recognisedgoogleadsence

Personaldatafordecisionalpurposesintheageofanalytics:FromanindividualtoacollectivedimensionofdataprotectionAlessandroManteleroa,b,*aNanjingUniversityofInformationScience&Technology(NUIST),SchoolofPublicAdministration,Jiangsu,ChinabPolytechnicUniversityofTurin,DepartmentofManagementandProductionEngineering,andNexaCenterforInternet&Society,Turin,ItalyABSTRACTInthebigdataera,newtechnologiesandpowerfulanalyticsmakeitpossibletocollectandanalyselargeamountsofdatainordertoidentifypatternsinthebehaviourofgroups,com-munitiesandevenentirecountries.
Existingcaselawandregulationsareinadequatetoaddressthepotentialrisksandissuesrelatedtothischangeofparadigminsocialinvestigation.
Thisisduetothefactthatboththerighttoprivacyandthemorerecentrighttodataprotectionareprotectedasindi-vidualrights.
Thesocialdimensionoftheserightshasbeentakenintoaccountbycourtsandpolicymakersinvariouscountries.
Nevertheless,therightsholderhasalwaysbeenthedatasubjectandtherightsrelatedtoinformationalprivacyhavemainlybeenexercisedbyindividuals.
Thisatomisticapproachshowsitslimitsintheexistingcontextofmasspredictiveanalysis,wherethelargerscaleofdataprocessingandthedeeperanalysisofinformationmakeitnecessarytoconsideranotherlayer,whichisdifferentfromindividualrights.
Thisnewlayerisrepresentedbythecollectivedimensionofdataprotection,whichprotectsgroupsofpersonsfromthepotentialharmsofdiscriminatoryandinvasiveformsofdataprocessing.
Onthebasisofthedistinctionbetweenindividual,groupandcollectivedimensionsofprivacyanddataprotection,theauthoroutlinesthemainelementsthatcharacterisethecollectivedimensionoftheserightsandtherepresentationoftheunderlyinginterests.
2016AlessandroMantelero,PublishedbyElsevierLtd.
Allrightsreserved.
Keywords:BigdataRighttoprivacyDataprotectionGroupprivacyCollectiveinterestsDataprotectionauthoritiesRiskassessment*DepartmentofManagementandProductionEngineering,PolitecnicodiTorino,C.
soDucadegliAbruzzi,24,10120Torino,Italy.
E-mailaddress:alessandro.
mantelero@polito.
it.
http://dx.
doi.
org/10.
1016/j.
clsr.
2016.
01.
0140267-3649/2016AlessandroMantelero,PublishedbyElsevierLtd.
Allrightsreserved.
computerlaw&securityreview32(2016)238–255Availableonlineatwww.
sciencedirect.
comwww.
compseconline.
com/publications/prodclaw.
htmScienceDirect1.
IntroductionandscopeoftheanalysisBigdataanalyticsmakeitpossibletoinferpredictiveinfor-mationfromlargeamountsofdatainordertoacquirefurtherknowledgeaboutindividualsandgroups,whichmaynotnec-essarilyberelatedtotheinitialpurposesofdatacollection.
1Moreover,analyticsgrouppeopletogetherbytheirqualita-tiveattributesandhabits(e.
g.
low-incomepeople,"working-classmom","metroparents"2)andpredictthefuturebehaviouroftheseclusters3ofindividuals.
4Thisapproachisadopted,forinstance,bysomehealthin-surancecompanies,whichextractpredictiveinformationabouttherisksassociatedwithsegmentsofclientsonthebasisoftheirprimetimetelevisionviewing,propensitytobuygeneralmerchandise,ethnicity,geographyoruseofmailorderbuying.
5Inthesecases,predictionsbasedoncorrelations6donotonlyaffectindividuals,whichmayactdifferentlyfromtherestofthegrouptowhichhavebeenassigned,7butalsoaffectthewholegroupandsetitapartfromtherestofsociety.
Anexampleinthissenseisprovidedbythe"neighbourhood'sgeneralcreditscore"adoptedbycreditcompanies,8whichinducescompaniestoprovideopportunitiesforpeoplelivinginagivenneighbourhoodinawaythatbearsnorelationshiptotheirindividualconditions,butisbasedontheaggregatescoreofthearea.
9Theseissuesarenotnewandmaybeconsideredtheeffectoftheevolutionofprolingtechnologies,inacontextcharacterisedbyanincreasedvolumeofinformationavail-ableandpowerfulsoftwareanalytics.
10Nevertheless,previousformsofcategorisationandprolingwerebasedonafewstan-dardvariables(e.
g.
sex,age,familyincome,maritalstatus,placeofresidence);therefore,theirpredictiveabilitywaslimited.
Today,bigdataanalyticsusehundredsofdifferentvariablestoinferpredictiveinformationaboutgroupsofpeopleand,inmanycases,thesevariablesconcernaspectsthatarenotclearlyrelatedtothenalprolescreatedbyanalytics.
Moreover,usersareoftenunawareoftheseformsofdataanalysisandoftheimpactthatsomeinformationmayhaveontheirmembershipofoneoranothergroupcreatedbyana-lytics.
Finally,decisionmakersusetheoutcomesgeneratedbybigdataanalyticstotakedecisionsthataffectindividualsandgroups,withoutallowingthemanyparticipationintheprocess,whichremainsprimarilybasedonobscuredatamanage-mentandfrequentlytakesplaceinsituationsofimbalancebetweendatagatherersanddatasubjects.
Inthelightoftheabove,theuseofbigdataanalyticscreates"anewtruthregime",11inwhichgeneralstrategiesareadopted1SeeDavidBollier,'ThePromiseandPerilsofBigData'(AspenInstitute,CommunicationsandSocietyProgram2010)accessed27February2014.
SeealsoPerttiAhonen,'InstitutionalizingBigDatamethodsinsocialandpoliticalresearch'(2015)BigData&Society1–12accessed21July2015.
2ThisisoneofthecategoriesusedbyUSdatabrokerstodenespecicsegmentsofpopulationbasedonmodelsofpredictivebehaviour.
Inthissense,thecategory"metroparents"includescon-sumers"primarilyinhighschoolorvocationallyeducated[.
.
.
]handlingsingleparenthoodandthestressesofurbanlifeonasmallbudget",seeFederalTradeCommission,'DataBrokers:ACallforTransparencyandAccountability'(2014),20andAppendixBaccessed27February2014.
3Inthisarticle,thenotionofclusterisusedtoidentifyasetofindividualsthataredirectlyorindirectlygroupedonthebasisofcommonqualitativeelements(classofage,habits,geographicdis-tribution,etc.
).
4SeeRecitalnn.
51,58and58aoftheProposalforaRegulationoftheEuropeanParliamentandoftheCouncilontheprotectionofindividualswithregardtotheprocessingofpersonaldataandonthefreemovementofsuchdata(GeneralDataProtectionRegu-lation)textadoptedbytheCounciloftheEuropeanUnion,Brussels,19December2014(hereinafterabbreviatedasEUProposal).
5SeeSatishGarla,AlbertHopping,RickMonacoandSarahRittman,'WhatDoYourConsumerHabitsSayAboutYourHealthUsingThird-PartyDatatoPredictIndividualHealthRiskandCosts.
Proceedings'(SASGlobalForum2013)accessed28February2015;seealsoFederalTradeCommission(n2)20andAppendixB.
6SeeBollier(n1).
SeealsoMireilleHildebrandt,'Proling:FromDatatoKnowledge.
Thechallengesofacrucialtechnology'(2006)30(9)DatenschutzundDatensicherheit548.
7SeealsoBarbaraD.
Underwood,'LawandtheCrystalBall:Pre-dictingBehaviorwithStatisticalInferenceandIndividualizedJudgment'(1979)88YaleLawJournal1408.
8Thisscorepredictscreditrisksofindividualsthatliveinasmallgeographicareaanditisdenedonthebasisofaggregatecreditscores.
9SeePamDixonandRobertGellman,'TheScoringofAmerica:HowSecretConsumerScoresThreatenYourPrivacyandYourFuture'(2014),21,44,accessed10March2015.
SeealsoFrankPasquale,TheBlackBoxSociety.
TheSecretAlgorithmsThatControlMoneyandInformation(HarvardUni-versityPress2015)22–26;DanielleKeatsCitronandFrankPasquale,'TheScoredSociety:DueProcessForAutomatedPredictions'(2014)89Wash.
L.
Rev.
1;MeikeKamp,BarbaraKrfferandMartinMeints,'ProlingofCustomersandConsumers–CustomerLoyaltyPro-grammesandScoringPractices'inMireilleHildebrandtandSergeGutwirth(eds.
),ProlingtheEuropeanCitizen.
Cross-DisciplinaryPer-spective(Springer2010)205–211;AntonH.
Vedder,'Privatization,InformationTechnologyandPrivacy:ReconsideringtheSocialRe-sponsibilitiesofPrivateOrganizations'inGeoffMoore(ed),BusinessEthics:PrinciplesandPractice(BusinessEducationPublishers1997)215–226.
10SeealsoSergeGutwirthandMireilleHildebrandt,'SomeCaveatsonProling'inSergeGutwirth,YvesPoulletandPauldeHert(eds.
)Dataprotectioninaproledworld(Dordrecht,London2010)32–33.
11SeeAntoinetteRouvroy,'Desdonnéessanspersonne:lefétichismedeladonnéeàcaractèrepersonnelàl'épreuvedel'idéologiedesBigData'(2014)9accessed8March2015;AntoinetteRouvroy,'AlgorithmicGovernmentalityandtheEnd(s)ofCritique'(2013)accessed10March2015.
239computerlaw&securityreview32(2016)238–255onalargescaleonthebasisofrepresentationsofsocietygeneratedbyalgorithms,whichpredictfuturecollectivebehaviour.
12Thesestrategiesarethenappliedtospecicin-dividuals,giventhefactthattheyarepartofoneormoregroupsgeneratedbyanalytics.
13Theuseofanalyticsandtheadoptionofdecisionsbasedongroupbehaviourratherthanonindividualsarenotlimitedtocommercialandmarketcontexts.
Theyalsoaffectotherim-portantelds,suchassecurityandsocialpolicies,whereadifferentbalancingtestshouldbeapplied,giventheimpor-tanceofpublicinterestissues.
Oneexampleofthisisprovidedbypredictivepolicingso-lutionslike"PredPol",14asoftwareusedbyUSlocalpoliceforcestoanticipate,preventandrespondmoreeffectivelytocrime,onthebasisofcrosscheckdata,placesandtechniquesofrecentcrimes.
PredPolandsimilarsoftwareareabletopredictfuturecrimesandtheirlocation,buttheyalsoinducea"self-fulllingcyclesofbias".
Thisisduetothefactthatpolicedepart-mentsallocatemoreresourcestotheareassuggestedbyanalyticsandthisincreasescrimedetectionatlocallevel,withtheresultofreinforcingtheoriginalprediction.
Atthesametime,areducedpolicepresenceinotherareasreducescrimedetectionandproducesanadversepredictionfortheseareas.
15Theconsequenceofthesesoftwaresolutionsisapotentialgeo-graphicaldiscrimination,whichmightnotdirectlyaffectindividuals,buthasanimpactonlocalcommunitiesintermsofsocialstigmaorinadequateprovisionofpoliceservices.
Inthissense,thereisacollectiveinterestinacorrectandaccu-rateuseofdata.
16Thesescenariosshowthecollectivedimensionofdeci-sionsadoptedusingdataanalyticsandtheirpotentialbias.
17Againstthisbackground,Korzybski'sstatement"amapisnottheterritory"18sumsupthefocusofthisarticle.
Thelogicoftheauthorofthemap,thewayinwhichtheterritoryis12SeePasquale(n9);ViktorMayer-SchnbergerandKennethCukier,BigData.
ARevolutionThatWillTransformHowWeLive,WorkandThink(JohnMurray2013);Bollier(n1);McKinseyGlobalInsti-tuteBigdata:Thenextfrontierforinnovation,competition,andproductivity(2011)accessed16April2012.
SeealsoBellagioBigDataWorkshopParticipants,'Bigdataandpositivesocialchangeinthedevelopingworld:Awhitepaperforpractitionersandresearchers'(OxfordInternetInstitute2014)accessed28June2015;IraS.
Rubinstein,'BigData:TheEndofPrivacyoraNewBeginning'(2013)3(2)InternationalDataPrivacyLaw74–87;danahboydandKateCrawford,'SixProvocationsforBigData'(paperpresentedatOxfordInternetInstitute's"ADecadeinInternetTime:Sympo-siumontheDynamicsoftheInternetandSociety",Oxford,September21,2011)ac-cessed16April2012;danahboydandKateCrawford,'CriticalQuestionsforBigData:ProvocationsforaCultural,Technologi-cal,andScholarlyPhenomenon'(2012)15(5)Information,Communication,&Society662–679;OmerTeneandJulesPolonetsky,'PrivacyintheAgeofBigData.
ATimeforBigDecisions'(2012)64Stan.
L.
Rev.
Online63–69accessed14March2013.
13SeeFederalTradeCommission(n2)IV–V("Potentiallysensi-tivecategoriesincludethosethatprimarilyfocusonethnicityandincomelevels,suchas'UrbanScramble'and'MobileMixers,'bothofwhichincludeahighconcentrationofLatinosandAfricanAmeri-canswithlowincomes.
Otherpotentiallysensitivecategorieshighlightaconsumer'sagesuchas'RuralEverlasting,'whichin-cludessinglemenandwomenovertheageof66with'loweducationalattainmentandlownetworths,'while'MarriedSo-phisticates'includesthirty-somethingcouplesinthe'upper-middleclass.
.
.
withnochildren'").
SeealsoBollier(n1);Hildebrandt,'Proling:FromDatatoKnowledge.
Thechallengesofacrucialtechnology'(n6)549–550.
14SeeWalterL.
Perry,BrianMcInnis,CarterC.
Price,SusanC.
SmithandJohnS.
Hollywood,'PredictivePolicing.
