LAW AND TECHNOLOGY
CHAPTER IV: FREEDOM OF EXPRESSION AND DIGITAL TECHNOLOGIES ............................ 8
1. Legal framework (p. 101) ...............................................................................................8
1.1. United Nations .....................................................................................................8
1.2. Council of Europe ................................................................................................9
1.3. European Union ................................................................................................. 11
1.4. Belgium ............................................................................................................. 12
CHAPTER V: THE RIGHT TO PRIVACY AND DATA PROTECTION IN A DIGITAL ERA ................ 14
1.Introduction (p. 123)........................................................................................................ 14
1.1 Digital technologies and individuals’ lives ............................................................ 14
1.2 The right to privacy and the right to data protection: related but different ............... 14
2 Legal framework (p. 128) ............................................................................................. 15
2.1 United Nations ................................................................................................... 15
2.2 Council of Europe .............................................................................................. 16
2.2.1 European Convention of Human Rights ........................................................... 16
2.2.2 Convention for the Protection of Individuals with regard to Automatic Processing of
Personal Data (Convention 108) .................................................................................. 17
2.2.3 Non-binding documents ..................................................................................... 18
2.3 European Union ................................................................................................. 18
2.3.1 Primary legislation: charter of fundamental rights ................................................ 18
2.3.2 Secondary legislation ......................................................................................... 19
2.4 Belgium ............................................................................................................. 19
2.5 Focus on GDPR .................................................................................................. 20
2.5.1 Why focus on GDPR? ...................................................................................... 20
2.5.2 Objectives...................................................................................................... 22
2.5.3 Material scope ............................................................................................... 22
2.5.4 Territorial scope ............................................................................................. 22
CHAPTER VI: DIGITAL DISCRIMINATION.......................................................................... 23
1. Introduction (p119) ..................................................................................................... 23
2. Legal framework (p122) ............................................................................................... 24
2.1. United Nations ................................................................................................... 24
2.2. Council of Europe ............................................................................................... 25
2.3. European Union ................................................................................................. 25
2.4. Belgium ............................................................................................................. 26
CHAPTER VII: CHILDREN’S RIGHTS IN THE DIGITAL ENVIRONMENT .................................. 27
1. Introduction (p135) ..................................................................................................... 27
1
, 2. Legal framework (p136) ............................................................................................... 27
2.1. United Nations ................................................................................................... 27
2.2. Examples of how these measures or being implemented in concrete legislation ... 28
2.3. European Union ................................................................................................. 30
CHAPTER VIII: PERSONAL DATA AND NONPERSONAL DATA ............................................ 31
1. Introduction................................................................................................................ 31
2. Legal framework ......................................................................................................... 31
2.1 Council of Europe and European Union ............................................................... 31
2.1.1 Personal data ................................................................................................. 31
2.1.2 Anonymous data ............................................................................................ 32
2.1.3 Pseudonymised data ...................................................................................... 32
2.1.4 Special categories of personal data of ‘sensitive’ data ...................................... 33
2.1.5 (Personal and non-personal) data ................................................................... 34
2.2 Belgium ............................................................................................................. 35
CHAPTER IX: DATA PROTECTION ACTORS ...................................................................... 36
1. Introduction................................................................................................................ 36
2. Legal framework ......................................................................................................... 36
2.1 European Union ................................................................................................. 36
2.1.1 Data subject .................................................................................................. 36
2.1.2 Controller ...................................................................................................... 37
2.1.3 Joint controllers.............................................................................................. 37
2.1.4 Data processor............................................................................................... 38
2.1.5 Sub-processors.............................................................................................. 38
2.1.6 Relationship between controller and processor ............................................... 39
2.1.7 Qualifications of controller/processor ............................................................. 39
2.1.8 Recipient and third party................................................................................. 40
CHAPTER XI: DATA PROTECTION PRINCIPLES ................................................................ 42
1. Lawfulness (art. 5.1 & 6 GDPR) .................................................................................... 42
1.1 Consent (art. 6 (1) a GDPR) ................................................................................. 42
1.2 Contract (art. 6 (1) b GDPR) ................................................................................ 43
1.3 Legal obligation (art. 6 (1) c GDPR) ...................................................................... 44
1.4 Vital interests (art. 6 (1) d GDPR) ......................................................................... 44
1.5 Public interest .................................................................................................... 44
1.6 Legitimate interests (art. 6(1)f) ............................................................................ 45
