The author evaluates the costs and/or gains and the interference (positive or negative) in the commercial, public administrative and social spheres that data protection laws have the potential to create, with numerous references to legislation and administrative decision making in a wide variety of jurisdictions.

This is the first work to examine the fundamental aims and principles of data privacy law in an international context. Bygrave analyses relevant law from across the globe, paying particular attention to international instruments and using these as a foundation for examining national law.

Bringing together leading European scholars, this thought-provoking Research Handbook provides a state-of-the-art overview of the scope of research and current thinking in the area of European data protection. Offering critical insights on prominent strands of research, it examines key challenges and potential solutions in the field. Chapters explore the fundamental right to personal data protection, government-to-business data sharing, data protection as performance-based regulation, privacy and marketing in data-driven business models, data protection and judicial automation, and the role of consent in an algorithmic society.

In the contemporary information society, organisations increasingly rely on the collection and analysis of large-scale data (popularly called ‘big data’) to make decisions. These processes, which take place largely beyond the individual’s knowledge, produce a cascade of effects that go beyond privacy and data protection. Should we focus on the possibilities of tackling these often negative effects through other areas of law, or maybe even find new solutions to cope with the dark side of big data? This ground-breaking book is the first to address this crucially important question in detail. Among the issues raised in the analysis are such vital elements as the following: − what is meant by ‘big data’; – ‘privacy’ according to the European Court of Human Rights and the Court of Justice of the European Union; – what the European Union legal framework on privacy and data protection consists of and how it functions in the light of big data; – what companies, governments and other organisations are permitted to do with big data under the current regulatory framework; – the central importance of personal autonomy; – circumstances that influence whether or not the right to privacy is triggered; – big data’s possible impact on democracy through, inter alia, potentially limiting freedom of expression; – how governmental or corporate surveillance chills the receiver’s gathering of information and ideas; – selective offering of choices or information, or manipulation of people’s ideas; – procedural aspects that influence the extrapolation of normative concepts of privacy and data protection; and – how discrimination occurs in big data. This book foregrounds a critical scrutiny of commercial uses of big data – its scale, its limited capacity for independent oversight and the expected prevalence of interference with individuals’ rights. The author’s conclusions explore possible legal alternatives to mitigate the negative impact of big data, using legal instruments, case law and legal academic literature in her analysis. Because the amount of digital data keeps growing and the private lives of individuals are increasingly taking place online – and because of the opacity of the big data process, the fundamental values that are at stake, and the speed of technological developments compared to the pace of legal reform – this comprehensive assessment of flaws in the current framework and possible practical solutions will be warmly welcomed by practitioners, policymakers and government officials in all legal fields related to privacy and data protection.

This thesis examines the principle of purpose limitation in data protection law from the perspective of regulating data-driven innovation. According to this approach, the principle of purpose limitation not only protects an individual's autonomy but simultaneously leaves sufficient room for data controllers to innovate when finding the best solution for protection. The first component of the principle of purpose limitation (i.e. to specify the purpose of data processing) is a precautionary protection instrument which obliges the controller to identify specific risks arising from its processing against all fundamental rights of the data subject. In contrast, the second component (i.e. the requirement to limit data processing to the preceding purpose) aims to control the risk caused by data processing that occurred at a later stage and adds to the risks which were previously identified. This approach provides an answer to the question of how the General Data Protection Regulation which does not only effectively protect an individual's autonomy but also helps controllers to turn their legal compliance into a mechanism that enhances innovation, should be interpreted with regard to all the fundamental rights of the data subject.

data. Furthermore, the European Union established clear basic principles for the collection, storage and use of personal data by governments, businesses and other organizations or individuals in Directive 95/46/EC and Directive 2002/58/EC on Privacy and Electronic communications. Nonetheless, the twenty-?rst century citizen – utilizing the full potential of what ICT-technology has to offer – seems to develop a digital persona that becomes increasingly part of his individual social identity. From this perspective, control over personal information is control over an aspect of the identity one projects in the world. The right to privacy is the freedom from unreasonable constraints on one’s own identity. Transactiondata–bothtraf?candlocationdata–deserveourparticularattention. As we make phone calls, send e-mails or SMS messages, data trails are generated within public networks that we use for these communications. While traf?c data are necessary for the provision of communication services, they are also very sensitive data. They can give a complete picture of a person’s contacts, habits, interests, act- ities and whereabouts. Location data, especially if very precise, can be used for the provision of services such as route guidance, location of stolen or missing property, tourist information, etc. In case of emergency, they can be helpful in dispatching assistance and rescue teams to the location of a person in distress. However, p- cessing location data in mobile communication networks also creates the possibility of permanent surveillance.