TheRoleofCrimeFore-castinginLawEnforcementOperations'(TheRANDCorporation2013),accessed10March2015.
SeealsoPasquale(n9)41–46,48–51;Robinson+Yu,'CivilRights,BigData,andOurAlgorithmicFuture.
ASeptember2014reportonsocialjusticeandtechnology'(2014),18–19accessed10March2015;AlessandroManteleroandGiuseppeVaciago,'Socialmediaandbigdata'inBabakAkhgar,AndrewStaniforthandFrancescaBosco(eds.
)CyberCrime&CyberTerrorism.
Investigator'sHandbook(Elsevier2014),175–196;AndrewGuthrieFerguson,'PredictivePolicing:TheFutureofReasonableSuspicion'(2012)62EmoryL.
J.
259accessed29January2014;RosamundevanBrakelandPaulDeHert,'Policing,surveillanceandlawinapre-crimesociety:Understand-ingtheconsequencesoftechnologybasedstrategies'(2011)20(3)JournalofPoliceStudies20(3):163–192http://www.
vub.
ac.
be/LSTS/pub/Dehert/378.
pdfaccessed27July2015.
15SeeKellyK.
Koss,'LeveragingPredictivePolicingAlgorithmstoRestoreFourthAmendmentProtectionsinHigh-CrimeAreasinaPost-WardlowWorld'(2015)90Chi.
-Kent.
L.
Rev.
301,311–312.
16SeealsoPerryet.
al.
(n14),118–125;OscarH.
GandyJr.
,'Explor-ingIdentityandIdenticationinCyberspace'(2000)14NotreDameJ.
L.
Ethics&Pub.
Pol'y1085,1100accessed10July2015.
17SeealsoTalZ.
Zarsky,'TransparentPredictions'(2013)4U.
Ill.
L.
Rev.
1503,1510–1513.
18AlfredKorzybski,'ANon-AristotelianSystemanditsNeces-sityforRigourinMathematicsandPhysics'inAlfredKorzybski(ed)Scienceandsanity:AnIntroductiontoNon-AristotelianSystemsandGeneralSemantics(InstituteofGeneralSemantics1933)747,750accessed15March2015;seealsoKateCrawford,'AlgorithmicIllusions:HiddenBiasesofBigData',presentationatStrata2013,accessed15March2015.
240computerlaw&securityreview32(2016)238–255representedandthepotentialerrorsofrepresentationcanproducedifferentmapsofthesameterritory.
Mapsarenotneutral.
Inthesameway,insocialinvestigations,thestrate-giesusedtogroupdata,thelogicofbigdataanalyticsandtheirpotentialbiashaveaninuenceonthenalrepresentationofgroupsandsociety.
19This"categorical"approachcharacterisingtheuseofana-lyticsleadspolicymakerstoadoptcommonsolutionsforindividualsbelongingtothesameclustergeneratedbyana-lytics.
Thesedecisionalprocessesdonotconsiderindividualsperse,butasapartofagroupofpeoplecharacterisedbysomecommonqualitativefactors.
Thisleadstoareectiononprivacyanddataprotection.
20Theuseofpersonalinformationandbigdataanalyticstosupportdecisionsexceedstheboundariesoftheindividualdi-mensionandassumesacollectivedimension,withpotentialharmfulconsequencesforsomegroups.
21Inthissense,preju-dicecanresultnotonlyfromthewell-knownprivacy-relatedrisks(e.
g.
illegitimateuseofpersonalinformation,datasecu-rity),butalsofromdiscriminatoryandinvasiveformsofdataprocessing.
22Thedichotomybetweenindividualsandgroupsisnotnewandithasalreadybeenanalysedwithregardtothelegalaspectsofpersonalinformation.
Nonetheless,therighttoprivacyandthe(morerecent)righttotheprotectionofpersonaldatahavebeenlargelysafeguardedasindividualrights,despitethesocialdimensionoftheirrationale.
23Thefocusonthemodelofindividualrightsisprobablythemainreasonforthefewcontributionsbyprivacyscholarsonthecollectivedimensionofprivacyanddataprotection.
Hith-erto,onlyfewauthorshaveinvestigatedthenotionofgroupprivacy.
Theyhaverepresentedthisformofprivacyastheprivacyofthefactsandideasexpressedbythemembersofagroupinthegroupenvironmentorintermsofprotectionofinformationaboutagroup.
Againstthisbackground,thisarticleisnotanattempttoprovideanewinterpretationofgroupprivacyortoinvesti-gatetherelationshipsbetweenthelegalandsociologicalnotionsofthegroup,whichisonlybrieytouchedoninthefollow-ingparagraphs.
Rather,itfocusesonthenewkindofgroupsthatresultsfromtheuseofbigdataanalyticstorepresentthe"territory"ofoursociety.
Inthislight,thearticleinvestigatestheconsequencesofthisalgorithmicrepresentation,intermsofprotectionofcollectiverights.
Fromthisperspective,therstpartofthisarticledealswiththetraditionalnotionsofindividualprivacyandgroupprivacy;itpointsoutthenoveltyofthegroupsgeneratedbyalgorithms,24whichareontologicallydifferentfromthegroupsreferredtobytheoriginalnotionof"groupprivacy".
25Inthissense,bigdataanalyticsgeneratenewgroups,whichdidnotprevi-ouslyexistinsociety,variableaggregationsofindividualswhosepersonalinformationisminedinordertoextractpredictiveinferences.
Thedifferentoriginandmorphologyofthesegroupsmakeitnecessarytoinvestigatethecollectivedimensionofprivacyanddataprotection,whichisdifferentfromthemanifesta-tionoftheindividualrighttobeletaloneinthegroupcontextortheprotectionofinformationregardingthegroup.
Forthisreason,thesecondpartofthearticlefocusesonthemainel-ementsthatcharacterisethiscollectivedimensioninthecontextofbigdataanalytics26andexaminesthenatureofthecollectiveinterestsatissueinthisregard,theirrepresenta-tionandthebalancewithotherconictinginterests.
2.
Thenotionofgroupinprivacyliterature:GroupprivacyandindividualrightsPrivacyscholarshavedevotedfewcontributionstogroupprivacyandcollectiveinterestsindataprocessing.
Arstapproachcon-sidersgroupprivacyastherighttoprivacyconcerninginformationsharedwithinagroupbyitsmembers.
27Inthissense,thereisnoautonomousnotionofgroupprivacy,butonlyapeculiarattitudeofindividualprivacyinthecontextofgroups.
Individualprivacydescribestheconditionsunderwhicha"right19Itshouldbenotedthatdifferentarchitecturesofalgorithmsmayproducedifferentresults,althoughonthebasisofthesamefactors.
SeeDixonandGellman(n9),2("newconsumerscoresusethou-sandsofpiecesofinformationaboutconsumers'paststopredicthowtheywillbehaveinthefuture.
Issuesofsecrecy,fairnessofunderlyingfactors,useofconsumerinformationsuchasraceandethnicityinpredictivescores,accuracy,andtheuptakeinbothuseandubiquityofthesescoresarekeyareasoffocus").
20Theoriginofdata,thenatureofinformationanditslegalpro-tection(i.
e.
righttoprivacyordataprotection)arenotparticularlyrelevantinthecontextdescribedinthepreviousparagraphs.
Inthisarticle,theanalysisofprivacyanddataprotectionismorefocusedontheuseofinformationandontherelationshipbetweenindividualandcollectivedimensions,ratherthanonthetradi-tionalaspectsofsecrecyanddataquality.
SeealsoFredH.
CateandViktorMayer-Schnberger,'DataUseandImpact.
GlobalWorkshop'(TheCenterforInformationPolicyResearchandTheCenterforAppliedCybersecurityResearch,IndianaUniversity2013)iiiaccessed27February2014;AlessandroMantelero,'ThefutureofconsumerdataprotectionintheE.
U.
Rethinkingthe"noticeandconsent"paradigmintheneweraofpredictiveanalytics'inthisReview(2014),vol30,issue6,643–660.
21SeealsoKateCrawford,GustavoFaleiros,AmyLuers,PatrickMeier,ClaudiaPerlichandJerThorp,'BigData,CommunitiesandEthicalResilience:AFrameworkforAction'(2013)6–7accessed5April2015;danahboyd,KarenLevy,AliceMarwick,'TheNetworkedNatureofAlgorithmicDis-crimination',inSeetaPeaGangadharan,VirginiaEubanksandSolonBarocasDataandDiscrimination:CollectiveEssays(OpenTechnologyInstituteandNewAmerica2014)56accessed14April2015.
22SeealsoTheWhiteHouse,ExecutiveOfceofthePresident,'BigData:SeizingOpportunities,PreservingValues'(2014)accessed26December2014.
SeealsoZarsky(n17)1560–1563;Vedder(n9).
23Seebelowfn.
61.
24Section2.
25SeeEdwardJ.
Bloustein,'GroupPrivacy:TheRighttoHuddle'(1977)8Rutgers-Cam.
L.
J.
219andEdwardJ.
Bloustein,IndividualandGroupPrivacy(TransactionBooks1978)123–186;AlanF.
Westin,PrivacyandFreedom(Atheneum1970)42–51.
26Section3.
27SeeBloustein,IndividualandGroupPrivacy(n25).
241computerlaw&securityreview32(2016)238–255tobeletalone"shouldberecognised,whilegroupprivacyde-terminesthetypeofpersonalinformationsharingthatgoeswithinagroup.
28Groupprivacythereforereferstotheprivacyofthefactsorideasexpressedbymembersofagroupinthegroupenvironmentandprovidesaguaranteethatthisinfor-mationwillnotberevealedoutsidethegroup.
29Thisnotionofgroupprivacyfocusesonsecrecyandinti-macyand,forthisreason,ismainlybasedontheleveloftrustexistingamongthemembersofagroup.
Theconsequenceisadutyofcondentiality.
30Groupprivacyconcernsthebreachofthisduty.
31Nevertheless,thisdoesnotrepresentachangeinthetraditionalperspective,whichremainsbasedonthein-dividual'srighttoprivacy.
32Aslightlydifferentnotionofgroupprivacyisrepresentedbytheideaof"organizationalprivacy",33whichfocusesoncontroloverinformationconcerningcollectiveentitiesandontheself-determinationoftheseentities.
34Inthissense,groupprivacystillreliesoncondentialityandregardstheinter-estsofthegroupitselfintheprotectionoffacts,actsordecisionsthatconcernitsinternalaffairsanditsorganisationalautonomy.
35Thusquestionsregarding"organizationalprivacy"donotonlyconcernwhetherlegalpersonsmighthaveale-gitimateclaimtoprivacy,36butalsorevolvearoundtheindirectprotectionofindividualswhoconstitutethecollectiveenti-tiesandtheirgroupinterests.
37Thesetwotheoriesongroupprivacyconcernthepeculiarnatureofthesharingofpersonalinformationwithinagroup.
Theyprovideasortofcontext-relatednotionofindividualprivacy.
Adifferentapproachfocusesoninformationregard-inggroupsperseanddoesnotfocusongroupsasasumtotaloftheindividualsthatmakethemup,withtherelatedinter-naldynamics.
38Inthisperspective,agroupisanautonomousentity(anorganisedoranon-organisedcollectiveentity)and28SeeBloustein,IndividualandGroupPrivacy(n25)127–130.
29SeeBloustein,IndividualandGroupPrivacy(n25)129–134.
Inthedescriptionofthevariouscontextsinwhichtherighttoprivacyisrelevantinthelightofthegroupdimension,theauthorcon-sidersmarital,priest–penitent,lawyer–clientandphysician–patientrelationships.
Inallthesecases,therighttoprivacyismainlyrelatedtointimacyandsecrecy.
30Itshouldbenotedthattermslikecondentialityor"rela-tionalprivacy"havebeenalsousedtodescribetheaspectsconcerningthenotionofgroupprivacythathasbeeninvesti-gatedbyBloustein.
See,e.
g.
,LawrenceO.
Gostin,Publichealthlaw:power,duty,restraint(UniversityofCaliforniaPress2008)316;Chris-tineM.
Emery,'Relationalprivacy.
ARightToGrieveinTheInformationAge:HaltingTheDigitalDisseminationofDeath-SceneImages'(2011)42RutgersL.
J.
765.
Authorsusedthenotionofrelationalprivacytopointoutthecontextualnatureofthisright,itsintimatenatureanditsprotection,butwithoutfocusingonthegroupdimensionperse.
SeeJamesRachels,'WhyPrivacyisIm-portant'(1975)4(4)Philosophy&PublicAffairs323–333;CharlesFried,'Privacy[Amoralanalysis]'(1968)77(3)YaleL.
J.
475–493.
SeealsoKendallThomas,'BeyondthePrivacyPrinciple'(1992)92(6)Colum-biaLawReview1431,1445–1446.
Onthecontrary,thestudyconductedbyBlousteinfocusesonthegroupenvironmentandpro-videsamoredetailedanalysisoftherighttoprivacyinthiscontext.
Moreover,thisauthorputsthenotionofgroupprivacyinrelation-shipwiththedynamicsofgroupsandthesociologicaltheoriesongroups.
Finally,thementionednotionof"relationalprivacy"isveryvague,sinceitisusedbylegalscholarstodescribedifferentkindsofsocial-relatedaspectsconcerningprivacy,fromprivacyoftherelativesconcerningthedeathofmembersoftheirfamilytointimatesexualaspects,uptothemorerecentdimensionofsocialnetworkinteraction.
SeealsoLorraineG.
Kisselburgh,'Reconceptualizingprivacyintechnologicalrealms:Theoreticalframeworksforcommunication'(2008)AnnualmeetingoftheIn-ternationalCommunicationAssociation,TBA,Montreal,Quebec,Canadaaccessed20February2015;BeateRssler,Thevalueofprivacy(Polity2005)130–133.
31SeeBloustein,IndividualandGroupPrivacy(n25)137–140,180–181.
32SeeBloustein,IndividualandGroupPrivacy(n25)125("Groupprivacyisanextensionofindividualprivacy.
