ICTlogy

Conclusions for day 2
Javier de la Cueva, Lawyer.

All the debate around Net Neutrality and the right to be forgotten is about a new container — the Internet and all new technologies at large — and a new container — digital content and services.

And what this container is asking us is to feed is for ourselves, for free and providing personal data in exchange.

And not only are these data consciously provided, by uploading content, of befriending people on 3rd parties’ platforms, but also in a hidden form, by means of cookies, scripts or other devices.

There still is an unanswered question and it is whether technology as an ideology. And the Law should deal with this issue explicitly and bravely. This includes code, that in some aspects is becoming a derivative or procedural law.

And not only whether technology conforms an ideology, but also whether it conforms a new 4th generation of human rights.

An interesting question to explore in the future is whether we can proceed with the concept of habeas data.

We are now fighting the inefficacy of Law, that always arrives late at regulating and, when it does, there are hackers and crackers (conceptually very different) that make many laws irrelevant in practice. Thus, we need global solutions, founded on the Philosophy of Law and Law Theory, so to provide solid and long-lasting frameworks.

More information

• Relato del VII Congreso Internacional sobre Internet, Derecho y Política: Neutralidad de la red y derecho al olvido, by Javier de la Cueva

Track on e-government and e-democracy
Chairs: Ismael Peña-López, Lecturer, School of Law and Political Science (UOC)

Lorenzo Cotino Hueso
The European electronic citizen initiative

The new European normative makes it possible that with the addition of 1,000,000 signatures, the political debate on a certain topic can be initiated in the European Parliament. And one of the good things about this new normative is that it has been designed for the XXIst century, as online participation (i.e. signing) is considered in equal terms as offline participation.

The procedure is the usual one, where an initiative is registered and then signatures are collected within the member states. Once the European Commission validates the firms (the person signing is a European citizen, has not signed more than one time, etc.), then a new legislative process can begin.

Another asset is that the European Commission must provide free software platforms for the collection of signatures in any website. These platforms will work with digital signature, whatever its kind: certificates, tokens, smartphones, etc.

The initiative can be started at any member state and, once the platform is validated, the process of gathering support can begin.

The regulation is written as if it was about data protection, as that is the major issue when providing a (electronic) vote supplying personal data, but the regulation to be applied will be the one of any member state.

Daniel Guagnin; Carla Ilten
Self-Governed Socio-technical Infrastructures. Autonomy and Cooperation through Free Software and Community Wireless Networks

Net Neutrality is the freedom to use a communication infrastructure in all possible ways without constrains. And free software is a matter of liberty, not price, it is about free as in free speech (not as in free beer).

Technology is society made durable: social “programmes” are inscribed in any technology. In expert systems rules are disembedded from the realm of use, and defined by experts. Free software opens up the experitse to laypeople, why proprietary software stays opaque.

Copyleft is a general method for making a program or other work freely available and with the compulsory condition that any other work based on it will also be available in the same way.

Community Wireless Networks are based on free software and DIY hardware. They use wireless peer-to-peer mesh network architecture and have collectively organized and owned communication infrastructures.

An example can be the Chicago Wireless Community Networks [in Spain we have the very interesting initiative Guifi.net.]. Chicago Wireless Community Networks is a non-profit project to serve disadvantaged neighborhoods, in cooperation with CUWIN open source programmers. It’s community building through network set-up and maintenance. The Pico Peering Agreement acts as a constitution for peer networking.

That is certainly a new approach to Net Neutrality, as Net Neutrality is, all in all, a battle about the control over infrastructures.

Mayo Fuster Morell
An introductory historical contextualization of online creation communities for the building of digital commons: The emergence of a free culture movement

Online creation communities (OCCs) are a set of individuals that communicate and collaborate mainly via a platform hosted on the Internet with the purpose to create a final outcome of the joint work.

These communities are deeply rooted in the movements of the 1950s like hacking culture, hippies contraculture, action-participation methodologies and popular education, etc.

If the free software projects imply the appearance of OCCs, there is a shift from free software to free culture with the change of millennium with movements like the Creative Commons, the Wikipedia, alternative news media (e.g. Indymedia), peer-to-peer file sharing, open access of scientific research, etc. The explosion of the web 2.0 is greatly powered and fostering at the same time the concept of OCCs.

Infrasctructure conditions:

• Level of freedom and autonomy of the content generators in regard to the infrastructure.
• Level representation of the interests of the community of creators in the infrastructure provision decision-making and provision transparency.

Two main types:

• Autonomy + open = commons logic; they reinforce more collaborative communities.
• Close + dependency = corporate logic. Tend to generate larger communities.

The free culture and digital rights movement has 4 main goals: preserve the digital commons, to make important information available to the public, promote creators, remove barriers to distribution of knowledge and goods.

