@article{nokey,

title = {Polen is plotseling de verdediger van de Europese grondwet. Een beschouwing over de zaak Polen/Europees Parlement: HvJ EU 22 april 2022, zaak C-401/19},

author = {Dommering, E.},

url = {https://www.ivir.nl/nl/auteursrecht_2022_4/},

year  = {2023},

date = {2023-01-31},

urldate = {2023-01-31},

journal = {Auteursrecht},

volume = {2022},

issue = {4},

pages = {219-227},

abstract = {Dit artikel bevat een inleiding waarin de verandering in de communicatienetwerkomgeving wordt geschetst om te verduidelijken dat het systeem van de e-Commercerichtlijn niet goed meer past, maar waar toch nog dikwijls aan wordt gerefereerd (par. 1). Vervolgens wordt stilgestaan bij de constitutionele toetsing die het VEU introduceert (par. 2). Hiermee hangt samen dat een abstracte constitutionele toetsing aan de beperkingsclausules van het Handvest ingewikkeld is, een aspect dat in deze vorm in het auteursrecht nog niet eerder aan de orde is geweest (par. 3). Dat een dergelijke constitutionele

toetsing heel verschillend kan worden aangepakt, blijkt uit de conclusie van de A-G en het Hof, die daarom tegenover de aanpak van het Hof wordt gezet (par. 4 en 5). Het artikel rondt af met een analyse dat de inzet van de zaak is vrijheid van meningsuiting, maar dat het resultaat is meer overheidsinvloed op de filtertechnieken die censuur moeten voorkomen (par. 6).},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Freedom of Expression and the EU’s Ban on Russia Today: A Dangerous Rubicon Crossed},

author = {Fahy, R. and Voorhoof, D.},

url = {https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4322452},

year  = {2022},

date = {2022-12-22},

urldate = {2022-12-22},

journal = {Communications Law},

volume = {27},

issue = {4},

pages = {186-193},

abstract = {In RT France v Council, the General Court of the European Union found that the ban on RT France in the EU did not violate the right to freedom of expression and media freedom, under Article 11 of the EU Charter of Fundamental Rights. Notably, the General Court sought to apply principles from case law of the European Court of Human Rights and international human rights law. This article argues that there are serious questions to be raised over the General Court’s reasoning in RT France, and the judgment arguably represents a deeply problematic application of European and international free expression principles.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Annotatie Hoge Raad 3 december 2021 (Hoist Finance AB)},

author = {Dommering, E.},

url = {https://www.ivir.nl/annotatie_nj_2022_258/},

year  = {2022},

date = {2022-11-28},

journal = {Nederlandse Jurisprudentie},

number = {258},

issue = {37/38/39},

pages = {4640-4642},

abstract = {Prejudici\"{e}le beslissing op voet art. 392 Rv. Algemene verordening gegevensbescherming (AVG). Rechtsgrond verwerking persoonsgegevens in kredietregistratiestelsel BKR; recht op gegevenswissing; recht op bezwaar.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Annotatie bij Hoge Raad 25 februari 2022 (Google)},

author = {Dommering, E.},

url = {https://www.ivir.nl/annotatie_nj_2022_259/},

year  = {2022},

date = {2022-11-28},

journal = {Nederlandse Jurisprudentie},

number = {259},

issue = {37/38/39},

pages = {4708-4709},

abstract = {Privacyrecht. Algemene Verordening Gegevensbescherming (AVG); verzoek verwijdering zoekresultaten; gevoelige persoonsgegevens (art. 10 AVG); maatstaf. Proceskosten in AVG-zaken; doeltreffende voorziening (art. 79 AVG en art. 47

Handvest Grondrechten EU).},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Using Terms and Conditions to Apply Fundamental Rights to Content Moderation},

author = {Quintais, J. and Appelman, N. and Fahy, R.},

url = {https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4286147

https://osf.io/f2n7m/},

year  = {2022},

date = {2022-11-25},

journal = {German Law Journal},

abstract = {Large online platforms provide an unprecedented means for exercising freedom of expression online and wield enormous power over public participation in the online democratic space. However, it is increasingly clear that their systems, where (automated) content moderation decisions are taken based on a platform's terms and conditions (T\&Cs), are fundamentally broken. Content moderation systems have been said to undermine freedom of expression, especially where important public interest speech ends up suppressed, such as speech by minority and marginalized groups. Indeed, these content moderation systems have been criticized for their overly vague rules of operation, inconsistent enforcement, and an overdependence on automation. Therefore, in order to better protect freedom of expression online, international human rights bodies and civil society organizations have argued that platforms “should incorporate directly” principles of fundamental rights law into their T\&Cs. Under EU law, and apart from a rule in the Terrorist Content Regulation, platforms had until recently no explicit obligation to incorporate fundamental rights into their T\&Cs. However, an important provision in the Digital Services Act (DSA) will change this. Crucially, Article 14 DSA lays down new rules on how platforms can enforce their T\&Cs, including that platforms must have “due regard” to the “fundamental rights” of users under the EU Charter of Fundamental Rights. In this article, we critically examine the topic of enforceability of fundamental rights via T\&Cs through the prism of Article 14 DSA. We ask whether this provision requires platforms to apply EU fundamental rights law and to what extent this may curb the power of Big Tech over online speech. We conclude that Article 14 will make it possible, in principle, to establish the indirect horizontal effect of fundamental rights in the relationship between online platforms and their users. But in order for the application and enforcement of T\&Cs to take due regard of fundamental rights, Article 14 must be operationalized within the framework of the international and European fundamental rights standards, and therefore allowing Article 14 to fulfil its revolutionary potential.},