The complexities of implementing the General Data Protection Regulation (GDPR) continue to grow as it progresses through new and ever-changing technologies, business models, codes of conduct, and decisions of the supervisory authorities, and the courts. This eminently practical guide to implementing the GDPR – written in an original, problem-solving style by a highly experienced data protection expert with equal knowledge of both law and technology – provides a step-by-step project management approach to building a GDPR-compliant data protection system, assessing, and documenting the risks and then implementing these changes through processes at the operational level. With detailed attention to case law (Member State, ECJ, and ECHR), especially where affecting high-risk areas that have attracted scrutiny, the guidance proceeds systematically through such topics and issues as the following: required documentation, policies, and procedures; risk assessment tools and analysis frameworks; children’s data; employee and health data; international transfers post-Schrems II; data subject rights including the right of access; data retention and erasure; tracking and surveillance; and effects of technologies such as artificial intelligence, biometrics, and machine learning. With its practical examples derived from the author’s experience in building GDPR-compliant software, as well as its analysis of case law and enforcement priorities, this incomparable guide enables company data protection officers and compliance staff to advise on key issues with full awareness of the legal and reputational risks and how to mitigate them. It is also sure to be of immeasurable value to concerned regulators and policymakers at all government levels. “…it's going to be the go to resource for practitioners.” Tom Gilligan, Data Protection Consultant, September 2021 "I purchased this book recently and I’m very glad I did. It’s the textbook I have been waiting for. As someone relatively new to data protection, I was finding it very difficult to find books on the practical side of data protection. This book is very clearly laid out with practical examples and case law given for each topic, which is immensely helpful. I would recommend it to any data protection practitioners." Jennifer Breslin, LLM CIPP/E, AIPP Member

Data protection law is often positioned as a regulatory solution to the risks posed by computational systems. Despite the widespread adoption of data protection laws, however, there are those who remain sceptical as to their capacity to engender change. Much of this criticism focuses on our role as 'data subjects'. It has been demonstrated repeatedly that we lack the capacity to act in our own best interests and, what is more, that our decisions have negative impacts on others. Our decision-making limitations seem to be the inevitable by-product of the technological, social, and economic reality. Data protection law bakes in these limitations by providing frameworks for notions such as consent and subjective control-rights and by relying on those who process our data to do so fairly. Despite these valid concerns, Data Protection Law and Emotion argues that the (in)effectiveness of these laws are often more difficult to discern than the critical literature would suggest, while also emphasising the importance of the conceptual value of subjective control. These points are explored (and indeed, exposed) by investigating data protection law through the lens of the insights provided by law and emotion scholarship and demonstrating the role emotions play in our decision-making. The book uses the development of Emotional Artificial Intelligence, a particularly controversial technology, as a case study to analyse these issues. Original and insightful, Data Protection Law and Emotion offers a unique contribution to a contentious debate that will appeal to students and academics in data protection and privacy, policymakers, practitioners, and regulators.

Nearly two decades after the EU first enacted data protection rules, key questions about the nature and scope of this EU policy, and the harms it seeks to prevent, remain unanswered. The inclusion of a Right to Data Protection in the EU Charter has increased the salience of these questions, which must be addressed in order to ensure the legitimacy, effectiveness and development of this Charter right and the EU data protection regime more generally. The Foundations of EU Data Protection Law is a timely and important work which sheds new light on this neglected area of law, challenging the widespread assumption that data protection is merely a subset of the right to privacy. By positioning EU data protection law within a comprehensive conceptual framework, it argues that data protection has evolved from a regulatory instrument into a fundamental right in the EU legal order and that this right grants individuals more control over more forms of data than the right to privacy. It suggests that this dimension of the right to data protection should be explicitly recognized, while identifying the practical and conceptual limits of individual control over personal data. At a time when EU data protection law is sitting firmly in the international spotlight, this book offers academics, policy-makers, and practitioners a coherent vision for the future of this key policy and fundamental right in the EU legal order, and how best to realize it.

This book provides a comparison and practical guide for academics, students, and the business community of the current data protection laws in selected Asia Pacific countries (Australia, India, Indonesia, Japan Malaysia, Singapore, Thailand) and the European Union. The book shows how over the past three decades the range of economic, political, and social activities that have moved to the internet has increased significantly. This technological transformation has resulted in the collection of personal data, its use and storage across international boundaries at a rate that governments have been unable to keep pace. The book highlights challenges and potential solutions related to data protection issues arising from cross-border problems in which personal data is being considered as intellectual property, within transnational contracts and in anti-trust law. The book also discusses the emerging challenges in protecting personal data and promoting cyber security. The book provides a deeper understanding of the legal risks and frameworks associated with data protection law for local, regional and global academics, students, businesses, industries, legal profession and individuals.