2. Fairness (art. 5.1.a GDPR) ........................................................................................... 46
3. Transparency (art. 5.1.a + art. 12-14 GDPR) .................................................................. 46
2
, 4. Purpose limitation (art. 5.1.b GDPR) ............................................................................ 46
5. Data minimisation (art. 5.1.c GDPR) ............................................................................ 47
6. Accuracy (art. 5.1.d GDPR) .......................................................................................... 47
7. Storage limitation (art. 5.1.e GDPR).............................................................................. 48
8. Integrity and confidentiality (art. 5.5 GDPR) .................................................................. 48
9. Data protection by design and by default (art. 25 GDPR) ............................................... 48
10. Accountability (art. 5.2 GDPR).................................................................................. 49
CHAPTER XII: DATA SUBJECT RIGHTS ............................................................................ 50
1. Introduction................................................................................................................ 50
2. The right to information (art. 13-14 GDPR) .................................................................... 51
2.1 Transparency / information ................................................................................. 51
2.2 Concise & transparent ........................................................................................ 51
2.3 Intelligible .......................................................................................................... 51
2.4 Easily accessible form ........................................................................................ 52
2.5 Clear and plain language .................................................................................... 53
2.6 How do you need to give the information? ........................................................... 53
3. The right to access (art. 15 GDPR) ................................................................................ 54
4. The right to erasure (‘right to be forgotten’) (art. 17 GDPR) ............................................. 54
5. The right to object (art. 21 GDPR) ................................................................................. 55
6. Automated individual decision-making ........................................................................ 55
6.1 In general ........................................................................................................... 55
6.2 Prohibition (art. 22 (1) GDPR) .............................................................................. 56
6.3 Exceptions (art. 22 (2) GDPR) .............................................................................. 56
6.4 Measures (art. 22 (3) GDPR) ................................................................................ 57
7. Data subject rights in practice ..................................................................................... 57
CHAPTER XIII: DATA PROTECTION COMPLIANCE ............................................................ 60
1. Introduction................................................................................................................ 60
1.1 Legal framework................................................................................................. 60
1.2 Accountability .................................................................................................... 60
1.3 Privacy notice .................................................................................................... 61
1.4 Balancing test .................................................................................................... 62
1.5 Data breach notification ..................................................................................... 63
2. Data protection officer ................................................................................................ 65
2.1 When to appoint a DPO? .................................................................................... 65
2.2 Who to appoint as DPO?..................................................................................... 66
2.3 What tasks does a DPO perform?........................................................................ 66
3
, 3. Data processing agreement......................................................................................... 67
3.1 Data processing agreement – article 28.3 GDPR .................................................. 67
3.2 Joint controllership agreement – article 26 GDPR................................................. 68
4. Records of processing activities .................................................................................. 69
5. Data protection impact assessment – article 35 GDPR ................................................. 71
5.1 What? ................................................................................................................ 71
5.2 When to carry out a DPIA? .................................................................................. 72
5.3 How to carry out a DPIA? .................................................................................... 73
6. Spotlight: AI and Data Protection ................................................................................. 74
CHAPTER XIV: DATA PROTECTION ENFORCEMENT ......................................................... 76
1. Legal framework ......................................................................................................... 76
2. Enforcement: Belgium ................................................................................................ 76
2.1 Independent supervisory authorities (chapter VI) ................................................ 76
2.2 Belgian Data Protection Authority ....................................................................... 78
2.3 Data Protection enforcement: other options........................................................ 78
2.3 Market Court ............................................................................................................ 79
3. Enforcement: European Union .................................................................................... 80
CHAPTER XV: THE REGULATION OF ELECTRONIC COMMERCE AND DIGITAL SERVICES ..... 83
1. Introduction................................................................................................................ 83
2. The Digital Markets Act ................................................................................................ 84
2.1 Gatekeeper? ...................................................................................................... 84
2.2 Cases ................................................................................................................ 85
3 The Digital Services Act ............................................................................................... 85
3.1 Introduction ....................................................................................................... 85
3.2 Material scope ................................................................................................... 86
3.3 Territorial scope ................................................................................................. 87
3.4 Due diligence obligations ................................................................................... 87
3.4.1 Four focal points ................................................................................................ 88
3.4.1.1 Content moderation ..................................................................................... 88
3.4.1.2 Protection of minors ..................................................................................... 91
