The DAPRECO knowledge base is the main outcome of the interdisciplinary project bearing the same name. It is a repository of rules written in LegalRuleML, an XML formalism designed to be a standard for representing the semantic and logical content of legal documents. The rules represent the provisions of the General Data Protection Regulation, the new Regulation that is significantly affecting the digital market in the European Union and beyond. The DAPRECO knowledge base builds upon the Privacy Ontology, which provides (...) a model for the legal concepts involved in the GDPR, by adding a further layer of constraints in the form of if-then rules, referring either to standard first order logic implications or to deontic statements. If-then rules are formalized in reified Input/Output logic and then codified in LegalRuleML. Reified Input/Output logic is an application of standard Input/Output logic for legal reasoning, in which Input/Output logic is combined with the reification-based approach in Hobbs and Gordon. The DAPRECO knowledge base is then a case study for reified Input/Output logic, and it shows that the formalism indeed appears to be a good candidate to effectively formalize, via uniform and simple representations, complex linguistic/deontic phenomena that may be found in legal texts. To date, the DAPRECO knowledge base is the biggest knowledge base in LegalRuleML and Input/Output logic freely available online. (shrink)

Risk management is a well-known method to face technological challenges through a win–win combination of protective and proactive approaches, fostering the collaboration of operators, researchers, regulators, and industries for the exploitation of new markets. In the field of autonomous and unmanned aerial systems, or UAS, a considerable amount of work has been devoted to risk analysis, the generation of ground risk maps, and ground risk assessment by estimating the fatality rate. The paper aims to expand this approach with a tool (...) for managing data protection risks raised by drones through the design of flight maps. The tool should allow UAS operators choosing the best air corridor for their drones based on the so-called privacy by design principle pursuant to Article 25 of the EU data protection regulation, the GDPR. Among the manifold applications of this approach, the design of fly zones for drones can be tailored for public authorities in the phase of authorization of new operations, much as for national Data Protection authorities that have to control the lawfulness of personal data processing by UAS operations. The overall aim is to present the first win–win approach to data protection issues, aerospace engineering challenges, and risk management methods for the threats posed by this technology. (shrink)

Broad consent – the act of gaining one consent for multiple potential future research projects – sits at the core of much current genomic research practice. Since the 25th May 2018, the General Data Protection Regulation (GDPR) has applied as valid law concerning genomic research in the EU and now occupies a dominant position in the legal landscape. Yet, the position of the GDPR concerning broad consent has recently been cause for concern in the genomic research community. Whilst (...) the text of the GDPR apparently supports the practice, recent jurisprudence contains language which is decidedly less positive. This article takes an in-depth look at the situation concerning broad consent under the GDPR and – despite the understandable concern flowing from recent jurisprudence – offers a positive outlook. This positive outlook is argued from three perspectives, each of which is significant in defining the current, and ongoing, legitimacy and utility of broad consent under the GDPR: the principled, the legal technical, and the practical. (shrink)

Since its inception the General Data Protection Regulation has introduced a number of rights and obligations that relate to the personal data processing. As the Regulation requires that all information about data subjects’ rights be conveyed in a clear and plain language (transparency principle), this study focuses on the linguistic means of expressing rights and obligations in the GDPR based privacy notices. The article aims at scrutinising the features and context of deontic expressions which may influence the clear message. (...) The research corpus consists of fourteen privacy notices of Finnish design companies which were analysed in order to identify deontic expressions. They were juxtaposed with the GDPR text and some discrepancies were found in their frequency and modal patterns. The qualitative analysis of the expressions with the help of Easy Language Meter criteria for Finnish revealed that privacy notices show simplifying tendencies like choice of modal expressions, the use of certain subjects and the way of addressing the reader. These comply with the Plain Language principles and thus the transparency principle highlighted in the GDPR. (shrink)

This paper analyses the information disclosures in two biobank consent documents used by biobanks operating under the General Data Protection Regulation (GDPR). The aim of the analysis is to investigate how these documents inform potential sample donors about possible future uses of biobank data. The findings suggest that the consent documents provide potentially misleading information regarding the range of possible future uses of biobank data. Based on these information disclosures, potential sample donors may reasonably believe that the data can (...) only be used for a narrowly defined range of research purposes. However, the range of lawful uses of the data is much broader and less clearly defined. Consent provided based on misleading information is not morally transformative, even if it were legally valid. To facilitate morally transformative biobank consent, this paper provides two recommendations for information disclosure to potential sample donors regarding future uses of biobank data: first, potential sample donors should be informed about the legal scope of consent; and second, they should be informed about the full range of lawful uses of biobank data. (shrink)

Scientific research is indispensable inter alia in order to treat harmful diseases, address societal challenges and foster economic innovation. Such research is not the domain of a single type of organization but can be conducted by a range of different entities in both the public and private sectors. Given that the use of personal data may be indispensable for many forms of research, the data protection framework will play an important role in determining not only what types of research may (...) occur but also which types of actors may carry it out. This article looks at the role the EU’s General Data Regulation plays in determining which types of actors can conduct research with personal data. In doing so it focuses on the various legal bases that are available and attempts to discern whether the GDPR can be said to favour research in either the public or private domains. As this article explains, the picture is nuanced, with either type of research actor enjoying advantages and disadvantages in specific contexts. (shrink)

The European Commission has argued that the General Data Protection Regulation (GDPR) adopted in 2018 created a solid framework of digital trust. This paper critically examines the statement. Firstly, a Kantian approach to trust is outlined. In the second section, key aspects of the historical development of commercial trade in personal data and the regulatory efforts of the EU are analyzed. The third part of the paper considers the concept of consent both as a philosophical concept and as the (...) main legal tool for protecting citizens’ data, arguing that the idea that citizens are able to make rational and informed choices about consent to sharing of data is currently fictitious. The final section draws on the Kantian conception of trust to evaluate the EU’s efforts to enable trustworthy data stewardship for its citizens in the digital information environment. The Kantian analysis concludes that even though the GDPR has the potential to supply citizens with trustworthy data protection, its enforcement procedures as well as the 2025 proposed amendments to the GDPR work against trustworthy data stewardship. (shrink)

