Complaint lodged by Homo Digitalis against Greece for non-compliance with the EU’s data privacy law addressed to the European Commission

Today, on 30.05.2019, our organisation lodged a complaint (reference number CHAP201901564) before the European Commission against Greece for non-compliance with the EU law on the protection of personal data (Directive 2016/680 and GDPR).

The complaint is related to Directive 2016/680, which regulates the processing of personal data by the national law enforcement authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. According to article 63 of this Directive, Member States shall adopt and publish, by 6 May 2018, the laws, regulations and administrative provisions necessary to comply with this Directive. They shall forthwith notify to the Commission the text of those provisions.

However, Greece has not transposed and adopted such law provisions yet, one year and twenty four days after the end of this deadline. Therefore, Greece breaches the mentioned Article 63

The provisions of the Directive 2016/680 are of the utmost importance for the protection of Democracy and the Rule of Law, as they provide a high level of protection for data subject’s rights against the processing of such data by the police or other national law enforcement authorities. This Directive replaces a very poor legal framework, the Council Framework Decision 2008/977/JHA, which unfortunately had an extremely limited scope (cross-border data exchange between the law enforcement authorities of Member States) and was not striking the right balance between law enforcement authorities’ needs in the course of their investigations and the rights of the people that are at the center of these investigations. As a result the legal principles around the processing of personal data were not respected and data subjects’ rights were noticeably weakened.

Thereby, for the first time, a single European framework that regulates the way the policeman of the neighbouring department, the border guard etc. can process our personal data and clearly provides how we shall exercise our rights to the police or other law enforcement authorities. You can find further information on the Directive 2016/680 here.

Greece by delaying the proceedings of such legislation and the adoption of the necessary provisions at a Member State level deprive data subjects and Greeks from their rights, as enshrined in the paragraphs 12-18 of the Directive, while creates concerns about citizens’ trust in the ways the law enforcement authorities treat their personal data. Specifically, the non transposition of the provisions concerning data protection by design or by default, the non keeping of the records of processing activities, etc. decrease public’s trust concerning the lawful processing of their personal data operated by these authorities.

Furthermore, the complaint raises issues related to the Regulation 2016/679 (GDPR). Specifically, our organisation highlights that despite the fact that GDPR shall be binding in its entirety and directly applicable in all member states, by 25.05.208, the European legislator has transferred important issues at the discretion of Greek legislator. These latter issues are related to the i.e. the minimum age for child’s consent in relation to information society services (article 8), provision for further conditions and restrictions on the processing of genetic and biometric data or data concerning health (article 9), NGO’s right independently of any data subject’s award to lodge a complaint and exercise the rights referred to articles 78 and 79 GDPR (Article 80), penalties for infringements which are not subject to administrative fines (Article 84), the processing of employees’ personal data in the course of their employment (Article 88), and obligations concerning confidentiality (Article 90).

Therefore, Greece without having up to date – one year and five days after the enforcement of GDPR– draft law, creates uncertainty to data subjects and Greeks with regard to the protection of their rights and confusion about the specific issues as mentioned above which are in need of direct implementation.

European Commission will process our complaint within the period of twelve months and will inform us οn its progress.

You can find the proof of our submitted complaint and its full text hereFinally, you can see our organisation’s press release here.


Homo Digitalis participates in major conferences and events in EU and the United States

In May 2019, our organisation had the pleasure to participate in events of high importance in Europe and the United States of America; there we discussed, exchanged points of views and concerns regarding the protection of Human Rights with academics and representatives of important organisations of civil society.

At the beginning of May, we attended  the two-day seminar in Vienna, which was organised by noyb and Access Now under the auspices of Digital Freedom Fund on the implementation of the provisions of GDPR.

In mid-May, we had the pleasure to participate in CopyrightX Summit held by Harvard Law School and its Research Center Berkman Klein Center about the arising challenges in relation to intellectual property rights through the use of new technologies, and to attend the presentation of the investigator’s David Weinberger book “Everyday Chaos”, which concerns the influence of Artificial Intelligence on the development and establishment of modern societies.

We, also, participated in the TILTing Perspectives 2019 Conference, organised by the Research centre of Tilburg Institute for Law, Technology, and Society (TILT) in the Netherlands. This specific three-day conference takes place every two years and is one of the most important academic events for law and new technologies researchers.

At the end of May, we accepted the invitation to attend the international conference “Malta Al and Blockchain Summit”, which brings together a large number of private operators and addresses the recent trends and the new technological advancements in the field of Artificial Intelligence and Blockchain.