Theinterestpro-tectedbygroupprivacyisthedesireandneedofpeopletocometogether,toexchangeinformation,sharefeelings,makeplansandactinconcerttoattaintheirobjectives").
33SeeWestin(n25).
34Collectiveentitiesmaybeautonomousandindependentofthesumoftheirmembers,but,atthesametime,theyarethesumoftheindividualpersonswhomakethemup.
Forthisreason,al-thoughorganisationalprivacycanbeconsideredasanautonomousrightoflegalpersons,inmanycasesitalsorepresentsanindi-rectprotectionoftheindividualrightsoftheirmembersandofthesecrecyofmembers'interactioninthecontextoftheorganisation.
SeeWestin(n25)42.
SeealsoLeeA.
Bygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(KluwerLawInterna-tional2002)175–176,186.
35SeealsoWestin(n25).
Forananalysisofthetheoreticalap-proachadoptedbyWestin,seealsoBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)247–252.
36Thisissueispartofthemoregeneraldebateonpersonalityrightsofcollectiveentitiesandonthedualismcharacterisinglegalpersons,fromvonSavignyandvanGierketoKelsen,HohfeldandHart.
SeeFriedrichKarlvonSavigny,Juralrelations:or,TheRomanlawofpersonsassubjectsofjuralrelations:beingatranslationofthesecondbookofSavigny'sSystemofmodernRomanlaw,translatedbyW.
H.
Rattigan(Wildy&Sons1884);OttovonGierke,DieGenossenschaftstheorieunddiedeutscheRechtsprechung(Weidmann1887);WesleyN.
HohfeldandWalterW.
Cook,Fundamentallegalcon-ceptionsasappliedinjudicialreasoning:andotherlegalessays(YaleUniversityPress1923);HerbertL.
A.
Hart,Denitionandtheoryinjurisprudence(Stevens1954);HansKelsen,ReineRechtslehre.
MiteinemAnhang:DasProblemderGerechtigkeit(F.
Deuticke1960).
SeealsoJohnDewey,'TheHistoricBackgroundofCorporateLegalPersonality'(1926)35(6)YaleL.
J.
655–673;KatsuhitoIwai,'Persons,ThingsandCorporations:TheCorporatePersonalityControversyandCom-parativeCorporateGovernance'(1999)47(4)TheAmericanJournalofComparativeLaw583–632.
37Onthisdualdimension,whichcharacterisescollectiveenti-tiesandthelegalprotectionofrelatedinterests,seeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)175–176,250–253.
38SeeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)173–298.
242computerlaw&securityreview32(2016)238–255groupprivacyreferstoinformationthatidentiesandde-scribesthegroup.
39Underthisthirdinterpretation,groupprivacyprotectsin-formationreferringtocollectiveentities–bothlegalpersonsandorganisationsorgroupswithoutaformalandindepen-dentidentity–andactsasanextensionofindividualdataprotectiontotheseentities.
40Althoughthisnotionofgroupprivacyisdifferentfromtheotherdenitionsbrieyde-scribedabove,itseemsnottochallengethetraditionalperspectivethatcharacterisesprivacyanddataprotection.
Thegroupdimensionaffectsthemanifestationoftheserightsinaspeciccontext(thegroup),buttheystillrevolvearoundthemodelofindividualrights,althoughreferringtoacollectiveentityoritsmembers.
41Nevertheless,thisapproachistheclosesttothecollectivedimensionofdataprotection,mainlywhenitfocusesonnon-organisedcollectiveentities.
42Despitethesedifferencesbetweenthetheoriesaboutgroupprivacy,thisbriefoverviewshowsthattheexistingstudiesareforthemostpartbasedontheindividualrightsmodelwheretheyconsiderthegroupdimensionofprivacyanddatapro-tection.
Thesetworightsarerelatedtogivenindividualswhoaremembersofagroup,ortothegroupitselfasanautono-mouscollectivebody.
Inbothcases,thearchitectureoftheserightsisnotinspiredbytheideaofthegroup'scollectiveandnon-aggregativeinterests.
Thisapproachtotheissuesrelatedtogroupsisconsis-tentwiththetraditionalprotectionoftherightsinquestion.
TherighttoprivacyandtherighttodataprotectionhavebeentreatedasindividualrightsinboththeU.
S.
andEuropeanex-periences,thoughbasedondifferingoriginsandevolutions.
IntheU.
S.
,attheendofthe19thcentury,WarrenandBrandeisshapedthemodernideaofprivacy,43whichwasdif-ferentfromthepreviousnotionofprotectionofprivatelifebasedonproperty.
44Inspiteofthis,therighttoprivacy,al-thoughredenedasapersonalityright,remainedlargelybasedontheindividualdimension.
45Neitherthenotionofdeci-sionalprivacynoritsconstitutionaldimension,originatingintheground-breakingopiniongivenbyBrandeisinhisroleasSupremeCourtjudge,46abandonedtheindividualisticnatureoftheright.
OntheothersideoftheAtlantic,individualprivacypro-tectionstemmedfromthesamesocialfactors(theinvasiveattitudeofthe"pennypress"andnewmedia)thatjustiedtheresponseoftheU.
S.
legalsystemtoprivacyinvasionandtheprotectionoftherighttobeletalone.
47However,theEuro-peanlegalnotionofprivacydidnotdrawitsoriginsfromtheU.
S.
experience,butwasindependentlyshapedbylegalschol-arsandthecourts.
48Fromthetheoreticalpointofview,therighttoprivacywasplacedinthesphereofindividualrights,asintheU.
S.
,butinEuropeancaselawandliteraturethereisacloserconnectionwiththegeneraltheoryofpersonalityrights.
49Moreover,unlikeintheU.
S.
,theEuropeannotionofprivacyhasnotacquiredthewiderdimensionoftheU.
S.
decisionalprivacy,buthasremainedmorefocusedoninformationalprivacy.
Thisdoesnotmeantherighttoself-determinationwithregardtogovernmentandpublicbodieshasnotbeenrecognisedinEurope,butthatitrestsonthedifferentfundamental39SeeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)partIII.
Theauthorextensivelydescribesthevariousissuesconcerningdataprotectionrightsofcollectiveentities.
SeealsoJean-PierreChamoux,'DataProtectioninEurope:TheProblemofthePhysicalPersonandtheirLegalPerson'(1981)2J.
MediaLaw&Practice70–83.
SeealsoArticle3(2)(b)ofConventionforthePro-tectionofIndividualswithregardtoAutomaticProcessingofPersonalData(CouncilofEurope,Strasbourg,28.
01.
1981)andRecital24oftheDirective95/46/EC.
40SeeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)186,241–282,288–289.
SeealsoBartvanderSloot,'DoprivacyanddataprotectionrulesapplytolegalpersonsandshouldtheyAproposalforatwo-tieredsystem'inthisReview(2015),vol.
31,issue1,26,33–45.
41Butsee,morerecently,LeeA.
BygraveandDagWieseSchartum,'Consent,ProportionalityandCollectivePower'inSergeGutwirth,YvesPoullet,PaulDeHert,CéciledeTerwangneandSjaakNouwt(eds.
),ReinventingDataProtection(Springer2009),157–173.
42SeeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)283–295.
Bygravepointsoutthepeculiarnatureofnon-organisedcollectiveentities,whicharecreatedbypersonsororganisationsoutsidethegroup.
Moreover,theauthorsug-gestssomeremediestoprotecttheinterestsoftheseentitiesandtheirmembersaccordingtotheexistingdataprotectionframework.
43SamuelD.
WarrenandLuisD.
Brandeis,'TheRighttoPrivacy'(1890)4(5)Harv.
L.
Rev.
193–220.
44SeeWarrenandBrandeis(n43)205,213;Westin(n25)337–345;DavidW.
Leebron,'TheRighttoPrivacy'sPlaceintheIntellectualHistoryofTortLaw'(1991)41CaseW.
Res.
L.
Rev.
769,775–778,781;RobertC.
Post,'RereadingWarrenandBrandeis:Privacy,PropertyandAppropriation'(1991)41CaseW.
Res.
L.
Rev.
647,663–670;AmitaiEtzioni,TheLimitsofPrivacy(BasicBooks1999)189.
45SeeWarrenandBrandeis(n43)219;Westin(n25)330–364;Etzioni(n44)189,196;DanielJ.
Solove,UnderstandingPrivacy(HarvardUni-versityPress2008)12–37,78–98.
46SeeBrandeis'opinionsinOlmsteadv.
UnitedStates277US438,471(1928).
SeealsoSweezyv.
NewHampshire354US234(1957);NAACPv.
Alabama357US449(1958);Massiahv.
US377US201(1964);Griswoldv.
Connecticut,381US479(1965);Roev.
Wade410US113(1973).
47SeeMichaelSchudson,DiscoveringtheNews.
ASocialHistoryofAmericanNewspaper(BasicBooks1978)12–60.
48See,e.
g.
,Trib.
civ.
Seine,16June1858,D.
P.
,1858.
3.
62.
SeealsoLeeA.
Bygrave,'PrivacyProtectioninaGlobalContext.
ACom-parativeOverview'(2004)7ScandinavianStudiesinLaw319,326–331;JamesQ.
Whitman,'TheTwoWesternCulturesofPrivacy:DignityversusLiberty'(2004)113YaleL.
J.
1151–1221;FritsW.
Hondius,EmergingDataProtectioninEurope(NorthHollandPublishingCompany1975)6.
49SeeStigStromhlm,RightofPrivacyandRightsofPersonality.
AcomparativeSurvey(Norstedt&Soners1967)28–31.
SeealsoHansGiesker,DasRechtderPrivatenandereigenenGeheimsphre.
EinBeitragzuderLehrevondenIndividualrechten(Müller1905);JosefKohler,UrheberrechtanSchriftwerkenundVerlagsrecht(F.
Enke1907)441.
243computerlaw&securityreview32(2016)238–255freedomsrecognisedbyEuropeanchartersandconventions,notsolelyontherighttoprivacy.
50Despitethesedifferences,thenatureoftherighttoprivacydependsprimarilyontheindividualrightsmodelonbothsidesoftheAtlantic.
51ThecollectivedimensionofthisrighthasbeenrecognisedintheU.
S.
andEurope,butprotectedmainlyindi-rectly,asanaggregationofindividualprivacyissuesandnotasanautonomousdimension.
52Thesameconsiderationscanbeappliedtothelegalregimesofpersonalinformation,whichisregulatedunderdatapro-tectionstatutes.
Althoughdataprotectionlawshavedrawntheiroriginsfromcitizens'concernsaboutgovernmentsocialcontrol,53regardingthecollectivedimensionofdataprotec-tion,theregulationfocusesondatasubjectsandtheirrights.
54Collectiveinterestshavebeenactivelyprotectedasthesumtotalofvariousindividualneeds.
Hence,lawmakers,thecourtsanddataprotectionauthoritieshaveaddressedtheseinter-estswithremediesthataremainlyfocusedonindividualrightsandtheirenforcement.
Inlightoftheabove,theapproachbasedontheindi-vidualrightsmodel,adoptedbylegalscholarswithregardtogroupprivacy,isinlinewiththegenerallegalnotionsofprivacyanddataprotection.
Itisalsoconsistentwiththetheoreticalstudiesongrouptheoryconductedintheeldofsociology.
Thevariousapproachesoflegalscholarsseemtoreectthemoregeneralcontroversybetweenindividualisticandorganicsociologicaltheoriesaboutthenatureofgroups.
55Ontheonehand,attentiontotheindividualdimensionofprivacyandtheinteractionsbetweendifferentindividuals56isconsistentwiththenotionofgroupasthesumoftherelationshipsexistingamongitsmembers(individualistictheory).
Ontheotherhand,whentheanalysistakesintoconsiderationinformationcon-cerningthegroupitselfasawhole,57thegroupisseenasanautonomousunitthatassumestheformofanorganisedcol-lectiveentity(organictheory).
Inthiscontext,thelegalapproachthatconsidersgroupprivacyasrelatingtotheindividual'sprivacyissueswithinagroup58isinlinewiththeindividualistictheory,whichseesgroupsasentitiesinwhichindividualsinteractwitheachotherinacontinuousandrelativelystablemanner.
Moreover,fromasociologicalperspective,themembersofagroupareawareofbeingpartofthegroupandthegroupisusuallyrecognisedasanautonomoussocialstructure.
Accordingtothisposi-tion,agroupistheproductofconcurrentdecisionsofvariouspersonswhoarestrivingtoreachacommongoalorsharecommonexperiences,valuesorinterests.
50SeetheinuentialdecisionadoptedbytheFederalGermanCon-stitutionalCourt(Bundesverfassungsgericht),15December1983,NeueJuristischeWochenschrift,1984.
accessed25June2014.
ForanEnglishtranslation,seeHumanRightsLawJournal1984,5:94.
Seealsothearticle8oftheEuropeanConventiononHumanRightsandtherelatedcaselawoftheEuropeanCourtofHumanRights,CouncilofEurope,'CaseLawoftheEuropeanCourtofHumanRightsConcerningtheProtectionofPersonalData'(2013)accessed20March2015;EuropeanCourtofHumanRights,'Protectionofpersonaldata'(2014)accessed21March2015.
SeealsoStefanoRodotà,'DataProtectionasaFundamentalRight'inGutwirth,Poullet,DeHert,deTerwangneandNouwt(n41),77–82;JosephA.
Cannataci,'LexPersonalitatis&Technology-drivenLaw'(2008)5(1)SCRIPTed1–6.
Onthenotionofpersonalityright,seeGiorgioResta,'Personnalité,persnlichkeit,personality'(2014)1(3)ComparativePer-spectivesontheProtectionofIdentityinPrivateLaw215–243.
51SeeBygrave,'PrivacyProtectioninaGlobalContext.
ACom-parativeOverview'(n48)324–325;Solove,UnderstandingPrivacy(n45)ch.
2.
SeealsoColinJ.
BennettandCharlesD.
Raab,TheGover-nanceofPrivacy.
Policyinstrumentsinglobalperspective(Ashgate2003)ch.
1;RobertC.
Post,'TheSocialFoundationsofPrivacy:Commu-nityandSelfintheCommonLawTort'(1989)77Cal.
