Foreword	5
	Contents	7
	Contributors	15
	Part I	24
	Chapter 1	25
	About the E-Privacy Directive: Towards a Third Generation of Data Protection Legislation?	25
	1.1 Is Personal Data the Adequate Concept?	31
	1.1.1 New Kinds of Sensitive Data in Our Modern Networks: Identifiers and Contact Data	33
	1.1.2 IP Address, Cookies, Data Generated by RFID, Always “Personal Data”? Why Regulate Them Anyway?	35
	1.1.3 New Data to be Protected: The Profiles	38
	1.2 New Objects and New Actors to be Regulated?	40
	1.2.1 EU Commission’s Support to PETs	42
	1.2.2 Towards a Liability of Terminal Equipments Producers and Information System Designers: The RFID Case	43
	1.2.3 Terminal Equipment as a Virtual Home?	45
	1.2.4 Conclusions of Sect. 1.2	49
	1.3 Final Conclusions	50
	Chapter 2	53
	Some Caveats on Profiling	53
	2.1 Introduction	53
	2.2 What Is It with Profiling?	53
	2.3 From Measurement to Detection	54
	2.4 A Risky Dependence	55
	2.5 Privacy, Fairness (Non-discrimination) and Due Process	56
	2.6 Causality and (Criminal) Liability	57
	2.7 Who Owns My Data	57
	2.8 Transparency and Anticipation	58
	2.9 Privacy and Data Protection	58
	2.10 From Data Minimisation to Minimal Knowledge Asymmetries?	60
	2.11 AmLaw: From Privacy Enhancing Technologies to Transparency Enhancing Tools?	61
	2.12 Call for Attention	61
	References	62
	Chapter 3	64
	Levelling up: Data Privacy and the European Court of Human Rights	64
	3.1 The Background	64
	3.2 Legality, Necessity, Secrecy	67
	3.3 Legality: The Liberty Case	68
	3.4 Necessity and Proportionality: The S. and Marper Case	70
	3.5 Where Does It Leave Us?	72
	Chapter 4	74
	Responding to the Inevitable Outcomes of Profiling: Recent Lessons from Consumer Financial Markets, and Beyond	74
	4.1 Preface	74
	4.2 Rethinking the Regulation of Profiling: In a Nutshell	76
	4.2.1 A Brief Introduction to the Flow of Personal Information	76
	4.2.2 The Limits and Troubles of Regulating Data Collection	78
	4.2.3 The Limits and Troubles of Regulating Data Analysis	78
	4.2.4 Regulating Profiling by Addressing Uses: Possibilities, Factors and Limits	79
	4.3 A Tale of Four Data Miners	82
	4.4 Some Conclusions and Summing Up	93
	References	94
	Part II	96
	Chapter 5	97
	The Emerging European Union Security Breach Legal Framework: The 2002/58 ePrivacy Directive and Beyond	97
	5.1 Introduction	98
	5.1.1 The EU Security Breach Legal Framework: The Background	98
	5.1.2 The Review of the ePrivacy Directive	99
	5.1.3 An Overview of the Security Breach Framework Under the Revised ePrivacy Directive	100
	5.2 Purposes and Existing Data Protection Princi-ples Underpinning the New EU Security Breach Framework	101
	5.2.1 Preventing and Minimising Adverse Effects for Individuals	101
	5.2.2 The Security Principle	102
	5.2.3 The Data Minimisation Principle	104
	5.2.4 The Information Principle	104
	5.2.5 The Accountability Principle	105
	5.3 Elements of the EU Security Breach Notification Framework	106
	5.4 Scope of the EU Security Breach Notification Framework	106
	5.4.1 Entities Obliged to Notify: Covered Entities	106
	5.4.2 The Application to Information Society Services and Beyond	107
	5.4.3 Definition of ‘Personal Data Breach’	109
	5.5 The Threshold Triggering the Obligation to Notify	110
	5.5.1 Description of the Threshold	110
	5.5.2 “Likely to Adversely Affect the Personal Data and Privacy”	112
	5.5.3 Exceptions Relating to Technological Protection Measures and Law Enforcement	113
	5.6 Means of Providing Notice, Timing and Content	115
	5.6.1 Means of Providing Notice	115
	5.6.2 Timing of the Notification	116
	5.6.3 Content of the Notification	117
	5.7 Enforcement of the Provisions	118
	5.7.1 Audit and Other Tools Available to the Authorities	118
	5.7.2 Selective to be Effective	119
	5.7.3 Damages	120
	5.8 The Next Steps	120
	5.8.1 Technical Implementing Measures Through Comitology	120
	5.8.2 Areas/Subjects Covered by Comitology	121
	5.8.3 Towards the Application of a Security Breach Notification Scheme Across Sectors	122
	5.9 Conclusions	124
	Chapter 6	125
	From Unsolicited Communications to Unsolicited Adjustments	125