BackgroundPrevious studies have indicated that failure to report ethical approval is common in health science articles. In social sciences, the occurrence is unknown. The Swedish Ethics Review Act requests that sensitive personal data, in accordance with the EU General Data Protection Regulation (GDPR), should undergo independent ethical review, irrespective of academic discipline. We have explored the adherence to this regulation. MethodsUsing the Web of Science databases, we reviewed 600 consecutive articles from three domains (health sciences with and without somatic (...) focus and social sciences) based on identifiable personal data published in 2020. ResultsInformation on ethical review was lacking in 12 of 200 health science articles with somatic focus (6%), 21 of 200 health science articles with non-somatic focus (11%), and in 54 of 200 social science articles (27%; p < 0.001 vs. both groups of health science articles). Failure to report on ethical approval was more common in (a) observational than in interventional studies (p < 0.01), (b) articles with only 1–2 authors (p < 0.001) and (c) health science articles from universities without a medical school (p < 0.001). There was no significant association between journal impact factor and failure to report ethical approval.ConclusionsWe conclude that reporting of research ethics approval is reasonably good, but not strict, in health science articles. Failure to report ethical approval is about three times more frequent in social sciences compared to health sciences. Improved adherence seems needed particularly in observational studies, in articles with few authors and in social science research. (shrink)

The General Data Protection Regulation (GDPR) of the EU confirms the protection of personal data as a fundamental human right and affords data subjects more control over the way their personal information is processed, shared, and analyzed. However, where data are processed by artificial intelligence (AI) algorithms, asserting control and providing adequate explanations is a challenge. Due to massive increases in computing power and big data processing, modern AI algorithms are too complex and opaque to be understood by most (...) data subjects. Articles 15 and 22 of the GDPR provide a modest regulatory framework for automated data processing by, among other things, mandating that data controllers inform data subjects about when it is being used, and its logic and ramifications. Nevertheless, due to the phrasing of the articles and the numerous exceptions they allow, doubts have arisen about their effectiveness. In this paper, we empirically evaluate the quality and effectiveness of AI disclosures as mandated by the GDPR. By means of an online survey (N = 835), we investigated how data subjects expect to be informed about the automated processing of their data. We then conducted a content analysis of the AI disclosures of N = 100 companies and organizations. The combined findings reveal that current GDPR-mandated disclosures do not meet the expectations and needs of data subjects. Explanations drawn up following the guidelines of the generic formulations of the GDPR differ widely and are often vague, incomplete and lack transparency. In our conclusions we identify a path towards standardizing and optimizing AI information notices. (shrink)

Organized immaturity refers to the capacity of widely institutionalized sociotechnical systems to challenge qualities of human enlightenment, autonomy, and self-determination. In the context of surveillance capitalism, where these qualities are continuously put at risk, data transparency is increasingly proposed as a means of restoring human maturity by allowing individuals insight and choice vis-à-vis corporate data processing. In this article, however, I draw on research on General Data Protection Regulation–mandated data transparency practices to argue that transparency—while potentially fostering maturity—itself risks producing (...) new forms of organized immaturity by facilitating user ignorance, manipulation, and loss of control of personal data. Considering data transparency’s relative “successes” and “failures” regarding the cultivation of maturity, I outline a set of possible remedies while arguing for a general need to develop more sophisticated ethical appreciations of transparency’s complex and potentially problematic implications for organized (im)maturity in the digital age. (shrink)

In this article, we consider the possible application of the European General Data Protection Regulation to “citizen scientist”-led health research with mobile devices. We argue that the GDPR likely does cover this activity, depending on the specific context and the territorial scope. Remaining open questions that result from our analysis lead us to call for lex specialis that would provide greater clarity and certainty regarding the processing of health data by for research purposes, including these non-traditional researchers.

Explainable AI (XAI) provides methods to understand non-interpretable machine learning models. However, we have little knowledge about what legal experts expect from these explanations, including their legal compliance with, and value against European Union legislation. To close this gap, we present the Explanation Dialogues, an expert focus study to uncover the expectations, reasoning, and understanding of legal experts and practitioners towards XAI, with a specific focus on the European General Data Protection Regulation. The study consists of an online questionnaire and (...) follow-up interviews, and is centered around a use-case in the credit domain. We extract both a set of hierarchical and interconnected codes using grounded theory, and present the standpoints of the participating experts towards XAI. We find that the presented explanations are hard to understand and lack information, and discuss issues that can arise from the different interests of the data controller and subject. Finally, we present a set of recommendations for developers of XAI methods, and indications of legal areas of discussion. Among others, recommendations address the presentation, choice, and content of an explanation, technical risks as well as the end-user, while we provide legal pointers to the contestability of explanations, transparency thresholds, intellectual property rights as well as the relationship between involved parties. (shrink)

In 2016, the European Parliament approved the General Data Protection Regulation (GDPR) whose core aim is the safeguarding of information privacy, and, by corollary, human dignity. Drawing on the field of philosophical anthropology, this paper analyses various interpretations of human dignity and human exceptionalism. It concludes that privacy is essential for humans to flourish and enable individuals to build a sense of self and the world.

It is argued that GDPR suffer from a practical problem of click-through consents, which developers of web browsers should resolve.