May of 2019 was, for sure, a month of major events and meetings, during which common strategies have been designed and cooperations have been forged between our organisation and various well-known private organisations for the future.

Stay tuned for more news!


Interview with ETHNOS about elections and processing of personal data

Homo Digitalis’s Katerina Pouliou sat down for an interview with journalist Mary Tsinou from ETHNOS, the daily newspaper about the processing of personal data during election campaigns!

Read the article and learn more about spams, personal data use -without consent- during the election period, the manipulation of voters through social media, here (in Greek).


Open letter on the implementation of the provisions of the new Directive on Copyright

Today, on 20 May 2019, EDRi and 41 other organisations, Homo Digitalis included, sent an open letter to the European Commission, requesting the organisations’ active inclusion in the implementation process of the newly adopted Copyright Directive, through the upcoming stakeholder dialogue.

Specifically, as provided for in Article 17 para. 10 of the new Copyright Directive, as of 6 June 2019 the Commission, in cooperation with the Member States, shall organise stakeholder dialogues to discuss best practices for cooperation between online content-sharing service providers and rightholders.

Therefore, by today’s open letter, the signatory organisations express their wish to be actively involved in this process, in order to achieve the establishment of a working group that will consist of representatives of organisations who aim to protecting and promoting Human Rights in current digital era. Given the provisions of Article 17, and the challenges deriving from the protection of privacy and the freedom of expression and information on the Internet, the participation of the mentioned organisations is considered necessary within the Commission’s organised dialogues.

You can learn more about the letter in the relevant article of EDRi and see the full text here.


Homo Digitalis at the Greek-French School of Piraeus "Saint Paul"

Today, Homo Digitalis was hosted by the Greek-French School of Piraeus “Saint Paul” and spoke to the students of the Secondary and High school about digital rights.

Specifically, Homo Digitalis conducted a presentation concerning cyberbullying and its consequences to the students of Secondary school and proposed protection ways. In addition to this, Homo Digitalis talked to the students of 1st and 2nd grade of the High school about digital footprints and their rights regarding their personal data.

Mr. Panagiotis Gialis, member of Homo Digitalis explains to the students of Secondary school the consequences of Cyberbullying

The following members of Homo Digitalis have worked for the presentation: Mrs. Mary Mouzaki, Mrs. Anastasia Karagianni,  Mr. Panagiotis Gialis, Mr. Kimonas Georgakis,  Mrs. Maria-Alexandra Papoutsi and Mr. Konstantinos Kakavoulis.

Mr. Konstantinos Kakavoulis, a Saint Paul graduate and founding member of Homo Digitalis, discusses with High school students about protection ways against Cyberbullying

In fact, the members of Homo Digitalis, Mr. Kimonas Georgakis and Mr.Konstantinos Kakavoulis had the pleasure to visiting the school they graduated from, with a completely different role this time.

Mr. Kimonas Georgakis, a Saint Paul graduate, talks to High School students about digital footprint

Mrs. Maria-Alexandra Papoutsi, member of Homo Digitalis explains to the students of the 1st and 2nd grade of the High school the right to access

We would like to thank the Administration of the High School for this invitation! Special thanks go to Mr. Antonis Voutsinos, Deputy General Manager of the school, to Mr. Koutsa, Head of the High school, to Mrs. Stamataki, High School Director, to Mr. Rousso, Deputy Director of the High School, and to Mrs. Lymberi for their impeccable hospitality.

High School Director, Mr. Koutsa, High School Director, Mr. Stamatakis, with the two graduates of Saint Paul and the President of Homo Digitalis, Mrs. Elpida Vamvaka

Stay tuned! There will be more presentations at schools!


Open Letter on the dangers of using deep packet inspection

Today, 15 May 2019, European Digital Rights (EDRi) along with other 45 civil society organizations, academics and private actors from 15 different countries, including Homo Digitalis, sent an open letter to European legislators informing them on the dangers resulting from the extensive use of deep packet inspection technology.

This technology has significant potential for intrusion into user privacy, but mobile operators continue to use it to investigate the content of our communications and to collect information such as the applications we use and the material we see on the internet. By extending zero-rating to almost all EU Member States (except two), companies use this technology to provide packets that give access to only specific services and service providers ( e.g. packets for exclusively Internet use for specific social networking platforms etc).

You can learn more about the open letter in the relevant EDRi article and see the full text here.


