Annual Privacy Forum 2017

A brief overview

DECEMBER 2017 www.enisa.europa.eu European Union Agency For Network and Information Security Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Contact For queries in relation to this paper, please use isdp@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged. 02 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

Table of Contents 1. Introduction 4 2. Programme 5 Invited Talks 5 Panel Sessions 6 2.2.1 Privacy regulation in a global context considering new challenges like Artificial Intelligence 6 2.2.2 Towards a European Data Protection Certification Scheme 6 2.2.3 Practical Implementation of GDPR in Mobile Applications 6 2.2.4 Lawful Interception and PETs 6 Scientific Track 7 3. Conclusions 9 Annex A: APF Programme 10 Day 1 – June 7, 2017 10 Day 2 – June 8, 2017 11 Annex B: Call for Papers 13 Call for papers text 13 Programme Committee 14 03 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

1. Introduction Electronic communication networks and interconnected digital services have become ubiquitous as they have permeated every fold of everyday life. At a time when automated profiling and electronic surveillance have become commodities, citizens and businesses alike may face limitations and threats when they have personal data processed or seek to protect their privacy on the internet or when using general communication services. Limitations in the transparency, the functionality and interconnectivity of online and communication services increase the risk of having personal data processed out of control of any accountable person or organisation or simply becoming exposed to all sorts of privacy threats. The recalibrated legal framework in the EU as manifested by the promulgation of the General Data Protection Regulation (GDPR) , is key in an effort to better control the processing of personal data. Additionally the recent EC proposal for a Regulation on Privacy and Electronic Communications is expected to give new impetus to the way privacy is protected in electronic communications. Even the best legislative efforts cannot keep up to speed with the pace of innovative technology and business models that challenge the way personal data is processed and privacy is protected across the EU and beyond; therefore examining what is at stake and where threats originate from becomes of paramount importance. In the light of GDPR and the recent EC proposal for a Regulation on Privacy and Electronic Communications, DG CONNECT, ENISA and the Law Faculty of the University of Vienna, Arbeitsgruppe Rechtsinformatikis organized the fifth edition of Annual Privacy Forum (APF) in Vienna, Austria on June 7 & 8, 2017. The event encouraged dialogue with panel discussions and provided room for exchange of ideas in between scientific sessions. This two-day conference was well attended by more than 100 participants in addition to more than 70 viewers through the web streaming service. http://eur-lex.europa.eu/eli/reg/2016/679/oj https://ec.europa.eu/digital-single-market/en/news/proposal-regulation-privacy-and-electronic-communications 04 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

2. Programme Invited speeches Three keynote speakers were invited, namely Peter Fleischer, Google, Reinhard Posch, TU Graz & Austria Chief Information Officer and Rosa Barcelo , European Commission. Their details are listed below. Peter Fleischer has worked as Google’s Global Privacy Counsel since 2006. Based in Europe, Peter is Google’s longest serving privacy leader. He counsels Google teams on how to design privacy sensitive and legally compliant products. Peter has designed many of Google’s privacy compliance programs. He has met with thousands of privacy officials and leaders worldwide. Peter has managed scores of regulatory actions around the world, and appeared before some of the world’s highest courts. Prior to joining Google, Peter worked for 10 years at Microsoft, as EMEA privacy leader and Director of Regulatory Compliance. Peter is a graduate of Harvard College and Harvard Law School. Reinhard Posch is chairman of the board of trustees of the non-profit foundation Stiftung Secure Information and Communication Technologies SIC which has been donated by Graz University of Technology. Reinhard Posch was also Chair of the Board of ENISA, the European Network and Security Agency. Reinhard Posch takes part in groups installed by the European Commission to elaborate ICT and security strategies (e.g. „Future Internet Visionaries“, RISEPTIS). Being a member of the "Rat der IT Weisen" he has provided advice to Commissioners Kroes and Sefkovic in the area of IT-Security to assist the implementation of the Digital Agenda. The keynote of Ms. Barcelo was provided by a colleague of hers, due to last minute change in her agenda. 05 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