L.
Rev.
957;JulieE.
Cohen,'ExaminedLives:InformationalPrivacyandtheSubject'(2000)52Stan.
L.
Rev.
1373,1426–1428.
52SeeinteraliaArticle29DataProtectionWorkingParty,'LettertoMr.
LarryPage,ChiefExecutiveOfcer'(2013)accessed27February2014;IrishDataProtectionCommissioner,'FacebookIrelandLtd.
ReportofRe-Audit'(2012)accessed27February2014;ItalianDataProtectionAuthority,'In-junctionandOrderIssuedAgainstGoogleInc.
'(2013)accessed27February2014.
Onlyinafewhypotheses,collectiveprivacyisrecognisedasanautonomousdi-mension,whichisdifferentfromindividualprivacy.
Thishappensinlabourlaw,wheretherepresentativesofemployeesconcurontheadoptionofthedecisionsconcerningsurveillanceinthework-placeonbehalfoftheworkers.
See,EuropeanCommission,'Secondstageconsultationofsocialpartnersontheprotectionofworkers'personaldata'(undated)7,10,16–17accessed10January2015.
SeealsospecicreferencestotheprovisionsofEuropeannationallabourlawsinMarkFreedland,'DataProtectionandEmploymentintheEuropeanUnion.
AnAnalyticalStudyoftheLawandPracticeofDataProtectionandtheEmploymentRelationshipintheEUandItsMember'(1999)40–43accessed25January2015;FrankHendrickx,'ProtectionofWorkers'PersonalDataintheEuropeanUnion'(undated)33–35,98–101,accessed18January2015.
SeealsoArticle4oftheItalianlabourstatute(L.
300/1970).
Seebelowpara3.
2.
53SeeWestin(n25)158–168,298–326;AdamC.
Breckenridge,TheRighttoPrivacy(UniversityofNebraskaPress1970)1–3;Secre-tary'sAdvisoryCommitteeonAutomatedPersonalDataSystems,'Records,ComputersandtheRightsofCitizens'(1973)accessed27February2014.
SeealsoSolove,UnderstandingPrivacy(n45)4–5.
SeealsoMyronBrenton,ThePrivacyInvaders(Coward-McCann1964);VancePackard,TheNakedSociety(DavidMcKay1964);ArthurR.
Miller,TheAssaultonPrivacyComputers,DataBanks,Dossiers(UniversityofMichiganPress1971)54–67;ViktorMayer-Schnberger,'GenerationaldevelopmentofdataprotectioninEurope'inPhilipE.
AgreandMarcRotenberg(eds),Technologyandprivacy:Thenewlandscape(MITPress1997)221–227.
54SeeColinJ.
Bennett,RegulatingPrivacy:DataProtectionandPublicPolicyinEuropeandtheUnitedStates(CornellUniversityPress1992)29–33,47;Mayer-Schnberger,'GenerationaldevelopmentofdataprotectioninEurope'(n53)219,221–222.
SeealsoBygraveandWieseSchartum(n41)169.
55SeeBloustein,IndividualandGroupPrivacy(n25)124.
56Ibid.
57SeeWestin(n25)42;Bygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)173–282.
58SeeBloustein,IndividualandGroupPrivacy(n25)124.
244computerlaw&securityreview32(2016)238–255Ontheotherhand,theorganictheoryofgroupsisconsis-tentwiththenotionofgroupprivacyintermsof"organizationalprivacy",59whichfocusesontheinformationalself-determinationofthegroupitself.
Inthissense,groupprivacyismorecloselyconnectedtothesecrecyofthegroup'sactivi-tiesthantothesecrecyofpersonalinformationsharedwithinthegroupbyitsmembers.
Theorganictheoryisalsoconsis-tentwiththemorerecentapproachfocusedondataprotection,60whichisnotnecessarilyrelatedtothesecrecyofinformation,butalsoregardspubliclyavailabledataoncol-lectiveentities.
Finally,aswehaveseen,thecentralroleoftheindividualrightsmodelinprotectingprivacyandpersonalinformationdoesnotmeanthatlegalsystemsdisregardthesocialdimen-sionsoftheserights.
Bothprivacyanddataprotectionplayanimportantroleinsafeguardingnotonlyindividualinterests,butalsothequalityofsocietyingeneral.
Freedomofassocia-tion,limitstodisproportionatesurveillancepractices,andpreventionofdiscriminationbasedonsensitivepersonaldataarejustfewexamplesofthesocialeffectsofsafeguardingtherighttoprivacyandpersonalinformation.
Valuessuchasde-mocracyandpluralismarestrictlyrelatedtotheprotectionoftheserights.
61However,thecourtsmayaddressissuesrelatedtogeneralinterestsonlywhentheyreceivecomplaintsfromrightsholders,buttherightholdersmayhavenointerestintheseissues,beunawareofthegeneralinterest,62orbeinnopositiontoreacttopotentialthreatstotheirinterests,owingtosituationsofpowerimbalance.
63Independentauthoritiesmaybetteraddresstheseissuesofgeneralinterest,64butweshouldrememberthattheseau-thoritiesoftenactonadiscretionarybasisandthismayhavenegativeeffects,intermsofunder-deterrence.
Thelicensingmodel,whichhasbeenadoptedinsomecasesbynationalregu-lators,representsapossiblesolutioninassessingtherisksassociatedwithspecictechnologiesorbusinessmodels,andtopreventunder-deterrence.
65Forthesereasons,independentauthoritiesmayplayanim-portantroleinsafeguardinginterestsrelatedtothecollectivedimensionofprivacyanddataprotectioninthebigdataen-vironment.
Evenso,adequatesolutionsarerequiredtoenlargetheirroleandmovefromadiscretionaryapproachtoageneralandmandatoryassessmentoftheimpactoftechnologiesandbusinessmodelsondataprotection.
663.
AnewdimensionofprotectionInthebigdataera,newtechnologiesandpowerfulanalyticsmakeitpossibletocollectandanalysehugeamountsofdatatotryandidentifypatternsinthebehaviourofgroupsofindividuals67andtotakedecisionsthataffecttheinternaldy-namicsofgroups,withconsequencesforthecollectiveissuesofthepeopleinvolved.
Nevertheless,thesegroupsaredifferentfromthosecon-sideredintheliteratureongroupprivacy,infactthattheyarecreatedbydatagatherersselectingspecicclustersofinfor-mation.
Datagatherersshapethepopulationtheysetouttoinvestigate.
Theycollectinformationaboutvariouspeople,whodonotknowtheothermembersofthegroupand,inmanycases,arenotawareoftheconsequencesoftheirbelongingtoagroup.
68Thisisthecaseofconsumergroupproling,69scoringsolutions70andpredictivepolicingapplications,71men-tionedabove.
Theissuesrelatingtoprivacythatarisefromthisnewsitu-ationaredifferentfromtheissuesofindividualprivacyandgroupprivacy.
Weareneitherinthepresenceofformsofanaly-sisthatinvolveonlyindividuals,norinthepresenceofgroupsinthetraditionalsociologicalmeaningoftheterm,givengroupmembers'lackofawarenessofthemselvesaspartofagroupandthelackofinteractionsamongpeoplegroupedintovariousclustersbydatagatherers.
59Seeabovefn.
33.
SeealsoBygrave,DataProtectionLaw.
Approach-ingItsRationale,LogicandLimits(n34)250.
60Seeabovefn.
38.
Onthedebateregardingtheapplicationofprivacynotiontocollectiveentities,seeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)241–256.
61SeeSimitis,'AufdemWegzueinemneuenDatenschutzrecht'(1984)3Informaticaediritto111;Schwartz,'PrivacyandPartici-pation:PersonalInformationandPublicSectorRegulationintheUnitedStates(1995)80IowaL.
Rev.
553,560–561.
Forageneralover-view,seeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n32)133–143,150–157;AnitaL.
Allen,UneasyAccess:privacyforwomeninafreesociety(Rowman&Littleeld1988)ch.
2.
62Extensivevideosurveillanceprograms,whichhavebeenadoptedbymunicipalitiesorpolicedepartments,offeranexampleinthissense:citizensareawareofbeingmonitored,but,inmanycases,donotcareaboutsurveillanceandarenotinterestedinthesocialimpactofthesecontrolsolutions.
63Seepara3.
2.
64Seefn.
126.
65Seebelowpara3.
3.
66Seebelowpara3.
3.
67Moreover,thisisalsopossiblewithoutdirectlyidentifyingdatasubjects;seeAndrejZwitter,'BigDataethics'(2014)BigData&Society1,4–5.
SeealsoPaulOhm,'BrokenPromisesofPrivacy:Re-spondingtotheSurprisingFailureofAnonymization'(2010)57UCLAL.
Rev.
1701–1777;PhilippeGolle,'RevisitingtheuniquenessofsimpledemographicsintheUSpopulation'inAriJuels(ed),Proc.
5thACMworkshoponPrivacyinelectronicsociety(ACM2006)77–80;LatanyaSweeney,'SimpleDemographicsOftenIdentifyPeopleUniquely'(CarnegieMellonUniversity2000)accessed24January2015;LatanyaSweeney,'FoundationsofPrivacyProtectionfromaComputerSciencePerspective'inProc.
JointStatisticalMeeting,AAAS,India-napolis(2000)http://dataprivacylab.
org/projects/disclosurecontrol/paper1.
pdf,accessed24January2015.
68SeeMireilleHildebrandt,'DeningProling:ANewTypeofKnowledge'inHildebrandtandGutwirth(n9)19–20.
SeealsoEx-ecutiveOfceofthePresidentoftheUnitedStates-CouncilofEconomicAdvisers,'BigDataDifferentialPricing'(2015)18accessed25March2015;Gandy(n16)1085,1088,1095;Hildebrandt,'Proling:FromDatatoKnowledge.
Thechallengesofacrucialtechnology'(n6)549–550.
69SeealsoRyanCalo,'DigitalMarketManipulation'(2014)82GeorgeWashingtonLawReview995.
70SeeFederalTradeCommission(n2).
ButseeArticles18and20oftheDirective2014/17/EUoncreditagreementsforconsumersrelatingtoresidentialimmovablepropertyandamendingDirectives2008/48/ECand2013/36/EUandRegulation(EU)No1093/2010.
71Seeabovefn.
14.
245computerlaw&securityreview32(2016)238–255Wemustthereforeextendtheeldofinvestigationtothecollectiveinterestsofthepersonswhosepersonaldataarebeingcollected,analysedandgrouped.
Thedifferingnatureofthesegroupsofindividualsrequiresadifferentapproachthatcannotbeexclusivelybasedonindividualrights.
Thenewscaleentailstherecognitionofanewlayer,rep-resentedbytherightsofgroupsofindividualstotheprotectionoftheircollectiveprivacyanddataprotection.
Moreover,sincethepredictivenatureofbigdataanalyticsisdesignedtoassistdecisionsthataffectapluralityofindividualsinvariouselds,wemustalsoconsiderthesocialandethicaleffectsassoci-atedwiththistypeofanalysis.
72Thiskindofapproachdiffersfromthetheoreticalframe-workproposedbylegalscholarsinshapingthenotionofgroupprivacy,73butitcangiveaspecicanswertotheissuesarisingfromthepresentandfuturescenariosofthedata-drivensociety.
3.
1.
CollectivedataprotectionanditsrationaleThecollectivedimensionofdataprotectionhasitsrootsintheindividual'srighttoprivacyandsharessomesimilaritieswithgroupprivacy,butdiffersfromboththesepreviousnotions.
Ontheonehand,notionsofindividualprivacyanddataprotec-tiondoinuencethedenitionoftheboundariesofthiscollectivedimension,butthegreaterscaleaffectsthemor-phologyoftheinterestsinvolvedandtheirenforcement.
Atthesametime,groupprivacy–ashithertodescribedbylegalschol-ars–representsthenotionthatisclosesttotheideaofcollectivedataprotection.
Ontheotherhand,collectivedataprotectiondoesnotnec-essarilyconcernfactsorinformationreferringtoaspecicperson,74aswithindividualprivacyanddataprotection.
Nordoesitconcernclustersofindividualsthatcanbeconsid-eredgroupsinthesociologicalsenseoftheterm.
Inaddition,collectiverightsarenotnecessarilyalarge-scalerepresentationofindividualrightsandrelatedissues.
75Finally,collectivedataprotectionconcernsnon-aggregativecollectiveinterests,76whicharenotthemeresumofmanyindividualinterests.
77Theimportanceofthiscollectivedimensiondependsonthefactthattheapproachtoclassicationbymodernalgo-rithmsdoesnotmerelyfocusonindividuals,butongroupsorclustersofpeoplewithcommoncharacteristics(e.
g.
cus-tomerhabits,lifestyle,onlineandofinebehaviour,etc.
).
78Datagatherersaremainlyinterestedinstudyinggroups'behaviourandpredictingthisbehaviour,ratherthaninprolingsingleusers.
Data-drivendecisionsconcernclustersofindividualsandonlyindirectlyaffectthemembersoftheseclusters.
Oneexampleofthisispricediscriminationbasedonage,habitsorwealth.
Themostimportantconcerninthiscontextistheprotec-tionofgroupsfrompotentialharmduetoinvasiveanddiscriminatorydataprocessing.
Thecollectivedimensionofdataprocessingismainlyfocusedontheuseofinformation,79ratherthanonsecrecy80anddataquality.
Weneedtoadoptabroadernotionofdiscriminationhere,onethatencompassestwodifferentmeanings.
Inanegativesense,discriminationis"theunjustorprejudicialtreatmentofdifferentcategoriesofpeople".
Inamoreneutralandpo-tentiallypositivesense,though,discriminationmaybethe"recognitionandunderstandingofthedifferencebetweenonethingandanother".
81Boththesedimensionsassumerel-evanceinthecontextofbigdataanalytics.
Wewillfocusbelowontherstmeaning,sincetheunfairpracticescharacterisedbydiscriminatorypurposesaregenerally72SeeArticle29DataProtectionWorkingParty,'Statementontheroleofarisk-basedapproachindataprotectionlegalframeworks'(2014)4accessed27February2014;PaulM.