The right to withdraw consent from research is a well-established right of research participants. This paper examines what it means to withdraw consent from biobank research in the European Union (EU) and the European Economic Area (EEA) – where biobank data is regulated by the General Data Protection Regulation (GDPR) – and how the implications of consent withdrawal are communicated to potential sample donors. An analysis of two biobank consent documents, one from Finland and one from Germany, indicates that (...) donors are informed of the right to withdraw but receive potentially misleading information about its consequences. In particular, the documents do not clarify that withdrawal may not prevent further use of data, overstating the right’s practical effect. This communicative strategy risks undermining informed consent and may erode trust in biobanks as research institutions if sample donors come to feel that they have been deceived. To address this issue, it is recommended that biobanks provide clear and accurate information about the legal impact of consent withdrawal on associated data. (shrink)

Recital 33 GDPR has often been interpreted as referring to ‘broad consent’. This version of informed consent was intended to allow data subjects to provide their consent for certain areas of research, or parts of research projects, conditional to the research being in line with ‘recognised ethical standards’. In this article, we argue that broad consent is applicable in the emerging field of Computational Social Science (CSS), which lies at the intersection of data science and social science. However, the (...) lack of recognised ethical standards specific to CSS poses a practical barrier to the use of broad consent in this field and other fields that lack recognised ethical standards. Upon examining existing research ethics standards in social science and data science, we argue that they are insufficient for CSS. We further contend that the fragmentation of European Union (EU) law and research ethics sources makes it challenging to establish universally recognised ethical standards for scientific research. As a result, CSS researchers and other researchers in emerging fields that lack recognised ethical standards are left without sufficient guidance on the use of broad consent as provided for in the GDPR. We conclude that responsible EU bodies should provide additional guidance to facilitate the use of broad consent in CSS research. (shrink)

Algorithmic decision-making based on profiling may significantly affect people’s destinies. As a rule, however, explanations for such decisions are lacking. What are the chances for a “right to explanation” to be realized soon? After an exploration of the regulatory efforts that are currently pushing for such a right it is concluded that, at the moment, the GDPR stands out as the main force to be reckoned with. In cases of profiling, data subjects are granted the right to receive meaningful (...) information about the functionality of the system in use; for fully automated profiling decisions even an explanation has to be given. However, the trade secrets and intellectual property rights (IPRs) involved must be respected as well. These conflicting rights must be balanced against each other; what will be the outcome? Looking back to 1995, when a similar kind of balancing had been decreed in Europe concerning the right of access (DPD), Wachter et al. (2017) find that according to judicial opinion only generalities of the algorithm had to be disclosed, not specific details. This hardly augurs well for a future right of access let alone to explanation. Thereupon the landscape of IPRs for machine learning (ML) is analysed. Spurred by new USPTO guidelines that clarify when inventions are eligible to be patented, the number of patent applications in the US related to ML in general, and to “predictive analytics” in particular, has soared since 2010—and Europe has followed. I conjecture that in such a climate of intensified protection of intellectual property, companies may legitimately claim that the more their application combines several ML assets that, in addition, are useful in multiple sectors, the more value is at stake when confronted with a call for explanation by data subjects. Consequently, the right to explanation may be severely crippled. (shrink)

This article critiques the fixation on data as an object of regulation for addressing a broad range of digital problems. We challenge the idea that data are always the appropriate regulatory targets for addressing information-related problems, specifically in the context of data protection and the General Data Protection Regulation (GDPR). The GDPR tackles a broad range of digital problems by regulating personal data. This results in regulatory imprecision. Framing digital problems as (personal) data problems often does not reflect (...) the causal processes law aims to control, pre-empts modernising traditionally non-digital legal domains, such as consumer and labour law, and distracts from what is really problematic and in need of regulatory intervention. Drawing on theories of regulation and information, we distinguish between two different causal processes underlying information-induced problems: semantic (meaning-driven) and syntactic (meaning-agnostic). We propose a roadmap for improving legal protection against information-related problems. (shrink)

Period-tracking software applications or ‘menstruapps’ have witnessed a surge in popularity in recent years. At the same time, many of them are a part of the adtech industry, using business models that create revenue by selling users’ personal and intimate data. This exploratory article brings menstruapps into a feminist legal debate. It investigates the supranational European legal standards on intimate and sensitive data processing, particularly the General Data Protection Regulation. Scrutinising explicit consent according to GDPR Article 9, this paper, (...) through empirical examples, claims that current legal standards are not enforced. The standards are, furthermore, theoretically insufficient to fully safeguard data subjects’ integrity and autonomy. Instead of abandoning the concept, the article reimagines consent, using a contextual and communicative model where power relations are taken into consideration, building on the feminist concept of freedom to negotiate. (shrink)

Scholarship on corporate political activity (CPA) has remained largely silent on the substance of information strategies that firms utilize to influence policymakers. To address this deficiency, our study is situated in the European Union (EU), where political scientists have noted information strategies to be central to achieving lobbying success; the EU also provides a context of global norm-setting activities, especially with its General Data Protection Regulation (GDPR). Aided by recent advances in the field of unsupervised machine learning, we performed (...) a structural topic model analysis of the entire set of lobby documents submitted during two GDPR consultations, which were obtained via a so-called Freedom of Information request. Our analysis of the substance of information strategies reveals that the two policy phases constitute “shifting battlegrounds,” where firms first seek to influence what is included and excluded in the legislation, after which they engage the more specific interests of other stakeholders. Our main theoretical contribution concerns the identification of two distinct information strategies. Furthermore, we point at the need for more attention for institutional procedures and for the role of other stakeholders’ lobbying activities in CPA research. (shrink)