3.4.1.3 Recommender systems ............................................................................... 93
3.4.1.4 Risk assessment & mitigation by VLOPs/VLOSEs ........................................... 93
3.5 Practical implementation ................................................................................... 96
3.5.1 Basic Information ........................................................................................... 96
3.5.2 Enforcement vis-à-vis VLOPSEs .................................................................... 100
3.5.2.1 Risk management cycle ........................................................................ 100
4
, 3.5.2.2 The Commission’s investigatory powers ................................................ 101
3.5.2.3 Non-compliance decision/fine .............................................................. 101
3.5.3 Politics and law ................................................................................................ 102
CHAPTER XVI: THE LIABILITY OF ONLINE INTERMEDIAIRIES ........................................... 103
1. Introduction (p293) ................................................................................................... 103
2. Legal framework (p294) ............................................................................................. 103
2.3 Council of Europe ............................................................................................. 103
2.4 European Union (p297) ..................................................................................... 104
CHAPTER XVII: CONSUMER PROTECTION IN THE ONLINE ENVIRONMENT ...................... 107
1. Spotplight: dark patterns ........................................................................................... 107
1.1. Definition ......................................................................................................... 107
1.2. Consumer Agenda by EU Commission .............................................................. 108
1.3. Legal Framework .............................................................................................. 108
1.3.1 Unfair commercial practices directive (UCPD) (p. 334) ....................................... 109
1.3.2 Data protection ................................................................................................ 110
1.3.3 Digital Services Act ........................................................................................... 112
1.3.4 Artificial Intelligence Act ................................................................................... 113
1.3.5 Conclusion legal framework.............................................................................. 114
CHAPTER XVIII: THE REGULATION OF DATA-RELATED PRODUCTS AND SERVICES ........... 115
1.Data intermediation services ......................................................................................... 115
1.1 Definition ............................................................................................................... 115
1.2 Obligations ............................................................................................................. 116
2. Data altruism services (p. 356) .................................................................................. 117
3. Connected products and related services .................................................................. 118
3.1. Connected products – what is it? ...................................................................... 118
3.2. Related services – what is it? ............................................................................ 118
3.3. Connected products and related services ......................................................... 119
4. Data processing services .......................................................................................... 121
5. Examples ................................................................................................................. 122
6. Overview of proposed legal framework: Digital Omnibus ............................................ 123
CHAPTER XXI: ONLINE ADVERTISING .......................................................................... 124
1. Legal framework ....................................................................................................... 124
2. Direct marketing and targeted advertising .................................................................. 124
2.1. Direct marketing .............................................................................................. 124
2.2. Targeted advertising ......................................................................................... 125
2.2.1 Definition ......................................................................................................... 125
5
, 2.2.2 GDPR ........................................................................................................... 126
2.3. Belgian Code of Economic Law (WER) (ePrivacy Directive) ................................. 127
2.3.1 Natural or legal purpose sending direct marketing communications ................... 127
2.3.2 Interplay GDPR and ePrivacy Directive .............................................................. 128
2.4. Legislation for specific market players .............................................................. 129
2.4.1 Information society services ......................................................................... 129
2.4.2 Online platforms .......................................................................................... 129
2.4.3 Online platforms accessible to minors .......................................................... 129
2.4.4 VLOPs/VLOSEs............................................................................................. 130
2.4.5 Political Advertising Regulation ......................................................................... 130
3. Business use of online platform for advertising .......................................................... 131
4. Spotlight: influencer marketing (p. 428)...................................................................... 131
4.1. Legal framework............................................................................................... 131
4.2. Legal implications ............................................................................................ 132
CHAPTER XX: COOKIES AND SIMILAR TRACKING TECHNOLOGIES ................................ 133
1. Introduction.............................................................................................................. 133
2. Practical implementation .......................................................................................... 135
3. Valid consent ............................................................................................................ 135
CHAPTER XXIII: CYBERCRIME AND CYBERSECURITY .................................................... 137
1. Cybercrime (p. 455) .................................................................................................. 137
1.1. Cybercrime: substantive .................................................................................. 137
1.1.1 Concept ........................................................................................................... 137
1.1.2 Challenges ....................................................................................................... 138
1.1.3 Convention on Cybercrime ............................................................................... 138
1.1.4 United Nations Convention on Cybercrime ........................................................ 139
1.1.5 Examples of crimes .......................................................................................... 139
1.1.5.1 Online Child Sexual exploitation ................................................................. 139
1.1.5.2 Non-consensual dissemination of intimate images ..................................... 142