Schwartz,'DataProtectionLawandtheEthicalUseofAnalytics'22–26accessed27February2014;DavidWright,'Aframeworkfortheethicalimpactassessmentofinformationtechnology'(2011)13EthicsInf.
Technol.
199–226.
SeealsoLucianoFloridi,The4THRevolution.
HowtheInfosphereisRe-shapingHumanReality(OxfordUniversityPress2014)189–190;HelenNissenbaum,PrivacyinContext.
Technology,Policy,andtheIntegrityofSocialLife(StanfordUniversityPress2010)231;RayanM.
Calo,'Con-sumerSubjectReviewBoards:AThoughtExperiment'(2013)66Stan.
L.
Rev.
Online97,101–102;CynthiaDworkandDeirdreK.
Mulli-gan,'It'snotPrivacyandIt'snotFair'(2013)66Stan.
L.
Rev.
Online35,38;Bygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)61–62,339;JulieE.
Cohen,'WhatPrivacyisFor'(2013)126Harv.
L.
Rev.
1904,1925–1926;Crawfordetal.
(n21)4.
73Seeabovepara2.
74Inmanycases,privatecompaniesandgovernmentshavenointerestsinprolingsinglecustomersorcitizens,butwishtodis-covertheattitudesofclustersofindividuals.
Theirmainpurposeistopredictfuturebehavioursofsegmentsofthepopulationtoachieveeconomicorpoliticalgoals.
SeeBollier(n1).
75SeeFrancescoCapotorti,'AreMinoritiesEntitledtoCollectiveInternationalRights'inYoramDinsteinandMalaTabory(eds),TheProtectionofMinoritiesandHumanRights(MartinusNijhoffPublish-ers1992)507,511.
76SeeDwightG.
Newman,'CollectiveInterestsandCollectiveRights'(2004)49(1)AmericanJournalofJurisprudence127,131.
Seealsobelowinthepresentsection.
Onthecontrary,anaggregativeapproachseemstobeconsistentwiththenotionofgroupprivacydescribedbyBloustein,IndividualandGroupPrivacy(n25)123–186.
77ContraVedder(n9),whoclaimsthatthenotionofcollectiveprivacy"remindsofcollectiverights",butsubjectsofcollectiverightsaregroupsorcommunities.
Conversely,thegroupsgeneratedbygroupprolingarenotcommunitiesofindividualssharingsimilarcharacteristicsandstructuredororganisedinsomeway.
Forthisreason,Vedderusesthedifferentdenitionof"categorialprivacy",seebelowfn.
101.
78Seeabovepara1andbelowinthetext.
79SeeCateandMayer-Schnberger(n20)iii;Mantelero,'ThefutureofconsumerdataprotectionintheE.
U.
Rethinkingthe"noticeandconsent"paradigmintheneweraofpredictiveanalytics'(n20).
80SeeBloustein.
IndividualandGroupPrivacy(n25)182.
81Seeaccessed29January2015.
246computerlaw&securityreview32(2016)238–255forbiddenandsanctionedbylaw.
82Thisarticleconcernsin-voluntaryformsofdiscriminationincaseswherebigdataanalyticsprovidebiasedrepresentationsofsociety.
83Forexample,in2013astudyexaminedtheadvertisingpro-videdbyGoogleAdSenseandfoundstatisticallysignicantracialdiscriminationinadvertisementdelivery.
84Similarly,KateCraw-fordhaspointedoutcertain"algorithmicillusions"85anddescribedthecaseoftheCityofBostonanditsStreetBumpsmartphoneapptopassivelydetectpotholes.
Theapplica-tionhadasignalproblem,duetothebiasgeneratedbythelowpenetrationofsmartphonesamonglowerincomeandolderresidents.
WhiletheBostonadministrationtookthisbiasintoaccountandsolvedtheproblem,lessenlightenedpublicof-cialsmightunderestimatesuchconsiderationsandmakepotentiallydiscriminatorydecisions.
86AnotherexampleistheProgressivecase,inwhichanin-surancecompanyobligeddriverstoinstallasmallmonitoringdeviceintheircarsinordertoreceivethecompany'sbestrates.
Thesystemconsideredasanegativefactordrivinglateatnight,butdidnottakeintoaccountthepotentialbiasagainstlow-incomeindividuals,whoaremorelikelytoworknightshifts,comparedwithlate-nightparty-goers,"forcingthem[low-incomeindividuals]tocarrymoreofthecostofintoxicatedandotherirresponsibledrivingthathappensdisproportion-atelyatnight".
87Thesecasesrepresentsituationsinwhichabiasedrepre-sentationofgroupsandsocietyresultsfromaweddataprocessing88oralackofaccuracyintherepresentation.
89Thisproducespotentiallydiscriminatoryeffectsasaconsequenceofthedecisionstakenonthebasisofanalytics.
Ontheotherhand,theothersenseofdiscriminationin-volvingdifferenttreatmentofdifferentsituationsmayrepresentanintentionalgoalforpolicymakers,whichisinlinewiththeruleoflaw.
Thisisthecaseoflawandenforcementbodiesandintelligenceagencies,whichadoptsolutionstodiscriminatebetweendifferentindividualsandidentifytargetedpersons.
Herethereisadeliberateintentiontotreatgivenindividualsdifferently,butthisisnotunfairorillegalprovidingitiswithinexistinglegalprovisions.
Nonetheless,asinthepreviouscase,potentialawsoralackofaccuracymaycauseharmtocitizens.
Forinstance,criticismshavebeenraisedwithregardtotheaforementionedpredictivesoftwareadoptedinrecentyearsbyvariouspolicedepartmentsintheUS.
90Leavingasidetheconstitutionalprolesassociatedwiththeseapplicationsandthepeculiarbalanceofinterestsofthisuseofdata,therehavebeencaseswherepeoplewerenamedaspotentialoffendersduetomerelyremoteconnectionswithauthorsofseriouscrimes.
91Criticismsalsoconcerntheuseofriskassessmentproceduresbasedonanalyticscoupledwithacategoricalap-proach(basedontypologyofcrimesandoffenders)inU.
S.
criminalsentencing.
9282SeeinteraliaEuropeanCommission,'DevelopingAnti-DiscriminationLawinEurope.
The28EUMemberStates,theFormerYugoslavRepublicofMacedonia,Iceland,Liechtenstein,NorwayandTurkeycompared'(2013)accessed28March2015;EvelynEllisandPhilippaWatson,EUAnti-DiscriminationLaw(2ndednOxfordUniversityPress2015).
SeealsoArticle14oftheConventionfortheProtectionofHumanRightsandFundamen-talFreedoms;Article21oftheCharterofFundamentalRightsoftheEuropeanUnion;Article19oftheTreatyontheFunctioningoftheEuropeanUnion;Directive2000/43/EC;Directive2000/78/EC.
SeealsoWimSchreurs,MireilleHildebrandt,ElsKindtandMichalVaneteren,'Cogitas,ErgoSum.
TheRoleofDataProtec-tionLawandNon-discriminationLawinGroupProlinginthePrivateSector'inHildebrandtandGutwirth(n9)258–264.
83SeeCitronandPasquale(n9),14;BirnyBurnbaum(2013).
In-surers'UseofCreditScoringforHomeownersinOhio:AReporttotheOhioCivilRightsCommission.
84SeeLatanyaSweeney,'DiscriminationinOnlineAdDelivery'(2013)56(5)CommunicationsoftheACM44–54.
SeealsoBiancaBosker,'Google'sOnlineAdResultsGuiltyOfRacialProling,Ac-cordingToNewStudy'TheHufngtonPost(2May2013)accessed27March2015.
85Crawford(n18).
86SeeKateCrawford,'TheHiddenBiasesinBigData'(2013)Harv.
Bus.
Rev.
April1,2013,accessed29January2015.
Similarconsiderationscanbemadeinthecaseofthepredictivepolicingsystemsmen-tionedaboveinthetext;seealsofn.
14.
SeealsoJonasLerman,'BigDataandItsExclusions'(2013)66Stan.
L.
Rev.
Online55.
87SeeRobinson+Yu(n14)6.
88ThisisthecaseoftheerrorsthataffecttheE-Verifysystem,whichisusedintheUStoverifyifanewworkerislegallyeli-gibletoworkintheUS.
SeeRobinson+Yu(n14)12–14;NationalImmigrationLawCenter,'VericationNation'(2013)6accessed29January2015.
89SeealsoGandy(n16)1099–1100.
90Seeabovepara1.
91SeeJeremyGorner,'Chicagopoliceuse'heatlist'asstrategytopreventviolence.
Ofcialsgenerateanalysistopredictwhowilllikelybeinvolvedincrime,asperpetratororvictim,andgodoortodoortoissuewarnings'ChicagoTribune(Chicago,21August2013)accessed25February2015.
92SeeU.
S.
DepartmentofJustice–CriminalDivision,OfceoftheAssistantAttorneyGeneral,'Annualletter'(2014)6–7,13accessed29January2015("Thisphenomenonulti-matelyraisesconstitutionalquestionsbecauseoftheuseofgroupbasedcharacteristicsandsuspectclassicationsintheana-lytics.
Criminalaccountabilityshouldbeprimarilyaboutpriorbadactsprovenbythegovernmentbeforeacourtoflawandnotsomefuturebadbehaviorpredictedtooccurbyariskassessmentin-strument.
Second,experienceandanalysisofcurrentriskassessmenttoolsdemonstratethatutilizingsuchtoolsfordeterminingprisonsentencestobeservedwillhaveadisparateandadverseimpactonoffendersfrompoorcommunitiesalreadystrugglingwithmanysocialills").
SeealsoAdministrativeOfceoftheUnitedStatesCourts–OfceofProbationandPretrialSer-vices,'AnOverviewoftheFederalPostConvictionRiskAssessment'(2011)accessed29January2015;Underwood(n7)1409–1413.
247computerlaw&securityreview32(2016)238–255Discrimination–thedifferenttreatmentofdifferentsitu-ations–alsoappearsincommercialcontextstooffertailoredservicestoconsumers.
Inthiscase,wheretheinterestsareofapurelyprivatenature,commercialpracticesmayleadtopricediscrimination93ortheadoptionofdifferentialtermsandcon-ditionsdependingontheassignmentofconsumerstoaspeciccluster.
94Thusconsumersclassiedas"nanciallychallenged"belongtoacluster"[i]ntheprimeworkingyearsoftheirlives[.
.
.
]in-cludingmanysingleparents,struggl[ing]withsomeofthelowestincomesandlittleaccumulationofwealth".
Thisimpliesthefollowingpredictiveviewpoint,basedonbigdataanalyt-icsandregardingallconsumersinthecluster:"[n]otparticularlyloyaltoanyonenancialinstitution,[and]theyfeeluncom-fortableborrowingmoneyandbelievetheyarebetteroffhavingwhattheywanttodayastheyneverknowwhattomorrowwillbring".
95Itisnothardtoimaginethepotentialdiscrimina-toryconsequencesofsimilarclassicationswithregardtoindividualsandgroups.
Itshouldbenotedthattheseformsofdiscriminationarenotnecessarilyagainstthelaw,especiallywhentheyarenotbasedonindividualprolesandonlyindirectlyaffectindividualsaspartofacategory,withouttheirdirectidentication.
96Forthisreason,existinglegalprovisionsagainstindividualdis-criminationmightnotbeeffectiveinpreventingthenegativeoutcomesofthesepractices,ifadoptedonacollectivebasis.
Still,suchcasesclearlyshowtheimportanceofthecollectivedimensionoftheuseofinformationaboutgroupsofindividuals.
WithintheEU,suchdataanalysisfocussingonclusteredindividualsmaynotrepresentaformofpersonaldataprocessing,97sincethecategoricalanalyticsmethodologydoesnotnecessarilymakeitpossibletoidentifyaperson.
98Moreover,93Pricediscriminationor"differentialpricing"isthepracticeofchargingcustomersdifferentpricesforthesameproduct;seeEx-ecutiveOfceofthePresidentoftheUnitedStates-CouncilofEconomicAdvisers(n68),4–5.
Thecasesconsideredinthisarticlemainlyconcerntheso-calledthird-degreepricedifferentiation,whichoccurswhensellerschargedifferentpricestodifferentseg-mentsofthemarket.
SeealsoAlexRosenblat,RobRandhava,danahboyd,SeetaPeaGangadharan,andCorrineYuProduced,'Data&CivilRights:ConsumerFinancePrimer'(2014)accessed15March2015.
94SeeExecutiveOfceofthePresidentoftheUnitedStates-CouncilofEconomicAdvisers(n68);FederalTradeCommission(n2)3,19–21;DixonandGellman(n9).
SeealsoTimothyC.
Lambert,'FairMarketing:ChallengingPre-ApplicationLendingPractices'(1999)87Geo.
L.
J.
2182.
95SeeFederalTradeCommission(n2)20,fn.
52.
96Article4(12b)oftheEUProposaldenes"prole"as"setofdatacharacterisingacategoryofindividualsthatisintendedtobeappliedtoanaturalperson".
SeealsoArticles4(12a),14(1a)(h)and20,EUProposal;Article29DataProtectionWorkingParty,'AdvicepaperonessentialelementsofadenitionandaprovisiononprolingwithintheEUGeneralDataProtectionRegulation'accessed29March2015;Article29DataProtec-tionWorkingParty,'Opinion01/2012onthedataprotectionreformproposals'(2012)accessed29March2015.
Regardingthedecisionsthataffectanindividualasmemberofaspecicclusterofpeople,itshouldbenotedthatinmanycasesthesedecisionsarenotbasedsolelyonautomatedprocessing;seeZarsky(n17)1518–1519.
Inthissense,creditscoringsystemshavereducedbutnotremovedhumaninterventiononcreditevaluation.
Atthesametime,classica-tionsoftenregardidentiedoridentiableindividuals.
