Table Of ContentLuís Antunes · Maurizio Naldi ·
Giuseppe F. Italiano · Kai Rannenberg ·
Prokopios Drogkaris (Eds.)
1
2
Privacy Technologies
1
2
1
S
C and Policy
N
L
8th Annual Privacy Forum, APF 2020
Lisbon, Portugal, October 22–23, 2020
Proceedings
Lecture Notes in Computer Science 12121
Founding Editors
Gerhard Goos
Karlsruhe Institute of Technology, Karlsruhe, Germany
Juris Hartmanis
Cornell University, Ithaca, NY, USA
Editorial Board Members
Elisa Bertino
Purdue University, West Lafayette, IN, USA
Wen Gao
Peking University, Beijing, China
Bernhard Steffen
TU Dortmund University, Dortmund, Germany
Gerhard Woeginger
RWTH Aachen, Aachen, Germany
Moti Yung
Columbia University, New York, NY, USA
More information about this series at http://www.springer.com/series/7410
í
Lu s Antunes Maurizio Naldi
(cid:129) (cid:129)
Giuseppe F. Italiano Kai Rannenberg
(cid:129) (cid:129)
Prokopios Drogkaris (Eds.)
Privacy Technologies
and Policy
8th Annual Privacy Forum, APF 2020
–
Lisbon, Portugal, October 22 23, 2020
Proceedings
123
Editors
Luís Antunes Maurizio Naldi
University of Porto LUMSA University
Porto, Portugal Rome, Italy
Giuseppe F.Italiano KaiRannenberg
LUISS Goethe University Frankfurt
Rome, Italy Frankfurtam Main,Germany
ProkopiosDrogkaris
ENISA
Athens, Greece
ISSN 0302-9743 ISSN 1611-3349 (electronic)
Lecture Notesin Computer Science
ISBN 978-3-030-55195-7 ISBN978-3-030-55196-4 (eBook)
https://doi.org/10.1007/978-3-030-55196-4
LNCSSublibrary:SL4–SecurityandCryptology
©SpringerNatureSwitzerlandAG2020
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartofthe
material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilarmethodologynow
knownorhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication
doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant
protectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthorsandtheeditorsaresafetoassumethattheadviceandinformationinthisbookare
believedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsortheeditors
give a warranty, expressed or implied, with respect to the material contained herein or for any errors or
omissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictionalclaimsin
publishedmapsandinstitutionalaffiliations.
ThisSpringerimprintispublishedbytheregisteredcompanySpringerNatureSwitzerlandAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Preface
With this volume we introduce the proceedings of the 2020 edition of the Annual
PrivacyForum(APF),thattookplaceinLisbon,Portugal.APF2020wasorganizedby
the European Union Agency for Cybersecurity (ENISA), the Directorate General for
Communications Networks, Content and Technology (DG CONNECT), and Católica
University of Portugal, Lisbon School of Law.
Thisconference,alreadyinits8thedition,wasestablishedasanopportunitytobring
together key communities, namely policy, academia, and industry, in the broader area
ofprivacyanddataprotectionwhilefocusingonprivacyrelatedapplicationareas.This
edition coincided with the first evaluation and review of the General Data Protection
Regulation (GDPR). Unfortunately, it also coincided with the global COVID-19 out-
break whichlead theorganizers topostpone theorganizationof theAPFfrom Juneto
later in 2020, in order to ensure the safety of the participants.
There were 59 submissions inresponse to the APF call for papers. Each paper was
peer-reviewedbythreemembersoftheInternationalProgramCommittee(PC).Onthe
basis of significance, novelty, and scientific quality, 12 papers were selected (a 20%
acceptancerate)andarecompiledinthisvolume.Thepapersareorganizedacrossfour
thematic areas, namely:
(cid:129) Impact Assessment (“The Data Protection Impact Assessment as a tool to enforce
non-discriminatoryAI”,“Processingoperations‘likelytoresultinhighrisksforthe
rights and freedoms’ - Lessons to be learned from national authorities’ DPIA
‘blacklists’”, and “Analysing the Impacts of Facial Recognition - Towards a Rig-
orous Methodology”)
(cid:129) PrivacybyDesign(“Privacythroughdatarecolouring”,“PrivacybyDesignIdentity
Architecture Using Agents and Digital Identities”, and “Preliminary remarks and
practicalinsightsonhowtheWhistleblowerProtectionDirectiveadoptssomeofthe
GDPR principles”)
(cid:129) Data Protection and Security (“Webs of Trust: Choosing Who to Trust on the
Internet”,“ItalianNationalFrameworkforCybersecurityandDataProtection”,and
“Operationalization of privacy and security requirements for eHealth IoT applica-
tions in the context of GDPR and CSL”)
(cid:129) Transparency(“Measuringtheusageofpurposesfordataprocessingandtheirlegal
basis in IAB Europe’s Transparency and Consent Framework”, “Towards Trans-
parency in the Internet of Things”, and “Tracking without Traces—Fingerprinting
in an Era of Individualism and Complexity”)
Anyconferenceisthefruitoftheeffortsofmanypeople,andAPFisnoexception.
We wish to thank the European Data Protection Supervisor, for continuing an estab-
lished tradition of supporting the APF and the Portuguese Data Protection Authority.
