David Barnard-Wills

In this paper we explore EU data protection authorities' (DPAs) role as leaders and educators, particularly in relation to awareness-raising efforts with Small and Medium-sized Enterprises (SMEs). The GDPR made awareness raising duties of DPAs explicit whilst SMEs face challenges complying with data protection law. We posit that DPAS should make better strategic use of collaboration with SME Associations as intermediaries to better access and understand the needs of SMEs. This collaboration could facilitate dissemination of guidance and information addressed to SMEs. It could also help to overcome concerns expressed by SME representatives about the existing guidance provided by DPAs as being overly generic, focused on legal theory, and in some states arriving too late for implementation. We suggest that by working together SME Associations and DPAs could increase their own working efficiency as well as the one of SMEs. We build our arguments on the findings of an online survey of 52-60 SMEs representatives and semi-structured qualitative interviews with 18 DPAs, 22 SME Association representatives and 11 SME representatives.

Understanding the attitudes of members of the public towards the impact of surveillance technologies used to enhance public security on their privacy is an essential, but complex consideration for policy makers, where public trust plays a central role. Understanding public attitudes involves assessing what public opinion surveys reveal. However, in order to ensure that public attitudes are appropriately being measured across all four concepts (privacy, security, trust and surveillance) it is necessary to consider how existing surveys conceptualise and operationalise these terms. This article undertakes precisely this consideration, in order to evaluate existing practices and provide recommendations for future public opinion surveys on surveillance technologies or practices intended to provide security, but which may impact privacy. We have found three issues relating to past approaches: past surveys do not always adequately define or conceptualise the terms they are employing. Second, surveys sometimes rely on the use of examples in lieu of definitions. Finally, and most importantly, we find that existing surveys do not always adequately examine the impact of the public’s trust towards the use of surveillance technologies to enhance security, but which may affect their privacy.

The EU faces substantive legislative reform in data protection, specifically in the form of the General Data Protection Regulation (GDPR). One of the new elements in the GDPR is its call to establish data protection certification mechanisms, data protection seals and marks to help enhance transparency and compliance with the Regulation and allow data subjects to quickly assess the level of data protection of relevant products and services. To this effect, it is necessary to review privacy and data protection seals afresh and determine how data protection certification mechanisms, seals or marks might work given the role they will be called to play, particularly in Europe, in facilitating data protection. This article reviews the current state of play of privacy seals, the EU policy and regulatory thrusts for privacy and data protection certification, and the GDPR provisions on certification of the processing of personal data. The GDPR leaves substantial room for various options on data protection certification, which might play out in various ways, some of which are explored in this article.

This paper sets out a structured methodology for conducting a societal impact assessment (SIA) of security research and security measure implementation. It first provides an overview of the need for and role of SIA, then presents an account of the existing impact assessment methodologies that have influenced this guide. The paper then describes the core methodology based upon an iterative approach to six key sectors of impact, then provides analytical questions for use in this process, before setting out a step-by-step process guideline. This guideline includes guidance on identifying stakeholders and incorporating best practice in impact assessment. Guidance on the content of an SIA report is then provided. The paper concludes with recommendations as how to best embed such a methodology within the broader security research process. The methodology has particular relevance for security research conducted within the EU.

Using the politics of personal information and online privacy as a case study, this article sets out the justification for the use of games in the education and communication of online privacy issues. It draws upon existing research into privacy knowledge and behaviour, game design for education and the experience of the Visualisation and Other Methods of Expression (VOME) project in designing a privacy education game.

Contemporary art has recently started to engage with surveillance. Before this trend developed art theory had developed a rangeof approaches to understanding identity in art, sometimes borrowing from social, psychoanalytic and political theory. Art work atthe intersection of surveillance and identity tends to focus upon the representation of the human body as subject of surveillanceand bearer of identity. However, contemporary surveillance is data, categorisation and flows of information as much as it isCCTV and images of the person. There are notably fewer works of art that engage with ‘dataveillance’. This paper engages withsuch artwork as a case study for assessing the suitability of contemporary art historical theories of identity to make sense ofidentity in a surveillance society.