Developing a Code of Practice for Using Data in Wellbeing Support

This article discusses the troubled relationship between contemporary advertising technology (adtech) systems, in particular systems of real-time bidding (RTB, also known as programmatic advertising) underpinning much behavioral targeting on the web and through mobile applications. This article analyzes the extent to which practices of RTB are compatible with the requirements regarding a legal basis for processing, transparency, and security in European data protection law. We first introduce the technologies at play through explaining and analyzing the systems deployed online today. Following that, we turn to the law. Rather than analyze RTB against every provision of the General Data Protection Regulation (GDPR), we consider RTB in the context of the GDPR’s requirement of a legal basis for processing and the GDPR’s transparency and security requirements. We show, first, that the GDPR requires prior consent of the internet user for RTB, as other legal bases are not appropriate. Second, we show that it is difficult—and perhaps impossible—for website publishers and RTB companies to meet the GDPR’s transparency requirements. Third, RTB incentivizes insecure data processing. We conclude that, in concept and in practice, RTB is structurally difficult to reconcile with European data protection law. Therefore, intervention by regulators is necessary.

Transfers of personal data outside the European Union are strictly regulated by the European Data Protection Directive. In today's globalized world, it has become increasingly challenging for companies to comply with the restrictions imposed by European data protection law. The existing legal mechanisms approved by the European Commission and the national data protection authorities have become, to a certain degree, ill-adapted to multiple and cross-jurisdictional transfers of personal data. In recent years, Binding Corporate Rules (BCR) have become a fast-growing legal mechanism that is more widely recognized by companies as an efficient tool for framing international transfers. BCR bring a truly globalized response to the issues associated with international data transfers within the same corporate group. In particular, companies appreciate their pragmatic approach and the fact that they can communicate more openly to their employees, clients, and suppliers about their data processing activities. BCR must first be approved by the national data protection authorities before they can be used by companies. To this end, data protection authorities in Europe have developed a cooperation procedure, which aims at recognizing BCR as an effective tool for providing an adequate level of protection to personal data being transferred globally. In the near future, the European Commission may officially recognize BCR as a valid accountability measure that enables international organizations to comply with European data protection regulations.

Privacy enhancing technologies (PETs) have long been discussed as a valuable tool to protect personal data. Apart from some examples at the Member State level (such as Germany), however, there is still a lack of legal instruments and requirements concerning these technical instruments. Without mandatory requirements and legal incentives, there is the risk that developers and controllers will not provide PETs to their respective customers. As European data protection law will undergo substantial changes in the coming years, there is now an opportunity to implement at least basic legal instruments to supplement and foster the development and implementation of PETs. This opportunity must not be missed: given the long reform cycles of European data protection law, any regulation that does not end up being part of the current reform may have to wait for another 15–20 years for the next opportunity.

Since March 2020 the Corona virus has limited personal encounters due to social distancing measures. Thus, many data collection techniques relying on face-to-face interaction, like interviews or Focus Groups (FG), are now being practised in online environments. Such change requires the implementation of innovative measures to comply with Regulation EU 2016/679 (GDPR) and obey national data protection laws. Processing personal data of voluntary participants has to have a lawful ground and a clear purpose behind it. Moreover, the researcher has to respect legal requirements and principles for processing personal data, provide the participants with information about the research procedure and apply security measures to avoid risks to the rights and freedoms of individuals. This process has to apply to any interaction mediated by Web-Conferencing Systems (WCS). The purpose of this paper is to describe the legal requirements for conducting online interviews or FG under social distancing conditions. The project of reference for the application of these requirements is the EU Horizon2020 HELIOS project consisting of the development of a decentralised social media platform. Lay summary At universities or in industry researchers can interview people personally to test, for instance, the use of a specific technology. The objective is to collect data for future improvements. In 2020 people all over the world found themselves in a pandemic. The Covid-19 limited social meetings with beloved ones and also restricted the work of scientific researchers. Individual or group interviews could not take place in presence. Thus, a solution was seen in online conferencing platforms such as Zoom. Modifying the space and the way in which an interview takes place poses some legal challenges regarding data protection. Such conversations with individuals always have to apply European and national data protection laws. Among other things, this means that there needs to be a specific legal reason to process personal data and a specific purpose behind the interview. Additionally, the researcher has to inform participants about all the legal terms, legal guarantees and research procedure. All this applies as well if online conferencing platforms are used. In this article, you can find a description of the necessary legal steps to develop online interviews with individuals or focus groups and fulfil European data protection requirements.

The extraterritorial scope of data protection law is by no means an invention of the GDPR. In fact, through the cases of Google Spain, Weltimmo, and Verein für Konsumenteninformation European data protection law already obtained legal relevance beyond EU borders. This jurisprudence is still relevant for the present interpretation of the GDPR that, by introducing the targeting criterion, expanded the extraterritorial scope of EU data protection law even further. This expansion not only covers data subjects that reside in the EU, but also data subjects that simply "are" in the EU at the moment the data processing takes place. To understand why policymakers were keen to ensure the GDPR's reach beyond EU territory, one has to look at the broader technical developments, social movement, and economic rationales that influenced the recent evolution of data protection law not only in Europe but also world-wide.