SeeArticle29DataProtectionWorkingParty,'Opinion2/2010ononlinebehaviouraladvertising'(2010)accessed29March2015;DataProtectionWorkingParty,'WorkingDocument02/2013pro-vidingguidanceonobtainingconsentforcookies'(2013)5–6accessed29March2015.
RegardingtheapplicabilityoftheDataProtectionDi-rectiveincaseofautomatedproling,seeLeeA.
Bygrave,'MindingtheMachine:Article15oftheECDataProtectionDirectiveandAu-tomatedProling'inthisReview(2001),vol.
17,issue1,17–24;Schreurs,Hildebrandt,KindtandVaneteren(n82)241–257;JudithRauhofer,'RoundandRoundtheGardenBigData,SmallGovern-mentandtheBalanceofPowerintheInformationAge'(2014)UniversityofEdinburghSchoolofLaw,ResearchPaperSeries2014/06,5,10accessed15March2015.
SeealsoValeriaFerrarisetal.
,'WorkingPaper.
DeningProling'(2014)15–20accessed15June2015;DouweKorff,'DataProtectionLawsintheEU:TheDifcultiesinMeetingtheChal-lengesPosedbyGlobalSocialandTechnicalDevelopments'(2010)82–89accessed7April2015.
97SeeArticle29DataProtectionWorkingParty,'Opinion4/2007ontheconceptofpersonaldata'(2007)accessed25January2015.
98Seealsoabovefn.
96.
Ontheblurringoftheborderbetweengroupprolesandpersonalisedproles,seealsoHildebrandt,'Pro-ling:FromDatatoKnowledge.
Thechallengesofacrucialtechnology'(n6).
248computerlaw&securityreview32(2016)238–255groupprolescanbemadeusinganonymiseddata.
99Thisreducesthechancesofindividualstakingactionagainstbiasedrepresentationsofthemselveswithinagrouporhavingaccesstothedataprocessingmechanisms,sincetheanonymisedin-formationusedforgroupprolingcannotbelinkedtothem.
100Evenso,groupprolingdoesmakeitpossibletotakedeci-sionsaffectingamultiplicityofindividuals.
101Inthissense,themaintargetofthecollectivedimensionofdataprocessingisnotthedatasubject,buttheclustersofpeoplecreatedbybigdatagatherers.
Theintereststhatassumerelevancethereforehaveasupra-individualnatureandacollectivedimension,102whicharenotadequatelyaddressedbytheexistingdataprotectionlegalframework.
Theseinterestsmaybesharedbyanentiregroupwithoutconictsbetweentheviewsofitsmembers(aggregativeinterests)orwithconictsbetweentheopinionsofitsmembers(non-aggregativeinterests).
103Ifthegroupischaracterisedbynon-aggregativeinterests,thecollectivenatureoftheinter-estisrepresentedbythefundamentalvaluesofagivensociety(e.
g.
environmentalprotection).
Thenotionofcollectivenon-aggregativeinterestsseemstobethebestwaytodescribethecollectivedimensionofdataprotection,whichbecomesimportantinthediscriminationcasesmentionedabove.
Althoughindividualsmayhavedif-ferentopinionsaboutthebalancebetweentheconictinginterests,104therearesomecollectiveprioritiesconcerningprivacyanddata-protectionthatareofrelevancetothegeneralinterest.
Heretherationaleforcollectivedataprotectionismainlyfocussedonthepotentialharmtogroupscausedbyextensiveandinvasivedataprocessing.
3.
2.
CollectiveinterestsindataprotectionandtheirrepresentationPrivacyanddataprotectionarecontext-dependentnotions,whichvaryfromculturetocultureandacrosshistoricalperiods.
105Inthesameway,therelatedcollectivedimensionsarenecessarilyinuencedbyhistoricalandgeographicalvari-ablesandaretheresultofactionbypolicymakers.
Forthesereasons,itisimpossibletodeneacommonandxedbalancebetweencollectivedataprotectionandconictinginterests.
Therearejurisdictionsthatgivegreaterprioritytona-tionalandsecurityinterests,whichinmanycasesprevailoverindividualandcollectivedataprotection;meanwhile,insomecountriesextensiveformsofsocialsurveillanceareconsid-ereddisproportionateandinvasive.
Therefore,anybalancingtestmustfocusonaspecicsocialcontextinagivenhistori-calmoment.
106Ashasbeenpointedoutintheliterature,107deningprescriptiveethicalguidelinesconcerningthevaluesthatshouldgoverntheuseofbigdataanalyticsandtherelatedbalanceofinterestsisproblematic.
Givensuchvariability,fromatheoreticalperspectiveacommonframeworkforabalancingtestcanbefoundinthevaluesrecognisedbyinternationalchartersoffundamental99Onthelimitsofanonymisationinthebigdatacontext,seeArvindNarayanan,JoannaHuey,EdwardW.
Felten,'APrecaution-aryApproachtoBigDataPrivacy'(2015)accessed4April2015;ArvindNarayanan,EdwardW.
Felten,'Nosilverbullet:De-identicationstilldoesn'twork'(2014)accessed25March2015;Ohm(n67);UnitedStatesGeneralAccountingOfce,'RecordLinkageandPrivacy.
IssuesincreatingNewFederalResearchandStatisticalIn-formation'(2011)68–72accessed14December2013;Golle(n67);LatanyaSweeney,'OnlyYou,YourDoctor,andManyOthersMayKnow'TechnologyScience.
2015092903.
September29,2015accessed28November2015;Sweeney,'SimpleDemographicsOftenIdentifyPeopleUniquely'(n67);Sweeney,'FoundationsofPrivacyProtectionfromaComputerSciencePer-spective'(n67).
100SeeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)319;Schreurs,Hildebrandt,KindtandVaneteren(n82)252–253;Rauhofer(n96).
WithregardtotheEUProposal,seealsoBert-JaapKoops,'ThetroublewithEuropeandataprotectionlaw'(2014)4(4)Int'l.
DataPrivacyLaw257–258.
Butseeabovefn.
99.
101Thishappens,forinstance,inthemanagementofsmartcitiesorinthedecisionsadoptedonthebasisofcreditscoringsystems.
Againstthisbackground,MireilleHildebrandtobservedthat"onceaproleislinkedtoanidentiableperson–forinstanceinthecaseofcreditscoring–itmayturnintoapersonaldata,thusre-vivingtheapplicabilityofdataprotectionlegislation",seeHildebrandt,'Proling:FromDatatoKnowledge.
Thechallengesofacrucialtechnology'(n6)550.
SeealsoVedder(n9)("Categorialprivacycanbeconsideredasrelatingtoinformation(1)whichwasoriginallytakenfromthepersonalsphereofindividuals,butwhich,afteraggregationandprocessingaccordingtostatisticalmethods,isnolongeraccompaniedbyidentiersindicatingindividualnaturalpersons,but,instead,byidentiersofgroupsofpersons,and(2)which,whenattachedtoidentiersofgroupsandwhendis-closed,isapttocausethesamekindofnegativeconsequencestothemembersofthosegroupsasitwouldforanindividualpersoniftheinformationwereaccompaniedbyidentiersofthatindividual").
102SeeNewman(n76)131.
103Newman(n76)131–132makesthisdistinctionanddenesthesetwocategoriesofinterestsrespectivelyas"shared"and"collec-tive"interests.
AsobservedbyFinnis,acollectiveinterestinwhichtheconictisdiminishedmaybecomeasharedinterest.
SeeJohnFinnis,'TheAuthorityofLawinthePredicamentofContempo-rarySocialTheory'(1984)1J.
L.
Ethics&Pub.
Pol'y115,135–136.
104Inthissense,anextensivegroupprolingforcommercialpur-posescanbepassivelyaccepted,consideredwithfavourorperceivedasinvasiveandpotentiallydiscriminatory.
Thesamedivergenceofopinionsandinterestsexistswithregardtogovernmentsocialsurveillanceforcrimepreventionandnationalsecurity,wherepartofthepopulationisinfavourofsurveillance,duetoconcernsaboutcrimeandterrorism.
105SeeWestin(n25)183–187;Whitman(n48);Bygrave,DataPro-tectionLaw.
ApproachingItsRationale,LogicandLimits(n34)327;Nissenbaum(n72);IrwinAltman,'PrivacyRegulation:CulturallyUniversalorCulturallySpecic'(1977)JournalofSocialIssues33(3)66–84.
106SeeinthissensethedifferentattitudesofU.
S.
governmentwithregardtosurveillance,beforeandaftertheSeptember11,2001,ter-roristattacks.
SeealsoBygrave,'PrivacyProtectioninaGlobalContext.
AComparativeOverview'(n48)329.
107SeeWright(n72)200.
249computerlaw&securityreview32(2016)238–255rights.
Thesechartersprovideabaselinefromwhichtoiden-tifythevaluesthatcanservetoprovideethicalguidanceanddenetheexistingrelationshipsbetweenthesevalues.
108Inaddition,thecontext-dependentframeworkofvaluesandtherelationshipbetweenconictinginterestsandrightsneedstobespeciedwithregardtotheactualuseofbigdataana-lytics.
InEurope,forinstance,commercialinterestsrelatedtocreditscoresystemscangenerallybeconsideredcompatiblewiththeprocessingofpersonalinformation,providingthatthedataareadequate,relevantandnotexcessiveinrelationtothepurposesforwhichitiscollected.
109Evenso,specicbigdataanalyticssolutionsadoptedbysomecompaniesforcreditscoringpurposesmayleadtoadisproportionatescrutinyofaconsumer'sprivatelife.
Thesamereasoningcanalsobeappliedtosmartmobilitysolutions,whichcanpotentiallyleadtoextensivesocialsurveillance.
Thismeansapriorcase-by-caserisk-assessmentisnecessarytomitigatethepotentialimpactofthesesolutionsondataprotectionandindividualfreedoms.
110This"in-context"balanceofconictinginterestsbasedonanimpactassessmentofcomplexdatacollectionandpro-cessingsystems,111shouldnotbeconductedbyconsumersorcompanies,butmustentailtheactiveinvolvementofvariousstakeholders.
Againstthisbackground,animportantaspectoftheprotectionofcollectiveinterestsrelatingtopersonalin-formationisananalysisoftheexistingconictinginterestsandtherepresentationoftheissuesregardingtheindividu-alsgroupedinclustersbythedatagatherers.
112Hereitisusefultobrieyconsidertheeldsinwhichthegroupdimensionofdataprotectionisalreadyknowninmoretraditionalcontextsthatarenotcharacterisedbyextensivedatacollectionanduseofanalytics.
Forinstance,labourlawrecognisesthiscollectivedimensionofrightsandthedualismbetweenindividualsandgroups.
113Undercertaincircum-stances,tradeunionsandemployees'representativesmayconcurintakingdecisionsthataffecttheemployeesandhaveanimpactondataprotectionintheworkplace.
114Collectiveagreementonthesedecisionsisbasedontherec-ognitionthatthepowerimbalanceintheworkplacemeansthat,insomecases,theemployeeisunawareoftheimplicationsofemployer'spolicies(e.
g.
employers'workplacesurveil-lancepractices).
Moreover,inmanycases,thisimbalancemakesitdifcultforemployeestoobjecttotheillegitimateprocess-ingoftheirdata.
Entitiesrepresentingcollectiveinterests(e.
g.
tradeunions)arelessvulnerabletopowerimbalanceandhaveabroadervisionoftheimpactoftheemployer'spoliciesanddecisions.
Itshouldalsobenotedthattheemployer'sunfairpoliciesandformsofcontrolareoftenorientedtowardsdiscriminatorymea-suresthataffectindividualworkers,eventhoughtheyaretargetedatthewholegroup.
Thiscollectiverepresentationofcommoninterestsisalsoadoptedinotherelds,suchasconsumerprotectionanden-vironmentalprotection.
Thesecontextsareallcharacterisedbyapowerimbalanceaffectingoneofthepartiesdirectlyin-volved(employees,consumersorcitizens).
Furthermore,inmanycasestheconictinginterestsrefertocontextswheretheuseofnewtechnologiesmakesithardforuserstobeawareofthepotentialnegativeimplications.
Thesamesituationofimbalanceoftenexistsinthebigdatacontext,wheredatasubjectsarenotinapositiontoobjecttothediscriminatoryuseofpersonalinformationbydata108SeeWright(n72)201–202.
109SeeArticles18and20oftheDirective2014/17/EU.
SeealsoArticle8oftheDirective2008/48/EConcreditagreementsforconsumersandrepealingCouncilDirective87/102/EEC.
110Seee.
g.
ItalianDataProtectionAuthority(AutoritàGaranteperlaprotezionedeidatiperosnali,hereafterGar.
),6September2006(decision,doc.
webn.
1339531)(textinItalian);Gar.
,28December2006(decision,doc.
webn.
1413380)(textinItalian);Gar.
,6September2006(decision,doc.
webn.
1339692)(textinItalian).
SeealsoAlessandroMantelero,'Dataprotection,e-ticketingandintelligentsystemsforpublictransport'(2015)5(4)Int'l.
DataPrivacyLaw309–320.
111Moreover,thesesystemsareinuencedbylock-ineffects.
Therearetwodifferentkindsoflock-ins:technologicallock-inandsociallock-in.
Therstisrelatedtothetechnologicalstandardsanddataformatsthatareadoptedbyserviceproviders.
Thislock-inrepre-sentsalimittodataportabilityandmigrationfromoneservicetoanother.
Thesecondlock-in(sociallock-in)isrelatedtothedomi-nantpositionheldbysomebigplayers.
Thislock-inisevident,forexample,inthesocialnetworksmarket,wherethereisanincen-tivetoremainonanetwork,giventhenumbersofsocialrelationshipscreatedbyusers.
112Ongroupright,seealsoJuliaStapleton,Grouprights:perspec-tivessince1900(ThoemmesPress1995);WillKymlicka,'IndividualandCommunityRights'inJudithBaker(ed),GroupRights(Univer-sityofTorontoPress1994)17–33;EugeneSchlossberger,AHolisticApproachtoRights:AfrmativeAction,ReproductiveRights,Cen-sorship,andFutureGenerations(UniversityPressofAmerica2008)ch.
