Georgetown University Law Center researchers propose that every IoT device manufacturer build a switch into their devices that disables any smart feature that contributes to security or privacy risks. This will render a smart thermostat just a thermostat and a smart doorbell just a doorbell, and will disable microphones, sensors,

There is a broad consensus that algorithmic systems should be approached principally through the lens of indirect discrimination and their impact, but researchers argue that this approach is both normatively undesirable and legally flawed. In some cases, algorithmic bias may constitute direct discrimination, and the law should be better equipped

This paper studies the installation and configuration process of consent pop-ups and their potential effects on website publishers' decision making. It finds that Consent Management Providers often violate the law, and that configuration options may lead to non-compliance. https://petsymposium.org/popets/2022/popets-2022-0082.pdf

Law can play an important role in safeguarding trust in organisations that use news personalisation. Control and transparency measures are crucial to enabling individuals to trust these organisations. The law’s current focus on informing individuals about and empowering them to stop personalisation does not account for the importance of

There is a wide gap between legal and ethical governance rules and the everyday practices of public sector data professionals. Frameworks are integrated implicitly, subtly influencing decision making. According to this article, mainstreaming literacy, rather than specialization, is a necessary consequence. https://www.cell.com/patterns/fulltext/S2666-3899(22)00229-X

Under Clause 14 of the Data Transfer SCCs, the data importer must carry out a transfer risk assessment to verify whether the laws and practices of the receiving third country could prevent the data importer from complying with the Data Transfer SCCs. If the risk assessment shows that the Data

The concept of proportionality is at the very core of the modern understanding of human rights. Proportionality is, first and foremost, a condition for the limitation of a qualified fundamental right. https://academic.oup.com/idpl/advance-article-abstract/doi/10.1093/idpl/ipac014/6647961?redirectedFrom=fulltext

Self-sovereign identity is an embryonic technology with uncertain benefits for refugees. It may help to empower them, but it also risks reinforcing the power of states and corporations over them, according to this article. https://www.tandfonline.com/doi/full/10.1080/14650045.2020.1823836

Data ownership proposals are misguided and would be self-defeating if implemented. Instead, privacy law reform should focus on strengthening ongoing use restrictions over personal data, according to this article. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3564480

Machine learning can be used to optimize sales practices in consumer markets, but it also raises concerns about manipulation. According to this article, in order to mitigate these risks, we need to understand how unfair commercial practice, data protection, and privacy law interact. https://papers.ssrn.com/sol3/papers.cfm?

DPAs are independent authorities entrusted with the consistent application of the GDPR, and are obliged to facilitate the submission of complaints. However, according to this paper, current practices related to this obligation are lacking in clarity, and there is a need for DPAs to provide more information to data subjects

* We propose a framework for defining different types of explanations of AI systems. * We contextualize current XAI discourses within the proposed framework. * We highlight two broad perspectives for defining quality criteria for explainability. * We discuss the relevance of our framework in light of current and upcoming AI regulation. https://www.

The GDPR incorporates the RBA for all obligations of the controller in the GDPR. Where the transfer rules are stated as obligations of the controller (rather than as absolute principles), the RBA of Article 24 therefore applies. Other than the DPAs assume, this is not contradicted by the ECJ in

The CLOUD Act agreements between the US and UK will likely improve the digital privacy rights of US and UK citizens, but they will further undermine these rights for Third Country Persons (eg from EU). The US and UK should voluntarily extend Fourth Amendment and Article 8 protections to these

This Article observes that constructing AI harms as risks is a choice with consequences. Risk regulation comes with its own policy baggage: a set of tools and troubles that have emerged in other fields. Moreover, there are at least four models for risk regulation, each with divergent goals and methods.

Thirty study participants playtested an innocent-looking "escape room" game in virtual reality (VR). Behind the scenes, an adversarial program had accurately inferred over 25 personal data attributes, from anthropometrics like height and wingspan to demographics like age and gender, within just a few minutes of gameplay. As notoriously data-hungry companies

European supervisory authorities’ varying practices of calculating GDPR administrative fines can be viewed, on the one hand, as inconsistent and in conflict with the principle of uniform interpretation and application of the GDPR in general and uniform sanction for GDPR infringements in particular, as enshrined in GDPR recital 10, 11

Do we need an Chief Privacy Officer, a Data Protection Officer, or do we need both?In the following article, I will examine the benefits of both roles, but I will also look at some of the challenges related to each of the roles and why these have impelled both