‘The Duty to Remember v the Right to be Forgotten: Holocaust Archiving and Research, and European Data Protection Law’: Notes from Arye Schreiber’s seminar hosted by NINSO, the Northumbria Internet & Society Research Interest Group

The recently passed European Directive on the Protection of Personal Data aims to harmonize European data protection law at a higher level of protection than exists now. It represents a European consensus on a standard for personal privacy and a model for countries without data protection laws. The protracted process for agreement and ratification, however, has produced a document with many derogations and ambiguities, reflecting the wider moves towards ''subsidiarity'' within the European Union. Of concern to North America is the stipulation that transborder data flow may not be permitted unless the receiving country can demonstrate an ''adequate'' level of protection. While the process through which this provision will be interpreted and applied is so far found to be complicated and unclear, nevertheless European authorities will be reluctant to tolerate ''data havens,'' a fact that should concern North American business that relies on the unimpeded flows of personal data from and to Europe. Neither Canada nor the United States can claim ''adequate'' data protection according to the European standard. However, Canadian efforts through the Canadian Standards Association and the Federal Information Highway Advisory Council signal an attempt to fashion a more comprehensive policy framework for privacy than the more incremental and reactive approach of the United States. This divergence is explained by key cultural, economic, and political factors within Canada, which have caused a different reaction to the extraterritorial effects of the European Union's Data Protection Directive.

Face verification has come into increasing focus in various applications including the European Entry/Exit System, which integrates face recognition mechanisms. At the same time, the rapid advancement of biometric authentication requires extensive performance tests in order to inhibit the discriminatory treatment of travellers due to their demographic background. However, the use of face images collected as part of border controls is restricted by the European General Data Protection Law to be processed for no other reason than its original purpose. Therefore, this paper investigates the suitability of synthetic face images generated with StyleGAN and StyleGAN2 to compensate for the urgent lack of publicly available largescale test data. Specifically, two deep learning-based (SER-FIQ, FaceQnet v1) and one standard-based (ISO/IEC TR 29794-5) face image quality assessment algorithm is utilized to compare the applicability of synthetic face images compared to real face images extracted from the FRGC dataset. Finally, based on the analysis of impostor score distributions and utility score distributions, our experiments reveal negligible differences between StyleGAN vs. StyleGAN2, and further also minor discrepancies compared to real face images.

There is a lot of panic in many businesses about European data protection law. This chapter introduces the key concepts and issues that businesses have to comply with under the GDPR. It also dispels many myths and provides practical guidance for finding a lawful basis for processing data and conducting a data protection audit of a fashion business. It looks at data breaches and then explains why compliance with data protection law is in the interests of all businesses regardless of where they are located.

Internet-related technology has been of high importance for businesses since the internet emerged. With the Internet of Things, a new (and probably lasting) era of internet-related business operations has just begun. Complex embedded IT-systems that are continuously connected to the internet enable modern products to operate themselves autonomously. This not only opens up new markets, but also creates legal challenges, which will be detailed in this chapter. Connected products collect a huge number of data; this does not only heavily touch on core principles of (European) data protection law, but is also a potential source of liability risks. This chapter illustrates both aspects using various examples. Businesses deploying the Internet of Things are subject of a variety of legal obligations that are, due to their rigidity, contrary to the nature of the Internet of Things. Being obliged to ask individuals whose data are processed for informed consent and the need to implement security mechanisms that comply with all data security requirements but are nevertheless cost-effective are not the only challenges for businesses. As there is no uniform legal framework concerning liability in Europe, businesses face liability under numerous and equally diverse national laws. This raises the question whether the current national regulatory framework is still adequate given the fact that the Internet of Things, with its approach to connect things globally via the internet, blurs boundaries.

The field of learning analytics (LA) is developing rapidly. However, previous empirical studies on LA were largely data-driven. Little attention has been paid to theory-driven LA studies. The present scoping review identified and summarized empirical theory-driven LA studies, aiming to reveal how theories were integrated into LA. The review examined 37 peer-reviewed journal articles published from 2016 to 2020 from six databases. Results show that most studies were guided by the theories of self-regulated learning and social constructivism; most integrated theories into LA for better interpreting the data analysis results; and most linked theoretical constructs and log variables directly. Several studies employed well-developed survey instruments to measure theoretical constructs. The review results indicate that LA studies still need to strive for new theory advances in learning. Recommendations for future study are discussed.