keywords = {},

pubstate = {forthcoming},

tppubtype = {article}

}

@article{nokey,

title = {Testimony for PEGA hearing on spyware and fundamental rights},

author = {van Daalen, O.},

url = {https://www.ivir.nl/testimony_pega/},

year  = {2022},

date = {2022-10-27},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Opinie: Staatspropaganda en uitingsvrijheid},

author = {Hins, A.},

url = {https://www.ivir.nl/opinie_mediaforum_2022_2/},

year  = {2022},

date = {2022-08-25},

journal = {Mediaforum},

volume = {34},

issue = {2},

pages = {45},

abstract = {Op 10 januari 2022 is de Europese Commissie een openbare raadpleging gestart inzake een nieuwe verordening op basis van art. 114 VWEU, genaamd ‘Europese wet inzake mediavrijheid. ’ Deze opinie bepleit om in de te toekomstige verordening vast te leggen dat publieke mediadiensten binnen de EU onafhankelijk moeten functioneren van de politieke macht. Het aanleggen van dezelfde criteria voor het doorgeven van programma’s die elders zijn uitgezonden is echter onevenredig.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Allocating Control in Decentralised Identity Management},

author = {Giannopoulou, A.},

url = {https://www.ivir.nl/erdal_2021_2/},

doi = {10.53136/97912599475299},

year  = {2022},

date = {2022-07-21},

urldate = {2022-07-21},

journal = {European Review of Digital Administration \& Law - Erdal},

volume = {2021},

issue = {2},

pages = {75-87},

abstract = {Creating legal identity in the digital space involves the challenging task of addressing the datarelated responsibilities and obligations for data governance and data protection (by design and by default) to name a few. Substantially, it also requires the datafication of legal identity which means transposing all its properties and foundational traits inits corresponding data expressions and relations. As (digital) legal identity evolves from the fringes of purely technology-related challenges towards the legal and socio-technical, state institutions \textendashsovereignly responsible for delivering digital legal identities to citizens\textendash are acknowledging the polyvalent, non-monolithic, and relational characters of identitiesand they explore appropriate architectures. This paper sets out to explore the institutional turn towards decentralized digital identities. The claims surrounding these digital identities raise high hopes for the cross border digital identity provisioning being data protection and privacy compliant, technologically secure, and user-centric. This paper attempts to explore how the relevant accountable actors \textendashas recognized through the data protection normative framework\textendash are formed around the technological identity infrastructure.We highlight and examine the conflict between the European proposals on the provision of digital identity infrastructures through decentralized architectures and the concepts of data controllership in the GDPR.

},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {In defense of offense: information security research under the right to science},

author = {van Daalen, O.},

doi = {10.1016/j.clsr.2022.105706},

year  = {2022},

date = {2022-07-12},

journal = {Computer Law \& Security Review},

volume = {46},

abstract = {Information security is something you do, not something you have. It's a recurring process of finding weaknesses and fixing them, only for the next weakness to be discovered, and fixed, and so on. Yet, European Union rules in this field are not built around this cycle of making and breaking: doing offensive information security research is not always legal, and doubts about its legality can have a chilling effect. At the same time, the results of such research are sometimes not used to allow others to take defensive measures, but instead are used to attack. In this article, I review whether states have an obligation under the right to science and the right to communications freedom to develop governance which addresses these two issues. I first discuss the characteristics of this cycle of making and breaking. I then discuss the rules in the European Union with regard to this cycle. Then I discuss how the right to science and the right to communications freedom under the European Convention for Human Rights , the EU Charter of Fundamental Rights and the International Covenant on Economic, Social and Cultural Rights apply to this domain. I then conclude that states must recognise a right to research information security vulnerabilities, but that this right comes with a duty of researchers to disclose their findings in a way which strengthens information security.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {A Matter of (Joint) control? Virtual assistants and the general data protection regulation},

author = {Mil, J. van and Quintais, J.},

doi = {https://doi.org/10.1016/j.clsr.2022.105689},

year  = {2022},

date = {2022-06-16},

journal = {Computer Law \& Security Review},

volume = {45},

abstract = {This article provides an overview and critical examination of the rules for determining who qualifies as controller or joint controller under the General Data Protection Regulation. Using Google Assistant \textendash an artificial intelligence-driven virtual assistant \textendash as a case study, we argue that these rules are overreaching and difficult to apply in the present-day information society and Internet of Things environments. First, as a consequence of recent developments in case law and supervisory guidance, these rules lead to a complex and ambiguous test to determine (joint) control. Second, due to advances in technological applications and business models, it is increasingly challenging to apply such rules to contemporary processing operations. In particular, as illustrated by the Google Assistant, individuals will likely be qualified as joint controllers, together with Google and also third-party developers, for at least the collection and possible transmission of other individuals’ personal data via the virtual assistant. Third, we identify follow-on issues relating to the apportionment of responsibilities between joint controllers and the effective and complete protection of data subjects. We conclude by questioning whether the framework for determining who qualifies as controller or joint controller is future-proof and normatively desirable.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Annotatie bij Rb Noord-Holland 6 oktober 2021 (Kamerlid / LinkedIn Ierland \& LinkedIn Nederland)},