Lately, the movement has been shifting from free culture to meta-politics. This can be seen in the Change Congress initiative in the US (2008) or the #nolesvotes and #15M movements in Spain.

Georgia Foteinou
Institutional Trust and e-Government Adoption in the EU: a Cross-National Analysis

Why citizens that are used to e-commerce appear sceptic when it comes to using e-government websites? Normally, it is attributed to the poor quality of services, few available services, insufficient infrastructure… but evidence shows that is none of the above, at least not as a strong determinant not to be using those services. In fact, e-government usage is higher than e-commerce in most European countries, even if it has a decline of -4.5% (of all Internet users) over the period 2005-2010. On the other hand, in aggregate, e-government is growing at 30% (accesses) while e-commerce is growing at 75%.

It seems that the digitally reluctant could not be trusting the government, but not of a specific agent, but in government as a whole. This is what data seem to be telling at statistically significant levels.

Jorge Luis Salcedo
Conflicts about the regulation of intellectual property in Internet: comparing the issue networks in UK and Spain

In the issue of the conflicts about the regulation of intellectual property, how is media visibility distributed between the stakeholders in this conflict? What actors have more visibility? This is crucially relevant in mass-mediated democracies.

A first hypothesis is that the regulation supporters (Copyrights coalition and governments) will achieve a greater visibility level on the news channel.

A second hypothesis is that the Digital Rights Activists (DRA) will have a higher visibility on non traditional media (blogs, websites) than the CRC.

3r hypothesis: DRA will have a higher visibility in specific web channels, but not on the entire web.

4th hypothesis: The most visible agents on the news channels are going to get the most visibility as a whole, especially in search engines.

It is very interesting to see how in Spain, DRA have huge coverage in online platforms, in the UK they are even with CRC and both of them having less visibility than the government’s official position. In search engines, though, both UK and Spanish DRA seem to be having the same impact.

The differences may come from different resources from the different stakeholders, a more lax regulation in the UK in downloading matters, the worst reputation that the coalition has in Spain in comparison to the UK’s, including the dynamics of politics in the different countries.

Track on the Right to be forgotten, data protection and privacy
Chairs: Mònica Vilasau Solana, Lecturer, School of Law and Political Science (UOC)

Pere Simon Castellano
The constitutional regime of the right to oblivion in the Internet

It is the principle of consent the one that gives us the legitimacy to claim for a right to privacy or data protection.

Especially related to search engines (though not only) is the legality of a given content another important factor when claiming for our privacy rights or the right to be forgotten.

Jelena Burnik
Behavioural advertising in electronic communications. A benefit to electronic communication development and an intrusion of individual’s right to privacy and data protection

Behavioural advertising tracks Internet users’ activities online and delivers only relevant advertisements, based on the data collected and analysed over a given period of time. It is normally enabled by cookies, that are placed by websites or advertisements on websites.

Behavioural advertising is defended in the name of relevance of advertisements, enhanced user experience, precise segmentation and less money spent on non-relevant audiences, support to free Internet content and a driver of innovation.

But it is a controversial practice that requires a fair balance between the interests of the industry and the rights of individuals. As cookies assign a unique ID with an IP address, there can be concerns on data protection. On the other hand, cookies are normally placed in the computer by default, while maybe a debate on opt-in vs. opt-out of cookie placing and cookie-based tracking should be considered.

A new “cookie” European directive should aim at shifting from an opt-out principle to an opt-in one, and cookies being placed only under explicit user’s concern. But how is the technological solution for an opt-in cookie principle?

In the US, though, what seems to be more acknowledged is an enhanced opt-out model.

But only true opt-in provides for transparency, and self-regulation of the industry will not suffice.

María Concepción Torres Diaz
Privacy and tracking cookies. A constitutional approach.

It is worth noting the difference between privacy, intimacy and personal data. And cookies can harm privacy. So, users should get all necessary information on cookies and tracking so they can decide whether a specific behaviour puts at stake their privacy. In case the user decides to go on, explicit consent should be provided to the service to perform its tracking activity.

We have to acknowledge that new technologies will bring with them new rights and new threats to old rights. Thus, we should be aware of the new technologies so that the law does not fall behind.

Philipp E. Fischer; Rafael Ferraz Vazquez
Data transfer from Germany or Spain to third countries – Questions of civil liability for privacy rights infringement

There are data transfers at the international level continuously. If those data got “lost”, the operator might have incurred in privacy rights infringement.

The European Directive on data transmission, it has been established that there can be data transmission within the European Union (nationally or internationally) or with 3rd countries with adequate level of data protection. There still are some issues with the US and there are other countries which are simply banned from data transmission between them and member states.

Faye Fangfei Wang
Legal Feasibility for Statistical Methods on Internet as a Source of Data Gathering in the EU

Privacy protection steps: suitable safeguards, duty to inform prior to obtaining consent (transparency), consent, and enforcement. Request for concern should be looked at as a very important step towards privacy protection. Consent must be freely given and informed.