1.1.5.3 Hacking ..................................................................................................... 143
1.1.6 Digital Services Act ........................................................................................... 144
1.2. Cybercrime: procedural.................................................................................... 144
1.2.1 Challenges for policymakers, legislators and law enforcement .......................... 144
1.2.2 Legal framework ............................................................................................... 145
1.2.2.1 United Nations Cybercrime Convention ...................................................... 145
1.2.2.2 Council of Europe Cybercrime Convention.................................................. 145
1.2.2.3 E-evidence ................................................................................................ 145
6
, 1.2.2.4 Belgian criminal code ................................................................................. 146
2. Cybersecurity ........................................................................................................... 147
2.1. Legal Framework .............................................................................................. 147
2.1.1 Directive on measures for a high common level of cybersecurity across the union
147
2.1.2 Belgium ....................................................................................................... 147
2.1.3 Cyberresilience act ...................................................................................... 150
CHAPTER XXIV: THE REGULATION OF ARTIFICIAL INTELLIGENCE .................................. 151
1. Introduction.............................................................................................................. 151
1.1 What is AI? ............................................................................................................. 151
1.2 What are the risks? ........................................................................................... 153
2. Legal Frame .............................................................................................................. 154
3. Council of Europe ..................................................................................................... 156
4. European Union ........................................................................................................ 157
4.1. European Commission (2020) White Paper On Artificial Intelligence - A European
approach to excellence and trust .................................................................................. 157
4.2. European Union – AI Act ................................................................................... 159
4.2.1 Introduction ..................................................................................................... 159
4.2.2 A dynamic and evolving framework ................................................................... 160
4.2.3 Objectives ........................................................................................................ 160
4.2.4 Definition of AI system ...................................................................................... 161
4.2.5 Scope of the AI act............................................................................................ 161
4.2.6 The obligations ................................................................................................. 162
4.2.7 Ai act – monitoring and enforcement ................................................................. 175
4.2.8 Remedies......................................................................................................... 175
CHAPTER XXV: LEGAL TECH........................................................................................ 176
7
, CHAPTER IV: FREEDOM OF EXPRESSION AND DIGITAL
TECHNOLOGIES
1. Legal framework (p. 101)
- Freedom of expression constitutes one of the essential foundations of [a democratic]
society, one of the basic conditions for its progress and for the development of every
man. (ECtHR, Handyside v. UK, 7 December 1976)
o if you hear how other people think you can form your own opinion
o and technology (internet) is very beneficial for the freedom of expression, it is
way easier to get more information, to hear other people’s opinions
▪ but also some disadvantages (the way techno has a negative impact on
freedom of expression
o
- the disinformation has been a real concern, not only on FOE but also on fair elections
- the algorithm works in a way that you are in a kind of filter bubble where you only get to
see the content that allies with your one ideas
- sometimes governments ask information of these companies
- these negative things are the problems of techno on FOE → and then the question is:
should we regulate?
1.1. United Nations
- Article 19 Universal Declaration of Human Rights Article 19 International Covenant on
Civil and Political Rights
- ➜ apply to all forms of expression, including all forms of audiovisual, electronic and
internet-based expression
- ➜ protection is not absolute, freedom may be subject to restrictions, if conditions are
fulfilled
- UN Human Rights Council:
o The same rights that people have offline must also be protected online, in
particular freedom of expression
o The internet can be an important tool for development and for exercising
human rights
o Condemns unequivocally measures in violation of international human rights
law that prevent or disrupt an individual’s ability to seek, receive or impart
information online, including Internet shutdowns and online censorship
8
, o Importance of countering expressions that may have a negative impact, e.g.
dissemination of online information that may be deliberately misleading or
false
- Special Rapporteur on the promotion and protection of freedom of expression (Irene
Khan) → Reports on:
o Reinforcing media freedom and safety of journalists in the digital age
o Disinformation and freedom of opinion and expression
o Online hate speech
o Surveillance and human rights
o Artificial Intelligence technologies and implications for the information
environment
o Online content regulation
o Freedom of expression, states and the private sector in the digital age
o The use of encryption and anonymity to exercise the rights to freedom of opinion
and expression in the digital age
- ➔ they gather info from all over the world then they write the reports and they give some
advice to some governments → interesting source bc we may be too focused on Europe
and the West and this source reports the whole world
1.2. Council of Europe
➔ Art. 10 ECHR: FOE
- Committee of Ministers
o all rights enshrined in the Convention for the Protection of Human Rights and
Fundamental Freedoms remain fully valid in the information age and should
continue to be protected regardless of new technological developments
o freedom of expression is essential for democratic societies and digital
technologies have become indispensable for this freedom
o Member States must assess and review their legislative, regulatory and
supervisory frameworks and policies as well as their practices with respect to the
impact of digital technologies on freedom of expression
o Privately owned providers of digital infrastructures that enable freedom of
expression online and shape the conditions under which this right can be
exercised play pivotal role → companies have a huge responsibility but it’s the
states who need to make sure the companies do this
- European Court of Human Rights
o Over the past decade increasingly cases related to freedom of expression and
the online environment
o “The Internet has now become one of the principal means by which individuals
exercise their right to freedom of expression and information, providing as it does
essential tools for participation in activities and discussions concerning political
issues and issues of general interest"
o Judgments on:
▪ internet blocking / censorship
• see examples further on