author = {Leerssen, P.},

url = {https://www.ivir.nl/annotatie_computerrecht_2022_97/},

year  = {2022},

date = {2022-06-16},

journal = {Computerrecht},

number = {97},

issue = {3},

pages = {228-230},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Naar een algemeen transparantiebeginsel? : Bespreking van het preadvies van A.W.G.J. Buijze voor de VAR 2022},

author = {Dommering, E.},

url = {https://www.ivir.nl/ntb_2022_5_141/},

year  = {2022},

date = {2022-06-07},

urldate = {2022-06-07},

journal = {Nederlands Tijdschrift voor Bestuursrecht},

number = {141},

issue = {5},

pages = {265-271},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Between Filters and Fundamental Rights: How the Court of Justice saved Article 17 in C-401/19 - Poland v. Parliament and Council},

author = {Quintais, J.},

url = {https://verfassungsblog.de/filters-poland/?s=09},

year  = {2022},

date = {2022-05-16},

journal = {Verfassungsblog},

abstract = {On 26 April 2022, the Court of Justice of the EU (CJEU or Court) delivered its much awaited judgement in Case C-401/19 \textendash Poland v Parliament and Council. The case focuses on the validity of Article 17 of the Copyright in the Digital Single Market Directive (CDSMD) in light of fundamental rights. The judgment marks the climax of a turbulent journey in the area of copyright law, with potential implications for the future of platform regulation and content moderation in EU law.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Article 17 survives, but freedom of expression safeguards are key: C-401/19 \textendash Poland v Parliament and Council},

author = {Quintais, J.},

url = {http://copyrightblog.kluweriplaw.com/2022/04/26/article-17-survives-but-freedom-of-expression-safeguards-are-key-c-401-19-poland-v-parliament-and-council/},

year  = {2022},

date = {2022-05-02},

urldate = {2022-05-02},

journal = {Kluwer Copyright Blog},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Knock Knock Who's There? Tussenpersonen, persoonsgegevens en de kunst van het juiste evenwicht},

author = {Alberdingk Thijm, Chr. A.},

url = {https://www.ivir.nl/nl/aa_2022/},

year  = {2022},

date = {2022-04-08},

journal = {Ars Aequi},

issue = {april},

pages = {279-288},

abstract = {Wat te doen als je op Twitter door een anoniem profiel voor rotte vis wordt uitgemaakt? Het Nederlandse recht biedt verschillende mogelijkheden om identificerende gegevens te verkrijgen van internettussenpersonen. Maar hoe wordt de afweging met de bescherming van de persoonsgegevens van de anonymus gemaakt? Hoe verhoudt het recht op een doeltreffende voorziening in rechte zich tot het gegevensbeschermingsrecht? Het Hof van Justitie schrijft voor dat bij botsende

fundamentele rechten het ‘juiste evenwicht’ moet worden gevonden. Dat blijkt de Nederlandse rechter nog niet zo eenvoudig te vinden, zo wordt duidelijk bij de bespreking van het Dutch FilmWorks-arrest in dit artikel.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Grondrechten voor de vijand},

author = {Hins, A.},

url = {https://www.montesquieu-instituut.nl/id/vlrjjfj3ptw8/nieuws/grondrechthttps://www.ivir.nl/hofvijver-28-maart-2022-opinie-grondrechten-voor-de-vijand/},

year  = {2022},

date = {2022-03-28},

journal = {De Hofvijver},

volume = {12},

issue = {129},

abstract = {Op 1 maart 2022 besloot de Raad van de Europese Unie tot een algemeen verbod op het doorgeven van de Russische propagandazenders RT (Russia Today) en Sputnik. In deze opinie wordt het standpunt ingenomen dat desinformatie moet worden bestreden, maar dat het middel van censuur erger is dan de kwaal.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Data na de dood: Zwevend tussen contract en gegevensbescherming},

author = {van Eechoud, M. and Schumacher, L.D.},

url = {https://www.ivir.nl/publicaties/download/NJB_2022_355.pdf},

year  = {2022},

date = {2022-02-14},

journal = {Nederlands Juristenblad (NJB)},

number = {355},

issue = {6},

pages = {396-405},

abstract = {Mensen zijn zich nog weinig bewust van wat de implicaties van overlijden zijn voor het digitale bezit dat ze nalaten, terwijl iedereen hier steeds meer van heeft. Opvattingen verschillen over de mate waarin erfgenamen toegang moeten krijgen; er is nog weinig bekend over (veranderende) maatschappelijke opvattingen daarover. Omdat digitale communicatie geregeerd wordt door standaardovereenkomsten met aanbieders van informatiediensten, wordt ook de positie van erfgenamen daar primair door bepaald. Tegelijkertijd hebben veel aanbieders nog geen doordacht ‘overlijdensbeleid’ en daarbij passende voorwaarden en tools. Het lijkt tijd dat de (Europese) wetgever daar wat aan gaat veranderen. Om op kortere termijn te zorgen voor meer rechtszekerheid, zou de Nederlandse wetgever in ieder geval enkele specifieke plichten en rechten uit de AVG van toepassing kunnen verklaren op de persoonsgegevens van overleden gebruikers van informatiediensten.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Microtargeted propaganda by foreign actors: An interdisciplinary exploration},

