Digital traces that people leave behind can be useful evidence in criminal courts. However, in many jurisdictions, the legal provisions setting the rules for the use of evidence in criminal courts were formulated long before these digital technologies existed, and there seems to be an increasing discrepancy between legal frameworks and actual practices. This chapter investigates this disconnect by analyzing the relevant legal frameworks in the EU for processing data in criminal courts, and comparing and contrasting these with actual court practices. The relevant legal frameworks are criminal and data protection law. Data protection law is mostly harmonized throughout the EU, but since criminal law is mostly national law, this chapter focuses on criminal law in the Netherlands. We conclude that existing legal frameworks do not appear to obstruct the collection of data for evidence, but that regulation on collection in criminal law and regulation on processing and analysis in data protection law are not integrated. We also characterize as remarkable the almost complete absence of regulation of automated data analysis – in contrast with the many rules for data collection.

Dean John Wade, who replaced the great torts scholar William Prosser on the Restatement (Second) of Torts, put the finishing touches on the defamation sections in 1977.1 Apple Computer had been founded a year before, and Microsoft two, but relatively few people owned computers yet. The twenty-four-hour news cycle was not yet a thing, and most Americans still trusted the press.2

The laws of defamation and privacy are at once similar and dissimilar. Falsity is the hallmark of defamation – the sharing of untrue information that tends to harm the subject’s standing in their community. Truth is the hallmark of privacy – the disclosure of facts about an individual who would prefer those facts to be private. Publication of true information cannot be defamatory; spreading of false information cannot violate an individual’s privacy. Scholars of either field could surely add epicycles to that characterization – but it does useful work as a starting point of comparison.

In the spring of 2022, visitors to the Smoking Gun website would find a challenging “game, where [one’s] wasted time [was] well spent.”1

Coordinated campaigns of falsehoods are poisoning public discourse.1 Amidst a torrent of social-media conspiracy theories and lies – on topics as central to the nation’s wellbeing as elections and public health – scholars and jurists are turning their attention to the causes of this disinformation crisis and the potential solutions to it.

Advances in biomarker science are transforming the treatment of Alzheimer’s disease. First, clinicians can now identify Alzheimer’s disease neuropathology in situ, years, or even decades, before the onset of cognitive and functional impairment using biomarkers, particularly measures of amyloid, tau, and neurodegeneration. Second, there is growing evidence that other digital markers – for instance, changes in banking and driving patterns – can be used to identify older adults at increased risk of cognitive decline. As a result of these two advances, there is growing interest in monitoring older adults for incipient changes in cognition that might affect their wellbeing. This monitoring can be no-tech, such as when an older adult asks a friend or family member to let them know if they start repeating questions or retelling stories. Or it can be high-tech, such as installing a device in one’s car that tracks sudden accelerations and decelerations and the distance traveled from home. While there is great enthusiasm for this kind of monitoring among clinicians and researchers, and even, as our own research shows, among some older adults and their family members, other older adults deem monitoring to be an unwanted intrusion on their privacy. This chapter discusses the changing understanding of Alzheimer’s disease risk; presents data on the desire for monitoring, highlighting the potential for intrafamilial conflict; considers the ethical obligations of non-health businesses to collect or disclose information about Alzheimer’s disease risk; and, finally, identifies potential ethical and legal challenges – such as privacy, stigma, and discrimination – with possible solutions.

Remote care technologies help patients connect with their caregivers through monitoring, alerts, anomaly detection, and so on. Due to their nature, remote care technologies cross a number of legal fields, such as privacy and data protection, cybersecurity, and medical devices regulation. This paper aims to close the gap between high-level legal principles and practical implementation by mapping the challenges in European Union (EU) law and combining them with initial results from the TeNDER project. Specifically, we focus on technologies, which create an alert system by combining data sources from electronic health records and connected devices. Using these solutions as a starting point, we analyze the obligations the EU law lays upon the stakeholders, that is, the designers or developers, and the users, who are patients and caregivers. We answer the following research question: Which challenges does EU law pose for designers and users of remote care solutions, and in what manner can those questions be addressed in practice? We then analyze and apply the principles of privacy and data protection (proportionality, lawfulness, and data quality), and cybersecurity notification duties, and discuss the possible classification as a medical device. For all three areas, we use the two-pronged approach from the project, that is, a big-picture description of the legal challenges posed by remote care technologies, and a detailed description of the legal obligations applicable to the developers as well as users (i.e., caregivers and patients). We will follow up our work in repeated impact assessments in order to determine the benefits and pitfalls of the current approach.