	6.1 Protecting the Individual in front of Technology	125
	6.2 The Regulation of Unsolicited Communications	127
	6.3 The Shift Towards Unsolicited Adjustments	130
	6.3.1 Upcoming Practices	131
	6.3.2 Present Problematic Practices	132
	6.3.3 The (Other) Limits of Current Legislation	134
	6.4 Concluding Remarks	135
	References	136
	Chapter 7	138
	Facebook and Risks of “De-contextualization” of Information	138
	7.1 Introduction	138
	7.2 The Risks of De-contextualization Deriving from Interactions on Facebook	140
	7.2.1 The Simplification of Social Relations on OSNS	141
	7.2.2 The Large Information Dissemination Implied by Interactions on Facebook	142
	7.2.3 The Globalization and Normalization Effects of Facebook	145
	7.3 Consequences of the Threat of De-contextualization on the Rights to Privacy and to Data Protection	146
	7.3.1 Consequences of the Threat of De-contextualization on Privacy as a Right of the Human Being	147
	7.3.2 Consequences of the Threat of De-contextualization on Data Protection as a Right of Data Subjects	151
	7.4 Conclusion	154
	Chapter 8	157
	Surveillance in Germany: Strategies and Counterstrategies	157
	8.1 Introduction	157
	8.2 The Online Searching Judgement of February 27th, 2008	158
	8.2.1 Background of the Case	158
	8.2.2 Other Fundamental Rights	159
	8.2.3 Content of the “New” Fundamental Right	160
	8.2.4 Interferences	161
	8.2.5 Further Developments	161
	8.3 The German Federal Constitutional Court: Closer to ICT and Technology Assessment than German Politicians	162
	8.3.1 Actors and Their Knowledge	162
	8.3.2 Strategies Working Against Privacy and Appropriate Counterstrategies Working Towards Privacy	165
	8.3.3 Summing up: Government vs. Court	166
	8.4 The Rise of the Anti-Surveillance Movement 2.0	166
	8.4.1 Data Retention and the Participatory Resistance Against Surveillance	167
	8.4.2 From the Internet to the Streets and into Pop Culture	169
	8.4.3 Putting Privacy on the Political Agenda	170
	8.4.4 Lessons Learned	172
	References	173
	Chapter 9	175
	Verifiability of Electronic Voting: Between Confidence and Trust	175
	9.1 Introduction	175
	9.2 Trust	176
	9.2.1 Good and Bad Trust	176
	9.2.2 Confidence and Trust	177
	9.2.3 Trust in E-voting	179
	9.3 Verifiability	181
	9.3.1 Voter-Verifiable Elections	181
	9.3.2 Verifiability and Receipt-Freeness	183
	9.3.3 Variants of Verifiability	184
	9.4 Verifiability and Trust	186
	9.4.1 The Politics of Voting Technology	187
	9.4.2 What Proof Do We Prefer?	187
	9.4.3 Beyond Electronic Voting	189
	9.5 Conclusions	191
	References	192
	Chapter 10	194
	Electronic Voting in Germany	194
	10.1 Introduction	194
	10.2 Approaches Applied in Germany	195
	10.2.1 Mechanical Voting Machines	195
	10.2.2 Direct Recording Electronic (DRE) Voting Computers	196
	10.2.3 Paper-Based Electronic Voting Systems	197
	10.2.4 Internet Voting Systems	200
	10.3 Requirement Documents	201
	10.3.1 German Federal Ordinance for Voting Machines	201
	10.3.2 Protection Profile for the Digital Voting Pen	201
	10.3.3 Online-Voting System Requirements for Non-parliamentary Elections	202
	10.3.4 Catalogue of the German Society of Computer Scientists	202
	10.3.5 GI/BSI/DFKI Protection Profile	202
	10.4 Activists’ Activities	203
	10.5 The Federal Constitutional Court Judgment	203
	10.6 Future of Electronic Voting in Germany	204
	References	205
	Part III	207
	Chapter 11	208
	The New Council Decision Strengthening the Role of Eurojust: Does It also Strengthen Data Protection at Eurojust?	208
	11.1 Introduction	208
	11.2 Amendments with Data Protection Relevance	210
	11.2.1 Preservation of the Specificity of the Eurojust Data Protection Regime	210
	11.2.2 Clear Definition of National Competences	211
	11.2.3 Extension of the Categories of Personal Data Which Eurojust May Legally Process	211
	11.2.4 Improvement of the Information Provision from Member States	213
	11.2.5 CMS-Related Issues and Secure Communication with Member States	215
	11.2.6 Time Limits	218
	11.2.7 Relations with Third Parties	220
	11.2.8 EU Classified Information	223