Rosa Barcelo works at the European Commission, in DG CONNECT (Unit H1 – Cybersecurity and Digital Privacy Unit) where she is Deputy Head of Unit. The Unit is responsible the review of the ePrivacy Directive (2002/58). It is also competent for legislative, policy and R&I actions to improve network and information security, such as the NIS Directive.Prior to taking up this job, Rosa worked for the European Data Protection Supervisor (2006-2011) and in DG JUSTICE Data Protection Unit of the European Commission. Rosa has worked as a private lawyer in the Brussels offices of Morrison and Foerster and DLA Piper where she advised clients on European privacy and data protection, electronic commerce and technology law. She also worked for some years in the academia (Belgium and Spain). She obtained her PhD in Law with a dissertation on electronic contracts and digital signatures. Panel Sessions Throughout the programme, four panel sessions were organized, targeting mainly topics and areas closely related to the Agency’s activities for 2017. An overview of the sessions is presented hereinafter. 2.2.1 Privacy regulation in a global context considering new challenges like Artificial Intelligence User interfaces - hardware and software - are produced for a global market. Artificial Intelligence (AI) tools with big data analytics allow more personalised services, resulting in a competitive advantage for respective companies. Therefore, privacy regulation must face these challenges and take into account that the global market must focus on privacy-friendly solutions. Ethics can play a strong role in this direction. 2.2.2 Towards a European Data Protection Certification Scheme In the Recitals of GDPR it is stated that “In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms and data protection seals and marks should be encouraged, allowing data subjects to quickly assess the level of data protection of relevant products and services”. The objective of this panel was to identify and explore the challenges and opportunities of GDPR personal data protection certification mechanisms. 2.2.3 Practical Implementation of GDPR in Mobile Applications In the course of the GDPR implementation, one very important aspect is the practical application of the specific data protection obligations (e.g. purpose limitation, data minimization, transparency, consent, etc.) into technical and organisational controls that can be used to achieve and/or assess compliance. The aforementioned concern is especially crucial in the area of mobile applications (apps). The objective of this panel was to discuss the current software development practices and challenges specific to app developers with regard to the processing of personal data and explore the level of practical implementation of GDPR. 2.2.4 Lawful Interception and PETs With the increasing importance of information services in virtually every aspect of life, the need for strong protection mechanisms for private information arises. This need is addressed by a wide spectrum of tools providing confidentiality, integrity and anonymity, which play a key role in the prevention of cybercrime. On the flip, side these tools can be adapted and used with criminal intend and then pose a critical impediment to the detection, investigation and prosecution of criminals across all crime areas. This leaves law enforcement with a conflict where cryptographic tools that are used to prevent crime are also used by criminals to engage in crime. Experts from ENISA, EUROPOL and Academia discussed how to find practical 06 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

solutions for this issue, reflecting the state of the art in electronic criminal investigations and what types of new evidence can be used in investigations. Scientific Track As in previous years, half of the conference agenda was dedicated to presentations of new ideas from research. To identify these new ideas, a call for papers was published in early 2017. This call was advertised by the programme committee (PC) members and published at relevant platforms, e.g. wiki-CfP . The Program Committee (PC) presented in section B.2 was composed of senior academics, alongside legal and technical experts. The submission process was supported by EasyChair . In total, we received 41 submissions in response to our call for papers. Each paper was peer-reviewed by at least four members of the Program Committee. On the basis of significance, novelty, and scientific quality, 12 full research papers were selected and were presented to the event. Revised versions of these papers were published as postproceedings from Springer LNCS . http://www.wikicfp.com/cfp/ http://easychair.org/ http://www.springer.com/cn/book/9783319672793 07 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

3. Organisational overview APF17 has been significant as it has become the first ever edition that has been funding neutral to the Agency. While a modest amount of appropriations in the order of 20 000 EUR has been put at the disposal of the organisers as has been the case in the past, the efficient organisational practices of all parties involved has rendered the event very attractive for sponsorships. The private sector, clearly motivated by the prominence of GDPR repeated events in this period, has provided adequate financial support. In addition, certain costs have been covered via third party funding which is available through public services in Vienna, such as a dinner sponsored by the City of Vienna. ENISA has bene reviewing its approach towards the APF to (a) include private sector representatives as local co-organisers to complement academic ones and (b) encouraging local actors to support the conference in a way that it becomes self-sufficient in funding. Clearly for extraordinary costs and a precautionary measure it is recommended to retain the option to support the organisation budget with a modest sum as it has been the case over the years. The next two editions of the APF are planned to be organised as follows: 1. In 2018, Barcelona, with the support of the Universidad Politecnica de Catalunya and Telefonica 2. In 2019, Rome Universita La Sapienza and a private sector partner TBD Suitable arrangements have bene made with for both cases. 08 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

