Privacy Technologies and Policy: 10th Annual Privacy Forum, APF 2022, Warsaw, Poland, June 23–24, 2022, Proceedings (Security and Cryptology)

This book constitutes the refereed conference proceedings of the 10th Annual Privacy Forum, APF 2022 in Warsaw, Poland in June 2022. The 8 full papers were carefully reviewed and selected from 38 submissions. The papers are organized in the area of privacy and data protection while focusing on privacy related application areas. A large focus of the 2022 conference was on the General Data Protection Regulation (GDPR). Preface Organization Contents Users’ Rights A Generic Data Model for Implementing Right of Access Requests 1 Introduction 1.1 The GDPR and Article 15 1.2 State of the Art 1.3 Goals 2 Requirements 3 Data Request Model 3.1 Initiation Interface 3.2 Authentication 4 Response Data Model 4.1 Article 20 Related Challenges 4.2 Exploring a Traceable Data Trail 4.3 Required Classes 4.4 Building a Data Request Result 5 Process and Evaluation 6 Conclusion and Future Work References Can Authoritative Governments Abuse the Right to Access? 1 Introduction 2 How are Subject Access Requests Authenticated? 2.1 Dashboard Versus DPO 3 Threat Model and Known Attacks 4 Advanced Forgery Attacks 4.1 Impact Assessment 4.2 Ethical Considerations 5 Countermeasures 6 Conclusion References Security of Personal Data The Data Protection Implications of the EU AML Framework: A Critical Overview & the Case of AI 1 Introduction 2 AML/CTF Framework: An Overview of the Challenges 3 Specific Data Protection and AML Challenges 3.1 AML Data Protection Provisions 3.2 Processing of Certain Categories of Personal Data for AML/CFT Purposes 3.3 Proportionality and Risk-Assessment 4 AI-Based AML/CFT Solutions: Raising the Stakes 4.1 Outsourcing and Article 22 GDPR 4.2 AIA Proposal 5 Conclusion: Resolving the Tension References Data Protection and Machine-Learning-Supported Decision-Making at the EU Border: ETIAS Profiling Under Scrutiny 1 Introduction 2 The ETIAS System 3 Machine Learning in ETIAS 3.1 Machine Learning in a Nutshell 3.2 Potential Use of AI in ETIAS 4 Interferences with Fundamental Rights 5 ML-Trained Models in ETIAS Under EU Data Protection Law 5.1 Applicable EU Data Protection Provisions 5.2 Human Oversight 5.3 The Rights of Information and Access to the Decision-Making Logic 5.4 Data and Profiling Model Accuracy 5.5 Supervision and Enforcement 6 Conclusion and Future Work References Privacy Enhancing Technologies Application-Oriented Selection of Privacy Enhancing Technologies 1 Introduction 2 Classifying PETs 2.1 Motivating Example 2.2 Criteria 2.3 Classification 3 Use Case and Discussion 3.1 Use Case 3.2 Discussion 4 Related Work 4.1 Privacy by Design 4.2 Systematization of PETs 5 Conclusions References Fifty Shades of Personal Data – Partial Re-identification and GDPR 1 Introduction 2 An Attacker Model 3 Cost-Benefit Considerations 4 Discussion 5 Conclusions and Future Work References Privacy Engineering Google and Apple Exposure Notifications System: Exposure Notifications or Notified Exposures? 1 Part I: The Exposure Notifications System 1.1 The Exposure Notifications System Within the Strategy of Tackling COVID-19 1.2 EN Contractual Terms VersusData Protection Law: 2 + 2 = 5? 2 Part II: Legal by Design and Legal Protection by Design 2.1 Legal by Design 2.2 Legal Protection by Design 3 Epilogue: From Data Protection to the Rule of Law References Analysis and Constructive Criticism of the Official Data Protection Impact Assessment of the German Corona-Warn-App 1 Introduction 1.1 Function and Architecture of the CWA 1.2 Data Protection Impact Assessment (DPIA) 1.3 Official Handling of Conducting the DPIA 2 General Points of Criticism 2.1 Protective Function of a DPIA 2.2 Requirements and Methodology of a DPIA 2.3 The Processing Activity 2.4 Risk Modeling 3 Concrete Constructive Criticism 3.1 Separation of the Personal Reference When Uploading the Positive Keys 3.2 Dealing with Risks at the ENF 3.3 Consent and Responsibility 3.4 Open Questions 4 Conclusion References Author Index