master_admin

By Anastasia Karagianni

The murder of the 21-year old Eleni at Rhodes urged the Greek society to finally face the real “scale” that rape can reach. Rape is not only the sexual contact without the consent of the other person. It is the force to sexual intercourse, the physical violence or a serious and imminent threat, that are undertaken to commit this inadvertent sexual intercourse. Rape can result in death, as we have seen.

Nevertheless, sexual harassment exists also in the digital world. How? In recent times it takes place due to personal data breach. Specifically, studies show that 4% of the adolescents aged 12-17 admit that they have sent sexual messages, which depicted them naked or half-naked, to other users, and 15% of the adolescents confess that they have received such material. This is called “sexting”, namely, the exchange of photographs and messages with mainly sexual content using applications installed in smartphones or other electronic devices. However, sometimes the exchange of these messages is carried out without the consent of the depicted person. In this case, the right to privacy of the person depicted is violated.

What are these personal data? Personal data are information related to a person. They might contain “sensitive” or “non-sensitive” information. This information is becoming personal when connected, directly or indirectly, with the specific person. It therefore concerns different information, which, if gathered together, can lead to identification of an individual. This information, therefore, characterize the biological, physical and mental existence of the person as well as its social, political, financial and cultural existence. In this connection, because of the sexual content of the message, the naked/half-naked picture of the person is considered personal data, as it concerns the user’s sex life.

But how can the infringement of personal data lead to sexual exploitation? Since a picture appears in the internet, it is difficult to control its circulation. In most cases, these photographs are sent within the framework of a confidential relation between the sender and the recipient. So far, this does not create any problem. Problems arise when this relationship is harmed or based on false information. The circulation of this material in a secondary level without the consent of the person depicted, and several times without him/her knowing, to other users, constitutes an infringement of his/her priveacy and violation of his/her sexual integrity, when it takes place in view of leacher acts, and the trafficking of pornographic material.

About two years ago, Lina, 22-years old, committed suicide, falling from the ninth floor of her Student Residence in Thessaloniki. A prosecutor’s investigation has been ordered in order to make an online investigation for traces of possible criminal behaviour for observation, retention and processing of personal data, threats via the Internet for action or tolerance and committing felony association, as it seems that the girl regularly received threats that her personal pictures would be published on the Internet.

The New Regulation for the Protection of Personal Data of the European Union safeguards the right to be forgotten , the right to information and access to data, the right to correction and to objection against their processing.

The Greek legislation and the case-law provides a high level of protection. It only remains to be understood from us.

*If you face problems on the Internet and you are under 18 years old, call 2106007686. Trust the helpline of the National Centre for Safe Internet.

Today, Wednesday 5 December 2018, in view of the upcoming meeting of the Council of Justice and Home Affairs of the European Council (6-7 December), 18 organizations sent a letter to all the EU Member States, putting forward their vivid concerns regarding the approach suggested by the Austrian Presidency in the draft Regulation on European production and preservation orders for electronic evidence in criminal matters (“e-evidence”).

Among these organizations are EDRi, Electronic Frontier Foundation, the Council of Bars and Law Societies of Europe – CCBE, Access Now, Privacy International and many national digital rights organizations, including Homo Digitalis.

We believe that the solution proposed by the Austrian Presidency do not manage to adequately address important issues, which arise from the legislation in question. For example, the text:

– greatly reduces the possibility for enforcing authorities to refuse recognition and enforcement of an order on the basis of a violation of the Charter of Fundamental Rights;

– wrongly assumes non-content data is less sensitive than content data, contrary to case law of the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR) – notably the CJEU Tele 2 judgment (cf. para.99) and the ECtHR’s case Big Brother Watch and others v. UK (cf. para.355-356);

– contemplates the possibility to issue orders without court validation, disregarding what the CJEU has consistently ruled, including in its Tele 2 judgment (para. 120).

– does not provide legal certainty; and

– undermines the role of executing states, thereby undermining judicial cooperation.

Similar views have been expressed by the European Data Protection Board (EDPB), judges such as German Association of Judges, companies like Internet Service Providers, academia, Bar Associations, the Meijers Committee, among many others.

In the national level, Homo Digitalis submitted today its letter to the Greek Ministry of Justice (Protocol no. 4568/5.12.2018), expressing its concerns for these provisions.

