In this paper we explore EU data protection authorities’ (DPAs) role as leaders and educators, particularly in relation to awareness-raising efforts with Small and Medium-sized Enterprises (SMEs). The GDPR made awareness raising duties of DPAs explicit whilst SMEs face challenges complying with data protection law. We posit that DPAS should make better strategic use of collaboration with SME Associations as intermediaries to better access and understand the needs of SMEs. This collaboration could facilitate dissemination of guidance and information addressed to SMEs. It could also help to overcome concerns expressed by SME representatives about the existing guidance provided by DPAs as being overly generic, focused on legal theory, and in some states arriving too late for implementation. We suggest that by working together SME Associations and DPAs could increase their own working efficiency as well as the one of SMEs. We build our arguments on the findings of an online survey of 52-60 SMEs representatives and semi-structured qualitative interviews with 18 DPAs, 22 SME Association representatives and 11 SME representatives. Keywords: Awareness Raising, Compliance, Data Protection Authorities, Deterrence, Enforcement Strategies, General Data Protection Regulation

The European Union has introduced the General Data Protection Regulation to reform and update data protection laws across Member States. To comply, the United Kingdom has introduced the Data Protection Act 2018. This article focuses on one schedule of the new Act, a data protection exemption for effective immigration control purposes. Considering that the UK Parliament has not implemented the Charter of Fundamental Rights into domestic law post-Brexit, it is therefore necessary to consider this exemption under the European Convention on Human Rights. Recital 73 of the Regulation requires any restrictions on the protection of personal data to be compatible with the Convention. In concluding that the exemption is incompatible with the Convention, this will highlight that not only would the UK be failing their existing human rights obligations but also raises concerns about the UK’s adequacy status as a third country post-Brexit. Keywords: Immigration, Exemptions, Article 8 ECHR, Effective Remedy, Discrimination

peer reviewed

Everyone who has followed a course on statistics or empirical (quantitative) research methods knows how hard it is to put together a dataset that is representative, to design research that can be replicated, to set up a questionnaire or other tools for gathering data that are neutral and unbiased and to find correlations that are valid, significant and have meaning.Not for nothing, most academic papers based on empirical research in, for example, sociology, psychology and social (behavioural) sciences, often consist for more than half of a description of the research methods, the limitations of the research and the insecurities involved with the research findings.AI, Big Data and profiling thrive on collecting, analysing and using large amounts of data and are often based on analytical tools that are grounded in basic statistics.When gathering data, the GDPR applies, at least when it concerns 'personal data'.When data-driven applications and technologies are used in practice, there is a variety of different legal instruments that apply, such as anti-discrimination law, tort law and the various human and fundamental rights instruments, at least when the applications have a direct effect on natural persons and their interests.But the methods for analysing data themselves are barely regulated and the computer scientists and programmers operating algorithmic data-analytics are not always aware of even the most basic standards of empirical research methods and statistics.