The General Data Protection Regulation is a European Union regulation that will replace the existing Data Protection Directive on 25 May 2018. The most significant change is a huge increase in the maximum fine that can be levied for breaches of the regulation. Yet fewer than half of UK companies are fully aware of GDPR—and a number of those who were preparing for it stopped doing so when the Brexit vote was announced. A last-minute rush to become compliant is (...) therefore expected, and numerous companies are starting to offer advice, checklists and consultancy on how to comply with GDPR. In such an environment, artificial intelligence technologies ought to be able to assist by providing best advice; asking all and only the relevant questions; monitoring activities; and carrying out assessments. The paper considers four areas of GDPR compliance where rule based technologies and/or machine learning techniques may be relevant: Following compliance checklists and codes of conduct; Supporting risk assessments; Complying with the new regulations regarding technologies that perform automatic profiling; Complying with the new regulations concerning recognising and reporting breaches of security. It concludes that AI technology can support each of these four areas. The requirements that GDPR state for explanation and justification of reasoning imply that rule-based approaches are likely to be more helpful than machine learning approaches. However, there may be good business reasons to take a different approach in some circumstances. (shrink)

In the current post-GDPR landscape, privacy notices have become ever more prevalent on our phones and online. However, these notices are not well suited to their purpose of helping users make informed decisions. I suggest that instead of utilizing notice to elicit informed consent, we could repurpose privacy notices to create the space for more meaningful, value-centered user decisions. Value-centered privacy decisions, or those that accurately reflect who we are and what we value, encapsulate the intuitive role of personal (...) values in data privacy decisions. To explore how we could design for such decisions, I utilize Suzy Killmister’s Four-Dimensional Theory of Autonomy (4DT) to operationalize value-centered privacy decisions. I then utilize 4DT to help design a system—called a value-centered privacy assistant (VcPA)—that could help create the space for value-centered data privacy decisions using privacy notices. Using this 4DT lens, I further assess the degree that an existing technology, personalized privacy assistants (PPAs), use notices in a manner that allows for value-centered decision-making. I lastly utilize insights from the PPA assessment to inform the design of a VcPA, concluding that a VcPA could utilize notices to assist users in value-centered app selection and in other data privacy decisions. (shrink)

Since approval of the EU General Data Protection Regulation (GDPR) in 2016, it has been widely and repeatedly claimed that the GDPR will legally mandate a ‘right to explanation’ of all decisions made by automated or artificially intelligent algorithmic systems. This right to explanation is viewed as an ideal mechanism to enhance the accountability and transparency of automated decision-making. However, there are several reasons to doubt both the legal existence and the feasibility of such a right. In contrast (...) to the right to explanation of specific automated decisions claimed elsewhere, the GDPR only mandates that data subjects receive meaningful, but properly limited, information (Articles 13-15) about the logic involved, as well as the significance and the envisaged consequences of automated decision-making systems, what we term a ‘right to be informed’. Further, the ambiguity and limited scope of the ‘right not to be subject to automated decision-making’ contained in Article 22 (from which the alleged ‘right to explanation’ stems) raises questions over the protection actually afforded to data subjects. These problems show that the GDPR lacks precise language as well as explicit and well-defined rights and safeguards against automated decision-making, and therefore runs the risk of being toothless. We propose a number of legislative and policy steps that, if taken, may improve the transparency and accountability of automated decision-making when the GDPR comes into force in 2018. (shrink)

What we today call “digital sovereignty” is neither a universal concept nor a neutral one. It is a product of specific cultural histories—American liberalism, Chinese statism, and European legalism—each grounded in theological and political trajectories unique to the West. This paper examines how these models—when exported globally—produce epistemic tensions in societies shaped by different traditions of thought. Through four case studies—Aadhaar, GDPR, China’s Social Credit System, and ChatGPT—it shows how digital infrastructures are not merely tools of governance, but enactments (...) of particular moral orders. Aadhaar performs modernity through a postcolonial state’s imitation; GDPR legislates morality through Europe’s juridical universalism; China encodes Confucian ethics via algorithm; and ChatGPT extends Western epistemology under the guise of intelligence. These are not exceptions that require explanation—they are symptoms of a deeper malady: the global circulation of categories that were never born global. What masquerades as universal is, in fact, provincial knowledge on a global tour. This paper, then, is not a call for better models, but for a different conversation—one that begins with civilizational difference, not ends with it. Sovereignty, here, becomes the right to think otherwise—and to build from that thinking. (shrink)

This paper examines the evolving regulation of the media environment in the digital age, focusing on innovative tools and practices aligned with European Union (EU)standards. The analysis underscores the dual challenge of safeguarding freedom of expression while addressing new risks such as disinformation, ownership concentration, and political interference. Drawing on the EU’s regulatory instruments, including the Audiovisual Media Services Directive (AVMSD), Digital Services Act (DSA), Digital Markets Act (DMA), General Data Protection Regulation (GDPR), and the newly adopted European Media (...) Freedom Act (EMFA), the paper highlights the EU’s role as a normative leader in shaping democratic media governance. Particular emphasis is placed on Albania, a candidate country whose progress toward EU membership depends on aligning its media framework with European standards. The findings show that while Albania has made formal legislative advances, implementation and enforcement remain weak, leaving journalists vulnerable to political and economic pressures. By situating Albania’s case within broader European developments, the paper identifies regulatory innovations and self-regulatory practices essential for building a resilient, independent, and pluralistic media landscape in the digital era. (shrink)

Digital privacy scholars tend to bemoan ordinary people’s limited knowledge of and lukewarm interest in what happens to their digital data. This general lack of interest and knowledge is often taken as a consideration in favor of legislation aiming to force internet companies into adopting more responsible data practices. While we remain silent on whether any new laws are called for, in this paper we wish to underline a neglected consequence of people’s ignorance of and apathy for digital privacy: their (...) potential to encourage capture by industry interests. In particular, we argue that such laws may be at increased risk of capture because they are unlikely to be democratically responsive. We make this claim on a twofold basis: first, well-known theoretical mechanisms explaining how the absence of responsiveness leads to capture, identified in prior political science and political philosophy literature, yield the prediction that digital privacy legislation is likely to be unresponsive and thus captured; second, empirical data concerning the European Union’s digital privacy laws, with a special focus on the General Data Protection Regulation, appears to confirm these predictions: the bloc’s (world’s?) flagship privacy protection law seems more responsive to corporate than citizen interests. (shrink)

This chapter discusses the emerging field of data ethics and ethics of AI. It starts with the notion of Big Data and the non-neutrality of data practices. It then turns to artificial intelligence, discussing its history and functioning and questions of agency and responsibility. Following this, the chapter delves into three core principles in AI and data ethics: privacy, fairness, and accountability. It concludes with discussing some important standards and regulations for AI and data ethics, like the GDPR.

