Frederik Zuiderveen Borgesius

When reviewing a job application letter, going on a first date, or considering doing business with someone, the first thing many people do is entering the person's name in a search engine. A search engine can point searchers to information that would otherwise have remained obscure. If somebody searched for the name of Spanish lawyer Mario Costeja González, Google showed search results that included a link to a 1998 newspaper announcement implying he had financial troubles at the time. González wanted Google to stop showing those links and started a procedure in Spain. After some legal wrangling, the Spanish Audiencia Nacional (National High Court) asked the Court of Justice of the European Union (CJEU) for advice on the application of the Data Protection Directive, which led to the controversial judgment in Google Spain. In its judgment, the CJEU holds that people, under certain conditions, have the right to have search results for their name delisted. This right can also extend to lawfully published information.

In the EU, the General Data Protection Regulation and the ePrivacy Directive mandate informed consent for behavioural advertising and use of tracking technologies. However, the ubiquity of consent banners and popups has led to widespread consent fatigue and questions regarding the effectiveness of these mechanisms in protecting users' data. In contrast, users in California and other US jurisdictions can utilize Global Privacy Control (GPC), a browser-based privacy signal that automatically broadcasts a legally binding opt-out request to websites. In this paper we explore whether, and to what extent, GPC can be adapted to the EU legal framework to mitigate consent fatigue and improve privacy protections for EU residents.We analyse GPC as a technical specification standardized at the World Wide Web Consortium and examine its standing under current EU data protection law. Generally, GPC can be mapped to the various legal bases for processing under the GDPR. However, our evaluation also identifies friction between the GPC specification and EU data protection law as it stands. These discrepancies are resolvable and present an opportunity for EU legislators and regulators to interpret GPC in alignment with EU data protection requirements, particularly, considering the European Commission’s recent Digital Omnibus proposal. We conclude that while GPC is not a silver bullet, its adoption—supported by clear authoritative guidance and specification updates—can offer a pragmatic path toward more automated and effective data protection in the EU.

Employers are adopting algorithmic hiring technology throughout the recruitment pipeline. Algorithmic fairness is especially applicable in this domain due to its high stakes and structural inequalities. Unfortunately, most work in this space provides partial treatment, often constrained by two competing narratives, optimistically focused on replacing biased recruiter decisions or pessimistically pointing to the automation of discrimination. Whether, and more importantly what types of , algorithmic hiring can be less biased and more beneficial to society than low-tech alternatives currently remains unanswered, to the detriment of trustworthiness. This multidisciplinary survey caters to practitioners and researchers with a balanced and integrated coverage of systems, biases, measures, mitigation strategies, datasets, and legal aspects of algorithmic hiring and fairness. Our work supports a contextualized understanding and governance of this technology by highlighting current opportunities and limitations, providing recommendations for future work to ensure shared benefits for all stakeholders.

This brief paper provides an introduction to non-discrimination law in Europe. It answers the questions: What are the key characteristics of non-discrimination law in Europe, and how do the different statutes relate to one another? Our main target group is computer scientists and users of artificial intelligence (AI) interested in an introduction to non-discrimination law in Europe. Notably, non-discrimination law in Europe differs significantly from non-discrimination law in other countries, such as the US. We aim to describe the law in such a way that non-lawyers and non-European lawyers can easily grasp its contents and challenges. The paper shows that the human right to non-discrimination, to some extent, protects individuals against private actors, such as companies. We introduce the EU-wide non-discrimination rules which are included in a number of EU directives, and also explain the difference between direct and indirect discrimination. Significantly, an organization can be fined for indirect discrimination even if the company, or its AI system, discriminated by accident. The last section broadens the horizon to include bias-relevant law and cases from the GDPR, the EU AI Act, and related statutes. Finally, we give reading tips for those inclined to learn more about non-discrimination law in Europe.

In April 2021, the European Commission proposed a Regulation on Artificial Intelligence, known as the AI Act. We present an overview of the Act and analyse its implications, drawing on scholarship ranging from the study of contemporary AI practices to the structure of EU product safety regimes over the last four decades. Aspects of the AI Act, such as different rules for different risk-levels of AI, make sense. But we also find that some provisions of the Draft AI Act have surprising legal implications, whilst others may be largely ineffective at achieving their stated goals. Several overarching aspects, including the enforcement regime and the risks of maximum harmonisation pre-empting legitimate national AI policy, engender significant concern. These issues should be addressed as a priority in the legislative process.

In 2020, a Dutch court passed judgment in a case about a digital welfare fraud detection system called Systeem Risico Indicatie (SyRI). The court ruled that the SyRI legislation is unlawful because it does not comply with the right to privacy under the European Convention of Human Rights. In this article we analyse the judgment and its implications. This ruling is one of first in which a court has invalidated a welfare fraud detection system for breaching the right to privacy. We show that the immediate effects of the judgment are limited. The judgment does not say much about automated fraud detection systems in general, because it is limited to the circumstances of the case. Still, the judgment is important. The judgment reminds policymakers that fraud detection must happen in a way that respects data protection principles and the right to privacy. The judgment also confirms the importance of transparency if personal data are used.