How "free" are our choices in the Big Data era? The example of Netflix

Written by Evangelos Farmakidis *

We have just finished the last episode of the new season of our favorite Netflix series and we have decided to go for a walk. Before we turn off the TV and get ready, another series is stirring our interest. It appeared in the trending and in the “choices for you” and it happens to be the kind of series we like. After a quick look we decide to watch only the Trailer to make sure it is to our liking.

Indeed it is! Going-out  is canceled and a new episode marathon (Binge-Watching) begins.

How free are our choices in the era of Big Data?

Did we really want to stay at home and watch a new series or did we want to go out for a walk?

Maybe according to an artistic manner our will is significantly influenced and our decisions guided?

We will try to give a short, simple and understandable answer to the above questions.

The Netflix example is certainly not accidental. It is not as a coincidence the arrival of the new proposed interesting series on the screen of our television.

Netflix today counts 137 million subscribers in 190 countries and owes much of its success to Big Data. The data analysis is a practice the company has implemented since the early years of its establishment, when streaming service was unavailable and Netflix provided its customers exclusively with services such as sending DVDs to their home by regular mail. Studying the preferences of its clients, it proposed films that might be of their interest.

In doing so, it wanted to increase its income while simultaneously facing up the problem that arose whenever a film won an Oscar or a famous film critic wrote an enthusiastic review for a film: the demand for that film was booming and as a result Netflix can’t cope with the rising demand and on the other hand older movies were not chosen by the customers so the company loses more revenue.

So it had to find a way to turn its clients into less famous or older movies. For this reason, it developed a prediction algorithm, which called Cinematch, to propose to its users new movies based on other users’ preferences.

Later, in October 2006, wanting to improve the algorithm’s performance, it launched an open competition, the Netflix Prize. The team, which would be able to improve the algorithm’s results to a satisfactory degree would win a $ 1 million cash prize. That competition drew the attention of the entire global community, brought together more than 40,000 teams of experts (in the fields of mathematics, statistics, information technology, etc.) from 183 different countries around the world.  For that purpose, researchers got access to ratings and reviews 500,000 users of Netflix.

It took three years to achieve the desired result and the prize was finally awarded on 21 September 2009. The winning algorithm was the result of a consortium of 4 teams called BellKor’s Pragmatic Chaos and improved the results of the existing algorithm by 10.06%. Today, the result according to which we receive proposals, exceeded at 85% success rate.

Keeping us busy with a constant stream of suggestions, Netflix manages to renew our subscription every month. If there were not such proposals, it is likely that after the end of the last season of our favorite series, we would cancel our subscription, at least until the new season of our favorite serie is released.

A typical example of Netflix’s personalized commercial practice is the following: To promote its – perhaps most famous – series, which established the company, House of Cards, different trailers with different versions of the same series were shot, but aimed at a different audience groups, depending on their preferences. Thus, each trailer featured a different trailer for exactly the same series, according to their preferences. For example, drama lovers saw a more dramatic version of the series, while adventure lovers saw a more adventurous version of the series etc.

Netflix today process various data from its users, such as age, gender, geographic location, information about their computer or other devices used to access the service, programs they has watched since their registration, days and times associated, the history of their searches, and even the way they scrolled while browsing. It still records every time they pause, go back to re-watch a scene, or pass a boring scene.

In science today, there is no universally accepted definition for Big Data. However, we can say that “Big Data” defines data, regardless of type, that have the following key characteristics: excessive volume, high variety, and high collection speed – even in real time – from multiple sources.

Data mining is the process whereby one obtains useful information through the proper processing of “raw”, unclassified, complex, and large volumes of data previously collected and stored on huge and vast databases.

The informations extracted from data is a powerful “weapon” in the hands of Marketers, who use them to promote products or even design new ones.

Today’s data, during the time of the 4th Industrial Revolution, have the same value as oil for the 2nd Industrial Revolution and steam for the 1st (The world’s most valuable resource is no longer oil, but data ).

As such, Netflix knows which of its programs to recommend us, but it also supports the production of new programs based on the preferences and habits of its users. Knowing exactly what its users prefer, it produces programs that are almost a success before they even turn around.

The use of these marketing methods is by no means reprehensible, neither it is, of course, the intention of the writer to condemn Big Data, which prove to be very useful in many areas of our life beyond commercial activity, such as in Medical Science.

On the other hand, the benefits for the informed consumer are numerous, as he is given the opportunity to make the right choices which will be to his liking and suit his needs while saving time and money.