author = {Fahy, R. and Dobber, T. and Zuiderveen Borgesius, F. and Shires, J.},

url = {https://www.ivir.nl/publicaties/download/MaastrichtJournalofEuropeanandComparativeLaw_2021_6.pdf},

doi = {10.1177/1023263X211042471},

year  = {2022},

date = {2022-01-25},

urldate = {2021-12-31},

journal = {Maastricht Journal of European and Comparative Law},

pages = {856-877},

abstract = {This article discusses a problem that has received scant attention in literature: microtargeted propaganda by foreign actors. Microtargeting involves collecting information about people, and using that information to show them targeted political advertisements. Such microtargeting enables advertisers to target ads to specific groups of people, for instance people who visit certain websites, forums, or Facebook groups. This article focuses on one type of microtargeting: microtargeting by foreign actors. For example, Russia has targeted certain groups in the US with ads, aiming to sow discord. Foreign actors could also try to influence European elections, for instance by advertising in favour of a certain political party. Foreign propaganda possibilities existed before microtargeting. This article explores two questions. In what ways, if any, is microtargeted propaganda by foreign actors different from other foreign propaganda? What could lawmakers in Europe do to mitigate the risks of microtargeted propaganda?},

note = {MJ, vol. 28, nr. 6, 2021},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Social Welfare, Risk Profiling and Fundamental Rights: The Case of SyRI in the Netherlands},

author = {Appelman, N. and Fahy, R. and van Hoboken, J.},

url = {https://www.ivir.nl/publicaties/download/jipitec_2021_4.pdf

https://www.jipitec.eu/issues/jipitec-12-4-2021/5407},

year  = {2021},

date = {2021-12-16},

journal = {JIPITEC},

volume = {12},

number = {4},

pages = {257-271},

abstract = {This article discusses the use of automated decisioning-making (ADM) systems by public administrative bodies, particularly systems designed to combat social-welfare fraud, from a European fundamental rights law perspective. The article begins by outlining the emerging fundamental rights issues in relation to ADM systems used by public administrative bodies. Building upon this, the article critically analyses a recent landmark judgment from the Netherlands and uses this as a case study for discussion of the application of fundamental rights law to ADM systems by public authorities more generally. In the so-called SyRI judgment, the District Court of The Hague held that a controversial automated welfare-fraud detection system (SyRI), which allows the linking and analysing of data from an array of government agencies to generate fraud-risk reports on people, violated the right to private life, guaranteed under Article 8 of the European Convention on Human Rights (ECHR). The Court held that SyRI was insufficiently transparent, and contained insufficient safeguards, to protect the right to privacy, in violation of Article 8 ECHR. This was one of the first times an ADM system being used by welfare authorities has been halted on the basis of Article 8 ECHR. The article critically analyses the SyRI judgment from a fundamental rights perspective, including by examining how the Court brought principles contained in the General Data Protection Regulation within the rubric of Article 8 ECHR as well as the importance the Court attaches to the principle of transparency under Article 8 ECHR. Finally, the article discusses how the Dutch government responded to the judgment. and discusses proposed new legislation, which is arguably more invasive, with the article concluding with some lessons that can be drawn for the broader policy and legal debate on ADM systems used by public authorities. implications.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Annotatie bij EHRM 25 mei 2021 (Big Brother Watch e.a. / Verenigd Koninkrijk) en Hof van Justitie EU 6 oktober 2020 (La Quadrature du Net e.a. / Premier ministre e.a.)},

author = {Dommering, E.},

url = {https://www.ivir.nl/publicaties/download/Annotatie_NJ_2021_362.pdf},

year  = {2021},

date = {2021-12-07},

journal = {Nederlandse Jurisprudentie},

number = {49},

pages = {6225-6237},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Annotatie bij Rb. Noord-Holland 6 oktober 2021 (Van Haga / LinkedIn)},

author = {Hins, A.},

url = {https://www.ivir.nl/publicaties/download/Annotatie_Mf_2021_6.pdf},

year  = {2021},

date = {2021-12-02},

journal = {Mediaforum},

volume = {33},

number = {6},

pages = {206-208},

abstract = {Het Tweede Kamerlid Van Haga heeft op zijn LinkedIn profielpagina berichten geplaatst waarin hij de gevaren van het coronavirus in twijfel trok. Het bedrijf LinkedIn heeft eerst een paar van deze berichten verwijderd en daarna  het account van Van Haga helemaal be\"{e}indigd. In het kort geding ging het onder meer om de vraag in hoeverre Van Haga beschermd wordt door de vrijheid van meningsuiting.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Het coronabeleid is onconstitutioneel},