This study explores the legal and ethical implications of introducing AI-powered robots into medical practice within the European Union (EU). It employs an interdisciplinary methodology that combines survey responses from medical professionals across 20 countries, expert interviews, literature review, and legal analysis. The findings identify a significant gap in professional awareness regarding existing legal frameworks. The analysis focuses in particular on several key EU regulations, including the Artificial Intelligence Act (AI Act), the General Data Protection Regulation (GDPR), the Medical (...) Device Regulation (MDR), and the revised Product Liability Directive (PLD). It further identifies eight key factors that influence liability, including the explainability of AI decisions, the quality of training data, cybersecurity vulnerabilities, and evolving dynamics in the doctor–patient relationship. Building on recent academic debates, the study proposes a dual framework for assigning liability: one that incorporates both ex-ante (preventive) and ex-post (remedial) mechanisms. Alongside this dual framework, the study further proposes liability models that translate these principles into practical mechanisms for regulating AI-powered robots deployed in medical practice. This model is grounded in a link-in-the-chain approach to liability, distributing liability among all actors involved in the development, deployment, and use of AI-powered robots. The study concludes that a harmonized, context-sensitive legal framework is urgently needed. Such a framework should clarify roles and responsibilities across the AI ecosystem, promote collaborative governance, and provide targeted training for medical professionals. Ultimately, ensuring the safe and effective integration of AI-powered robots in medical practice will depend on coordinated regulatory action and a shared commitment to transparency, accountability, and patient safety. (shrink)

The growing importance of researching online activities, such as cyber-deviance and cyber-crime, as well as the use of online tools (e.g. questionnaires, games, and other interactive tools) has created new ethical and legal challenges for researchers, which can be even more complicated when researching adolescents. In this article, we highlight the risks emerging from the current European legal and ethical landscape when researching potentially vulnerable groups, with a special focus on online research. It is not always clear how to differentiate (...) research ethics consent from consent for data processing activities: when can an adolescent independently consent to research, or when is parental consent needed? Additional problems emerge when parents do not consent to research activities, but their adolescent children do. A serious ethical challenge can arise when the parents do not communicate with researchers, but the adolescent wishes to participate, especially when weak parental oversight is coupled with research on sensitive topics. We offer some guidance on what to keep in mind when conducting online research with adolescents and highlight possible ways that these issues can be dealt with in pan-European projects. (shrink)

:This article considers recent ethical topics relating to medical AI. After a general discussion of recent medical AI innovations, and a more analytic look at related ethical issues such as data privacy, physician dependency on poorly understood AI helpware, bias in data used to create algorithms post-GDPR, and changes to the patient–physician relationship, the article examines the issue of so-called robot doctors. Whereas the so-called democratization of healthcare due to health wearables and increased access to medical information might suggest (...) a positive shift in the patient-physician relationship, the physician’s ‘need to care’ might be irreplaceable, and robot healthcare workers might be seen as contributing to dehumanized healthcare practices. (shrink)

The aim of the article is to explain the relationship between the ethical evaluation of scientific research involving personal data and the assessment of compliance with data protection law. The article presents the mutual relationship between the protection of personal data and scientific activity from a dogmatic perspective, the legal regulation of the processing of personal data in scientific research, and the so-called research exceptions that apply when data are processed for scientific research. It also covers the importance of meeting (...) the ethical requirements of scientific research in order to profit from the indicated exceptions. Finally, it provides a comparison between the ethical and the legal systems of personal data protection in research (objectives, criteria, authorities, and procedures). (shrink)

The study explores how Indian philosophical ethics can provide a transformative foundation for contemporary cybersecurity governance. Modern digital systems are dominated by technocratic and legalistic frameworks that emphasise compliance and control but often neglect moral consciousness and collective welfare. Drawing upon the concepts of Dharma, Nyāya, Nīti, Ahimsa, and Lokasaṃgraha, this research reinterprets cybersecurity as a moral ecosystem sustained by duty, justice, prudence, and non-harm. The work introduces an original theoretical construct- the Dharma-Centric Governance Model (DCGM)- developed by Dr. Dhananjay (...) Trivedi. The DCGM integrates Indian ethical philosophy with international standards such as the GDPR (General Data Protection Regulation, a European Union law), NIST framework (National Institute of Standards and Technology, a US agency), and India’s Digital Personal Data Protection Act. It rests upon five axioms and operates through five interdependent layers: ontological, normative, procedural, technical, and civic. The model operationalises Dharma through practical mechanisms, including Dharma Audits and Ethical Impact Assessments. Through comparative analysis of global cyber incidents and Indian regulatory contexts, the research demonstrates that sustainable cybersecurity requires ethical sovereignty, a state’s capacity to exercise digital power with moral restraint. The study concludes that Dharma offers not only a philosophical ideal but also a pragmatic blueprint for global digital governance. By fusing timeless moral principles with modern regulatory design, the research proposes a new paradigm of ethical cyber governance that aligns technological innovation with human values and universal welfare. (shrink)