▪ hyperlinks
9
CHAPTER IV: FREEDOM OF EXPRESSION AND DIGITAL TECHNOLOGIES ............................ 8
1. Legal framework (p. 101) ...............................................................................................8
1.1. United Nations .....................................................................................................8
1.2. Council of Europe ................................................................................................9
1.3. European Union ................................................................................................. 11
1.4. Belgium ............................................................................................................. 12
CHAPTER V: THE RIGHT TO PRIVACY AND DATA PROTECTION IN A DIGITAL ERA ................ 14
1.Introduction (p. 123)........................................................................................................ 14
1.1 Digital technologies and individuals’ lives ............................................................ 14
1.2 The right to privacy and the right to data protection: related but different ............... 14
2 Legal framework (p. 128) ............................................................................................. 15
2.1 United Nations ................................................................................................... 15
2.2 Council of Europe .............................................................................................. 16
2.2.1 European Convention of Human Rights ........................................................... 16
2.2.2 Convention for the Protection of Individuals with regard to Automatic Processing of
Personal Data (Convention 108) .................................................................................. 17
2.2.3 Non-binding documents ..................................................................................... 18
2.3 European Union ................................................................................................. 18
2.3.1 Primary legislation: charter of fundamental rights ................................................ 18
2.3.2 Secondary legislation ......................................................................................... 19
2.4 Belgium ............................................................................................................. 19
2.5 Focus on GDPR .................................................................................................. 20
2.5.1 Why focus on GDPR? ...................................................................................... 20
2.5.2 Objectives...................................................................................................... 22
2.5.3 Material scope ............................................................................................... 22
2.5.4 Territorial scope ............................................................................................. 22
CHAPTER VI: DIGITAL DISCRIMINATION.......................................................................... 23
1. Introduction (p119) ..................................................................................................... 23
2. Legal framework (p122) ............................................................................................... 24
2.1. United Nations ................................................................................................... 24
2.2. Council of Europe ............................................................................................... 25
2.3. European Union ................................................................................................. 25
2.4. Belgium ............................................................................................................. 26
CHAPTER VII: CHILDREN’S RIGHTS IN THE DIGITAL ENVIRONMENT .................................. 27
1. Introduction (p135) ..................................................................................................... 27
1
, 2. Legal framework (p136) ............................................................................................... 27
2.1. United Nations ................................................................................................... 27
2.2. Examples of how these measures or being implemented in concrete legislation ... 28
2.3. European Union ................................................................................................. 30
CHAPTER VIII: PERSONAL DATA AND NONPERSONAL DATA ............................................ 31
1. Introduction................................................................................................................ 31
2. Legal framework ......................................................................................................... 31
2.1 Council of Europe and European Union ............................................................... 31
2.1.1 Personal data ................................................................................................. 31
2.1.2 Anonymous data ............................................................................................ 32
2.1.3 Pseudonymised data ...................................................................................... 32
2.1.4 Special categories of personal data of ‘sensitive’ data ...................................... 33
2.1.5 (Personal and non-personal) data ................................................................... 34
2.2 Belgium ............................................................................................................. 35
CHAPTER IX: DATA PROTECTION ACTORS ...................................................................... 36
1. Introduction................................................................................................................ 36
2. Legal framework ......................................................................................................... 36
2.1 European Union ................................................................................................. 36
2.1.1 Data subject .................................................................................................. 36
2.1.2 Controller ...................................................................................................... 37
2.1.3 Joint controllers.............................................................................................. 37
2.1.4 Data processor............................................................................................... 38
2.1.5 Sub-processors.............................................................................................. 38
2.1.6 Relationship between controller and processor ............................................... 39
2.1.7 Qualifications of controller/processor ............................................................. 39
2.1.8 Recipient and third party................................................................................. 40
CHAPTER XI: DATA PROTECTION PRINCIPLES ................................................................ 42
1. Lawfulness (art. 5.1 & 6 GDPR) .................................................................................... 42
1.1 Consent (art. 6 (1) a GDPR) ................................................................................. 42
1.2 Contract (art. 6 (1) b GDPR) ................................................................................ 43
1.3 Legal obligation (art. 6 (1) c GDPR) ...................................................................... 44
1.4 Vital interests (art. 6 (1) d GDPR) ......................................................................... 44
1.5 Public interest .................................................................................................... 44
1.6 Legitimate interests (art. 6(1)f) ............................................................................ 45