	11.3 Amendments with Relevance to the Joint Supervisory Body of Eurojust (JSB)	223
	11.4 Concluding Remarks	225
	Chapter 12	226
	The Case of the 2008 German–US Agreement on Data Exchange: An Opportunity to Reshape Power Relations?	226
	12.1 Introduction	226
	12.2 Towards a “Prüm Model”?	227
	12.3 Context: Transitional Periods?	228
	12.4 Contents and Core Provisions. Which Core? Which Provisions?	230
	12.5 Memberships and Actors	231
	12.6 Divergences Among Provisions of Prüm Instruments	233
	12.7 Resistance to the “Prüm Model”?	235
	12.8 Final Considerations	237
	References	238
	Chapter 13	242
	DNA Data Exchange: Germany Flexed Its Muscle	242
	13.1 Introduction	242
	13.2 Background	243
	13.3 Substantive Law	247
	13.4 German Hegemony & Democratic Deficit	248
	13.5 Innocent ‘Lambs for Slaughter’	251
	13.6 Data Protection	253
	13.7 Conclusion	255
	References	256
	Part IV	259
	Chapter 14	260
	Information Privacy in Europe from a TA Perspective	260
	14.1 Introduction	260
	14.2 About EPTA	261
	14.3 ICT and Privacy in Europe: The First Common EPTA Project	262
	14.3.1 Methodology of the Project	263
	14.3.2 Outcome	264
	14.3.3 Some Findings	265
	14.3.4 The Challenges: and How to Deal with Them	266
	References	267
	Chapter 15	270
	Privacy and Security: A Brief Synopsis of the Results of the European TA-Project PRISE	270
	15.1 Introduction	270
	15.2 Background and Objectives of PRISE	271
	15.3 Project Methods	272
	15.4 Results of the Interview Meetings	273
	15.5 Criteria for Privacy Enhancing Security Technologies	273
	15.6 Next Steps and Continuative Recommendations	274
	References	275
	Part V	276
	Chapter 16	277
	The Role of Private Lawyers in the Data Protection World	277
	16.1 The Roles of Data Protection Lawyers	277
	16.1.1 Legal Practice	277
	16.1.2 Speaking, Writing, and Other Pro Bono Activities	279
	16.2 The Challenges of Practicing Data Protection Law	279
	16.3 Outlook for Data Protection Law Practice	280
	16.4 Conclusions	281
	Chapter 17	283
	Transfer and Monitoring: Two Key Words in the Current Data Protection Private Practice: A Legal Practitioner’s View1	283
	17.1 Introduction	283
	17.2 International Data Flows: The Issue of Transfer	284
	17.2.1 Unambiguous Consent: A Subsidiary Solution?	285
	17.2.2 Standard Contractual Clauses: A Solution to be Further Harmonised	286
	17.2.3 Binding Corporate Rules: The Way Forward	287
	17.2.4 No One Size Fits-All Solution to the Data Transfer	289
	17.3 Big Brother Is Watching You: the Issue of Monitoring	289
	17.3.1 Monitoring by Private Companies	290
	17.3.2 Monitoring by Public Authorities	295
	17.3.3 Monitoring by Individuals	297
	17.4 Conclusion	297
	Part VI	299
	Chapter 18	300
	Architecture Is Politics: Security and Privacy Issues in Transport and Beyond	300
	18.1 Architectural Issues	300
	18.2 What Went Wrong: Smart Cards in Public Transport	302
	18.3 What Can Still Go Right: Road Pricing	306
	18.4 Privacy and Trust for Business	308
	References	309
	Chapter 19	311
	PETs in the Surveillance Society: A Critical Review of the Potentials and Limitations of the Privacy as Confidentiality Paradigm	311
	19.1 Introduction	311
	19.2 Privacy as Data Confidentiality and Anonymity	313
	19.2.1 Personal Data as the Focus of PETs	313
	19.2.2 Anonymity as a Privacy Enhancing Mechanism	315
	19.2.3 Anonymity and Confidentiality in the Internet: Assumptions of PETs	316
	19.3 Surveillance Society and Its Effects on PETs	318
	19.3.1 The Daily Perspective on Surveillance	318
	19.3.2 The Marketing Perspective on Surveillance	319
	19.3.3 The Political Perspective on Surveillance	319
	19.3.4 The Performative Perspective on Surveillance	320
	19.4 The Information Perspective on Surveillance	321
	19.5 Revisiting the Assumptions	323
	19.6 Conclusion	326
	References	329
	Chapter 20	332
	Privacy by Design: A Matter of Choice	332
	20.1 Introduction	332
	20.2 What Do We Mean by Privacy by Design?	332
	20.3 A Matter of Choice	335
	20.4 From a Vicious Cycle to a Virtuous Cycle	337
	20.4.1 Lawyers and Legislators	338
	20.4.2 Computer Scientists	340
	20.4.3 A Virtuous Cycle	341
	References	341