Tilburg University Digital Personae and Profiles in Law C Roosendaal
Total Page：16
File Type：pdf, Size：1020Kb
Tilburg University Digital personae and profiles in law C Roosendaal, A.P. Publication date: 2013 Link to publication in Tilburg University Research Portal Citation for published version (APA): C Roosendaal, A. P. (2013). Digital personae and profiles in law: Protecting individuals' rights in online contexts. Wolf Legal Publishers (WLP). General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. Download date: 30. sep. 2021 Digital Personae and Profiles in Law Protecting Individuals’ Rights in Online Contexts Arnold Roosendaal a Digital Personae and Profiles in Law Protecting Individuals’ Rights in Online Contexts Arnold Roosendaal ISBN: 978-90-5850-989-5 Fotografie omslag: Tobias Groenland http://www.tobiasgroenland.nl +31614669030 Published by: aolf Legal Publishers (WLP) PO Box 313 5060 AH Oisterwijk The Netherlands E-Mail: [email protected] www.wolfpublishers.com Attribution: Licensees may copy, distribute, display and perform the text of the work and make derivative works based on it only if they give the author or licensor the credits by referring to the original work. This license does not include the cover of this work. Digital Personae and Profiles in Law Protecting Individuals’ Rights in Online Contexts Proefschrift ter verkrijging van de graad van doctor aan Tilburg University op gezag van de rector magnificus, prof.dr. Ph. Eijlander, in het openbaar te verdedigen ten overstaan van een door het college voor promoties aangewezen commissie in de aula van de Universiteit op dinsdag 21 mei 2013 om 16.15 uur door Arnold Petrus Christiaan Roosendaal, geboren op 18 april 1979 te Halsteren Promotores: prof.dr. R.E. Leenes prof.dr. E.J. Koops Commissieleden: prof.mr.dr. M. Hildebrandt prof.dr.ir. W. Kraaij prof.dr. E.G. Smit prof.dr. P. de Hert Table of Contents Abbreviations 1 Preface 3 Chapter 1 Introduction 5 1. Setting the stage 5 1.1. Digital Interactions 6 1.2. Digital personae 8 1.3. Privacy and data protection legislation 9 1.4. An alternative approach 11 2. Aim of the study 11 3. Methodology 12 4. Outline of the study 13 Part I Theory and Abstract Level Chapter 2 Identity and Representation 17 1. Introduction 17 2. Presentation and representation 17 3. The concept of identity 18 3.1. Identity in sociology 20 3.2. Identity in philosophy 24 3.3. Identity in media theory 25 4. Digital presentation and representation 28 4.1. Digital personae 28 4.2. Profiles 29 4.3. From profile to digital persona 31 4.4. Comparing digital personae and profiles 33 5. Synthesis 36 Chapter 3 Digital Persona: Definition and Appearance 39 1. Introduction 39 2. The digital persona in general and its three specific forms 39 2.1. The projected digital persona 41 2.2. The imposed digital persona 42 2.3. The hybrid digital persona 44 3. Why digital personae are created 46 3.1. Representation (persona) 46 3.2. Facilitating automated processing (digital) 48 3.3. ‘Digital persona’ 50 4. The practical appearance of digital personae 52 4.1. Collection of data 53 4.2. The form of the digital persona 59 4.3. The application of the digital persona 61 5. How to determine whether a data set is a digital persona? 65 Chapter 4 Human dignity and related values and rights and their legal protection 67 1. Introduction 67 2. Main concepts and their relation 68 2.1. Human dignity 69 2.2. Autonomy 70 2.3. Identity 72 2.4. Informational self-determination 72 2.5. Contextual integrity 74 2.6. Privacy 76 2.7. Conclusion 78 3. Fundamental rights and values 78 3.1. The European Convention on Human Rights 79 3.2. The Charter of Fundamental Rights of the European Union 83 4. The regulation of data protection 87 4.1. Definitions 89 4.1.1. Any information 90 4.1.2. Relating to 91 4.1.3. Identified or identifiable 91 4.1.4. Natural person 92 4.2. Principles underlying data protection regulation 92 5. Conclusion 95 Part II Practice and Concrete Level Chapter 5 The Use of Digital Personae and Profiles 99 1. Introduction 99 2. The life of a digital persona 99 2.1. The story of Aydee the Avatar 100 2.2. Aydee the Avatar: background 104 2.3. Information differences affecting individuals 105 2.3.1. Digital form 105 2.3.2. Inexhaustible memory 106 2.3.3. Being involved in an interaction without knowledge or involvement of concerned individual 107 3. Technical description 108 3.1. What happens in a web interaction? 