2. Fairness (art. 5.1.a GDPR) ........................................................................................... 46
3. Transparency (art. 5.1.a + art. 12-14 GDPR) .................................................................. 46
2
, 4. Purpose limitation (art. 5.1.b GDPR) ............................................................................ 46
5. Data minimisation (art. 5.1.c GDPR) ............................................................................ 47
6. Accuracy (art. 5.1.d GDPR) .......................................................................................... 47
7. Storage limitation (art. 5.1.e GDPR).............................................................................. 48
8. Integrity and confidentiality (art. 5.5 GDPR) .................................................................. 48
9. Data protection by design and by default (art. 25 GDPR) ............................................... 48
10. Accountability (art. 5.2 GDPR).................................................................................. 49
CHAPTER XII: DATA SUBJECT RIGHTS ............................................................................ 50
1. Introduction................................................................................................................ 50
2. The right to information (art. 13-14 GDPR) .................................................................... 51
2.1 Transparency / information ................................................................................. 51
2.2 Concise & transparent ........................................................................................ 51
2.3 Intelligible .......................................................................................................... 51
2.4 Easily accessible form ........................................................................................ 52
2.5 Clear and plain language .................................................................................... 53
2.6 How do you need to give the information? ........................................................... 53
3. The right to access (art. 15 GDPR) ................................................................................ 54
4. The right to erasure (‘right to be forgotten’) (art. 17 GDPR) ............................................. 54
5. The right to object (art. 21 GDPR) ................................................................................. 55
6. Automated individual decision-making ........................................................................ 55
6.1 In general ........................................................................................................... 55
6.2 Prohibition (art. 22 (1) GDPR) .............................................................................. 56
6.3 Exceptions (art. 22 (2) GDPR) .............................................................................. 56
6.4 Measures (art. 22 (3) GDPR) ................................................................................ 57
7. Data subject rights in practice ..................................................................................... 57
CHAPTER XIII: DATA PROTECTION COMPLIANCE ............................................................ 60
1. Introduction................................................................................................................ 60
1.1 Legal framework................................................................................................. 60
1.2 Accountability .................................................................................................... 60
1.3 Privacy notice .................................................................................................... 61
1.4 Balancing test .................................................................................................... 62
1.5 Data breach notification ..................................................................................... 63
2. Data protection officer ................................................................................................ 65
2.1 When to appoint a DPO? .................................................................................... 65
2.2 Who to appoint as DPO?..................................................................................... 66
2.3 What tasks does a DPO perform?........................................................................ 66
3
, 3. Data processing agreement......................................................................................... 67
3.1 Data processing agreement – article 28.3 GDPR .................................................. 67
3.2 Joint controllership agreement – article 26 GDPR................................................. 68
4. Records of processing activities .................................................................................. 69
5. Data protection impact assessment – article 35 GDPR ................................................. 71
5.1 What? ................................................................................................................ 71
5.2 When to carry out a DPIA? .................................................................................. 72
5.3 How to carry out a DPIA? .................................................................................... 73
6. Spotlight: AI and Data Protection ................................................................................. 74
CHAPTER XIV: DATA PROTECTION ENFORCEMENT ......................................................... 76
1. Legal framework ......................................................................................................... 76
2. Enforcement: Belgium ................................................................................................ 76
2.1 Independent supervisory authorities (chapter VI) ................................................ 76
2.2 Belgian Data Protection Authority ....................................................................... 78
2.3 Data Protection enforcement: other options........................................................ 78
2.3 Market Court ............................................................................................................ 79
3. Enforcement: European Union .................................................................................... 80
CHAPTER XV: THE REGULATION OF ELECTRONIC COMMERCE AND DIGITAL SERVICES ..... 83
1. Introduction................................................................................................................ 83
2. The Digital Markets Act ................................................................................................ 84
2.1 Gatekeeper? ...................................................................................................... 84
2.2 Cases ................................................................................................................ 85
3 The Digital Services Act ............................................................................................... 85
3.1 Introduction ....................................................................................................... 85
3.2 Material scope ................................................................................................... 86
3.3 Territorial scope ................................................................................................. 87
3.4 Due diligence obligations ................................................................................... 87
3.4.1 Four focal points ................................................................................................ 88
3.4.1.1 Content moderation ..................................................................................... 88
3.4.1.2 Protection of minors ..................................................................................... 91