Further,wewishtothankthemembersofthePC,fordevotingtheirtimetoreviewing
vi Preface
the submitted papers and providing constructive feedback, the authors, whose papers
makeupthebulkofthecontentofthisconference,andtheattendees,whoseinterestin
the conference is the main driver for its organization.
May 2020 Luís Antunes
Maurizio Naldi
Giuseppe F. Italiano
Kai Rannenberg
Prokopios Drogkaris
Organization
Program Committee
Agrafiotis Ioannis ENISA, Greece
Banavara Harsha Signify North America Corporation, USA
Berendt Bettina Katholieke Universiteit Leuven, Belgium
Castelluccia Claude Inria, France
D’Acquisto Giuseppe Garante per la protezione dei dati personali, Italy
Del Álamo José M. Universidad Politécnica de Madrid, Spain
Dell’Amico Matteo NortonLifeLock, France
Dimitrova Diana FIZ Karlsruhe, Germany
Efstathopoulos Petros Symantec Research Labs, USA
Fabian Prasser Technical University of Munich, Germany
Ferreira Ana University of Porto, Portugal
Fischer-Hübner Simone Karlstad University, Germany
Friedewald Michael Fraunhofer, Germany
Gruschka Nils University of Oslo, Norway
Irion Kristina University of Amsterdam, The Netherlands
Jensen Meiko Kiel University of Applied Sciences, Germany
Kalloniatis Christos University of the Aegean, Greece
Kamara Irene VUB, TILT, The Netherlands
Kardasiadou Zoi European Commission, Belgium
Kasem-Madani Saffija University of Bonn, Germany
Katsikas Sokratis Open University of Cyprus, Cyprus
Lambrinoudakis Costas University of Piraeus, Greece
Lauradoux Cedric Inria, France
Le Métayer Daniel Inria, France
Limniotis Konstantinos Hellenic Data Protection Authority, Greece
Malatras Apostolos ENISA, Greece
Mantelero Alessandro Politecnico di Torino, Italy
Mitchell Chris Royal Holloway, University of London, UK
Mitrakas Andreas ENISA, Greece
Moulinos Konstantinos ENISA, Greece
Olejnik Lukasz EDPS, Belgium
Pape Sebastian Goethe University Frankfurt, Germany
Pierce Robin TILT Tilburg Law School, The Netherlands
Polemi Nineta University of Pireaus, Greece
Roßnagel Heiko Fraunhofer, Germany
Schiffner Stefan University of Luxembourg, Luxembourg
Schweighofer Erich University of Vienna, Austria
Silva Fernando CNPD, Portugal
viii Organization
von Grafenstein Maximilian Alexander von Humboldt-Institut für Internet und
Gesellschaft, Germany
Zanfir-Fortuna Gabriela Future of Privacy Forum, USA
General Co-chair
Antunes Luís Filipe Coelho University of Porto, Portugal
Program Co-chairs
Naldi Maurizio LUMSA University, Italy
Italiano Giuseppe LUISS Guido Carli University, Italy
Rannenberg Kai Goethe University Frankfurt, Germany
Drogkaris Prokopios ENISA, Greece
Additional Reviewers
Schunck Christian H. Fraunhofer, Germany
Sanchez-Rola Iskander Symantec, USA
Sellung Rachelle Fraunhofer, Germany
Schmitz Sandra University of Luxembourg, Luxembourg
Karaboga Murat Fraunhofer, Germany
Sellung Rachelle Fraunhofer, Germany
Karkala Smaragda ENISA, Greece
Contents
Impact Assessment
The Data Protection Impact Assessment as a Tool to Enforce
Non-discriminatory AI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Yordanka Ivanova
Processing Operations ‘Likely to Result in a High Risk to the Rights
and Freedoms of Natural Persons’: Lessons to Be Learned from National
Authorities’ DPIA ‘Blacklists’ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Katerina Demetzou
Position Paper: Analyzing the Impacts of Facial Recognition . . . . . . . . . . . . 43
Claude Castelluccia and Daniel Le Métayer
Privacy by Design
Privacy Through Data Recolouring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Giuseppe D’Acquisto, Alessandro Mazzoccoli, Fabio Ciminelli,
and Maurizio Naldi
Privacy by Design Identity Architecture Using Agents
and Digital Identities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Kalman C. Toth, Ann Cavoukian, and Alan Anderson-Priddy
Preliminary Remarks and Practical Insights on How the Whistleblower
Protection Directive Adopts the GDPR Principles . . . . . . . . . . . . . . . . . . . . 95
Rita de Sousa Costa and Inês de Castro Ruivo
Data Protection and Security
Webs of Trust: Choosing Who to Trust on the Internet . . . . . . . . . . . . . . . . 113
Matteo Dell’Amico
Italian National Framework for Cybersecurity and Data Protection . . . . . . . . 127
Marco Angelini, Claudio Ciccotelli, Luisa Franchina,
Alberto Marchetti-Spaccamela, and Leonardo Querzoni
Operationalization of Privacy and Security Requirements for eHealth IoT
Applications in the Context of GDPR and CSL . . . . . . . . . . . . . . . . . . . . . 143
Oleksandr Tomashchuk, Yuan Li, Dimitri Van Landuyt,
and Wouter Joosen