author = {Dommering, E.},

url = {https://www.ivir.nl/publicaties/download/NJB_Opinie_2021.pdf},

year  = {2021},

date = {2021-11-25},

journal = {Nederlands Juristenblad (NJB)},

number = {41},

pages = {3396-3398},

abstract = {De Staat is verplicht om in te grijpen bij het uitbreken van een pandemie van een gevaarlijke ziekte en moet dan maatregelen treffen om deze zoveel mogelijk in te dammen. Maar daarbij hoort een ingewikkelde afweging van conflicterende fundamentele rechten, belangen en redelijkerwijze van de ingreep te verwachten gevolgen. Deze noodzakelijke grondrechtelijke toetsing was, is en blijft maar achterwege bij de coronamaat-regelen die in Nederland uitgevaardigd worden.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {The perils of legally defining disinformation},

author = {Fahy, R. and Helberger, N. and Appelman, N.},

url = {https://www.ivir.nl/publicaties/download/InternetPolicyReview_2021.pdf},

doi = {10.14763/2021.4.1584},

year  = {2021},

date = {2021-11-12},

journal = {Internet Policy Review},

volume = {10},

number = {4},

abstract = {EU policy considers disinformation to be harmful content, rather than illegal content. However, EU member states have recently been making disinformation illegal. This article discusses the definitions that form the basis of EU disinformation policy, and analyses national legislation in EU member states applicable to the definitions of disinformation, in light of freedom of expression and the proposed Digital Services Act. The article discusses the perils of defining disinformation in EU legislation, and including provisions on online platforms being required to remove illegal content, which may end up being applicable to overbroad national laws criminalising false news and false information.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Janssen2021c,

title = {Persoonlijke PIMS: privacyfort of luchtkasteel?},

author = {Janssen, H.},

year  = {2021},

date = {2021-10-28},

journal = {Privacy \& Informatie},

number = {5},

pages = {214-225},

abstract = {Persoonsgegevens worden thans veelal op ondoorzichtige wijze, buiten de controle van de betrokkenen verwerkt. Persoonlijke informatiebeheersystemen (PIMS) willen betrokkenen technologische toepassingen aanreiken, die hun meer controle geven over de verwerking van hun persoonsgegevens. PIMS presenteren zich als alternatief voor de huidige, ‘gecentraliseerde’ wijze van gegevensverwerking, waarbij (grote) organisaties persoonsgegevens op meestal ondoorzichtige wijze verzamelen, analyseren en doorgeven aan derden. PIMS bieden betrokkenen technische instrumenten waarmee zij zelf kunnen controleren en bepalen wanneer en aan wie zijn hun gegevens overdragen, en/of analyses over hun gegevens kunnen laten uitvoeren. Hoewel argumenten voor deze ‘decentralisatie’

aantrekkelijk klinken, rijzen vragen over de mate waarin PIMS de problemen met de huidige gegevensverwerking effectief kunnen bestrijden. In dit artikel ligt de focus bij de vraag in hoeverre deze PIMS de machtsongelijkheid tussen betrokkenen en grote organisaties daadwerkelijk kunnen bestrijden, die als gevolg van de huidige gegevensverwerkingspraktijk zijn ontstaan. PIMS kunnen enig inzicht in en controle over gegevensverwerking bieden, maar desondanks zal de machtsongelijkheid grotendeels blijven voortbestaan.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Giannopoulou2021,

title = {Putting Data Protection by Design on the Blockchain},

author = {Giannopoulou, A.},

doi = {10.21552/edpl/2021/3/7},

year  = {2021},

date = {2021-10-22},

urldate = {2021-10-22},

journal = {European Data Protection Law Review},

volume = {7},

number = {3},

pages = {388-399},

abstract = {The principle of data protection by design, as it is enshrined in article 25 of the GDPR, is difficult to apply in blockchains. This article will assess how the reliance on asymmetric encryption and other privacy enhancing technological architectures -necessary in a blockchain-based system- approach both user control and data protection by design compliance from the single scope of anonymization and unlinkability. Data subjects’ rights, accountability, and the potential shortcomings of applied technological constraints are thus sidelined. Ultimately, this limited understanding of technological privacy, acts as a misguiding set of principles for technological co-regulation through standardisation in blockchains. The standardization of these choices without a holistic analysis of data protection by design imperatives could ultimately weaken the position of data subjects, whose trust in the technological protections of personal data might prove to be relatively misplaced.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Helberger2021bb,

title = {Towards Unfair Political Practices Law: Learning lessons from the regulation of unfair commercial practices for online political advertising},