You can find a copy of our letter in Greek here.

You can learn more on the action in the European level here.

Today, 4 December, EDRi, Access Now, APTI, EFN, Epicenter.works, Open Rights Group, Privacy International and Homo Digitalis sent a joint letter to the National Assembly of the Republic of Serbia, requesting a transparent procedure regarding the appointment of the new Data Protection Commissioner of the country.

This is the second action in the Balkans in which Homo Digitalis takes part in, aiming at the provision of adequate safeguards for human rights in the contemporary digital age.

The letter is available here.

On November 27, 2018 the Norwegian Consumer Council filed a complaint against Google. Based on a new study, Google is accused of using deceptive design and misleading information to manipulate its users.

More particularly, Google is accused of tracking users through “Location History” and “Web & App Activity”, which are settings integrated into all Google accounts.

For the users with Android software, such as Samsung and Huawei smartphones users, it is extremely difficult to avoid this tracking.

According to the complaint, some of the techniques used by Google to push the users to share their location are:

Deceptive click-flow: The click-flow when setting up an Android device pushes users into enabling “Location History” without being aware of it. This contradicts legal obligations to ask for informed and freely given consent.

Hidden default settings: When setting up a Google account, the Web & App activity settings are hidden behind extra clicks and enabled by default..

Repeated nudging: Users are repeatedly asked to turn on “Location History” when using different Google services even if they decided against this feature when setting up their phone.

Google’s intention is to elicit users’ consent, so that users agree on being constantly tracked, thus revealing very important aspects of their personalities! Which are these aspects?

What does Google know exactly? Does Google know, for example, if you are in your living room, your bedroom or even your toilet? How many times per minute does it track you? When you take a cigarette break at work is Google there with you? Does Google know when you are on a date? Does it know your religious beliefs? Your health history? Learn more about all these in the official video by the Norwegian Consumer Council. More information can be found here.

By Ιason Chontzopoulos* and Konstantinos Kakavoulis

When we visit a website for the first time, the following message appears “this website uses cookies to ensure you get the best experience”.

But what are these famous cookies? Do they really improve our experience on the internet? And if so, do they do so with no cost?

What are cookies?

They are small files with information, created by websites while we visit them. They are equivalent to short text files, in which the information is usually codified, or has an ids form, so it does not appear to be coherent, when a human reads them. These files and the information they contain, are created by the computer, in which the server operates. Each website uses only the cookies that it has created itself.

How are cookies used?

They serve to add functionality to the websites we visit. For example, they are used for a website to recognise us. Since they are created by the website, they do not include personal information.

They usually recognise the browser we have used during our previous entry. The principle on which the websites are based is that each of our clicks is independent from the previous one. Cookies were created to denote the continuous relation between the two clicks (on the same site).

Are there different types of cookies?

Yes! We can distinguish cookies according to their functionality, in simple cookies, session cookies and tracking cookies.

1) Simple cookies serve as information storage. Online retailers use such cookies just to remember the products that we have already chosen to buy. Other information could be the technical characteristics, statistics related to how many times we have visited the website, which language we choose, which page layout we prefer etc.

2) Session Cookies: the most common are the authentication cookies, that help to identify our profile, as we previously mentioned. According to their application, they can have a limited duration (temporary cookies). Usually we can find temporary cookies in the website of banks, which expire for safety reasons after a fixed period and we have to re-insert our particulars.

In other cases, the option “Remember Me” or “Keep me Logged in”, sets them active until we explicitly choose to disconnect (permanent cookies).

It is noteworthy that authentication cookies constitute an essential privacy element on the internet and they are always dispatched codified. There are also technologies that can increase the certification’s safety and reliability and operate at the same time with cookies.

3) Lastly, there are tracking cookies. The third-party tracking cookies constitute the most frequently disputed tracking cookies category, as they focus on the service’s improvement apart from those, which are offered from the website. Advertising is included in these services. Cooperating websites obtain the right to use cookies, so as to collect information related to our Internet surfing behaviour. The fact that third services, besides the website itself, can install cookies extend their use beyond the prime reason for which cookies have been created; this is obviously the improvement of the services of the initial website and is served by the simple cookies and the authentication cookies.

There are tools that help us check the information flow we share through cookies. We can see below one of these tools, where the shared information is recorded in cooperating undertakings.