The first few years of the 21st century were characterised by a progressive loss of privacy. Two phenomena converged to give rise to the data economy: the realisation that data trails from users interacting with technology could be used to develop personalised advertising, and a concern for security that led authorities to use such personal data for the purposes of intelligence and policing. In contrast to the early days of the data economy and internet surveillance, the last few years have (...) witnessed a rising concern for privacy. As bad data practices have come to light, citizens are starting to understand the real cost of using online digital technologies. Two events stamped 2018 as a landmark year for privacy: the Cambridge Analytica scandal, and the implementation of the European Union’s General Data Protection Regulation (GDPR). The former showed the extent to which personal data has been shared without data subjects’ knowledge and consent and many times for unacceptable purposes, such as swaying elections. The latter inaugurated the beginning of robust data protection regulation in the digital age. Getting privacy right is one of the biggest challenges of this new decade of the 21st century. The past year has shown that there is still much work to be done on privacy to tame the darkest aspects of the data economy. As data scandals continue to emerge, questions abound as to how to interpret and enforce regulation, how to design new and better laws, how to complement regulation with better ethics, and how to find technical solutions to data problems. The aim of the research project Data, Privacy, and the Individual is to contribute to a better understanding of the ethics of privacy and of differential privacy. The outcomes of the project are seven research papers on privacy, a survey, and this final report, which summarises each research paper, and goes on to offer a set of reflections and recommendations to implement best practices regarding privacy. (shrink)

ABSTRACT: One important criticism of algorithmic systems is that they lack transparency. Such systems can be opaque because they are complex, protected by patent or trade secret, or deliberately obscure. In the EU, there is a debate about whether the General Data Protection Regulation (GDPR) contains a “right to explanation,” and if so what such a right entails. Our task in this chapter is to address this informational component of algorithmic systems. We argue that information access is integral for (...) respecting autonomy, and transparency policies should be tailored to advance autonomy. -/- To make this argument we distinguish two facets of agency (i.e., capacity to act). The first is practical agency, or the ability to act effectively according to one’s values. The second is what we call cognitive agency, which is the ability to exercise what Pamela Hieronymi calls “evaluative control” (i.e., the ability to control our affective states, such as beliefs, desires, and attitudes). We argue that respecting autonomy requires providing persons sufficient information to exercise evaluative control and properly interpret the world and one’s place in it. We draw this distinction out by considering algorithmic systems used in background checks, and we apply the view to key cases involving risk assessment in criminal justice decisions and K-12 teacher evaluation. -/- The link below is to an open access version of the chapter. (shrink)

During the nineteenth century, advances in medical research led to grave robbing and an illicit market in human biological remains (HBR). The historical episode of grave robbing illustrates how science can upend social norms. A similar scenario could soon emerge, but this time it will not be with people's biological remains, but with people's digital remains. Artificial intelligence and extended reality now create digital representations from avatars to human digital twins. In addition to the sophisticated digital appearance, the representations are (...) drawing on personal and biometric data to create complex behavioural and biological replications of people. These digital artefacts form part of a person's digital estate, which persists after death as Human Digital Remains (HDR). HDR presents an urgent socio-technological risk because like the 19th-century trade in HBR, HDR presents existing legal and ethical gaps.. The research responds by adopting what is to our knowledge, the first of its kind cross-disciplinary study that combines conceptual analysis, anticipatory and precautionary governance frameworks, and doctrinal review to analyse and anticipate legal and ethical gaps and grey areas. Our analysis shows that neither General Data Protection Regulation (GDPR) nor the AI Act (2025) currently extends rights to the deceased. In response, we outline a HDR governance framework, supported by six targeted policy-facingrecommendations: (1) build HDR-specific anticipatory governance capacity, (2) innovate and safeguard posthumous privacy and data protections, (3) protect citizen autonomy with advance data directives and data trustees, (4) leverage existing tools by developing a data-donor card and support the right to gift or trade HDR, (5) enhance the right to be forgotten post-mortem, and (6) update digital identity and legacy rights, including the right to continuation or erasure of Digital Human Twins. (shrink)

The Harold Pinter Archive at the British Library contains correspondence dating from 1977 to 2008, including his e-mail archive. In total, the correspondence strand of the archive contains c.20,000 paper letters and c.3500 e-mails. This project used data analytics (in Python) and network visualisation (in Gephi) to interrogate the ways in which digital and analogue correspondence function together within Pinter’s literary archive. The attendant paper reflects upon what this analysis might mean for archivists, curators and researchers working with hybrid correspondence (...) collections in the context of Digital Humanities and Artificial Intelligence based research methodologies. The paper includes an analysis of what an email is both materially and functionally—what are its constituent parts and in what ways is it like and unlike a physical letter, as well as a discussion of how we can leverage the highly structured nature of e-mail data to our advantage using computational techniques, and the limitations of these approaches to socalled “dark archives”. Network visualisations are used to represent correspondence visually in order to shed light on the activities it represents; particularly literary collaboration and administration. The paper concludes with an attempt to draw conclusions from these analyses and to think about their implications for repositories and researchers collecting and using hybrid correspondence collections. The Python code produced for the project is collection agnostic and available under a Creative Commons Licence, meaning that any collecting repository holding email archives in MBOX format can use it to extract GDPR compliant metadata from their collections and visualise them in Gephi. (shrink)

This paper explores some key discrepancies between two sets of normative requirements applicable to the research use of personal data and human biological materials: the data protection regime which follows the application of the European Union General Data Protection Regulation, and the Declaration of Helsinki, CIOMS guidelines and other research ethics regulations. One source of this controversy is that the GDPR requires consent to process personal data to be clear, concise, specific and granular, freely given and revocable and therefore (...) has challenged the concept of ‘broad consent’, which has been widely applied in the context of biobanking. Another source of controversy is the interplay between regulations of research ethics and protection of personal data related to the secondary use of personal data and biological materials. In this case, the GDPR ‘research condition’ provides an alternative to re-consent for the use of previously collected personal data and biological materials. Although the mentioned controversies have been raised in the legal literature, they have not been explicitly addressed from the research ethics perspective. Should consent be regarded as a priority legal basis for personal data processing in health data research? Can broad consent still be a suitable legal ground for biobanking? What should be the role of research ethics provisions that differ from the GDPR standards, and what should be the role and function of research ethics committees in the changing environment of health data research? These are the ongoing controversies to be explored in the paper. (shrink)