108 3.2. Cookies 113 3.2.1. What is a cookie? 113 3.2.2. Third-party cookies 116 3.3. User accounts 120 3.4. Connecting devices to single individuals 121 3.5. The memory and existence of Aydee 122 3.6. Interim summary 124 4. Case studies 125 4.1. Facebook 126 4.1.1. The Facebook ‘Like’ Button 128 4.1.2. Cookies, recognition, and identification 129 4.1.2.1. Scenarios 130 4.1.2.1.1 The web user has a Facebook account 131 4.1.2.1.2. The web user does not have a Facebook account 132 4.1.2.1.3. A user becomes a Facebook member 133 4.1.2.1.4. A user deletes his Facebook account 134 4.1.2.2. Recognition and identification 135 4.1.2.3. Friend Suggest 137 4.2. Google 138 4.2.1. Google Privacy Policy: one policy for the entire web 141 4.3. The combination of online and offline data 143 4.3.1. Credit rating agencies 143 4.3.2. Tracking and profiling by banks and insurance companies 144 4.3.3. The shift from commercial contexts to administrative and law enforcement contexts 146 5. Implications of digital persona and profile creation and use 147 Chapter 6 Shortcomings in Data Protection Regulation: The Practical Level 155 1. Introduction 155 2. Digital personae in view of the DPD 156 2.1. Identified or identifiable 156 2.2. Requirements from the DPD: data controllers 159 2.2.1. Grounds for legitimate data processing 159 2.2.2. Information duties 163 2.3. Rights from the DPD: data subjects 164 2.3.1. Data subject access rights 166 3. Profiles in view of the DPD 168 3.1. The individual is not identifiable 171 3.2. The individual may be identifiable 172 3.3. The individual may be identifiable in the future 174 4. Means likely reasonably to be used for identification 175 4.1. The controller or any other person 175 4.2. Likely reasonable means 180 5. Problems when the DPD is applicable 182 5.1. Consent 183 5.2. Weighing of interests 188 5.3. Consequences for the individual 189 6. Conflicts with the main values and rights to be respected 192 7. Problem definition: Legal uncertainty for data controllers and inappropriate protection of individuals 200 7.1. Two key problems 201 7.2. Synthesis and research question 202 Part III Protection of Digital Personae Chapter 7 Protection of Digital Personae 209 1. Introduction 209 2. Draft proposal for a General Data Protection Regulation 209 3. Legal personality and legal status 218 3.1. Legal personality and legal status in general 218 3.2. Legal personality and legal status for digital personae? 223 4. Property 225 4.1. Ownership of things 225 4.2. Intellectual property 231 4.2.1. Copyright 232 4.2.2. Database rights 237 4.2.3. Limitations of copyright and database rights as protecting concepts 240 4.2.4. Portrait law 241 4.2.5. Protection of digital personae by portrait law? 243 5. Conclusion 245 Chapter 8 The Digital Persona as a New Legal Concept 249 1. Introduction 249 2. Proposal for implementing the concept of the digital persona in law 251 2.1. Main points of attention related to the use of digital personae 251 2.2. The digital persona in portrait law 255 2.3. The digital persona in data protection law 256 2.4. The digital persona as a portrait in data protection law? 258 3. Issues covered by the GDPR 260 4. Further points of attention and suggestions 262 5. Conclusion and reflection 268 Bibliography 273 Summary 295 Abbreviations CNIL La Commission Nationale de l’Informatique et des Libertés (French DPA) DCC Dutch Civil Code DNT DoNotTrack DPA Data Protection Authorities DPD Data Protection Directive (95/46/EC) EC European Commission ECHR European Convention on Human Rights and Fundamental Freedoms ECtHR European Court on Human Rights FCC Federal Communications Commission FTC Federal Trade Commission GDPR General Data Protection Regulation (Proposal) OBA Online Behavioral Advertising SNS Social Networking Site(s) W3C World Wide Web Consortium 1 Preface The chance to write a PhD thesis is a wonderful privilege. It requires effort, lots of effort, but also a good working environment. An environment with high academic standards and culture, which consists not only of the physical surroundings but also, perhaps even more importantly, of people who support and contribute to your own academic development.