author = {Helberger, N. and Dobber, T. and Vreese, C.H. de},

url = {https://www.jipitec.eu/issues/jipitec-12-3-2021/5338},

year  = {2021},

date = {2021-08-26},

journal = {JIPITEC},

volume = {12},

number = {3},

pages = {273-296},

abstract = {Online political advertising operates in a tense forcefield between political and commercial elements and thus presents regulators with a difficult conundrum: because online political advertising is political rather than commercial speech, it is destined to follow a different regulatory tradition than commercial advertising. And yet many of the tools used, players involved and concerns triggered by modern online political advertising strategies very much resemble the tools, players and concerns in online commercial targeting. Commercial advertising is subject to consumer law and unfair advertising regulation, including rules about unfair commercial practices. Unfair commercial practices law and other rules about commercial advertising, however, are explicitly not applicable to forms of non-commercial political or ideological advertising. An important reason why this is so is the different level of protection of political and commercial speech under fundamental rights law standards. And yet with the ongoing commercial turn in advertising, the traditional division between forms of commercial and political advertising is no longer that self-evident. Also, it cannot be denied that commercial advertising law has a long tradition of thinking of where and how to draw the line between lawful advertising and unlawful persuasion through withholding or misleading consumers about the information they need to take informed decisions, or abusing superior knowledge, exerting undue psychological pressure and engaging in other forms of unfair behaviour. The question this article explores is whether there are lessons to be learned from the regulation of commercial advertising for the pending initiatives at the national and the European level to regulate online political advertising, and online political targeting in specific.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Sax2021b,

title = {Voorbij privacy: manipulatie is het \'{e}chte probleem in gezondheidsapps},

author = {Sax, M.},

url = {https://www.uitgeverijparis.nl/nl/reader/209785/1001582341},

year  = {2021},

date = {2021-06-24},

journal = {Privacy \& Informatie},

number = {3},

pages = {117-120},

abstract = {Ze zijn enorm populair en zullen alleen nog maar populairder worden: gezondheidsapps. Er zijn populaire gezondheidsapps met tientallen tot soms honderden miljoenen gebruikers voor van alles en nog wat: dieetadviezen en calorie\"{e}ntellen (MyFitnessPal), meditatie en mindfulness (Headspace), het tracken en onderling vergelijken van sportactiviteiten (Strava), het tracken van je algehele bewegings- en gezondheidspatronen via een wearable (Fitbit), enzovoort. Hun huidige populariteit zal alleen nog maar toenemen, aangezien werkgevers en verzekeraars steeds nadrukkelijker het gebruik van gezondheidsapps aanprijzen. 1 Gezondheid is goed, meer gezondheid is beter. Geweldig toch, die alsmaar toenemende populariteit van gezondheidsapps?},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{vanHoboken2021b,

title = {Smartphone platforms as privacy regulators},

author = {van Hoboken, J. and Fahy, R.},

url = {https://www.ivir.nl/publicaties/download/Smartphone-platforms-as-privacy-regulators.pdf},

doi = {https://doi.org/10.1016/j.clsr.2021.105557},

year  = {2021},

date = {2021-06-10},

journal = {Computer Law \& Security Review},

volume = {41},

abstract = {A series of recent developments highlight the increasingly important role of online platforms in impacting data privacy in today's digital economy. Revelations and parliamentary hearings about privacy violations in Facebook's app and service partner ecosystem, EU Court of Justice judgments on joint responsibility of platforms and platform users, and the rise of smartphone app ecosystems where app behaviour is governed by app distribution platforms and operating systems, all show that platform policies can make or break the enjoyment of privacy by users. In this article, we examine these developments and explore the question of what can and should be the role of platforms in protecting data privacy of their users.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{vanHoboken2021,

title = {Regulating Disinformation in Europe: Implications for Speech and Privacy},

author = {van Hoboken, J. and Fahy, R.},

url = {https://www.ivir.nl/publicaties/download/Regulating-Disinformation-in-Europe.pdf},

year  = {2021},

date = {2021-06-01},

journal = {UC Irvine Journal of International, Transnational, and Comparative Law},

volume = {6},

number = {1},

pages = {9-36},

abstract = {This Article examines the ongoing dynamics in the regulation of disinformation in Europe, focusing on the intersection between the right to

freedom of expression and the right to privacy. Importantly, there has been a recent wave of regulatory measures and other forms of pressure on online platforms to tackle disinformation in Europe. These measures play out in different ways at the intersection of the right to freedom of expression and the right to privacy. Crucially, as governments, journalists, and researchers seek greater transparency and access to information from online platforms to evaluate their impact on the health of their democracies, these measures raise acute issues related to user privacy. Indeed, platforms that once refused to cooperate with governments in identifying users allegedly responsible for disseminating illegal or harmful content are now expanding cooperation. However, while platforms are increasingly facilitating government access to user data, platforms are also invoking data protection law concerns as a shield in response to recent efforts at increased platform transparency. At

the same time, data protection law provides for one of the main systemic regulatory safeguards in Europe. It protects user autonomy concerning datadriven campaigns, requiring transparency for internet audiences about targeting and data subject rights in relation to audience platforms, such as social media companies.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Voorhoof2021,

title = {Freedom of expression, the Media and Journalists: Case-law of the Euopean Court of Human Rights},

author = {Voorhoof, D. and McGonagle, T.},

url = {https://rm.coe.int/iris-themes-vol-iii-2020-edition-en-28-april-2021-/1680a24eee},

