elaborate balancing of conflicting interests in European legal tradition. It is shown thatthe attemptto implement oblivion, erasure and forgetting in the digital age is a complex undertaking.

Welcome to the Jungle: The Liability of Internet Intermediaries for Privacy Violations in Europe

In Europe, roughly three regimes apply to the liability of Internet intermediaries for privacy violations conducted by users through their network. These are: the e-Commerce Directive, which, under certain conditions, excludes them from liability; the Data Protection Directive, which imposes a number of duties and responsibilities on providers processing personal data; and the freedom of expression, contained inter alia in the ECHR, which, under certain conditions, grants Internet providers several privileges and freedoms. Each doctrine has its own field of application, but they also have partial overlap. In practice, this creates legal inequality and uncertainty, especially with regard to providers that host online platforms and process User Generated Content.

La sous-traitance des données du patient au regard de la Directive 95/46

La gestion des données du patient occupe une place significative dans la pratique de l’art de guérir. Il arrive fréquemment que des personnes participent à la production ou à la gestion des données du patient alors que, praticiens de la santé ou non, elles ne travaillent pas sous l’autorité ou la direction du praticien ou de l’équipe en charge du patient. Au regard de la directive 95/46/CE relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel, ces tiers revêtent la qualité de sous–traitant lorsqu’ils traitent des données pour compte du responsable du traitement de données. Ce dernier doit choisir un sous–traitant qui apporte des garanties suffisantes au regard des mesures de sécurité technique et d’organisation relatives aux traitements à effectuer, et il doit veiller au respect de ces mesures. L’existence de labels de sécurité pourrait faciliter le choix du sous–traitant. S’agissant de données très sensibles comme les données génétiques, il serait opportun d’envisager un contrôle préalable par l’autorité de contrôle ou par un détaché à la protection des données. Il demeure alors à déterminer le véritable responsable du traitement des données du patient, ce qui dépend fortement du poids socialement reconnu et attribué aux différents acteurs de la relation thérapeutique.

Decentralized systems for the protection and portability of personal data

The General Data Protection Regulation (GDPR) has been designed to help promote a view in favor of the interests of individuals instead of large corporations. However, there is the need of more dedicated technologies that can help companies comply with GDPR while enabling people to exercise their rights. We argue that such a dedicated solution must address two main issues: the need for more transparency towards individuals regarding the management of their personal information and their often hindered ability to access and make interoperable personal data in a way that the exercise of one's rights would result in straightforward. We aim to provide a system that helps to push personal data management towards the individual's control, i.e., a personal information management system (PIMS). By using distributed storage and decentralized computing networks to control online services, users' personal information could be shifted towards those directly concerned, i.e., the data subjects. The use of Distributed Ledger Technologies (DLTs) and Decentralized File Storage (DFS) as an implementation of decentralized systems is of paramount importance in this case. The structure of this dissertation follows an incremental approach to describing a set of decentralized systems and models that revolves around personal data and their subjects. Each chapter of this dissertation builds up the previous one and discusses the technical implementation of a system and its relation with the corresponding regulations. We refer to the EU regulatory framework, including GDPR, eIDAS, and Data Governance Act, to build our final system architecture's functional and non-functional drivers. In our PIMS design, personal data is kept in a Personal Data Space (PDS) consisting of encrypted personal data referring to the subject stored in a DFS. On top of that, a network of authorization servers acts as a data intermediary to provide access to potential data recipients through smart contracts.

Protecção de dados pessoais na Internet

The present dissertation has as object of study the right to be forgotten, a new right for increase the control of subject over their data. It’s analyzed the data protection on Internet, especially, some scenarios of processing and the regulation applicable to it (directive 95/46/CE and directive 2002/58/CE).

O âmbito de aplicação material da legislação de proteção de dados pessoais e o tratamento de imagem por pessoa singular