3.4.1.3 Recommender systems ............................................................................... 93
3.4.1.4 Risk assessment & mitigation by VLOPs/VLOSEs ........................................... 93
3.5 Practical implementation ................................................................................... 96
3.5.1 Basic Information ........................................................................................... 96
3.5.2 Enforcement vis-à-vis VLOPSEs .................................................................... 100
3.5.2.1 Risk management cycle ........................................................................ 100
4
, 3.5.2.2 The Commission’s investigatory powers ................................................ 101
3.5.2.3 Non-compliance decision/fine .............................................................. 101
3.5.3 Politics and law ................................................................................................ 102
CHAPTER XVI: THE LIABILITY OF ONLINE INTERMEDIAIRIES ........................................... 103
1. Introduction (p293) ................................................................................................... 103
2. Legal framework (p294) ............................................................................................. 103
2.3 Council of Europe ............................................................................................. 103
2.4 European Union (p297) ..................................................................................... 104
CHAPTER XVII: CONSUMER PROTECTION IN THE ONLINE ENVIRONMENT ...................... 107
1. Spotplight: dark patterns ........................................................................................... 107
1.1. Definition ......................................................................................................... 107
1.2. Consumer Agenda by EU Commission .............................................................. 108
1.3. Legal Framework .............................................................................................. 108
1.3.1 Unfair commercial practices directive (UCPD) (p. 334) ....................................... 109
1.3.2 Data protection ................................................................................................ 110
1.3.3 Digital Services Act ........................................................................................... 112
1.3.4 Artificial Intelligence Act ................................................................................... 113
1.3.5 Conclusion legal framework.............................................................................. 114
CHAPTER XVIII: THE REGULATION OF DATA-RELATED PRODUCTS AND SERVICES ........... 115
1.Data intermediation services ......................................................................................... 115
1.1 Definition ............................................................................................................... 115
1.2 Obligations ............................................................................................................. 116
2. Data altruism services (p. 356) .................................................................................. 117
3. Connected products and related services .................................................................. 118
3.1. Connected products – what is it? ...................................................................... 118
3.2. Related services – what is it? ............................................................................ 118
3.3. Connected products and related services ......................................................... 119
4. Data processing services .......................................................................................... 121
5. Examples ................................................................................................................. 122
6. Overview of proposed legal framework: Digital Omnibus ............................................ 123
CHAPTER XXI: ONLINE ADVERTISING .......................................................................... 124
1. Legal framework ....................................................................................................... 124
2. Direct marketing and targeted advertising .................................................................. 124
2.1. Direct marketing .............................................................................................. 124
2.2. Targeted advertising ......................................................................................... 125
2.2.1 Definition ......................................................................................................... 125
5
, 2.2.2 GDPR ........................................................................................................... 126
2.3. Belgian Code of Economic Law (WER) (ePrivacy Directive) ................................. 127
2.3.1 Natural or legal purpose sending direct marketing communications ................... 127
2.3.2 Interplay GDPR and ePrivacy Directive .............................................................. 128
2.4. Legislation for specific market players .............................................................. 129
2.4.1 Information society services ......................................................................... 129
2.4.2 Online platforms .......................................................................................... 129
2.4.3 Online platforms accessible to minors .......................................................... 129
2.4.4 VLOPs/VLOSEs............................................................................................. 130
2.4.5 Political Advertising Regulation ......................................................................... 130
3. Business use of online platform for advertising .......................................................... 131
4. Spotlight: influencer marketing (p. 428)...................................................................... 131
4.1. Legal framework............................................................................................... 131
4.2. Legal implications ............................................................................................ 132
CHAPTER XX: COOKIES AND SIMILAR TRACKING TECHNOLOGIES ................................ 133
1. Introduction.............................................................................................................. 133
2. Practical implementation .......................................................................................... 135
3. Valid consent ............................................................................................................ 135
CHAPTER XXIII: CYBERCRIME AND CYBERSECURITY .................................................... 137
1. Cybercrime (p. 455) .................................................................................................. 137
1.1. Cybercrime: substantive .................................................................................. 137
1.1.1 Concept ........................................................................................................... 137
1.1.2 Challenges ....................................................................................................... 138
1.1.3 Convention on Cybercrime ............................................................................... 138
1.1.4 United Nations Convention on Cybercrime ........................................................ 139
1.1.5 Examples of crimes .......................................................................................... 139
1.1.5.1 Online Child Sexual exploitation ................................................................. 139
1.1.5.2 Non-consensual dissemination of intimate images ..................................... 142