isbn = {9789287184351},

year  = {2021},

date = {2021-05-06},

abstract = {This e-book provides valuable insights into the European Court of Human Rights’ extensive case-law on freedom of expression and media and journalistic freedoms. The first four editions of the e-book (2013, 2015, 2016, 2017 and 2020) have proved hugely successful. The new sixth edition summarises over 339 judgments or decisions by the Court and provides hyperlinks to the full text of each of the summarised judgments or decisions (via HUDOC, the Court's online case-law database). },

note = {IRIS Themes, vol. III, 6th edition, April 2021},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Dommering2021c,

title = {Annotatie bij Hof van Justitie EU 16 juli 2020 (Data Protection Commissioner / Facebook Ireland \& Schrems)(Schrems II)},

author = {Dommering, E.},

url = {https://www.ivir.nl/publicaties/download/Annotatie_NJ_2021_24.pdf},

year  = {2021},

date = {2021-03-12},

journal = {Nederlandse Jurisprudentie},

volume = {2021},

number = {5/6},

pages = {455-458},

abstract = {Uitlevering persoonsgegevens Ierland/VS in strijd met de AVG omdat veiligheidsdiensten in VS ongecontroleerd toegang hebben tot serviceproviders die deze persoonsgegevens ontvangen.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Dommering2021d,

title = {Annotatie bij Hoge Raad 1 oktober 2019 (nr. 17/01305)},

author = {Dommering, E.},

url = {https://www.ivir.nl/publicaties/download/Annotatie_NJ_2021_29.pdf},

year  = {2021},

date = {2021-03-12},

journal = {Nederlandse Jurisprudentie},

volume = {2021},

number = {5/6},

pages = {550-551},

abstract = {Schending geheimhoudingsplicht lid Antilliaanse parlement.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Dommering2021b,

title = {Annotatie bij EHRM 8 oktober 2019 (Szurovecz / Hongarije)},

author = {Dommering, E.},

url = {https://www.ivir.nl/publicaties/download/Annotatie_NJ_2021_13.pdf},

year  = {2021},

date = {2021-03-11},

journal = {Nederlandse Jurisprudentie},

volume = {2021},

number = {4},

pages = {230-231},

abstract = {Deze zaak gaat over de vrijheid van nieuwsgaring. Een journalist kreeg geen toegang tot vreemdelingencentra in Hongarije. Het EHRM achtte dat in de gegeven omstandigheden in strijd met artikel 10 EVRM. },

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Poort2021,

title = {Personalised pricing: The demise of the fixed price?},

author = {Poort, J. and Zuiderveen Borgesius, F.},

url = {https://www.ivir.nl/publicaties/download/The-Demise-of-the-Fixed-Price.pdf},

year  = {2021},

date = {2021-03-04},

abstract = {An online seller or platform is technically able to offer every consumer a different price for the same product, based on information it has about the customers. Such online price discrimination exacerbates concerns regarding the fairness and morality of price discrimination, and the possible need for regulation. In this chapter, we discuss the underlying basis of price discrimination in economic theory, and its popular perception. Our surveys show that consumers are critical and suspicious of online price discrimination. A majority consider it unacceptable and unfair, and are in favour of a ban. When stores apply online price discrimination, most consumers think they should be informed about it. We argue that the General Data Protection Regulation (GDPR) applies to the most controversial forms of online price discrimination, and not only requires companies to disclose their use of price discrimination, but also requires companies to ask customers for their prior consent. Industry practice, however, does not show any adoption of these two principles.},

note = {Forthcoming as chapter 10 in: Kohl, U., \& Eisler, J. (eds.), Data-Driven Personalisation in Markets, Politics and Law. Cambridge: Cambridge University Press, 2021.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{QuintaisJutte2021,

title = {The Pelham Chronicles: Sampling, Copyright and Fundamental Rights},

author = {Quintais, J. and Jutte, B.J.},

url = {https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3775599},

doi = {https://doi.org/10.1093/jiplp/jpab040},

year  = {2021},

date = {2021-02-18},

journal = {Journal of Intellectual Property Law \& Practice},

volume = {16},

number = {3},

pages = {213-225},

abstract = {On 29 July 2019 the Court of Justice of the European Union (CJEU or Court) rendered its long-awaited judgment in Pelham. This judgement was published together, but not jointly, with those on Spiegel Online and Funke Medien. A bit less than a year later, on 30 April 2020, the German Federal Court of Justice (Bundesgerichtshof or BGH), which had referred the cases to Luxembourg, rendered its judgments in all three cases. There are obvious parallels between these judgments, and their combined relevance for the interpretation of European copyright law in the light of EU fundamental rights cannot be understated.



This article focuses on Pelham, or the “Metall auf Metall” saga, as it is known in Germany. It analyses the relevant aspects and impact of Pelham in EU copyright law and examines how the BGH implemented the guidance provided by the CJEU. Where relevant, we draw the parallels to Funke Medien and Spiegel Online. Pelham gave the Court the opportunity to define the scope of the related right of reproduction of phonogram producers in art. 2(c) of Directive 2001/29/EC (InfoSoc Directive). The question whether such right enjoys the same scope of protection as the reproduction right for authorial works had made its way through the German courts for a remarkable two decades. This saga included a constitutional complaint, which in 2016 answered the question in the affirmative. The BGH’s preliminary reference to the CJEU was particularly important because on the back of the reproduction question it sought to clarify issues with fundamental rights implications, in particular the scope of the quotation right or defence and its application to musical creativity in the form of sampling.