Images have gained a never before seen importance. Technological changes have given the Information Society extraordinary means to capture, treat and transmit images, wheter your own or those of others, with or without a commercial purpose, with no boundaries of time or country, without “any kind of eraser”. From the several different ways natural persons may engage in image processing with no commercial purpose, the cases of sharing pictures through social networks and video surveillance assume particular relevance. Consequently there are growing legitimate concerns with the protection of one's image, since its processing may sometimes generate situations of privacy invasion or put at risk other fundamental rights. With this in mind, the present thesis arises from the question: what are the existent legal instruments in Portuguese Law that enable citizens to protect themselves from the abusive usage of their own pictures, whether because that image have been captured by a smartphone or some video surveillance camera, whether because it was massively shared through a blog or some social network? There is no question the one's right to not having his or her image used in an abusive way is protected by the Portuguese constitution, through the article 26th CRP, as well as personally right, under the article 79th of the Civil Code, and finally through criminal law, articles 192nd and 193rd of the Criminal Code. The question arises in the personal data protection context, considering that one's picture, given certain conditions, is personal data. Both the Directive 95/46/CE dated from 1995 as well as the LPD from 1998 are applicable to the processing of personal data, but both exclude situations of natural persons doing so in the pursuit of activities strictly personal or family-related. These laws demand complex procedures to natural persons, such as the preemptive formal authorisation request to the Data Protection National Commission. Failing to do so a natural person may result in the application of fines as high as €2.500,00 or even criminal charges. Consequently, the present thesis aims to study if the image processing with no commercial purposes by a natural person in the context of social networks or through video surveillance belongs to the domain of the existent personal data protection law. To that effect, it was made general considerations regarding the concept of video surveillance, what is its regimen, in a way that it may be distinguishable from Steve Mann's definition of sousveillance, and what are the associated obligations in order to better understand the concept's essence. The application of the existent laws on personal data protection to images processing by natural persons has been analysed taking into account the Directive 95/46/CE, the LPD and the General Regulation. From this analysis it is concluded that the regimen from 1995 to 1998 is out of touch with reality creating an absence of legal shielding in the personal data protection law, a flaw that doesn't exist because compensated by the right to image as a right to personality, that anyway reveals the inability of the Portuguese legislator to face the new technological challenges. It is urgent to legislate. A contrary interpretation will evidence the unconstitutionality of several rules on the LPD due to the obligations natural persons are bound to that violate the right to the freedom of speech and information, which would be inadequate and disproportionate. Considering the recently approved General Regulation and in the case it becomes the final version, the use for natural person of video surveillance of private spaces, Google Glass (in public and private places) and other similar gadgets used to recreational purposes, as well as social networks are subject to its regulation only if the images are shared without limits or existing commercial purposes. Video surveillance of public spaces in all situations is subject to General Regulation provisions.

Protecção de dados pessoais na internet

The present dissertation has as object of study the right to be forgotten, a new right for increase the control of subject over their data. It’s analyzed the data protection on Internet, especially, some scenarios of processing and the regulation applicable to it (directive 95/46/CE and directive 2002/58/CE).

Comment appliquer les règles de protection des données aux transferts de données personnelles dans une société à la fois globale mais également multi-économique et multiculturelle ?

Dans son texte, l’auteur répond à une question posée lors d’une Conférence organisée conjointement par l’US Department of Commerce et le Groupe de l’article 29 et qui appelle à déterminer la façon dont les règles de protection des données doivent s’appliquer lors des transferts de données personnelles dans une société globale, multi-économique et multiculturelle. La question est pertinente dans une telle société, caractérisée par le besoin, d’une part d’assurer, sans considération de frontières, un certain régime de protection des données et d’autre part, de respecter la diversité des réalités économiques et culturelles qui se côtoient de plus en plus. L’auteur rappelle d’abord comment l’Europe a progressivement mis en place le système du droit à la protection des données personnelles. Il explique ensuite comment l’Union européenne a considéré la question de la réglementation des flux transfrontières pour en arriver au développement d’un système de protection adéquat et efficace lors des transferts de données hors de l’Union européenne. Toutefois, un tel système mis en place ne semble plus répondre de nos jours à la réalité des flux transfrontières, d’où la nécessité éventuelle de le réformer.

La protection des données sur Internet en droit suisse

La protection des données personnelles en Suisse trouve son fondement dans la constitution et se concrétise avant tout dans une loi fédérale adoptée avant l'avènement d'Internet et la généralisation de la transmission d'informations personnelles sur des réseaux numériques. Cette réglementation est complétée par les engagements internationaux de la Suisse et notamment la Convention européenne des Droits de l'Homme du Conseil de l'Europe. L'article délimite tout d'abord le champ d'application de la législation, qui joue un rôle pour le traitement de données personnelles par des particuliers comme par les autorités de l'administration fédérale. Suit une brève analyse des principes fondamentaux (licéité, bonne foi, proportionnalité, finalité, exactitude, communication à l'étranger, sécurité, droit d'accès) et de leur application sur Internet. Enfin, la protection du contenu des messages électroniques privés est brièvement abordée sous l'angle du secret des télécommunications et à la lumière d'une jurisprudence récente du Tribunal fédéral.