The European Union has already recognized the value of personal data since the mid-1990s and has set up a specific legislative framework to facilitate their free flow and to protect the residents of its member states. Its last major legislative initiative is the adoption of the General Data Protection Regulation or more commonly known as GDPR. It should be noted that the new ePrivacy Regulation is expected to address, including other and the processing of personal data in electronic communications.

The importance of big data for the modern economics and the science of Marketing is unquestionable. After all, as Dan Zarrella has rightly pointed out, “Marketing without data is like driving a car with your eyes closed”.

However,  consumers do need to be aware in order these practices to serve their interests , not by influencing their will, manipulating their decisions and defining their lifestyles.

Bibliografy

    • Mareike Jenner, (2018), Netflix and the Re-invention of Television. Palgrave Macmillan.
    • Pant V., Yu E., (2018), Conceptual Modeling to Support the “Larger Goal” Pivot – An Example from Netflix. In: Buchmann R., Karagiannis D., Kirikova M. (eds) The Practice of Enterprise Modeling. PoEM 2018. Lecture Notes in Business Information Processing, vol 335. Springer, Cham.
    • Kai-Ingo Voigt, OanaBuliga, Kathrin Michl, (2017), Entertainment on Demand: The Case of Netflix. In: Business Model Pioneers, Springer International Publishing.
    • Jenkins J., (2017), Netflix. In: Schintler L., McNeely C. (eds) Encyclopedia of Big Data, Springer, Cham
    • Roberts R., (2017), Live TV, Netflix, Amazon, the Universe!In: Mastering Media with the Raspberry Pi. Apress, Berkeley, CA.
    • McDonald K. & Smith-Rowsey D., (2016), The Netflix effect: Technology and entertainment in the 21st century. London: Bloomsbury Academic.
    • Amatriain X., Basilico J., (2015), Recommender Systems in Industry: A Netflix Case Study. In: Ricci F., Rokach L., Shapira B. (eds) Recommender Systems Handbook. Springer, Boston, MA.
    • Mary J. Cronin, (2014), Netflix Switches Channels. In: Top Down Innovation, Springer International Publishing.
    • Keating, Gina, (2012), Netflixed: The Epic Battle for America’s Eyeballs. Portfolio/ Penguin.
    • Robert M. Bell, Yehuda Koren& Chris Volinsky, (2010), All Together Now: A Perspective on the Netflix Prize. CHANCE, 23:1, 24-29.
    • S. Finlay, (2014), Predictive Analytics, Data Mining and Big Data, Palgrave Macmillan UK.
    • Min Chen, Shiwen Mao, Yin Zhang, Victor CM Leung, (2014), Big Data: Related Technologies, Challenges and Future Prospects, Springer International Publishing.
    • Hrushikesha Mohanty, PrachetBhuyan, Deepak Chenthati, (2015), Big Data: A Primer, Springer India.

* Evangelos Farmakidis is a member of Homo Digitalis, trainee lawyer,  graduate of Master of Science in “Law and Informatics” of the Department of Applied Informatics, of the University of Macedonia and the Law School, Democritus University of Thrace, postgraduate student of Criminal Law and Forensic Sciences of Law School, Democritus University of Thrace, holder of a Diploma in Social Economy and Social Entrepreneurship and Accredited Ombudsman of the Ministry of Justice, Transparency and Human Rights.


Concept Note to the United Nations Committee on the Rights of Children

Today, Homo Digitalis responding to the invitation of the UN Committee on the Rights of the Child (‘CRC’) submitted Concept Note on children’s rights in relation to the digital environment.

The note will be used by the CRC in the adoption of the General Comment on children’s rights in relation to the digital environment.

You can read the note in English here.


How to create and use powerful passwords

Written by Vyron Kavalinis *

On the web, it is widespread that a website needs the user’s registration to display its content or provide its service or even allow to comment on an article. The registration of the user, and consequently, the account creation requires the use of a username and a password.

The username will need to be unique and no longer linked to the page itself to create the required account while the username and password combination proves the user’s identity and the correct completion give them access to the content of your page. Even in our email, if we want to sign in we will need a username (usually our email address) and a password.

The password is usually a combination of letters, symbols and numbers. The use of strong passwords is necessary to protect the user’s security and identity. An easy password is more likely to be guessed by someone else and therefore has access to our personal data.