This article proceeds as follows. After this introduction, we briefly revisit the Pelham saga in its journey through the German and European courts, providing he context to the underlying legal issues (2). We then turn to the interpretation of the scope of the reproduction and distribution rights for phonograms (3) before examining the CJEU’s assessment of the systematic nature of exceptions and limitations (E\&Ls) (4). We then discuss the wider implications of Pelham on the role of fundamental right in copyright law (5). We conclude with some doctrinal and practical observations on the wider implications of the “Metall auf Metall”-saga (6). },

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Janssen2021,

title = {Decentralised Data Processing: Personal Data Stores and the GDPR},

author = {Janssen, H. and Cobbe, J. and Norval, C. and Singh, J.},

url = {https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3570895

https://www.ivir.nl/publicaties/download/IDPL-2021-4.pdf},

doi = {https://doi.org/10.1093/idpl/ipaa016},

year  = {2021},

date = {2021-01-04},

journal = {International Data Privacy Law},

volume = {10},

number = {4},

pages = {356-384},

abstract = {When it comes to online services, users have limited control over how their personal data is processed. This is partly due to the nature of the business models of those services, where data is typically stored and aggregated in data centres. This has recently led to the development of technologies aiming at leveraging user control over the processing of their personal data.

Personal Data Stores (“PDSs”) represent a class of these technologies; PDSs provide users with a device, enabling them to capture, aggregate and manage their personal data. The device provides tools for users to control and monitor access, sharing and computation over data on their device. The motivation for PDSs are described as (i) to assist users with their confidentiality and privacy concerns, and/or (ii) to provide opportunities for users to transact with or otherwise monetise their data.

While PDSs potentially might enable some degree of user empowerment, they raise interesting considerations and uncertainties in relation to the responsibilities under the General Data Protection Regulation (GDPR). More specifically, the designations of responsibilities among key parties involved in PDS ecosystems are unclear. Further, the technical architecture of PDSs appears to restrict certain lawful grounds for processing, while technical means to identify certain category data, as proposed by some, may remain theoretical.

We explore the considerations, uncertainties, and limitations of PDSs with respect to some key obligations under the GDPR. As PDS technologies continue to develop and proliferate, potentially providing an alternative to centralised approaches to data processing, we identify issues which require consideration by regulators, PDS platform providers and technologists.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Janssen2021b,

title = {Personal Data Stores: a user-centric privacy utopia?},

author = {Janssen, H. and Cobbe, J. and Singh, J.},

year  = {2021},

date = {2021-01-04},

journal = {Internet Policy Review},

keywords = {},

pubstate = {forthcoming},

tppubtype = {article}

}

@article{Ferrari2020b,

title = {Crosshatching Privacy: Financial Intermediaries’ Data Practices Between Law Enforcement and Data Economy},

author = {Ferrari, V.},

url = {https://edpl.lexxion.eu/article/EDPL/2020/4/8

https://www.ivir.nl/publicaties/download/edpl_2020_04.pdf},

doi = {https://doi.org/10.21552/edpl/2020/4/8},

year  = {2020},

date = {2020-12-22},

journal = {European Data Protection Law Review},

volume = {6},

number = {4},

pages = {522-535},

abstract = {Financial data are key to various law enforcement processes, including criminal investigations, anti-money laundering strategies and the implementation of national fiscal policies. However, financial data also qualify as personal data. While law enforcement objectives can derogate certain privacy-related legal safeguards, private financial firms should, in principle, comply with the privacy standards upheld by GDPR. Highlighting the most critical trends of the current financial industry (i.e. commercial exploitation of data; international dimension of financial informational networks; use of automated processing and decision-making tools), the present paper analyses how privacy and law enforcement priorities interplay in determining the governance of financial data. We conclude by recognizing that privacy loopholes exist in the current financial industry’s data practices, and that - as payments tend to be increasingly performed in digital manners, exponentially increasing the availability of financial data - privacy-enhancing payment methods should be encouraged and legitimised.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Dommering2020i,

title = {Annotatie bij Rb. Den Haag 5 februari 2020 (NJCM c.s. / Staat der Nederlanden - SyRI-wetgeving)},

author = {Dommering, E.},

url = {https://www.ivir.nl/publicaties/download/Annotatie_NJ_2020_386.pdf},

year  = {2020},

date = {2020-11-10},

journal = {Nederlandse Jurisprudentie},

number = {45},

pages = {6792-6795},

abstract = {De SyRI-wetgeving voldoet niet aan de in art. 8 lid 2 EVRM gestelde eis dat de inmenging in de uitoefening van het recht op respect voor het priv\'{e}leven noodzakelijk is in een democratische samenleving, dat wil zeggen noodzakelijk, evenredig (proportioneel) en subsidiair in relatie tot het beoogde doel.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}