There is an exemption clause in the UK legislation, to be used when gathering some data is strictly necessary for a service to run, or for scientific purposes, etc. But the exception clause must be used legally.

Ricardo Morte Ferrer
The ADAMS database of the Anti Doping World Agency. Data protection problems

The ADAMS database stores whereabouts, reporting where a sportsman is during 3 months, for a daily time span from 6:00 to 23:00 and including a full daily 1h detailed report of their whereabouts. Instead of presuming innocence, this database kind of presumes guiltiness.

That is a lot of information and, being the holder an international agency based in Canada, a threat on data protection as it implies a continuous traffic of personal data internationally.

Inmaculada López-Barajas Perea
Privacy in the Internet and penal research: challenges in justice in a globalized society

The possibility that personal information of citizens can be retrieved, remotely, by law enforcement institutions, is it just the digital version of the usual (and completely legal) surveillance methodologies, or is it something new and something that threatens citizens’ privacy?

More information

• Tracking without cookies, by Smári McCarthy.

Panel: Internet Privacy and the Right to Be Forgotten
Chairs: Esther Mitjans, Director of the Catalan Data Protection Authority and Professor of Constitutional Law at the University of Barcelona

Norberto Nuno Gomes de Andrade, Scientific Officer at the European Commission, working at the Institute for Prospective Technological Studies (IPTS, Spain)
The Right to be Forgotten. An Identity Perspective

The right to be forgotten should be anchored to the right to identity.

The data protection – data privacy – identity triangle: the data protection directive presents and apparently harmonious and coherent articulation of the concepts of data protection, privacy and identity. Data protection protects the righ to privacy by relying upon the notion of personal identity. This assumed harmonious connection is flawed and problematic. In reality, it is much more complex and dynamic.

Data protection should be procedural right, while data privacy and identity should be substantial rights. Substantial rights are a social interest, while procedural rights set the rules, methods and conditions through which those substantive rights are effectively enforced and protected.

Right to identity is the right to be unique, the persons’ definite and inalienable interest in the uniqueness of their being. The right to identity is infringed if person A makes use of person B’s identity in a way contrary to how that person B perceives his or her identity.

Right to privacy protects the personal condition of live characterized by seclusion from, and therefore, absence of acquaintance by the public. Right to privacy is only infringed if true private facts related to a person are revealed to the public.

The right to be forgotten can be seen from an identity perspective. Reinforces the anti-essentialism view of Ientity (a narrative identity): a process of negotiation, social construct, a matter of choices; corresponds to the ever-expanding manner in which law is allowing the individual to infuence aspecte of their identity; and matches the rational of the right to identity: the right not to have one’s identity miss represented, right to new beginning, right to be different Unot only from others, but also from one self).

The right to be forgotten from an identity angle also coves the facts that are already in the public domain, public factas, and covers also the not-necessarily truthful or decontextualized information, the one that is out-dated.

Milagros Pérez Oliva, Ombudsman of El País

It is worth noting that the information that appears on a newspaper is very different from the one that appears on a social networking site. In principle, all the information published in newspapers is public interest, and thus, that information should be publicly available. The problem is when (a) newspapers upload all their archives to the Internet and (b) finding out information (oftentimes serendipitously) is now easy and cheap and quick.

Historical archives cannot be modified and must be public. Period. Of course, that is not the final solution in the case of information vs. privacy, but the beginning of all problems. A first recommendation is to write new information according to some cautionary rules: avoid names (just initials) if the person is not a public celebrity, avoid contextual information that can lead to their identification, etc.

The problem comes with already published information. The suggestion could be to put out of the search engines’ reach some obsolete information. The problem comes, again, with defining what is obsolete information, or what has become non-relevant information.

Yet another problem, added to obsolete information or non-relevant, is incomplete information or plain wrong information. Those are pieces of news that were discontinued (e.g. trials) or never corrected and that pose a problem, as there are thousands of pieces of news within this category.

There is a need for a collective decision on how to add or link new information to an already published piece of news.

María González Ordóñez, Head of Legal for Spain, Portugal & Israel, Google Spain

Google’s policy is to not delete personal data from their cache if the original source has not also deleted those data. In this sense, Google is very respectful with what instructions a webmaster gives to Google (usually via robots.txt) in relationship with indexing and caching.

This policy is based in the fact that Google wants to provide what is available in the Internet. If Google erases information that still is on the net, the search engine will lose transparency and neutrality. On the other hand, there is also the fact that Google can do the very same claims of newspapers concerning the right to information and freedom of expression.

Ricard Martínez Martínez. Professor of Constitutional Law, Universitat de València

We have a dire need to balance the different rights put at stake with the digitization of our lives.

