VU Research Portal
The Quest for the Effective Protection of the Right to Privacy
Wisman, T.H.A.
2019
document version
Publisher's PDF, also known as Version of record
Link to publication in VU Research Portal
citation for published version (APA)
Wisman, T. H. A. (2019). The Quest for the Effective Protection of the Right to Privacy: On the Policy and Rulemaking concerning Mandatory Internet of Things Systems in the European Union.
General rights
Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain
• You may freely distribute the URL identifying the publication in the public portal ?
Take down policy
If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.
E-mail address:
vuresearchportal.ub@vu.nl
5
Chapter 1
Chapter I... 11 Introduction ... 11 1. Research Context: The Age of Internet of Things ... 11 2. Applying EU law to the design of mandatory IoT systems ... 18 3. Research question and outline ... 22 4. Methodology ... 22 Chapter II ... 27The right to privacy in the EU legal order ... 27
1. Introduction ... 27
2. The scope of the right to private life and the home ... 29
2.1 The right to private life ... 30
2.2 The home ... 40
2.3 Positive obligation to protect rights in Article 8 ECHR ... 41
2.4 Reflections on implications for IoT systems ... 44
3. Requirements for interference with the right to privacy ... 47
3.1 ‘In accordance with the law’ ... 47
3.2 The element of ‘necessity’, testing proportionality ... 52
3.3 ‘Essence’ of the right to privacy ... 63
3.4 Implications and conclusions for EU law mandating IoT systems ... 65
4. Conclusion ... 67
Chapter III ... 71
Data protection in the EU legal order ... 71
1. Introduction ... 71
2. The legal regime of Directive 95/46/EC and the GDPR ... 73
2.1 The processing of personal data ... 76
2.2 Data protection principles ... 77
2.3 Grounds for processing ... 84
2.4 The rights of the data subject ... 88
2.5 The GDPR: changing anchors ... 89
2.6 Implications for IoT systems ... 91
6
3.1 The structure of Article 8... 93
3.2 Confusion about the relation between Article 8 and 7 ... 98
4. Conclusion ... 101
Chapter IV ... 103
The Commission’s approach to and interpretation of the right to privacy in Internet of Things policy... 103
1. Introduction ... 103
2. The Commission as a policy maker ... 106
2.1 Communications on data protection and privacy in general ... 107
2.2 The role of data in the future economy ... 111
2.3 Communications and recommendations addressed to IoT systems ... 114
2.4 Taking stock of the Commission’s role as a policymaker ... 115
3. The Commission in the legislative process ... 117
3.1 Assessing fundamental rights impacts in a legislative proposal ... 117
3.2 Guarding fundamental rights in the legislative process ... 124
3.3 Consulting the Article 29 Working Party ... 126
3.4 Additional regulatory instruments ... 128
4. The Commission as the ‘executive’ ... 129
4.1 The Commission’s margin of discretion ... 131
4.2 The request of the Commission to the ESOs ... 139
4.3 The Commission’s attitude towards the ESOs ... 141
5. Conclusion ... 144
Chapter V ... 147
The regulatory framework of the smart meter: a case study ... 147
1. Introduction ... 147
2. The mandatory character of the installation ... 149
2.1 Installation according to EU law ... 150
2.2 The goals supposedly served by mandatory installation ... 151
3. The functions of the smart meter ... 156
3.1 Groundwork by the Commission ... 156
3.2 Privacy infringing functions in the Directive ... 158
3.3 Privacy and data protection in the Directive ... 161
7
4.1 Impact assessment and Explanatory memorandum of the Commission ... 163
4.2 The Data Protection Impact Assessment Template ... 165
4.3 The impact assessment & Explanatory memorandum revisited ... 168
5. Privacy infringing functions and implementing acts ... 176
5.1 Essential elements of smart meter design ... 176
5.2 Instructing the ESOs ... 178
5.3 The approach to privacy in the Smart Meters-Coordination Group ... 180
6. Conclusion ... 181
Chapter VI ... 183
Regulatory framework of eCall: case study II ... 183
1. Introduction ... 183
2. Groundwork by the Commission: making eCall mandatory ... 185
2.1 Communications framework ... 185
2.2 Legislative framework ... 191
3. The Impact Assessment and Explanatory Memorandum ... 196
3.1 The Impact Assessment and Explanatory Memorandum of the Commission ... 196
3.2 The Impact Assessment and Explanatory Memorandum revisited ... 202
4. Privacy and data protection in eCall legislation ... 214
4.1 Privacy and data protection in the ITS Directive and eCall Regulation ... 214
4.2 Added value services ... 216
5. What is left unsettled: the Commission, ESOs and essential elements of design ... 217
5.1 Instructing the Commission ... 218
5.2 Essential elements of eCall’s design ... 220
5.3 Instructing the ESOs ... 223
8 Het recht op privacy en gegevensbeschermingswetgeving ... 244 Conflicterende rollen van de Europese Commissie ... 245 Vrijheid, autonomie en architectuur ... 247 BIBLIOGRAPHY ... 251 Primary Legislation ... 251
European Commission Documents ... 253
