| Foreword | 5 |
|---|
| Contents | 7 |
|---|
| Contributors | 15 |
|---|
| Part I | 24 |
|---|
| Chapter 1 | 25 |
|---|
| About the E-Privacy Directive: Towards a Third Generation of Data Protection Legislation? | 25 |
| 1.1 Is Personal Data the Adequate Concept? | 31 |
| 1.1.1 New Kinds of Sensitive Data in Our Modern Networks: Identifiers and Contact Data | 33 |
| 1.1.2 IP Address, Cookies, Data Generated by RFID, Always “Personal Data”? Why Regulate Them Anyway? | 35 |
| 1.1.3 New Data to be Protected: The Profiles | 38 |
| 1.2 New Objects and New Actors to be Regulated? | 40 |
| 1.2.1 EU Commission’s Support to PETs | 42 |
| 1.2.2 Towards a Liability of Terminal Equipments Producers and Information System Designers: The RFID Case | 43 |
| 1.2.3 Terminal Equipment as a Virtual Home? | 45 |
| 1.2.4 Conclusions of Sect. 1.2 | 49 |
| 1.3 Final Conclusions | 50 |
| Chapter 2 | 53 |
|---|
| Some Caveats on Profiling | 53 |
| 2.1 Introduction | 53 |
| 2.2 What Is It with Profiling? | 53 |
| 2.3 From Measurement to Detection | 54 |
| 2.4 A Risky Dependence | 55 |
| 2.5 Privacy, Fairness (Non-discrimination) and Due Process | 56 |
| 2.6 Causality and (Criminal) Liability | 57 |
| 2.7 Who Owns My Data | Who Authors the Profiles I Match with? |
| 2.8 Transparency and Anticipation | 58 |
| 2.9 Privacy and Data Protection | 58 |
| 2.10 From Data Minimisation to Minimal Knowledge Asymmetries? | 60 |
| 2.11 AmLaw: From Privacy Enhancing Technologies to Transparency Enhancing Tools? | 61 |
| 2.12 Call for Attention | 61 |
| References | 62 |
| Chapter 3 | 64 |
|---|
| Levelling up: Data Privacy and the European Court of Human Rights | 64 |
| 3.1 The Background | 64 |
| 3.2 Legality, Necessity, Secrecy | 67 |
| 3.3 Legality: The Liberty Case | 68 |
| 3.4 Necessity and Proportionality: The S. and Marper Case | 70 |
| 3.5 Where Does It Leave Us? | 72 |
| Chapter 4 | 74 |
|---|
| Responding to the Inevitable Outcomes of Profiling: Recent Lessons from Consumer Financial Markets, and Beyond | 74 |
| 4.1 Preface | 74 |
| 4.2 Rethinking the Regulation of Profiling: In a Nutshell | 76 |
| 4.2.1 A Brief Introduction to the Flow of Personal Information | 76 |
| 4.2.2 The Limits and Troubles of Regulating Data Collection | 78 |
| 4.2.3 The Limits and Troubles of Regulating Data Analysis | 78 |
| 4.2.4 Regulating Profiling by Addressing Uses: Possibilities, Factors and Limits | 79 |
| 4.3 A Tale of Four Data Miners | 82 |
| 4.4 Some Conclusions and Summing Up | 93 |
| References | 94 |
| Part II | 96 |
|---|
| Chapter 5 | 97 |
|---|
| The Emerging European Union Security Breach Legal Framework: The 2002/58 ePrivacy Directive and Beyond | 97 |
| 5.1 Introduction | 98 |
| 5.1.1 The EU Security Breach Legal Framework: The Background | 98 |
| 5.1.2 The Review of the ePrivacy Directive | 99 |
| 5.1.3 An Overview of the Security Breach Framework Under the Revised ePrivacy Directive | 100 |
| 5.2 Purposes and Existing Data Protection Princi-ples Underpinning the New EU Security Breach Framework | 101 |
| 5.2.1 Preventing and Minimising Adverse Effects for Individuals | 101 |
| 5.2.2 The Security Principle | 102 |
| 5.2.3 The Data Minimisation Principle | 104 |
| 5.2.4 The Information Principle | 104 |
| 5.2.5 The Accountability Principle | 105 |
| 5.3 Elements of the EU Security Breach Notification Framework | 106 |
| 5.4 Scope of the EU Security Breach Notification Framework | 106 |
| 5.4.1 Entities Obliged to Notify: Covered Entities | 106 |
| 5.4.2 The Application to Information Society Services and Beyond | 107 |
| 5.4.3 Definition of ‘Personal Data Breach’ | 109 |
| 5.5 The Threshold Triggering the Obligation to Notify | 110 |
| 5.5.1 Description of the Threshold | 110 |
| 5.5.2 “Likely to Adversely Affect the Personal Data and Privacy” | 112 |
| 5.5.3 Exceptions Relating to Technological Protection Measures and Law Enforcement | 113 |
| 5.6 Means of Providing Notice, Timing and Content | 115 |
| 5.6.1 Means of Providing Notice
|