10;HelenO'Nions,MinorityRightsProtectioninInternationalLaw:TheRomaofEurope(AshgatePublishing2007)26–28;PeterJones,'GroupRights'(2008)inStanfordEncyclopediaofPhilosophyhttp://stanford.
library.
usyd.
edu.
au/entries/rights-group/accessed4July2015;Newman(n76);WillKymlicka,'TheNewDebateOverMi-norityRights'inWayneNormanandRonaldBeiner(eds.
)CanadianPoliticalPhilosophy:ContemporaryReections(OxfordUniversityPress2000)159–176;JohnPacker,'ProblemsinDeningMinorities'inDeirdreFottrellandBillBowring(eds),Minorityandgrouprightsinthenewmillennium(M.
NijhoffPublishers1999)241ff;WillKymlicka,'IndividualandCommunityRights'inJudithBaker(ed)GroupRights(UniversityofTorontoPress1994)17–33.
113SeeItalianArticles4and8,Act300,20May1970(StatuteoftheWorkers'Rights).
114Seeaboveatfn.
52.
SeealsoBygraveandWieseSchartum(n41)170.
250computerlaw&securityreview32(2016)238–255gatherers.
115Datasubjectsoftendonotknowthebasicstepsofdataprocessing,116andthecomplexityoftheprocessmeansthattheyareunabletonegotiatetheirinformationandarenotawareofthepotentialcollectiveprejudicesthatunderlayitsuse.
117Thisiswhyitisimportanttorecognisetheroleofen-titiesrepresentingcollectiveinterests,ashappensintheabovecases.
Employeesarepartofaspecicgroup,denedbytheirre-lationshipwithasingleemployer;therefore,theyareawareoftheircommonidentityandhavemutualrelationships.
Bycontrast,inthebigdatacontext,thecommonattributesofthegroupoftenonlybecomeevidentinthehandsofthedatagatherer.
118Datasubjectsarenotawareoftheidentityoftheothermembersofthegroup,havenorelationshipwiththemandhavealimitedperceptionoftheircollectiveissues.
Further-more,thesegroupsshapedbyanalyticshaveavariablegeometryandindividualscanshiftfromonegrouptoanother.
Thisdoesnotunderminetheideaofarepresentingcol-lectivedataprotectioninterests.
Onthecontrary,thisatomisticdimensionmakestheneedforcollectiverepresentationmoreurgent.
However,itishardtoimaginerepresentativesap-pointedbythemembersofthesegroups,asisinsteadthecaseintheworkplace.
Inthissensetherearesimilaritieswithconsumerlaw,wheretherearecollectiveinterests(e.
g.
productsecurity,faircom-mercialpractices),butthepotentialvictimsofharmhavenorelationshiptooneanother.
Thus,individuallegalremediesmustbecombinedwithcollectiveremedies.
119Examplesofpos-siblecomplementarysolutionsareprovidedbyconsumerlaw,whereindependentauthoritiesresponsibleforconsumerpro-tection,classactionlawsuitsandconsumerassociationsplayanimportantrole.
Intheeldofbigdataanalytics,thepartiallyhiddennatureoftheprocessesandtheircomplexityprobablymaketimelyclassactionsmoredifcultthaninotherelds.
Forinstance,inthecaseofaproductliability,thedamagesareoftenmoreevidentmakingiteasierfortheinjuredpeopletoreact.
120Ontheotherhand,associationsthatprotectcollectiveinterestscanplayanactiveroleinfacilitatingreactiontounfairprac-ticesand,moreover,theycanbeinvolvedinamulti-stakeholderriskassessmentofthespecicuseofbigdataanalytics.
121Theinvolvementofsuchbodiesrequiresspecicproce-duralcriteriatodenetheentitiesthatmayactinthecollectiveinterest.
122Thisismoredifcultinthecontextofbigdata,wherethegroupscreatedbydatagatherersdonothaveastablechar-acter.
Inthiscase,anassessmentofthesocialandethicalimpactofanalyticsoftenprovidestheopportunitytodis-coverhowdataprocessingaffectscollectiveinterestsandthusidentifythepotentialstakeholders.
1233.
3.
TheroleofdataprotectionauthoritiesHowcollectiveinterestsshouldbeprotectedagainstdiscrimi-nationandsocialsurveillanceintheuseofbigdataanalyticsislargelyamatterforthepolicymakers.
Differentlegalsystemsanddifferentbalancesbetweenthecomponentsofsocietysuggestdifferingsolutions.
Identifyingtheindependentau-thoritychargedwithprotectingcollectiveinterestsmaythereforebedifcult.
115Inthedigitaleconomy,consumersoftenacceptnothavinganeffectivenegotiationoftheirpersonalinformation,duetomarketconcentrationandrelatedsocialandtechnologicallock-ins.
Seeabovefn.
111.
116SeealsoAlessandroAcquisti,LauraBrandimarteandGeorgeLoewenstein,'Privacyandhumanbehaviorintheageofinforma-tion'(2015)347(6221)Science509–514.
117Thecomplexityofdataprocessinginthebigdataenviron-mentdoesnotofferusersarealchancetounderstanditandmaketheirchoice.
SeePasquale(n9)143–144;LauraBrandimarte,AlessandroAcquisti,andGeorgeLoewenstein,'MisplacedCon-dences:PrivacyandtheControlParadox'(2010),NinthAnnualWorkshopontheEconomicsofInformationSecurityaccessed27February2014;JosephTurow,ChrisJayHoofnagle,DeirdreK.
Mul-ligan,andNathanielGood,'TheFederalTradeCommissionandConsumerPrivacyintheComingDecade'(2007)3ISJLP723–749accessed27Feb-ruary2014;FederalTradeCommission(n2)42.
Onthelimitsofthetraditionalnotices,seealsoRayanM.
Calo,'AgainstNoticeSkep-ticisminPrivacy(andElsewhere)'(2013)87(3)NotreDameL.
Rev.
1027,1050–1055accessed27February2014;DanielJ.
Solove,'Introduction:PrivacySelf-managementandTheConsentDilemma'(2013)126Harv.
L.
Rev.
1880,1883–1888;WorldEconomicForum,'UnlockingtheValueofPersonalData:FromCollectiontoUsage'(2013)18accessed27February2014.
118SeealsoBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)283–284.
119Thesameapproachhasbeenadoptedintherealmofanti-discriminationlaws;seeEuropeanCommission,'DevelopingAnti-DiscriminationLawinEurope.
The28EUMemberStates,theFormerYugoslavRepublicofMacedonia,Iceland,Liechtenstein,NorwayandTurkeycompared'(n82)83–110.
SeealsoLillaFarkas,'CollectiveactionsunderEuropeananti-discriminationlaw'(2014)19Euro-peanAnti-DiscriminationLawRew.
25–40.
120AsdemonstratedbyrecentrevelationsonNSAcase,inthebigdatacontextpeoplearenotusuallyawareofbeingundersurveil-lance.
Onlyleaksofinformationcandisclosethesepractices,openadebateontheirlegitimacyandgivethechancetoindividualstobringlegalactions.
SeealsoEuropeanParliament,'Resolutionof4July2013ontheUSNationalSecurityAgencysurveillancepro-gramme,surveillancebodiesinvariousMemberStatesandtheirimpactonEUcitizens'privacy'(2013)accessed27February2014.
Ontheroleplayedbygroupactionsinordertoprotectindividualandcollec-tiveinterestsconcerningpersonalinformation,seeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34),288–290.
121Seealsopara3.
3.
122Seeart.
76oftheEUProposal.
123Forthesereasons,apreventiveapproachbasedonriskassess-mentseemstobemoreeffectivethanexpostlegalactions.
Moreover,italsocontributestotackletherisksofhiddenformsofdatapro-cessing,whichoftencreateanasymmetricdistributionofthecontroloverinformationinoursociety.
SeealsoAlessandroMantelero,'SocialControl,Transparency,andParticipationintheBigDataWorld'(2014)AprilJournalofInternetLaw23–29.
251computerlaw&securityreview32(2016)238–255Manycountrieshaveindependentbodiesresponsibleforsu-pervisingspecicsocialsurveillanceactivities,andotherbodiesfocusedonanti-discriminationactions.
124Inothercountries,thisresponsibilityisspreadacrossvariousauthorities,whichtakedifferentapproaches,usedifferentremediesanddonotnecessarilycooperateinsolvingcaseswithmultipleimpacts.
Meanwhile,acentralelementintherisk-assessmentofbigdataanalyticsistheanalysisofdataprocessing,thefactorcommontoallthesesituations,regardlessofthepotentialharmtocollectiveinterests.
Forthisreason,dataprotectionauthori-tiescanplayakeyroleintheriskassessmentprocesses,eveniftheyarenotfocusedonthespecicsocialimplications(e.
g.
discrimination).
Ontheotherhand,ifwetakeadifferentapproachthattakesintoconsiderationthevariousnegativeeffectsgeneratedbytheuseofbigdata(discrimination,unfairconsumerprac-tices,socialcontrol,etc.
),weshouldinvolvemultipleentitiesandauthorities.
Nevertheless,aswehaveseentheendresultmaybeafragmentedandpotentiallyconictingdecision-makingprocessthatmayunderestimatetheuseofdata,whichisthecommoncoreofallthesesituations.
125Furthermore,thedataprotectionauthoritiesareaccus-tomedtoaddressingcollectiveissuesandhavealreadydemonstratedthattheydoconsiderboththeindividualandthewidercollectivedimensionofdataprocessing.
126Focus-ingondataprotectionandfundamentalrights,theyarealsowellplacedtobalancetheconictinginterestsaroundtheuseofdata.
Theadequacyofthesolutionisalsoempiricallydemon-stratedbyimportantcasesdecidedbydataprotectionauthoritiesconcerningdataprocessingprojectswithsignicantsocialandethicalimpacts.
127Thesecasesshowthatdeci-sionstoassesstheimpactofinnovativeproducts,servicesandbusinesssolutionsondataprotectionandsocietyarenotnor-mallyontheinitiativeofthedatasubjects,butprimarilyonthatofthedataprotectionauthoritieswhoareawareofthepotentialrisksofsuchinnovations.
Basedontheirbalancingtests,theseauthoritiesareinapositiontosuggestmeasuresthatcompaniesshouldadopttoreducetherisksdiscussedhereandtoplacetheseaspectswithinthemoregeneralframe-workoftherightsoftheindividual,asasinglepersonandasamemberofademocraticsociety.
Theriskassessmentrepresentstheopportunityforgroupissuestobeidentiedandaddressed.
Thus,bodiesrepresent-ingcollectiveinterestsshouldnotonlypartiallyexercisetraditionalindividualrightsonbehalfofdatasubjects,128butalsoexerciseotherautonomousrightsrelatingtothecollec-tivedimensionofdataprotection.
Thesenewrightsmainlyconcernparticipationintheriskassessmentprocess,whichshouldtakeamulti-stakeholderapproach.
129Againstthisbackground,dataprotectionauthoritiesmayinvolveintheassessmentprocessthevariousstakeholders,whichrepresentthecollectiveinterestsaffectedbyspecicdataprocessingprojects.
130Thiswouldleadtothedenitionofanewmodelinwhichcompaniesthatintendtousebigdataana-lyticswouldundergoanassessmentpriortocollectingandprocessingdata.
124SeeEuropeanCommission,'DevelopingAnti-DiscriminationLawinEurope.
The28EUMemberStates,theFormerYugoslavRepub-licofMacedonia,Iceland,Liechtenstein,NorwayandTurkeycompared'(n82)113–125.
125SeealsoLerman(n86)60,whopointsoutthelimitsoftheU.
S.
equalprotectiondoctrineinthecontextofbigdataanalytics.
126Seefn.
52.
Seealsoe.
g.
Article29DataProtectionWorkingParty,'ExplanatoryDocumentontheProcessorBindingCorporateRules'(2015)accessed29November2015;Article29DataProtec-tionWorkingParty,'Opinion9/2014ontheapplicationofDirective2002/58/ECtodevicengerprinting'(2014);Article29DataPro-tectionWorkingParty,'Opinion8/2014ontheRecentDevelopmentsontheInternetofThings'(2014);Article29DataProtectionWorkingParty,'Opinion03/2012ondevelopmentsinbiometrictechnologies'(2012);Article29DataProtectionWorkingParty,'Opinion02/2012onfacialrecognitioninonlineandmobileservices'(2012).
127Seeabovefns.
52and126.
128Thestakeholdersmayhaverightofaccesstothedocumentsthatdescribethespecicstructureandgeneralpurposesofbigdataprocessing.
However,inordertoprotectthelegitimateinterestsofcompaniesandgovernments,thedataprotectionauthoritiesmightlimitthisdisclosuretothirdparties.
Seealsoart.
76oftheEUPro-posalandBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34)274–282.
129Notethattheextentoftherightsconferreduponthediffer-entstakeholdersintheprotectionofcollectiveprivacyislargelyamatterforpolicymakerstodecideandwoulddependonthenatureandvaluesofthedifferentsocio-legalcontexts.
130SeealsoWright(n72)201–202,215–220;DanielleKeatsCitron,'TechnologicalDueProcess'(2008)85(6)Wash.
U.
L.
Rev.
1249,1312.
Adifferentassessmentexclusivelybasedontheadoptionofse-curitystandardsorcorporateself-regulationwouldnothavethesameextentandindependency.
Thisdoesnotmeanthat,inthisframework,formsofstandardisationorco-regulationcannotbeadopted.
252computerlaw&securityreview32(2016)238–255Theassessmentwouldnotonlyfocusondatasecurityanddataprotection,131butalsoconsiderthesocialandethicalimpactsrelatingtothecollectivedimensionofdatauseinagivenproject.
132Thisassessmentshouldbeconductedbythirdpartiesandsupervisedbythedataprotectionauthorities.
133Oncethismultiple-impactassessmentisapprovedbythedataprotectionauthorities,theensuingdataprocessingwouldbeconsideredsecureinprotectingpersonalinformationandcol-lectiveinterests.