4. Conclusions Building on top of the experience accumulated all these five years, it is safe to say that the next edition of the Annual privacy Forum, which is expected to take place in June 2017, will continue attracting multidisciplinary experts, researchers and policy makers in the areas of privacy and data protection. 09 Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

Annex A: APF Programme Day 1 – June 7, 2017

DAY 1. WEDNESDAY JUNE 07, 2017

8:00 Registration & Coffee Dean Prof. Paul Oberhammer, University of Vienna 9:00 Opening Remarks Prof. Erich Schweighofer, University of Vienna Mr. Paulo Empadinhas, ENISA 9:15 Opening Keynote Mr. Wojciech Wiewiórowski, EDPS

Keynote

9:45 "Technology and Privacy: how Google is preparing for the Mr. Peter Fleischer, Google

GDPR"

10:30 Networking Coffee

Paper Session I

The GDPR and Big Data: leading the way for Big Genetic Kärt Pormeister Data?

Towards a Privacy-preserving Reliable European Identity Jorge Bernal Bernabe, Antonio Skarmeta Gomez, Nicolás 11:00 Ecosystem Notario, Julien Bringer and Martin David Forget Me, Forget Me Not - Redefining the Boundaries of the Right to be Forgotten to Address Current Problems Beata Sobkow and Areas of Criticism

A Refinement Approach for the Reuse of Privacy Risk Sourya Joyee De and Daniel Le Métayer Analysis Results 12:30 Lunch

Panelists

- Ms. Marit Hansen, Unabhängiges Landeszentrum für

Panel Session I : “Practical Implementation of GDPR in

Datenschutz

Mobile Applications”

- Mr. Arndt Gerdes, Huawei Technologies The objective of this panel is to discuss the current - Mr. Peter Kraus, EDPS 13:30 software development practices and challenges specific to - Mr. Peter Fleicher, Google app developers with regard to the processing of personal

Moderator

data and explore the level of practical implementation of Ms. Athena Bourka, ENISA GDPR.

15:00 Networking Coffee

15:30 Paper Session II

Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

DAY 1. WEDNESDAY JUNE 07, 2017

A Gamified Approach to explore Techniques of Andreas Rieb, Tamara Gurschler and Ulrike Lechner Neutralization of Threat Actors in Cybercrime

Privacy by Design Data Exchange between CSIRTs Erich Schweighofer, Vinzenz Heußler and Peter Kieseberg

Mr X vs. Mr Y: the emergence of externalities in Maurizio Naldi and Giuseppe D'Acquisto differential privacy

Diffix: High-Utility Database Anonymization Paul Francis and Sebastian Probst Eide

Panelists

- Ms. Jelena Burnik, Slovenian DPA - Ms Bojana Bellamy, CIPL

Panel Session II: “Towards a European Data Protection

- Mr. Sebastian Meissner, EuroPriSe

Certification Scheme”

- Ms. Irene Kamara, Tilburg University (TILT), Vrije Universiteit Brussel (LSTS) 17:00 The objective of this panel is to identify and explore the - Mr. José M. del Álamo, TRUESSEC.EU challenges and opportunities of personal data protection certification mechanisms, seals or marks focusing also on existing initiatives and voluntary schemes

Moderator

Mr. Prokopios Drogkaris, ENISA

Dinner

19:15

Day 2 – June 8, 2017

DAY 2. THURSDAY JUNE 08, 2017

8:30 Registration & Coffee

Keynote

Mr. Reinhard Posch, TU Graz & Austria Chief Information 9:00 “Data protection issues into the context of modern Officer

technology environments”

Keynote

9:45

Ms. Rosa Barcelo, European Commission “ePrivacy Regulation proposal”

10:30 Networking Coffee

Panellists Panel Session III: “Privacy regulation in a global context”