1.1.5.3 Hacking ..................................................................................................... 143
1.1.6 Digital Services Act ........................................................................................... 144
1.2. Cybercrime: procedural.................................................................................... 144
1.2.1 Challenges for policymakers, legislators and law enforcement .......................... 144
1.2.2 Legal framework ............................................................................................... 145
1.2.2.1 United Nations Cybercrime Convention ...................................................... 145
1.2.2.2 Council of Europe Cybercrime Convention.................................................. 145
1.2.2.3 E-evidence ................................................................................................ 145
6
, 1.2.2.4 Belgian criminal code ................................................................................. 146
2. Cybersecurity ........................................................................................................... 147
2.1. Legal Framework .............................................................................................. 147
2.1.1 Directive on measures for a high common level of cybersecurity across the union
147
2.1.2 Belgium ....................................................................................................... 147
2.1.3 Cyberresilience act ...................................................................................... 150
CHAPTER XXIV: THE REGULATION OF ARTIFICIAL INTELLIGENCE .................................. 151
1. Introduction.............................................................................................................. 151
1.1 What is AI? ............................................................................................................. 151
1.2 What are the risks? ........................................................................................... 153
2. Legal Frame .............................................................................................................. 154
3. Council of Europe ..................................................................................................... 156
4. European Union ........................................................................................................ 157
4.1. European Commission (2020) White Paper On Artificial Intelligence - A European
approach to excellence and trust .................................................................................. 157
4.2. European Union – AI Act ................................................................................... 159
4.2.1 Introduction ..................................................................................................... 159
4.2.2 A dynamic and evolving framework ................................................................... 160
4.2.3 Objectives ........................................................................................................ 160
4.2.4 Definition of AI system ...................................................................................... 161
4.2.5 Scope of the AI act............................................................................................ 161
4.2.6 The obligations ................................................................................................. 162
4.2.7 Ai act – monitoring and enforcement ................................................................. 175
4.2.8 Remedies......................................................................................................... 175
CHAPTER XXV: LEGAL TECH........................................................................................ 176
7
, CHAPTER IV: FREEDOM OF EXPRESSION AND DIGITAL
TECHNOLOGIES
1. Legal framework (p. 101)
- Freedom of expression constitutes one of the essential foundations of [a democratic]
society, one of the basic conditions for its progress and for the development of every
man. (ECtHR, Handyside v. UK, 7 December 1976)
o if you hear how other people think you can form your own opinion
o and technology (internet) is very beneficial for the freedom of expression, it is
way easier to get more information, to hear other people’s opinions
▪ but also some disadvantages (the way techno has a negative impact on
freedom of expression
o
- the disinformation has been a real concern, not only on FOE but also on fair elections
- the algorithm works in a way that you are in a kind of filter bubble where you only get to
see the content that allies with your one ideas
- sometimes governments ask information of these companies
- these negative things are the problems of techno on FOE → and then the question is:
should we regulate?
1.1. United Nations
- Article 19 Universal Declaration of Human Rights Article 19 International Covenant on
Civil and Political Rights
- ➜ apply to all forms of expression, including all forms of audiovisual, electronic and
internet-based expression
- ➜ protection is not absolute, freedom may be subject to restrictions, if conditions are
fulfilled
- UN Human Rights Council:
o The same rights that people have offline must also be protected online, in
particular freedom of expression
o The internet can be an important tool for development and for exercising
human rights
o Condemns unequivocally measures in violation of international human rights
law that prevent or disrupt an individual’s ability to seek, receive or impart
information online, including Internet shutdowns and online censorship
8
, o Importance of countering expressions that may have a negative impact, e.g.
dissemination of online information that may be deliberately misleading or
false
- Special Rapporteur on the promotion and protection of freedom of expression (Irene
Khan) → Reports on:
o Reinforcing media freedom and safety of journalists in the digital age
o Disinformation and freedom of opinion and expression
o Online hate speech
o Surveillance and human rights
o Artificial Intelligence technologies and implications for the information
environment
o Online content regulation
o Freedom of expression, states and the private sector in the digital age
o The use of encryption and anonymity to exercise the rights to freedom of opinion
and expression in the digital age
- ➔ they gather info from all over the world then they write the reports and they give some
advice to some governments → interesting source bc we may be too focused on Europe
and the West and this source reports the whole world
1.2. Council of Europe
➔ Art. 10 ECHR: FOE
- Committee of Ministers
o all rights enshrined in the Convention for the Protection of Human Rights and
Fundamental Freedoms remain fully valid in the information age and should
continue to be protected regardless of new technological developments
o freedom of expression is essential for democratic societies and digital
technologies have become indispensable for this freedom
o Member States must assess and review their legislative, regulatory and
supervisory frameworks and policies as well as their practices with respect to the
impact of digital technologies on freedom of expression
o Privately owned providers of digital infrastructures that enable freedom of
expression online and shape the conditions under which this right can be
exercised play pivotal role → companies have a huge responsibility but it’s the
states who need to make sure the companies do this
- European Court of Human Rights
o Over the past decade increasingly cases related to freedom of expression and
the online environment
o “The Internet has now become one of the principal means by which individuals
exercise their right to freedom of expression and information, providing as it does
essential tools for participation in activities and discussions concerning political
issues and issues of general interest"
o Judgments on:
▪ internet blocking / censorship
• see examples further on
▪ hyperlinks
9