Initially, an easy password is short. The bigger the password is, the harder  is to be guessed by someone, and the resulting combinations are much more. From researches into millions leaked passwords, it has been revealed that combinations and selections preferred by users are very easy and are in the form “123456”, “password”, “football” and other simple words that we all use in our everyday life, and it is therefore easy for a  third person to guess and find.

It is also worth mentioning the fact that a large number of users use the same password on all the pages they need to link. So if someone knows our email or our username then with a single password they can have access to all the pages we have an account, whether this page is our bank’s account or a shop that we are buying or even our own profile on Facebook.

The best way to increase security levels is to create more complex passwords. It is recommended that the password be long, usually over 12 characters, and be sentences that the user can easily remember.

A good way is the use of Online tools, which add words at random and create sentences for their use as passwords or setting up codes in accordance with some options determined by the user. In the text that follows we shall refer to some examples of such tools that you can use.

It is worth mentioning that a password with at least 12 characters can take few centuries for an invader to break it. In the current computer capacities and with the simultaneous use of many of them, this time might not be actual but still is so much to break. For example, according to researches that have been carried out, a supercomputer (having an efficiency as 100 computers at the same time) can break a 10-character password in 3 years.

It is not recommended to use the same password in every web site and application as also to not write down the passwords on simple text files or notebooks.

Moreover, the use of symbols and numbers  can really help as the password becomes more complicated and therefore more difficult for a third person to find it.

The use of password generators is a very good solution since the most enable the user to set the parameters of the password and to create one, ready for use. Generators’ use is very helpful as if necessary for a web site to use capital symbols and small will create a more complex password. For example in that case a human would allocate a password “Letmein!123”, while a password generator would allocate “lwIXgHeaWiq”. The second choice is more difficult to find even if it doesn’t include special characters and symbols.

The use of password generators doesn’t require specific and specialised knowledge from the user, while there are many online tools that can be used for the creation of our passwords. We can show you online password generators that you can use:

Strong password generator (https://www.strongpasswordgenerator.com/). It gives the opportunity to define the length of the code and also some options of configuration, like the use of “voice words”. With the use of voice words actually the generator shows the letter and number combination in words so the passwords be more memorable.

Norton Password Generator (https://my.norton.com/extspa/idsafe?path=pwd-gen|). Norton, known in the field of safety has set up an online tool for the creation of passwords. This specific tool gives many options as the choice of the length of the code and the use of capitals, symbols and numbers.

XKpassword (https://xkpasswd.net/s/). XKpassword is probably one of the few, who offer so many options for the creation of the password. A feature differentiating it from the majority of password generators is the selection of provider according to the rules of which the password will be created. Some of these examples are according to the frameworks of AppleID, WiFi etc.

Finally, we would recommend the use of password managers for the storage and the management of your passwords. Password managers are substantially programs, which manage your passwords and store them coded in order to be understood by someone other. Through the use of this programs you just need to know one password and this is your access code to your password manager.

With the use of password managers you don’t have to remember your passwords by heart, as they have addons for every known browser, that when you enter to a web site they immediately recognise through the relevant form and give you the possibility of automatic completing.

Some password managers, also authorise the automatic completion with random passwords when registering and their automatic storage.

Since there is the possibility for somebody to intercept the password from the password manager and therefore to have access to the others, many from password managers provide also extra safeguards in the event of unusual mobility.

One of the most well-known password managers is the LastPass and the 1Password. Both provide the possibility of free use, while upon payment subscription they unlock more options and functions. Both have admins for Chrome, Mozilla, Opera and operate with Windows, Linux and MacOS. It is also noteworthy that if you take notice that your main code has been intercepted you can request for your account to be deleted, while 1Password recognises the device with which you are connecting and if you wish to connect from a new one you have to complete the master password you have been given after your registration to the application automatically.

We shall mention that there have been notified various safety lapses in password managers. Despite all these, each and every company immediately takes all the necessary steps to fill these gaps and increase the safety of their services. Even after of those notifications their use is considered to be more safe than the storage of passwords within a simple file, which will not contain any type of encryption.

Homo Digitalis has no interest in suggesting the above tools. We recommend you use these tools as safe alternatives given the wide variety of such tools. It shall be noted that many of these tools might have as objective to intercept your data. Therefore, we recommend you be very careful when you are using such tools.

* Viron is a graduate from the Department of Informatics Engineering, TEI Crete. He works for a company, which operates in the field of Web hosting and domain names. He deals with the development of web sites and safety. In the past he has undertaken SSL certificates.