The right of access in Article 15 of the EU General Data Protection Regulation (GDPR) is essential for empowering data subjects when exercising other data subject rights. In the context of automated decision-making, including profiling, Article 15(1)(h) provides a right to meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. In this research, the notions of ‘meaningful information’, ‘the logic involved’, and ‘the significance and the envisaged consequences’ are analysed. Apart from a legal analysis, empirical research was carried out in 30 countries (27 EU and 3 EFTA EEA Member States), consisting of a survey amongst all Data Protection Authorities (DPAs) and interviews with experts of privacy organisations. Several types of potentially meaningful information that could be in scope of right of access requests were assessed, as well as several types of information on the consequences for data subjects. Even though respondents indicate that most of these types of information should be provided upon access requests, the findings show that most of these types of information are rarely or not at all provided in practice. Providing such information strongly depends on the willingness of data controllers to cooperate, as they may balance this against rights and freedoms of others, including intellectual property and trade secrets. Particularly trade secrets are invoked in practice to block or restrict access requests, despite the GDPR stating that these considerations should not lead to a refusal of the request to provide all information to the data subject.

With the rise of deepfakes and synthetic media, the question as to what is real and what is not will become increasingly important and politized. Deepfakes can be used to spread fake news, influence elections, introduce highly realistic fake evidence in courts and make fake porno movies. Each of these applications potentially has a big impact on society, social relationships, democracy and the rule of law. The question this article shall assess is whether the current regulatory regime suffices to address these potential harms and if not, which additional rules and principles should be adopted. It will discuss several potential amendments to the privacy and data protection regime, limitations to the freedom of expression and ex ante rules on the distribution of use of deepfake-technologies.

The Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 is Australia's latest attempt at solving the ‘going dark’ debate. Yet, like many other regulatory attempts towards ameliorating the ill-effects of encrypted communications and information, it has been criticised for privileging law enforcement and intelligence aims of public safety and security over other interests; particularly privacy and cybersecurity. Some fear that the new powers facilitate the creation of encryption backdoors that could be exploited by bad actors. This paper examines the so-called ‘systemic weakness’ limitation, which was designed to allay these fears. The paper concludes that the limitation is effective at preventing the most blatant, wholesale encryption backdoors, yet is not a panacea against all cybersecurity-related concerns that the instrument brings, and its efficacy in practice is likely to be undermined by its substantive and procedural complexity.

Financial Intelligence Units (FIUs) are key players in the current Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) legal system. FIUs are specialised bodies positioned between private financial institutions and states’ law enforcement authorities, what renders them a crucial middle link in the chain of information exchange between the private and public sectors. Considering that a large share of this information is personal data, its processing must meet the minimum data protection standards. Yet, the EU data protection legal framework is composed of two main instruments, i.e. the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED), which provide different thresholds for the protection of personal data. The aim of this paper is to clarify the applicable data protection legal regime for the processing of personal data by FIUs for AML/CFT purposes. To that end, the paper provides an overview of the nature and goals of AML/CFT policy and discusses the problem of the diversity of existing FIU models. Further, it proposes a number of arguments in favour of and against the possibility of applying either the GDPR or LED to the processing of personal data by the FIUs and reflects on how convincingly these arguments can be used depending on the specificities of a given FIU model.

Contemporary criminal investigation assisted by computing technology imposes challenges to the right to a fair trial and the scientific validity of digital evidence. This paper identifies three categories of unaddressed threats to fairness and the presumption of innocence during investigations – (i) the inappropriate and inconsistent use of technology; (ii) old procedural guarantees, which are not adapted to contemporary digital evidence processes and services; (iii) and the lack of reliability testing in digital forensics practice. Further, the solutions that have been suggested to overcome these issues are critically reviewed to identify their shortcomings. Ultimately, the paper argues for the need of legislative intervention and enforcement of standards and validation procedures for digital evidence in order to protect innocent suspects and all parties in the criminal proceedings from the negative consequences of technology-assisted investigations.