And as citizens usually cannot control their profile on the net, the responsibility to take action relies, on the one hand, on the legislator to design a legal framework, and on the other hand, on the online service and content providers.

We could try and have new tools to “prune” our public information. And those tools should be developed by the industry itself.

More information

• El olvido: El derecho a ser diferente… de uno mismo. Una reconsideración del derecho a ser olvidado, by Norberto Nuno Gomes de Andrade.
• ¿Tenemos derecho a ser olvidados en Internet? (IDP 2011), by Cristina Aced

Introduction by Esther Mitjans, Director of the Catalan Data Protection Authority and Professor of Constitutional Law at the University of Barcelona.

Three reasons why the right to forget is not already in the Law:

• We could not know.
• We did not know we were to lose all control on our own data,.
• We could not have known that segmented marketing would highly value personal data.

We face a trade-off between economic profits from data exploitation and privacy and security.

Cécile de Terwangne, Professor, Centre de recherche informatique et droit
Internet Privacy and the Right to Be Forgotten

Privacy does not mean intimacy or secrecy, but individual autonomy. In the context of the internet, it is informational self-determination, the control over one’s personal information. This personal information is made up by confidential data, but also by professional data, commercial data, published data, photos, films, sound…

In Europe, this “informational self-determination” has been recognized and protected by several norms, and the right to oblivion of the judicial/criminal past has been recognized by case law in several countries, based on the right to privacy or on personality rights.

The justification for the right to oblivion is justified by faith in human beings’ capacity of improving, the conviction that man should not be reduced to their past, the idea that once you have paid what was due, society must offer the possibility to rehabilitate.

But the right to oblivion conflicts with the right to information.

The criterion to resolve the conflict should be time:

• If there is newsworthiness, the right to information should prevail.
• If the information is no more newsworthy, then the right to oblivion should prevail.

What do we do, though, with digital newspapers archives and case law databases, which are clearly breaking the balance that we had reached?

Related to case law databases, the solution that has been proposed is anonymization, with respect of the purpose principle — by which only relevant data in relation with the purpose may be processed — and the proportionality principle — by which no excessive data may be processed.

Related to newspapers, one thing is to restrict the dissemination of old personal data, a different one is a right to delete those data. Deleting data out of “chronicles” is tempering on one’s own history.

On the other hand, there is of course a conflict with freedom of the press, a conflict that becomes a dilemma as there is not an a priori hierarchy amongst personal rights freedom of the press or the right to information.

In general, though, legislation shows that too many definitions/thresholds are subjectively defined, like “data won’t be kept longer than necessary” or some conditions under which it is possible to anonymize or delete data.

With the pervasiveness of the Web 2.0 and cloud services, there is a claim for a new right to oblivion, due to the problem of long lasting records kept by certain Internet actors of traces unconsciously left when surfing the web. But, again, as some economic models heavily rely on those data basis, there is a trade-off between personal and corporate rights.

A first solution is having the possibility to stablish a right to have information deleted and not only rendered inaccessible.

Another solution could be based on basing the right to be forgotten on a right based on the no-collection of personal data and established by default, that is, privacy by design.

More information

• Privacidad en Internet y el derecho a ser olvidado/derecho al olvido, by Cécile de Terwangne.
• ¿Tenemos derecho a ser olvidados en Internet? (IDP 2011), by Cristina Aced

Conclusions for day 1
Javier de la Cueva, Lawyer.

First of all, it is worth noting the role of Philosophy when talking about Net Neutrality. We are indeed building a new world, and this new world is not about machines, but about people. And the question is not about Net Neutrality, but about what will be the new 4th generation fundamental rights that we want for our future.

Another important issue is the definition of jurisdiction. And this jurisdiction is not only geographical, but can also be understood all along the value chain Internet provided content and services. We can speak about the different layers that make the Internet up, of about the different ends of the service, etc. But the truth is that there are many actors on the Internet and many of them belong to different legal, technical or factual jurisdictions.

A missing point during the Congress is the asymmetry of download and upload speeds. This asymmetry makes it more difficult peer-to-peer sharing, and makes it more difficult to become a real prosumer.

Again, the important thing is what do we want. In matters of Net Neutrality, do we want Net Neutrality as a right, as a principle or as a goal.

In some way, the absence of net neutrality is like adding a layer of obscurity and unfairness amongst two layers of freedom: the layer of free software, the free code that runs the Internet; and the layer of free content, the one that is freely created by the contributing users.

Of course, we have to be aware that with great power comes great responsibility: we have to acknowledge that a lot of work has still to be done in issues like privacy, reputation and honour, security, etc. Part of the solution comes, evidently, with lawyers and policy-makers learning much more on how the Internet and technology in general work.

More information

• Relato del VII Congreso Internacional sobre Internet, Derecho y Política: Neutralidad de la red y derecho al olvido, by Javier de la Cueva