Ronald Leenes & Eleni Kosta, Taming the Cookie Monster with Dutch Law – A Tale of Regulatory Failure, CSLR 31 (2015), pp. 317-335

Abstract:
Profiling the online behaviour of Internet users has become a defining feature of the Internet. Individual surfing behaviour is tracked by many enterprises for statistical purposes, but also for behavioural advertising and other personalisation services. Profiling implies the processing of personal data often facilitated by cookies and other markers placed on the terminal equipment of Internet users. The European rules for the regulation of cookies and similar technologies were modified in 2009 requiring prior consent of the user, in order to guarantee that the user has some control over the processing of their information. In 2013 the Netherlands introduced probably the strictest implementation of the European rules concerning the installation of cookies. However, in practice the new legal requirements resulted in neglect of the obligations regarding user information on the one hand and in the widespread deployment of annoying banners, popup screens and ‘cookie walls’ on the other. Not only the advertising industry, but also web publishers and even ordinary Internet users opposed the regulation. Furthermore, the regulation, certainly initially, did not lead to increased user control. These and other factors support the conclusion that the Dutch cookie regulation is a case of regulatory failure. This paper discusses the practices that were deployed in the Netherlands and assesses them based on a multi-site study that examined the practices of 100 Dutch websites with regard to the installation of cookies. It further reflects on the response of the Dutch regulator, who – under the pressure of industry and consumers outcry – amended the relevant provisions of the Dutch Telecommunications Act in 2014.

Preprint:
Leenes, Ronald E. and Kosta, Eleni, Taming the Cookie Monster with Dutch Law – A Tale of Regulatory Failure (March 10, 2015). Forthcoming in CLSR, Vol. 31.2; Tilburg Law School Research Paper. Available at SSRN: http://ssrn.com/abstract=2577233

Ronald Leenes & Federica Lucivero, Laws on Robots, Laws by Robots, Laws in Robots: Regulating Robot Behaviour by Design, in Law, Innovation, and Technology, (2014) 6(2) LIT 194–222, DOI: http://dx.doi.org/10.5235/17579961.6.2.194

abstract
Speculation about robot morality is almost as old as the concept of the robot itself. Asimov’s three laws of robotics provide an early and widely discussed example of the moral rules that robots should observe. Despite the widespread influence of the three laws of robotics and their role in shaping visions of future robo-dense worlds, these laws have been neglected by hands-on roboticists, who have been busy addressing less abstract questions about robots’ behaviour concerning space locomotion, obstacle avoidance and automatic learning, amongst other things. However, robots should not only be able to perform these locomotive and haptic acts to function successfully in society; when robots enter our everyday lives they will also have to observe social and legal norms. For example, social robots in hospitals are expected to observe social rules, and robotic dust cleaners scouring the streets for waste as well as automated cars will have to observe traffic regulations. In this article we elaborate on the various ways in which robotic behaviour is regulated. We distinguish between imposing regulations on robots, imposing regulation by robots, and imposing regulation in robots. In doing this, we distinguish between regulation that aims at influencing human behaviour and regulation whose scope is robots’ behaviour. We claim that the artificial agency of robots requires designers and regulators to look at the issue of how to regulate robot behaviour in a way that renders it compliant with legal norms. Regulation by design offers a means for this. We further explore this idea through the example of automated cars.

Get your preprint copy here.

Martin Gilje Jaatun, Siani Pearson, Frédéric Gittler, Ronald Leenes, to appear in Proceedings of IEEE CloudCom 2014

abstract
In order to be an accountable organisation, Cloud Providers need to commit to being responsible stewards of other people’s information. This implies demonstrating both willingness and capacity for such stewardship. This paper outlines the fundamental requirements that must be met by accountable organisations, and sketches what kind of tools, mechanisms and guidelines support this in practice.

Paulan Korenhof, Jef Ausloos, Ivan Szekely, Meg Ambrose, Giovanni Sartor, and Ronald Leenes (2015), Timing the Right to Be Forgotten: A Study into “Time” as a Factor in Deciding About Retention or Erasure of Data, in: S. Gutwirth et al. (eds.), Reforming European Data Protection Law,Law, Governance and Technology Series 20, Dordrecht: Springer, 171-201, DOI 10.1007/978-94-017-9385-8__7

Abstract The so-called “Right to Be Forgotten or Erasure” (RTBF), article 17 of the proposed General Data Protection Regulation, provides individuals with a means to oppose the often persistent digital memory of the Web. Because digital information technologies affect the accessibility of information over time and time plays a fundamental role in biological forgetting,‘time’ is a factor that should play a pivotal role in the RTBF.This chapter explores the roles that ‘time’ plays and could plain decisions regarding the retention or erasure of data. Two roles are identified: (1) ‘time’ as the marker of a discrete moment where the grounds for retention no longer hold and ‘forgetting’ of the data should follow and (2) ‘time’ as a factor in the balance of interests, as adding or removing weight to the request to ‘forget’ personal information or its opposing interest. The chapter elaborates on these two roles from different perspectives and highlights the importance and underdeveloped understanding of the second role.

pre-print