The EDPS Ethics Advisory Group (EAG) has carried out its work against the backdrop of two significant social-political moments: a growing interest in ethical issues, both in the public and in the private spheres and the imminent entry into force of the General Data Protection Regulation (GDPR) in May 2018. For some, this may nourish a perception that the work of the EAG represents a challenge to data protection professionals, particularly to lawyers in the field, as well as to (...) companies struggling to adapt their processes and routines to the requirements of the GDPR. What is the purpose of a report on digital ethics, if the GDPR already provides all regulatory requirements to protect European citizens with regard to the processing of their personal data? Does the existence of this EAG mean that a new normative ethics of data protection will be expected to fill regulatory gaps in data protection law with more flexible, and thus less easily enforceable ethical rules? Does the work of the EAG signal a weakening of the foundation of legal doctrine, such as the rule of law, the theory of justice, or the fundamental values supporting human rights, and a strengthening of a more cultural approach to data protection? Not at all. The reflections of the EAG contained in this report are not intended as the continuation of policy by other means. It neither supersedes nor supplements the law or the work of legal practitioners. Its aims and means are different. On the one hand, the report seeks to map and analyse current and future paradigm shifts which are characterised by a general shift from analogue experience of human life to a digital one. On the other hand, and in light of this shift, it seeks to re-evaluate our understanding of the fundamental values most crucial to the well-being of people, those taken for granted in a data-driven society and those most at risk. The objective of this report is thus not to generate definitive answers, nor to articulate new norms for present and future digital societies but to identify and describe the most crucial questions for the urgent conversation to come. This requires a conversation between legislators and data protection experts, but also society at large - because the issues identified in this report concern us all, not only as citizens but also as individuals. They concern us in our daily lives, whether at home or at work and there isn’t a place we could travel to where they would cease to concern us as members of the human species. (shrink)

The French research ecosystem long resisted extending the ethics regulation processes established for biomedical science into the social sciences. This is now changing. This history of resistance is examined, together with the alternatives proposed. These include self-regulation by professional associations. Consideration is also given to the wider legal environment for French social sciences, particularly the laws on defamation and privacy, which also influence the opportunities for research and for the pursuit of grievances by participants. The introduction of ethics regulation, through (...) IRB-style committees in universities and research organizations, reflects isomorphic pressures from the international research community, reinforced by the impact of the European Union’s General Data Protection Regulations (GDPR) on the application of national privacy law. Nevertheless, outside the specific domain of health-related research, ethics regulation still sits more lightly on French social science than in the anglosphere. (shrink)

Developments in medical big data analytics may bring societal benefits but are also challenging privacy and other ethical values. At the same time, an overly restrictive data protection regime can form a serious threat to valuable observational studies. Discussions about whether data privacy or data solidarity should be the foundational value of research policies, have remained unresolved. We add to this debate with an empirically informed ethical analysis. First, experiences with the implementation of the General Data Protection Regulation (GDPR) (...) within a European research consortium demonstrate a gap between the aims of the regulation and its effects in practice. Namely, strictly formalised data protection requirements may cause routinisation among researchers instead of substantive ethical reflection, and may crowd out trust between actors in the health data research ecosystem; while harmonisation across Europe and data sharing between countries is hampered by different interpretations of the law, which partly stem from different views about ethical values. Then, building on these observations, we use theory to argue that the concept of trust provides an escape from the privacy-solidarity debate. Lastly, the paper details three aspects of trust that can help to create a responsible research environment and to mitigate the encountered challenges: trust as multi-agent concept; trust as a rational and democratic value; and trust as method for priority setting. Mutual cooperation in research—among researchers and with data subjects—is grounded in trust, which should be more explicitly recognised in the governance of health data research. (shrink)

Around the world, private and public organizations use software called legal expert systems to compute taxes. This software must comply with the laws they are designed to implement. As such, a bug or an error in a program that leads to tax miscalculations can have heavy legal and democratic consequences. However, increasing evidence suggests that some legal expert systems may not comply with the law. Moreover, traditional software development processes mean that legal expert systems are difficult to adapt to the (...) continuous flow of new legislation. To prevent further software decay and to reconcile these systems with the growing demand for algorithmic transparency, we argue that there is a need for a new development process for legal expert systems. This new system must be built to comply with the law, in particular the GDPR. It must also respect democratic transparency. For these reasons, we present a solution built by lawyers and computer scientists: C atala, a new programming language coupled with a pair programming development process. (shrink)

IntroductionThe idea of video recording in the operating room with panoramic cameras and microphones is a new concept that is changing the approach to medical activities in the OR. However, VR in the OR has brought up many concerns regarding patient privacy and has highlighted legal and ethical issues that were never previously exposed.AimTo review the literature concerning these aspects and provide a better ethical and legal understanding of the new challenges concerning VR in the OR.ConclusionsThere is a disparity between (...) the two main legal models concerning VR in the OR, namely the European legal system ) and the American legal framework ). This difference mainly deals with two distinct bioethical paradigms: GDPR places a strong emphasis on protecting patients’ privacy to improve the public health system, whereas HIPAA indicates the need to generate protocols to safeguard the risks connected to medical activity and patient privacy. Following from this point, we may argue that, at the ethical and bioethical level, GDPR and HIPAA depend mainly on two different ethical models: a perspective based on moral acquaintances and weak proceduralism, respectively. It is worth noting the importance of developing additional guidelines concerning different world regions to avoid the ethical problems that may emerge when simply applying a foreign paradigm to a very different culture. (shrink)

