ion is a third strategy through which the values underlying privacy and data protection can be safeguarded by designing technologies as to limit, as much as possible in light of the processing purposes, the detail in which personal data is processed. As opposed to minimisation, abstraction does not limit the quantity of the data processed, but its granularity. Abstraction can be implemented by summarising certain attributes into less granular versions (e.g. by processing whether a data subject is a minor or not rather than the exact age), by grouping individual data into an aggregate group profile, or by perturbing the personal data processed by approximation or through the addition of random noise. A relevant pattern would be for instance location data fuzzing, 314 through which the accuracy of location information is decreased in a way that aims at preserving its general utility. Let us say that a smart city project requires the monitoring of individuals’ location data to identify aggregated movement patterns to be used as a basis for data-driven spatial planning: to what extent can the information capture technologies deployed abstract the data gathered while still being able to fulfil their goals? Even when personal data must be collected, and regardless of the level of detail necessary to achieve the processing’s purposes, data subjects’ information can be concealed. Hiding personal data, a last data-oriented strategy, can be achieved through several tactics: access restrictions, obfuscation (e.g. through encryption), disassociation to prevent linkability, and mixing it to hide its origin or its relationship with other data. The use of pseudonymous identities315 is a design pattern that well exemplifies how hiding personal information can be a valid design strategy – if a smart city service provider does not need to know a user’s real identity, it may very well be required to deal with a pseudonym, so that the identification of the data subject’s identity would need an additional step (and further transaction costs) to be performed. Likewise, when users’ inputs can lead to privacy breaches, a system that foresees the possibility to generate fake inputs that cannot be distinguished from real inputs so that the system operator cannot identify an unidentified data subject or infer the attributes of an identified data subject316 is a viable privacy pattern to implement the ‘hide’ strategy. Aside from the data-oriented privacy by design strategies and tactics above, there are also a number of process-oriented options through which the values underlying privacy and data protection can be transposed into the technologies that make up the technological layer of the smart city construct. The provision of information by design helps curbing the information asymmetry inherent to the deployment of smart city technologies. Informing data subjects, timely and adequately, about the processing of their personal data is a first process-oriented strategy, and can be implemented through the tactics of supplying information about the processing to data subjects, explaining its logic, and notifying individual data subjects about processing events that specifically concern them. Examples of design patterns that implement 313 See https://privacypatterns.org/patterns/Personal-data-store. 314 See https://privacypatterns.org/patterns/Location-granularity. 315 See https://privacypatterns.org/patterns/Pseudonymous-identity. 316 See https://privacypatterns.org/patterns/Use-of-dummies.

Safeguarding data protection in an open data world : On the idea of balancing open data and data protection in the development of the smart city environment

precautionary protection only in cases of special danger Britz summarizes several topics discussed in legal literature with respect to special dangers and concludes from these topics several types of cases that justify, exceptionally, or even require a precautionary protection against abstract dangers:1480 (a) In contrast to the considerations of the German Constitutional Court, there might be a special danger even if the (state) interest for the data concerned is not yet so particular that it qualitatively concerns an in(2) between the three principles clarity of law, proportionality, and purpose limitation.. 1476 See Britz, ibid., p. 578. 1477 See Britz, ibid., p. 578 with references esp. to Hoffmann-Riem, New Concept of Data Protection, pp. 514 et sequ. as well as 528; Eifert, Purpose Congruence instead of Purpose Limitation, pp. 140 et. sequ. 1478 Cf. above under points C. I. 1. b) aa) (3) (b) Priority of contractual agreements and the imbalance of powers, C. I. 1. b) aa) (3) (c) Balancing the colliding constitutional positions, C. I. 1. b) bb) (1) The 3-Step-Test: Assessing the defensive and protection function. 1479 See Britz, ibid., p. 579. 1480 See Britz, ibid., pp. 579 to 581. IV. Data protection instruments in non-linear environments

/pdf/the-principle-of-purpose-limitation-in-data-protection-laws-2ib2o13uzy.pdf

The Principle of Purpose Limitation in Data Protection Laws : The Risk-based Approach, Principles, and Private Standards as Elements for Regulating Innovation

Personal debt remains an important factor in many economic models because it encourages people to use debt to finance consumption. Whether this model is sustainable for individuals or the countries in which they reside is an ongoing question of great complexity and many social and economic implications, not only for the burdened individuals and their countries, but also for the EU as a whole. In Personal Debt in Europe, Federico Ferretti and Daniela Vandone examine the 'dark side' of personal debt, or over-indebtedness, in social and economic terms, and legal terms. They employ cross-country consumer-level data to present the latest empirical studies on the problem, analyse these findings to better understand its nature and causes, and discuss the merits of proposed insolvency legislation and harmonisation initiatives in the EU.

Personal Debt in Europe: The EU Financial Market and Consumer Insolvency

The risk-based approach has been introduced to the General Data Protection Regulation (GDPR) to make the rules and principles of data protection law “work better”. Organisations are required to calibrate the legal norms in the GDPR with an eye to the risks posed to the rights and freedoms of individuals. This article is devoted to an analysis of the way in which this new approach relates to “tick-box” compliance. How can the law enhance itself? If handled properly by controllers and supervisory authorities, the risk-based approach can bring about a valuable shift in data protection towards substantive protection of fundamental rights and freedoms. While the risk-based approach has a lot of potential, it also has a risk of its own: it relies on controllers to improve compliance, formulating what it means to attain compliance 2.0.

https://www.cambridge.org/core/services/aop-cambridge-core/content/view/C527DEE76C5E9F7D09830E218D1DCA8D/S1867299X18000478a.pdf/div-class-title-enhancing-compliance-under-the-general-data-protection-regulation-the-risky-upshot-of-the-accountability-and-risk-based-approach-div.pdf

Enhancing compliance under the general data protection regulation: The risky upshot of the accountability- and risk-based approach

This article critically assesses the potential impact of the proposed Data Protection Regulation on the undertaking of social sciences research in the UK, providing practical analysis from the perspective of research involving administrative data. This assessment reveals how changes to the key concepts of anonymisation, personal data and lawfulness may impact upon social sciences research. The approach taken to the regulation of personal versus anonymised data in the proposed Regulation represents a disproportionate and de-contextualised response to the risks involved in undertaking social sciences research that may create disincentives for investing in privacy protective mechanisms. It is positive that there is explicit recognition of research as a legitimate form of data processing. However, negative implications will arise from the introduction of pseudonymous data as a subset of personal data, without proportionate consideration of varying processing contexts and factors surrounding de-identification and specifically, the strict security measures taken to prohibit deidentification in the research context.

/pdf/the-proposed-data-protection-regulation-and-its-potential-4glf63lrkw.pdf

The Proposed Data Protection Regulation and Its Potential Impact on Social Sciences Research in the UK

Both Directive 95/46/EC and the new data protection framework proposed by the European Commission (the Draft Regulation published on January 25, 2012) aim to find an appropriate balance between data subjects’ rights and safeguards, and the free processing (and flow) of information across the European Union (and beyond), for an economic, compatible growth in line with the expectations of society (the "appropriate balance"). Therefore, lawful processing should be subject to the so-called "balancing test" which establishes the ultimate level of protection that can effectively be guaranteed when personal data is processed. In this respect, it can be argued that the Draft Regulation contains a set of requirements and obligations that can be described as a comprehensive 'Data Protection Compliance Program' ("DPCP") which itself creates an "appropriate balance" between data protection and free flow of information/data.

Rosario Imperiali

Papers

Legitimate interest of the data controller New data protection paradigm: legitimacy grounded on appropriate protection