Social media platforms like Facebook are taking an increasingly important place in political and public opinion debates, and some commentators argue that they have a significant impact on the results of elections (Brexit and Trump election, for instance). This study, conducted through three academic articles, aims to assess the impact of social media on the polarization of the political debate through three major European case studies. To this finality, the research performs a literature review based on key studies besides investigating and grabbing institutional information. The first article explores how the new versions of Facebook's algorithm accentuate the social bubble effect, weakening the confrontation of the plurality of opinions necessary for the democratic debate. The literature shows that these social bubbles are a risk for democracies, but that they are inherent to the human psychological condition (the algorithms are just amplifying an existing phenomenon by reinforcing our persistent individual beliefs): the real issue seems to be our human capacity to question the veracity of the message we receive (hence the need for regulation of the social media platforms to minimize the risk of manipulations). Faced with these new challenges, the second article assesses how the institutions of the European Union sought to protect the parliamentary elections in May 2019 against the viral proliferation of fake news and against the unlawful use of citizens' data to target specific groups of strategic voters. This research focuses on the European General Data Protection Regulation (GDPR) mechanisms to avoid fake news and microtargeting effects on the electoral context. Preliminary results suggest that GDPR reduced social media's effects on the 2019 European Parliament elections by adopting a public and private co-regulation approach, which avoids counterproductive reinforcement of the autopersuasion power of fake news. Finally, the article discusses the difficulties of applying the European data protection law in a new digital era to conclude that it is essential to continue developing alternative measures. To finish with, the third article discusses to what extent the concepts developed in the two previous articles can be applied to the Yellow Vests' social manifestation on France's streets from November of 2018 to the end of the year 2019, and specifically how the new algorithm introduced by Facebook in January 2018 (with the creation of the controversial "Facebook groups" which encourage the information exchanged between users sharing common points at the expense of information coming from "official pages" of traditional media or political figures) facilitated the emergence of this movement. The research explains how this algorithm played a key role in transforming digital anger into a radical social movement in the streets and investigates how the lack of governance on the social networks could lead to violent real-life manifestations, resulting in negative net gains in the long run and a high potential to destabilize democracies. The final considerations of this dissertation address the limits of the European model of protection (GDPR), open avenues for reflection on its adaptation, and present the new European legislation (the Digital Markets Act (DMA) and the Digital Services Act (DSA)) which should come into force in 2023 and whose general principles are to strengthen competition law in the face of the GAFAM "monopoly", and to condemn in digital life everything that is reprehensible in real life.

The confirmed exit of the United Kingdom from the European Union (EU) coincides with significant reform of European data protection law. Such reform will arise through the European General Data Protection Regulation (GDPR) which is on course for direct enforcement in all EU Member States as of May 2018. Separation negotiations must be endured before finalization of an EU-UK divorce, the product of which will determine the role of GDPR in Britain’s future.

The purpose of this study is to present data on the use of learning analytics in the field of education. For this purpose, data available in the Web of Science database were examined using bibliometric analysis. The publication distribution varied between 2011 and 2022, with the number of publications reaching its peak in 2020 and declining thereafter. Findings from co-authorship analysis indicate that Dragan Gašević is the most prolific author and the most cited researcher in the field of learning analytics. Results of co-authorship analysis by country suggest that researchers affiliated with institutions in Australia engage in more collaborative work and cooperation. Results of co-authorship analysis by organizations demonstrate that Monash University in Australia is the organization with the highest level of collaboration with other organizations. The most cited work is Ferguson's (2012) article titled "Learning analytics: drivers, developments and challenges." The most frequently used keywords in conjunction with learning analytics are higher education, educational data mining, online learning, learning design, and self-regulated learning. In recent years, there has been a focus on learning analytics related to learning management systems (LMS) rather than MOOCs in learning environments. The British Journal of Educational Technology, which was established in 1970, is the most cited journal that is commonly referenced in the articles. It is hoped that this study will serve as a valuable reference for researchers interested in the field and guide them in making accurate inferences based on a broad perspective.

While there is currently much buzz about the new field of learning analytics [19] and the potential it holds for benefiting teaching and learning, the impression one currently gets is that there is also much uncertainty and hesitation, even extending to scepticism. A clear common understanding and vision for the domain has not yet formed among the educator and research community. To investigate this situation, we distributed a stakeholder survey in September 2011 to an international audience from different sectors of education. The findings provide some further insights into the current level of understanding and expectations toward learning analytics among stakeholders. The survey was scaffolded by a conceptual framework on learning analytics that was developed based on a recent literature review. It divides the domain of learning analytics into six critical dimensions. The preliminary survey among 156 educational practitioners and researchers mostly from the higher education sector reveals substantial uncertainties in learning analytics.In this article, we first briefly introduce the learning analytics framework and its six domains that formed the backbone structure to our survey. Afterwards, we describe the method and key results of the learning analytics questionnaire and draw further conclusions for the field in research and practice. The article finishes with plans for future research on the questionnaire and the publication of both data and the questions for others to utilize.