Does this seem complicated? You should try this tool to find out live with whom you share each click at any time!

So, do cookies target me?

As we mentioned above, usually cookies aim at recognising the browser we use and our IP address. Cookies rarely contain personalised characteristics, which indicate the user’s identity. The combination of these specific elements with other sources may be used for the identification of natural persons; for this reason the functioning of cookies is regulated by legislation.

What does the legislation provide for cookies?

The EU General Data Protection Regulation (GDPR) includes a provision concerning cookies.

Specifically, Recital 30 of the Regulation, provides:

“Natural persons may be associated with online identifiers […] such as internet protocol addresses, cookie identifiers or other identifiers […]. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.”

In simple terms, if cookies can identify a natural person, they are subject to GDPR. Of course not all cookies can identify a person, but most of them -if combined with third sources- can.

For websites to be compatible with the GDPR and not be at risk of being fined under its provisions, they must either stop collecting cookies, which can identify a natural person, or establish an adequate and lawful reason for the collection and the processing of such information.

Significant changes that the GDPR brought in cookies use

1) Tacit consent in cookies use is no longer sufficient. The website user must explicitly provide his/her consent to cookies installation from the website. This is the reason why the messages we mentioned at the beginning of the article, are displayed each time we visit a new website. These messages may seem merely embarrassing, at first sight, but having read this article, you should have a second thought before you click “I accept” next time.

2) The message “By using this website, you agree in the use of cookies” is not sufficient. User’s granted consent must be genuine and consistent with his free will; the user should really have the choice not to accept the cookies installation.

3) The user must have the possibility to withdraw his/her consent as easily as he/she provided it. Therefore, websites must give users the possibility to change their mind and change their original choice at any time, by offering them easy and rapid access in the relevant menu – equally easy and rapid with the one they had when they first visited the website.

What can I do if a website does not comply with the above obligations relating to cookies?

Take a look at the guide that Homo Digitalis has prepared on what you can do and to whom you can address if you face problems with the processing of your personal data. You have to follow the same steps in case a website infringes the legislation on cookies.

Can a website function without cookies?

Cookies obviously multiplied the possibilities of websites and in many cases increased their safety.

Their use is clearly a design choice for each website, but the use of certain cookies has purely technical nature. An example is the online shops we previously mentioned.

Cookies with technical nature are necessary. Websites are accessible through various devices and browsers. The various devices and browsers require particular treatment for technical reasons; therefore, the use of simple cookies with technical data is considered necessary. In this way, the website’s layout changes so as to fit in requisite needs, as for example the adaptation of the website to mobile phones and small screens.

This does not apply to tracking cookies. The use of tracking cookies has attracted world-wide interest in recent years, in particular related to the purpose for which the collected data is exploited. For this reason, the legislation aims to help cookies’ use come into open, giving rights and an option for users to choose. At the same time, it requires transparency in the use of cookies by companies and provides for large fines, in order for companies to comply with their obligations.

Homo Digitalis, faithful to the values it represents, does not place cookies at its website visitors’ devices, in order to analyse the effectiveness of the design and the presentation of our website or identity its visitors (tracking cookies).

We don’t, therefore, make notes of your activity in our website. The only cookie that our website uses is called PHPHSESSID.

This specific cookie cannot identify any natural person and does not note user’s personal data. It is only of technical nature, serving the server’s function.

*Ιason Chontzopoulos is a data scientist based in Zurich. He is an electrical and computer engineer, having studied in National Polytechnic School of Athens and ETH Zurich.

*Source of the main photo: https://www.howtogeek.com/327268/why-do-some-websites-have-pop-up-warnings-about-cookies/

By Anastasia Karagianni*

Social media platforms offer to everyone the opportunity to connect and express freely their opinion and stay informed. In this way, information flows continuously, as it should be. Information though sometimes can be dangerous. The commonly said Hate Speech, according to the European legislation, could be defined as “every form of expression that disseminates, actuates, promotes or justifies racism, xenophobia, anti-semitism and other forms of hate that are based on intolerance, including the one that is expressed through the excessive nationalism and ethnocentrism, the discrimination and hostility towards minorities and the immigrants”.