Facial recognition technology (FRT) has been actively deployed by both private and public sectors for a wide range of purposes in China. As the technology has become more prevalent, the laws governing FRT have developed rapidly in recent years. While the use of FRT is increasingly regulated in the country, the regulatory restrictions can be invariably lifted for the reason of public security. Government agencies have consistently claimed this regulatory exemption for their massive FRT deployment. Moreover, the liability for government’s abuse or misuse of personal data is relatively insignificant when compared with that for private parties. Based on recent laws and cases, this chapter explains China’s asymmetric regulatory framework and the factors shaping it.

Although in all of the EU member states, law enforcement institutions have to adhere to European standards of facial recognition technology (FRT) usage, each country has local national standards that transpose these requirements into the framework of FRT in practice. However, recognising that each society has an important role in controlling the implementation of legal acts, especially where they relate to human rights, society and related interest groups have to regard the proper implementation of FRT regulation as necessary; otherwise it remains declarative and void. If public awareness and pressure to have a law implemented properly are high, the implementing institutions are forced to take action.

This chapter analyses the regulation of FRT usage by Lithuanian law enforcement institutions. Public discussion relating to FRT usage in the media, the involvement of non-governmental organisations, and other types of social control are also discussed. Finally, the chapter considers the changes that may be brought to national regulation of FRT by the EU Artificial Intelligence Act.

As facial recognition technology (FRT) becomes more widespread, and its productive processes, supply chains, and circulations more visible and better understood, privacy concepts become more difficult to consistently apply. This chapter argues that privacy and data protection law’s clunkiness in regulating facial recognition is a product of how privacy and data protection conceptualise the nature of online images. Whereas privacy and data protection embed a ‘representational’ understanding of images, the dynamic facial recognition ecosystem of image scraping, dataset production, and searchable image databases used to build FRT suggest that online images are better understood as ‘operational’. Online images do not simply present their referent for easy human consumption, but rather enable and participate in a sequence of automated operations and machine–machine communications that are foundational for the proliferation of biometric techniques. This chapter demonstrates how privacy law’s failure to accommodate this theorisation of images leads to confusion and diversity in the juridical treatment of facial recognition and the declining coherence of legal concepts.

The question of how to balance free data flows and national policy objectives, especially data privacy and security, is key to advancing the benefits of the digital economy. After establishing that new digital technologies have further integrated physical and digital activities, and thus, more and more of our social interactions are being sensed and datafied, Chapter 6 argues that innovative regulatory approaches are needed to respond to the impact of big data analytics on existing privacy and cybersecurity regimes. At the crossroads, where multistakeholderism meets multilateralism, the roles of the public and private sectors should be reconfigured for a datafied world. Looking to the future, rapid technological developments and market changes call for further public–private convergence in data governance, allowing both public authorities and private actors to jointly reshape the norms of cross-border data flows. Under such an umbrella, the appropriate role of multilateral, state-based norm-setting in Internet governance includes the oversight of the balance between the free flow of data and other legitimate public policies, as well as engagement in the coordination of international standards.

Consumers are at the forefront of market uses of AI. There are also myriad consumer uses of AI products. Consumer protection law justifies greater responses where the interactions involve significant risks and relevant consumer vulnerability; both such elements are present in the current and predicted AI uses concerning consumers. Whilst consumer protection law is likely to be able to be sufficiently flexible to adapt to AI, there is a need to recalibrate consumer protection law to AI.

Deep fakes are a special kind of counterfeit image that is difficult to distinguish from an authentic image. They may be used to represent a person doing any act and are generated using advanced machine learning techniques. Currently, such an appropriation of personality is only actionable if the circumstances disclose one of a number of largely unrelated causes of action. As these causes of action are inadequate to protect claimants from the appropriation of their personalities, there should be a new independent tort or statutory action for the appropriation of personalities which is grounded in the protection of a person’s dignitary interests.

The chapter explores the question of how different domestic and international law approaches to regulating the international transfer of personal data deal with cybersecurity threats. It examines the 2016 EU General Data Protection Regulation, the 2021 UK National Security and Investment Act, and the 2018 United States, Mexico and Canada Agreement, as representing distinct approaches for regulating international data transfers, namely data protection legislation, investment screening legislation, and digital trade agreements. The analysis demonstrates that a lack of uniformity in terms of what constitutes an adequate level and design of data protection mechanisms has left the issue of how to distinguish between acceptable and non-acceptable data-transfer restrictions largely unresolved.