In this article we examine the effectiveness of consent in data protection legislation. We argue that the current legal framework for consent, which has its basis in the idea of autonomous authorisation, does not work in practice. In practice the legal requirements for consent lead to ‘consent desensitisation’, undermining privacy protection and trust in data processing. In particular we argue that stricter legal requirements for giving and obtaining consent as proposed in the European Data protection regulation will further weaken the (...) effectiveness of the consent mechanism. Building on Miller and Wertheimer’s ‘Fair Transaction’ model of consent we will examine alternatives to explicit consent. (shrink)

The legal basis for processing personal data and some other types of Big Data is often the informed consent of the data subject involved. Many data controllers, such as social network sites, offer terms and conditions, privacy policies or similar documents to which a user can consent when registering as a user. There are many issues with such informed consent: people get too many consent requests to read everything, policy documents are often very long and difficult to understand and users (...) feel they do not have a real choice anyway. Furthermore, in the context of Big Data refusing consent may not prevent predicting missing data. Finally, consent is usually asked for when registering, but rarely is consent renewed. As a result, consenting once often implies consent forever. At the same time, given the rapid changes in Big Data and data analysis, consent may easily get outdated. This paper suggests expiry dates for consent, not to settle questions, but to put them on the table as a start for further discussion on this topic. Although such expiry dates may not solve all the issues of informed consent, they may be a useful tool in some situations. (shrink)

Through the exponential growth in digital devices and computational capabilities, big data technologies are putting pressure upon the boundaries of what can or cannot be considered acceptable from an ethical perspective. Much of the literature on ethical issues related to big data and big data technologies focuses on separate values such as privacy, human dignity, justice or autonomy. More holistic approaches, allowing a more comprehensive view and better balancing of values, usually focus on either a design-based approach, in which it (...) is tried to implement values into the design of new technologies, or an application-based approach, in which it is tried to address the ways in which new technologies are used. Some integrated approaches do exist, but typically are more general in nature. This offers a broad scope of application, but may not always be tailored to the specific nature of big data related ethical issues. In this paper we distil a comprehensive set of ethical values from existing design-based and application-based ethical approaches for new technologies and further focus these values to the context of emerging big data technologies. A total of four value lists were selected for this. The integrated list consists of a total of ten values: human welfare, autonomy, non-maleficence, justice, accountability, trustworthiness, privacy, dignity, solidarity and environmental welfare. Together, this set of values provides a comprehensive and in-depth overview of the values that are to be taken into account for emerging big data technologies. (shrink)

Increasing numbers of decisions about everyday life are made using algorithms. By algorithms we mean predictive models captured from historical data using data mining. Such models often decide prices we pay, select ads we see and news we read online, match job descriptions and candidate CVs, decide who gets a loan, who goes through an extra airport security check, or who gets released on parole. Yet growing evidence suggests that decision making by algorithms may discriminate people, even if the computing (...) process is fair and well-intentioned. This happens due to biased or non-representative learning data in combination with inadvertent modeling procedures. From the regulatory perspective there are two tendencies in relation to this issue: to ensure that data-driven decision making is not discriminatory, and to restrict overall collecting and storing of private data to a necessary minimum. This paper shows that from the computing perspective these two goals are contradictory. We demonstrate empirically and theoretically with standard regression models that in order to make sure that decision models are non-discriminatory, for instance, with respect to race, the sensitive racial information needs to be used in the model building process. Of course, after the model is ready, race should not be required as an input variable for decision making. From the regulatory perspective this has an important implication: collecting sensitive personal data is necessary in order to guarantee fairness of algorithms, and law making needs to find sensible ways to allow using such data in the modeling process. (shrink)

Technological developments increasingly enable monitoring and steering the behavior of individuals. Enforcement of the law by means of technology can be much more effective and pervasive than enforcement by humans, such as law enforcement officers. However, it can also bypass legislators and courts and minimize any room for civil disobedience. This significantly reduces the options to challenge legal rules. This, in turn, can impede the development of legal systems. In this paper, an analogy is made with evolutionary biology to illustrate (...) that the possibility to deviate from legal rules and existing norms is sometimes necessary for the further development of legal systems. Some room to break the law, for instance, through civil disobedience or imperfect enforcement of the law, will ensure sufficient variation. This allows for properly evolving legal systems that can continue to provide fair solutions, even when society and concepts of fairness further develop. (shrink)

Personal data use is increasingly permeating our everyday life. Informed consent for personal data use is a central instrument for ensuring the protection of personal data. However, current informed consent practices often fail to actually inform data subjects about the use of personal data. This article presents the results of a requirements analysis for informed consent from both a legal and usability perspective, considering the application context of educational assessment. The requirements analysis is based on European Union law and a (...) review of current practices. As the main outcome, the article presents a blueprint which will be the basis for the development of an informed consent template that supports data controllers in establishing an effective and efficient informed consent form. Because the blueprint, and subsequently, the template, distinguishes between legal and usability requirements, it also provides the basis for the mapping of legal requirements in other contexts. (shrink)