A context that can define a hate speech action could be based on the character and the popularity of the speaker, the audience’s emotional situation, the content of the action itself as instigation of hatred, the social frame in which the action is manifested and the manners used for its dissemination, including the adopted language. The European Union Council Framework Decision 2008/913/JHA, issued on 28th of November 2008 concerning the elimination of racism, xenophobia and their interaction with the freedom of speech, according to which the national cooperation between the member countries is performed, mostly in article 1 paragraph 1, article 3 and article 4, played a decisive role in hate speech confrontation.

However, a conflict between human rights in the context of hate speech emerges sometimes. Specifically, according to the special regime for children’s protection, which is established in Europe Union, the article 2 of United Nation Convention on the Rights of Children about the welfare of the children is opposed to the article 13 about freedom of information. Thus the freedom of expression and speech seem to conflict with the protective measures will confine children’s access to some activities not the internet. Despite this conflict, children’s protection and the freedom of speech converge at the necessity for protection of the fundamental human rights, which are based on the fundamental values of human autonomy and dignity.

For the purpose of addressing hate speech on the internet, the European Commission agreed with Facebook, Microsoft, Twitter and Youtube on May 2016 and later on 2018 with Instagram, Google, Snapchat and Dailymotion on the adoption of a Code of Conduct, in order for these platforms to offer the opportunity for users to report hate speech incidents, by enforcing social support and coordination with the national authorities. They also agreed to submit users’ notifications according to the European and national legislation regarding hate speech and they committed themselves to extract, if necessary, the notifications assessed against the law.

Nevertheless, different risks possibly need different measures. Sonia Livingstone observes a distinction between the risks for children’s protection, detecting four types of risks: the commercial, the risk of attack or violence against children, risk of sexual abuse, exploitation etc against them and the risks that affect values, as hate speech. These risks are further distinguished according to children’s susceptibility to them: as recipients, as participants and as offenders. Both distinctions highlight the importance of a child-friendly policy making.

Such a policy is detected in articles 6 and 8 of the New Regulation on the Protection of Personal Data (GDPR), as in its Preamble 58. In more detail, in articles 6 and 8 GDPR, the Commission introduces paternal consent or consent from those with the parental responsibility as a way to legitimise the processing of children’s personal data on the internet. The age of 13 is the limit, which dictates if the processing of children’s personal data will be subject to less legal restrictions.

In practice, in this way, children are divided in two age groups: children who are able to give their consent in processing their personal data between 13-16 years of age, and the children who are dependent on paternal consent for their behaviour on the Internet, between 0 to 3 years. The establishment of such a strict line is in conflict with the stages of children’s physical and social development. In further, the paternal consent must be addressed each time from a legal standpoint, whether the proposed measure, in the present case, is proportional and if it reconciles with the framework of human rights.

Paternal consent is opposed, in some cases, with the children’s right to participate in the decision-making process relating to them, a right protected in the United Nations Convention on the Rights of the Child and also safeguarded in the European Union and its Member States. The child’s right to freedom of expression and to private life could be undermined in case that children’s access to information will be restricted and depended on parents. Furthermore, the scope of their right to privacy is shrinking, as parents will have to interfere in children’s privacy to make the corresponding decisions, for example the profile creation in social media. Accordingly, it is observed that paternal consent, occasionally infringes the fundamental principles of human right’s law established by the Convention.

Even so, the role of parents is undoubtedly important and determining for the protection of the child. Despite the fact that they are “children of the digital age”, they don’t have complete digital skills. According to a recent study of EU Kids Online, even though 43% of the children believe that they know more for the internet than their parents, they do not possess digital skills, such the blocking of an unwanted communication, the change of privacy settings in social media and the critical assessment of the information they have access to.

To sum up, social media platforms are among the most important players in the online marketplace. Their business model is based on the processing of users’ personal data. A huge and active part of them is children, which are dependent on the presence of these large companies in their everyday life and develop a strong consuming relation with them. The existence of these Codes of Conduct is really important, as it adds to the existing legal provisions and offers a high level of safety. Equally important is the use of social media for the children’s personal and social development. Thus, a fair balance must be found between freedom of expression and children’s protection.

* Anastasia Karagianni is a lawyer, specialising in children’s digital rights. She is a member of Homo Digitalis and co-creator of ChildAct with the aim of protecting children’s digital rights. On the 8th of November she represented Homo Digitalis in the session on “Facebook and other social risks”, which took place in the European Parliament.