134Althoughdataprotectionauthoritiesarealreadyengagedtosomedegreeinaddressingthecollectivedimension,135thesug-gestedsolutionwouldleadtoabroaderanddeeperassessment,whichwouldbecomemandatory.
136Thisproposalisthereforeinlinewiththeviewthatalicensingschememight"provetobethemosteffectivemeansofensuringthatdataprotectionprinciplesdonotremain'law-in-book'withrespecttoprol-ingpractices".
137Finally,itshouldbenotedthatadifferentriskassessmentmodel,whichalsotakesintoaccounttheethicalandsocialeffectsofdatause,directlyaffectsdataprocessing131Ontraditionalformsofprivacyimpactassessment,seeRogerClarke,'Privacyimpactassessment:Itsoriginsanddevelopment'inthisReview2009,vol.
25,issue2,123–129;DavidFlaherty,'Privacyimpactassessments:anessentialtoolfordataprotection'(2000)7(5)Priv.
Law&Pol'yRep.
45;DavidWright,'Thestateoftheartinprivacyimpactassessment'inthisReview2012,vol.
28,issue154–61;DavidWrightandPaulDeHert(eds),PrivacyImpactAssess-ment(Springer2012);DavidWright,MichaelFriedewald,andRaphaelGellert,'DevelopingandTestingaSurveillanceImpactAssess-mentMethodology'(2015)5(1)Int'l.
DataPrivacyLaw40–53.
SeealsoCommissionnationaledel'informatiqueetdeslibertés,'tuded'impactsurlavieprivée(EIVP)'(2015)accessed16July2015.
132Inthebigdatacontext,anotherimportantaspectisthetrans-parencyofthealgorithmsusedbycompanies.
SeeCitronandPasquale(n9)5,10–11,25,31;Pasquale(n9)193,216–218.
SeealsoViktorMayer-SchnbergerandKennethCukier,BigData.
ARevo-lutionThatWillTransformHowWeLive,WorkandThink(n12)179–182;theysuggestamodelbasedonindependentinternalandexternalaudits.
AwideraccesstothelogicofthealgorithmswasrequiredbyArticle29DataProtectionWorkingParty,'Opinion03/2013onpurposelimitation'(2013)47accessed27February2014.
SeealsoTarletonGillespie,'TheRelevanceofAlgorithms'inTarletonGil-lespie,PabloJ.
Boczkowski,andKirstenA.
Foot(eds)MediaTechnologies.
EssaysonCommunication,Materiality,andSociety(MITPress2014)167,194;DixonandGellman(n9),7("Tradesecretshaveaplace,butsecrecythathidesracism,deniesdueprocess,under-minesprivacyrights,orpreventsjusticedoesnotbelonganywhere").
ButseeRecitaln.
51ofEUProposal,textadoptedbytheCounciloftheEuropeanUnion,Brussels,19December2014("Everydatasubjectshouldthereforehavetherighttoknowandobtaincom-municationinparticularforwhatpurposesthedataareprocessedwhatisthelogicinvolvedinanyautomaticdataprocessingandwhatmightbe,atleastwhenbasedonproling,theconse-quencesofsuchprocessing.
Thisrightshouldnotadverselyaffecttherightsandfreedomsofothers,includingtradesecretsorin-tellectualpropertyandinparticularthecopyrightprotectingthesoftware").
Ontheinterestinknowingthelogicofproling,seealsoSchreurs,Hildebrandt,KindtandVaneteren(n82)253–256.
Ontransparencyindecisionalprocessesbasedonbigdataana-lytics,seealsoZarsky(n17)1523–1530.
133Theentiresystemwillworkonlyifthepoliticalandnancialautonomyofdataprotectionauthoritiesfromgovernmentsandcor-porationsisguaranteed.
Moreover,dataprotectionauthoritieswouldneednewcompetenceandresourcesinordertobeartheburdenofthesupervisionandapprovalofthesemultiple-impactassess-ments.
Forthesereasons,amodelbasedonmandatoryfees–paidbycompanieswhentheysubmittheirrequestsforauthorisationtodataprotectionauthorities–wouldbepreferable.
SeeMantelero,'ThefutureofconsumerdataprotectionintheE.
U.
Rethinkingthe"noticeandconsent"paradigmintheneweraofpredictiveana-lytics'(n20).
Itshouldalsobenotedthat,incasesoflargescaleandmultinationaldatacollection,formsofmutualassistanceandcooperationmayfacilitatetheroleplayedbydataprotectionau-thoritiesinaddressingtheproblemsrelatedtothedimensionsofdatacollectionanddatagatherers.
SeealsoGwendalLeGrandandEmilieBarrau,'PriorChecking,aForerunnertoPrivacyImpactAs-sessments'inWrightandDeHert(n131)112–116.
134Therefore,inthisscenario,companiescanenlistusersinthedataprocessingwithoutanypriorconsent,providedtheygivenoticeoftheresultsoftheassessmentandprovideanopt-outoption.
SeemoreextensivelyMantelero,'Thefutureofconsumerdatapro-tectionintheE.
U.
Rethinkingthe"noticeandconsent"paradigmintheneweraofpredictiveanalytics'(n20),654–659.
Inthiscase,althoughthisassessmentrepresentsaneconomicburdenforcom-panies,itallowsthosewhopasstousedataforcomplexandmultiplepurposes,withoutrequiringuserstoopt-in.
Atthesametime,fromtheusers'side,theassessmentsupervisedbydatapro-tectionauthoritiesprovidesaneffectiveevaluationofrisks,whiletheoptiontoopt-outallowsuserstochoosetonotbeapartofthedatacollection.
SeealsoCitronandPasquale(n9)24–28.
Thesug-gestedmodelrepresentsasignicantchangeinthetraditionalapproachtodataprotection,butthisisinlinewiththeapproachadoptedinothereldscharacterisedbythepresenceofrisksforindividualsandsociety(e.
g.
authorisationprocedureforhumanmedicines,mandatorysecuritystandardsprovidedbyproductli-abilitylaws,securitystandardsforindustrialactivities).
Forthisreason,itwouldbenecessarytoadoptasubsetofrulesforbigdataanalytics,whichfocusesonmultipleriskassessmentandadeeperlevelofcontrolbydataprotectionauthorities.
135Seeabovefns.
52and126.
136Seefns.
133,134.
137SeeBygrave,DataProtectionLaw.
ApproachingItsRationale,LogicandLimits(n34),373–374.
SeealsoLeeA.
Bygrave,DataPrivacyLaw.
AnInternationalPerspective(OxfordUniversityPress2014)183–186.
253computerlaw&securityreview32(2016)238–255design.
Literatureonprivacybydesign138hasclearlystressedtherelevanceofembeddingprivacyvaluesinthedeviceandser-vicesarchitecture.
Toachievethisgoal,apreliminaryanalysisoftheuseofpersonalinformationineachspecicapplication(goodorservice)isrequiredtoshapethisuseaccordingtodataprotectionpurposes.
Basedonthisassessment,suitablemea-sureswouldbetakentoreducethepotentialnegativeoutcomesofdatause.
Thisstrictrelationshipbetweenriskassessmentandso-lutionsbydesignimpliesthatanychangeinthenatureoftheassessmentwouldaffectthearchitecturalsolutionsadopted.
Thus,themultipleimpactassessmentsuggestedwouldnec-essarilyleadcompaniestoconsiderabroaderrangeofby-designsolutionstomitigatetheadditionalethicalandsocialconcerns.
1394.
ConclusionsThisarticledoesnotprovidecompleteanswerstothevariousissuesconcerningthecollectivedimensionofprivacyanddataprotectionrelatingtotheuseofbigdataanalytics.
Theanaly-sisoffersanintroductorystudyofanewapproachtogroupprivacythatwouldappearnecessarytoadequatelyconsiderthenon-aggregativeinterestsarisingfromthedata-drivensociety.
Bigdataanalyticsarecreatinganewdigitallandscapethatcannotbedescribedasamereincreaseinthequantityofin-formationprocessed.
Thepredictivenatureoftheinferencesextractedfromdatabases,thecomplexityofdataprocessinganditsobscurity,aswellasthecategoricalapproach,distin-guishitfrompreviousprolingsolutions.
Fromthegroupperspective,bigdataanalyticscreatenewkindofgroups,whichcannotbecomparedwiththetradi-tionalconceptofagroup.
Theyaretheresultofaggregationsofinformationproducedbydatagatherersandhaveavari-ablegeometry,settingthemapartfromthepreviousstaticcategoriesusedforgroupproling.
Moreover,datasubjectsarenotawareoftheidentityoftheothermembersofthegroupandhavealimitedornoperceptionoftheircollectiveissues,whereasintraditionalgroupsthereisanawarenessofbeingpartofagroupandgroupshaveexternalvisibility.
Thenewscaleofdataprocessing,thepervasivediffusionofdata-basedapplications,theevolutionandcomplexityofgroupprolingrepresentimportantchangeswithrespecttothepreviousscenario.
140Atthedawnofthedata-drivensociety,thequestionariseswhetheritisnecessarytoreconsiderthetraditionalapproachtogroupprivacyanddataprotection,whichismainlybasedonthemodelofindividualrights.
Thisarticlegivesanafrmativeresponsetothisquestiononthebasisoftheimpactthatbigdataanalyticshaveondataprocessinganddata-drivendecisions.
Theshiftinthedatapro-cessingparadigmandthenewformsofcategoricalapproachhaveadisruptiveeffectonthetraditionalideaofgroupprivacyandhighlightitslimits.
Thenewscaleentailstherecognitionofanewlayer,rep-resentedbygroups'needfortheprotectionoftheircollectivedataprotectionrights.
Inthisscenario,dataprotectioncon-cernsnotonlyindividuals,butalsothecollectivedimension,associatedwithpotentialharmtogroupsintermsofdiscrimi-natoryandinvasiveformsofdataprocessing.
However,collectiveinterestsrequireadequateformsofrep-resentation,aswellastheinvolvementofarangeofstakeholdersinthebalancingofconictinginterests.
Spe-cicproceduralcriteriamustbelaiddowntodenewhichentitiesmayactinthecollectiveinterest,andthisdecisionismademoredifcultinthecontextofbigdatabythelackofstabilityinthenatureofgroupscreatedbydatagatherers.
138SeeAnnCavoukian,'Privacybydesign.
Fromrhetorictoreality'(2014)12–18,65–100accessed27February2014;AnnCavoukian,'PrivacybyDesign:Leadership,Methods,andResults'inSergeGutwirth,RonaldLeenes,PaulDeHert,YvesPoullet(eds),EuropeanDataProtection:ComingofAge(Springer2013)175–202;AnnCavoukian,'PrivacybyDesign:Origins,Meaning,andProspectsforAssuringPrivacyandTrustintheInformationEra'inYee,GOM(ed),PrivacyProtectionMeasuresandTechnologiesinBusi-nessOrganizations:AspectsandStandards(IGIGlobal2012)170–208;IraS.
Rubenstein,'RegulatingPrivacyByDesign'(2011)26Berke-leyTech.
L.
J.
1409–1456;PeterSchaar,'PrivacybyDesign'(2010)3(2)IdentityintheInformationSociety267–274.
SeealsoArticle29DataProtectionWorkingParty,'Opinion07/2013ontheDataProtec-tionImpactAssessmentTemplateforSmartGridandSmartMeteringSystems('DPIATemplate')preparedbyExpertGroup2oftheCommission'sSmartGridTaskForce'(2013)accessed27Febru-ary2014;Article29DataProtectionWorkingParty,'Opinion9/2011ontherevisedIndustryProposalforaPrivacyandDataProtec-tionImpactAssessmentFrameworkforRFIDApplications'(2011)accessed27February2014;WoodrowHartzogandFredericStutzman,'ObscuritybyDesign'(2013)88Wash.
L.
Rev.
385,397;FederalTradeCommission,'ProtectingConsumerPrivacyinanEraofRapidChange.
RecommendationsforBusinessandPolicymakers'(2012)22–24accessed25June2014.
139SeeWright(n72).
140In2014,the90%oftheworld'sdataweregeneratedinthelasttwoyears,whiletheremaining10%wereproducedthroughtherestofhumanityhistory.
In2014,thespeedofcommoncom-puterprocessorswasaround100–200thousandMIPS(millioninstructionspersecond),in1994,itwasaround180.
In2012,therewere8.
7billionofconnecteddevices(so-calledInternetofThings);in2020theywillbe50billion.
SeeCNN,'Thedatarush:Howin-formationaboutyouis21stcentury"gold"'(November13,2014);Wikipedia,'Instructionspersecond',Wikipedia,thefreeencyclopedia(2015);Cisco,'SeizeNewIoTOpportunitieswiththeCiscoIoTSystem'.
Allthesesourceswereaccessedon12June2015.
254computerlaw&securityreview32(2016)238–255Inthiscontext,theassessmentofthesocialandethicalimpactofanalyticsmayrepresentanopportunitytodiscoverhowdataprocessingaffectscollectiveinterestsandsimilarlyanopportunitytoidentifythepotentialstakeholders.
Meanwhile,theassessmentalsorepresentstheprincipalmechanismbywhichconictinginterestsrelatingtothecontext-dependentnotionofcollectivedataprotectioncanbebalanced.
Finally,giventhecentralroleofdataprocessinganalysisinrisk-assessment,dataprotectionauthoritiescanplayakeyroleintheassessmentprocessandlicensingmodelscanbere-consideredinthespeciccontextofbigdataanalytics.
AcknowledgementsIamindebtedtoallwhoprovidedfeedbackduringtherstpre-sentationsofmythoughtsonthistopicatthe6thInternationalConferenceonInformationLawandEthics(Thessaloniki,30–31May2014)andatthe9thInternationalConferenceonLegal,SecurityandPrivacyIssuesinITLaw(Lisbon,15–17October2014).
IwouldliketothankProf.
LeeBygrave,Prof.
LeonardoLentiandDr.
GiuseppeVaciagofortheirhelpfulsuggestions.
IamgratefultotheanonymousCLSRreviewersfortheircon-structivecomments.
255computerlaw&securityreview32(2016)238–255