In various official documents, the European Union has declared its goal to pursue a citizen-centric governance of digital transformation. Through a critical review of several of these documents, here we show how “citizen-centric” is more a glamouring than a driving concept. De facto, the EU is enabling a federated data system that is corporate-driven, economic-oriented, and GDPR-compliant; in other words, a Digital Single Market (DSM). This leaves out societal and collective-level dimensions of digital transformation—such as social inclusion, digital sovereignty, (...) and environmental sustainability—which are acknowledged, but not operationalized, by the EU as pillars of a citizen-centric governance. Hence, the door is open to a complementary approach to the governance of digital transformation. We argue that, while a federated data model can constitute the tech-legal backbone of the emerging DSM, a commoning of data, as an ecosystemic approach that maintains a societal and collective outlook by default, can represent a complement to enact a truly citizen-centric governance. (shrink)

Mental privacy is a growing concern as neurotechnologies and digital mental health tools collect and process sensitive brain‐related data. In South Africa, cultural and religious diversity adds complexity to protecting mental privacy, with traditional healing practices, communal decision‐making, and spiritual beliefs influencing mental health perceptions and care. This article examines the ethical, legal, and socio‐cultural challenges of mental privacy in South Africa, focusing on cognitive autonomy, informed consent, and exploitation risks. It critiques global regulatory frameworks, highlighting the limitations of the (...) EU's GDPR and the fragmented US approach in addressing culturally diverse and economically unequal contexts. The article proposes enhancements to South Africa's Protection of Personal Information Act, emphasising the need for explicit classification of neural and mental health data as sensitive categories. Additionally, it recommends culturally informed consent processes, collaboration with traditional and religious leaders, and public awareness initiatives to ensure inclusive mental privacy protections that respect cultural diversity while safeguarding individual rights. (shrink)

PurposeThis paper aims to provide a brief overview of the ethical challenges facing researchers engaging with web archival materials and demonstrates a framework and method for conducting research with historical web data created by young people.Design/methodology/approachThis paper’s methodology is informed by the conceptual framing of data materials in research on the “right to be forgotten” (Crossen-White, 2015; GDPR, 2018; Tsesis, 2014), data afterlives (Agostinho, 2019; Stevenson and Gehl, 2019; Sutherland, 2017), indigenous data sovereignty and governance (Wemigwans, 2018) and feminist (...) ethics of care (Ciforet al., 2019; Cowan, 2020; Franzkeet al., 2020; Luka and Millette, 2018). It demonstrates a new method called an archive promenade, which builds on the walkthrough and scroll-back methods (Lightet al., 2018; Robards and Lincoln, 2017).FindingsThe archive promenades demonstrate how individual attachments to digital traces vary and are often unpredictable, which necessitates further steps to ensure that privacy and data sovereignty are maintained through research with web archives.Originality/valueThis paper demonstrates how the archive promenade methodological intervention can lead to better practices of care with sensitive web materials and brings together previous work on ethical fabrications (Markham, 2012), speculation (Luka and Millette, 2018) and thick context (Marzulloet al., 2018), to yield new insights for research on the experiences of growing up online. (shrink)

In this chapter I identify three problems affecting the plausibility of group privacy and argue in favour of their resolution. The first problem concerns the nature of the groups in question. I shall argue that groups are neither discovered nor invented, but designed by the level of abstraction (LoA) at which a specific analysis of a social system is developed. Their design is therefore justified insofar as the purpose, guiding the choice of the LoA, is justified. This should remove the (...) objection that groups cannot have a right to privacy because groups are mere artefacts (there are no groups, only individuals) or that, even if there are groups, it is too difficult to deal with them. The second problem concerns the possibility of attributing rights to groups. I shall argue that the same logic of attribution of a right to individuals may be used to attribute a right to a group, provided one modifies the LoA and now treats the whole group itself as an individual. This should remove the objection that, even if groups exist and are manageable, they cannot be treated as holders of rights. The third problem concerns the possibility of attributing a right to privacy to groups. I shall argue that sometimes it is the group and only the group, not its members, that is correctly identified as the correct holder of a right to privacy. This should remove the objection that privacy, as a group right, is a right held not by a group as a group but rather by the group’s members severally. The solutions of the three problems supports the thesis that an interpretation of privacy in terms of a protection of the information that constitutes an individual—both in terms of a single person and in terms of a group—is better suited than other interpretations to make sense of group privacy. (shrink)

Open science has recently gained traction as establishment institutions have come on-side and thrown their weight behind the movement and initiatives aimed at creation of information commons. At the same time, the movement's traditional insistence on unrestricted dissemination and reuse of all information of scientific value has been challenged by the movement to strengthen protection of personal data. This article assesses tensions between open science and data protection, with a focus on the GDPR.

The transboundary nature of data flows necessitates a nuanced understanding of core legal concepts across jurisdictions. While terms like “privacy” and “data protection” are often used interchangeably in global discourse, this study posits that they embody distinct, jurisdictionally specific semantic and conceptual structures. Moving beyond traditional doctrinal comparison, this research employs a novel computational linguistics and corpus semantics framework to analyze a curated digital corpus comprising the European Union’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), (...) and China’s Personal Information Protection Law (PIPL). Through keyword co-occurrence network analysis and conceptual mapping, we quantitatively delineate the semantic fields and conceptual networks surrounding core terms. Our findings reveal a fundamental schism: the GDPR constructs a dense, rights-centric conceptual network around “personal data,” deeply intertwined with human dignity; the CCPA orbits around a market-oriented concept of “consumer” and “sale,” framing privacy as a commodifiable good; and the PIPL foregrounds “personal information” within a framework of state security and social management. This study demonstrates the power of data-driven methods to uncover the implicit architectural logics of legal systems, offering a more granular and empirically grounded basis for understanding legal interoperability and conflict in the digital age. (shrink)