- Ms. Caroline Goemans Dorny, Interpol (tbc) - Mr. Zoltán Précsényi, Symantec User interfaces - hardware and software - are produced for - Mr. Niko Härting, PinG a global market. AI tools with big data analytics allow more 11:00 - Mr. Maximilian Schrems, Privacy Activist personalized services, resulting in a competitive advantage for respective companies. Therefore, privacy regulation must face these challenges and take into

Moderator

account that the global market must focus on privacy- Mr. Erich Schweighofer, University of Vienna

Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

DAY 2. THURSDAY JUNE 08, 2017

friendly solutions. Ethics can play a strong role in this direction.

12:30 Lunch

Paper Session III

Towards a Principled Approach for Engineering Privacy by Majed Alshammari and Andrew Simpson Design

PrivacyScore: Improving Privacy and Security via Crowd- Max Maaß and Dominik Herrmann Sourced Benchmarks of Websites 13:30 Vasiliki Diamantopoulou, Konstantinos Angelopoulos, Julian Privacy Data Management and Awareness for Public Flake, Andrea Praitano, José Francisco Ruiz, Jan Jürjens, Administrations: a Case Study from the Healthcare Michalis Pavlidis, Dimitri Bonutto, Andrès Castillo Sanz, Domain Haralambos Mouratidis, Javier García Robles and Alberto Eugenio Tozzi

Better Data Protection by Design through Multicriteria Decision Making: On False Tradeoffs between Privacy and Bettina Berendt Utility

15:00 Networking Coffee

Panel Session IV: “Lawful interception and PETs” Panelists

- Mr. Philipp Amann, Europol EC3 The EC3-ENISA joint working group on encryption invites - Mr. Laurent Beslay, DG Joint Research Centre to discuss practical solutions for the conflict where - Mr. Stephan Krenn, AIT 15:30 cryptographic tools that are used to prevent crime are also used by criminals to engage in crime. We will reflect the state of the art in electronic criminal investigations and Moderator what types of new evidence can be used during the Mr. Stefan Schiffner, ENISA investigations.

17:00 End of Event

privacyhub.wien - Annual Privacy Forum – OCG

Mr. Max Maaß

Invited Talk: “Eine praxisnahe Einführung in die

18:00 PrivacyScore-Benchmarking-Plattform" (Practical Mr. Dominik Herrmann Introduction to the PrivacyScore Benchmarking Platform)

Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

Annex B: Call for Papers Call for papers text In APF 2017 we invite papers presenting original work on the themes of data protection and privacy and their repercussions on technology business, government, law, society, policy and on law enforcement. An inter-disciplinary approach is high in demand to contribute to bridging the gap between research, business models and policy much like proposing new models and interpretations are. Research - Opinion Papers APF2017 seeks contributions from policy makers and implementers, Data Protection Authorities, industry, consultants, NGOs and civil society as well as law enforcement representatives. Opinion and interpretation papers are expected to reflect the views of the author(s). Submissions can be up to 8000 words long, excluding bibliography and appendices. Both research and opinion papers should deal with at least one of the following aspects:  Implementation aspects of "by design" and "by default" paradigms  Implementation and adoption of PETs in contemporary digital services  Modelling of data protection and privacy requirements, such as:  Machine readable representations and automatic evaluation of policies  Enabling transparency: technological and organizational challenges  Technical solutions for the enforcement and the implications of the subject’s right, e.g. right to erasure, access and correction.  Aspects of privacy impact and risk assessment  Technical solutions for data portability  Sustainable business models for privacy friendly online services  Information and consent in online environments: practical solutions and implementations  Privacy education, reliability and usability of PETs  Trust services for the protection of personal data - privacy aware trust services (i.e. electronic certificates, signatures, etc.)  Security measures for the protection of personal data  Economics of privacy and personal data  Legal, technical and organisational aspects of privacy and law enforcement  Ethical conditions to the applicable framework  Procedural issues  Issues of transatlantic interest Student Papers In order to encourage participation of young researchers, the submission of papers by students is encouraged. These papers will be treated as thoroughly as full papers, but can be shorter (up to 4000 words) and reflect novel thinking that might not have been fully elaborated just yet. Short Papers Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

In addition to student papers, short papers are invited as this call is open to anyone who has a sketch of an idea, opinion or a call for collaboration. Short papers should be up to 4000 words and should not overlap with work published elsewhere. Review and Publication All submissions will be thoroughly reviewed by our PC members. We aim at minimal 3 average 4 reviews per Paper. Authors must submit their papers according to conditions and within the deadline communicated on the conference web site. Conference Chairs and Springer Publishers are currently negotiating the conditions for acceptance in Lecture Notes in Computer Science. Pre-proceedings will be published by the Austrian Computing Society and made available at the conference. Submissions of original work are invited; papers must not overlap substantially with work already published or simultaneously submitted to a journal or a proceedings bearing venue. Submissions can be up to 8000 words long, excluding bibliography and appendices. Shorter submissions are encouraged, as described elsewhere. Submissions must be drafted in English and they currently need to comply with the Springer LNCS style guide, which can be found at:  http://www.springer.com/computer/lncs?SGWID=0-164-6-793341-0  http://static.springer.com/sgw/documents/1121537/application/pdf/Springer_CS_Proceedings_Autho r_Guidelines_Jan_2013.pdf Programme Committee General Co chairs Prof. Dr. Erich Schweighofer, University of Vienna Prof. Dr. Kai Rannenberg, Goethe University Frankfurt Mr. Herbert Leitold, A-SIT Dr. Andreas Mitrakas, ENISA Program Committee Luis Antunes University of Porto Paul de Hert VUB Bojana Belamy Centre for Information Policy Roberto Di Pietro Bell Labs Leadership Josep Domingo‐Ferrer Universitat Rovira i Bettina Berendt KU Leuven Virgili Athena Bourka ENISA Prokopios Drogkaris ENISA Pompeu Casanovas UAB Hannes Federrath University of Hamburg Valentina Casola UNINA Mathias Fischer University of Muenster George Christou University of Warwick Lorena González Manzano Universidad Carlos Fanny Coudert KU Leuven III de Madrid Malcolm Crompton IIS Graham Greenleaf University of Sydney José María De Fuentes Universidad Carlos III Dominik Herrmann University of Siegen de Madrid Marko Hölbl University of Maribor Annual Privacy Forum 2017

| | Error! No text of specified style in document. | December 2017

Walter Hötzendorfer Research Institute, Heiko Roßnagel Fraunhofer IAO Vienna Kazue Sako NEC Sokratis Katsikas NTNU Peter Schartner Alpen‐Adria‐Universität Stefan Katzenbeisser TU Darmstadt Ingrid Schaumueller‐Bichl University of Dogan Kesdogan University of Regensburg Applied Sciences Upper Austria Peter Kieseberg SBA Research Stefan Schiffner ENISA Els Kindt KU Leuven Jetzabel Serna University of Frankfurt Sabrina Kirrane WU Wien Florian Skopik AIT Dariusz Kloza VUB Christoph Sorge University of Saarland Stefan Köpsell TU Dresden Morton Swimmer Trend Micro Chris Kuner VUB Christof Tschohl Research Institute, Vienna Gwendal Le Grand CNIL Patrick van Ecke University of Antwerp / DLA Daniel Le Métayer INRIA Jozef Vyskoc VaF Fabio Martinelli IIT‐CNR Edgar Weippl SBA Research Vashek Matyas Masaryk University Stefan Weiss Swiss Re Chris Mitchell Royal Holloway University of Diane Whitehouse IFIP working group 9.2 on London social accountability and ICT Gregory Neven IBM Research Bernhard C. Witt it.sec GmbH & Co. KG Sebastian Pape Goethe University Frankfurt Sven Wohlgemuth Independent Consultant Peter Parycek Danube University Krems Georgios Yannopoulos Law School of the Aljosa Pasic Atos Origin National and Kapodistrian University of Hans‐Jürgen Pollirer Secure Data Athens and Director of the Legal Informatics Joachim Posegga University of Passau Workshop. Charles Raab University of Edinburgh Harald Zwingelberg ULD Schleswig‐Holstein Vincent Rijmen KU Leuven

ENISA

European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

Athens Office

1 Vasilissis Sofias Marousi 151 24, Attiki, Greece PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu