Michael Veale | |
---|---|
Alma mater | University College London London School of Economics Maastricht University |
Website | michae |
Michael Veale is a technology policy academic who focuses on information technology and the law. He is currently associate professor in the Faculty of Laws at University College London (UCL).
Veale holds a PhD in the application of law and policy to the social challenges of machine learning from UCL, [1] a BSc in Government and Economics from the London School of Economics and a MSc in Sustainability, Science and Policy from Maastricht University. [2]
Veale joined the Faculty of Laws at UCL in 2019 as lecturer in Digital Rights and Regulation, and was appointed associate professor in 2021, where he teaches Internet law and privacy law. [1] [3] Veale was previously a Digital Charter Fellow at the Alan Turing Institute, the UK's National Centre for AI and Data Science, and the UK Government's Department for Digital, Culture, Media and Sport. [1] Veale is also affiliated with Pennsylvania State University's PILOT Lab and teaches at the New York University Stern School of Business. [4]
Veale has authored and co-authored reports on data and technology policy for the Royal Society, [5] the Law Society of England and Wales [6] and the Commonwealth Secretariat. [7]
Veale's scholarship concerns information technology, law and society. His work has highlighted tensions between the practice and functioning of technologies including machine learning, encryption and Web technologies, and the laws that govern them. Veale's work has been influential among governments, legislators and NGOs. Work with Lilian Edwards on a right to an explanation in data protection law [8] has led to legislative amendments in the UK Parliament, [9] and has been cited by the US Federal Trade Commission, [10] the Article 29 Data Protection Working Party, [11] the Council of Europe, [12] [13] the United Nations special rapporteur on Extreme Poverty and Human Rights Philip Alston, [14] the European Parliament, [15] [16] European Commission, [17] [18] [19] and the Information Commissioner's Office. [20] His work on the legality of cookie consent banners has also been cited by the Irish Data Protection Commissioner, [21] Facebook [22] and a range of media outlets. [23] [24] [25] [26] During the COVID-19 pandemic, Veale co-authored the Decentralized Privacy-Preserving Proximity Tracing protocol for Bluetooth contact tracing apps which formed a basis for Apple and Google's partnership protocol, Exposure Notification. [27]
Veale is a noted digital rights activist. He is a member of the Advisory Councils of the Open Rights Group and Foxglove, both of which are UK-based NGOs which campaign in favour of privacy and digital rights, [28] [29] and advises the Ada Lovelace Institute. [30]
Veale has been involved in a variety of actions concerning the right to access personal data under data protection law.
It has been reported that Veale is party to a complaint to the Irish data protection authority concerning Apple's refusal to provide access to users' personal data in the form of recordings made by Siri, [31] [32] stemming from research undertaken by Veale with KU Leuven and the University of Oxford. [33] Apple had reportedly argued that the recordings were anonymised and so did not constitute personal data. [31] [32] At the time, the recordings were stored alongside a device identifier rather than a user's name for up to 6 months, and without any identifier at all for up to 18 months beyond that. Apple also said that the device identifier changes if or when Siri is disabled or re-enabled. Apple said it had not currently built a way to access this device identifier on specific users' devices or to search data that it held by an identifier. However, Veale and colleagues pointed out that Apple associates device identifiers with other information stored on its servers, such as the names of contacts, reminders set, and playlist titles that make it possible for anyone with access to the recordings to identify who it relates to "by using easily accessible data sources, like social media". The researchers argued that Apple's refusal to recognise users' right of access under the GDPR prevented them from verifying if Siri was accidentally recording conversation that was not meant to be recorded or using the recordings in inappropriate ways. [33] [32]
Complaints from Veale around the refusal by Facebook and Twitter to provide access to data concerning the extent of their Web tracking operations have also reportedly led to investigations by the Irish Data Protection Commission. [34] [35] [36] The commission's Annual Report lists these complaints as 2 of 27 cross-border inquiries commenced since 25 May 2018, concerning Twitter's use of advertising URL shortening and Facebook's 'Hive' database. [37]
Following the release of the choose-your-adventure style movie Bandersnatch by Netflix in 2019, Veale obtained his and posted his viewing data from Netflix by invoking his right of access under the European Union General Data Protection Regulation (GDPR), [38] leading to an array of coverage of the issue and debates around the use of such information in profiling. [39] [40] [41] [42]
In September 2018, Veale, Johnny Ryan (then-Chief Policy and Industrial Relations Officer at Brave), [43] and Jim Killock (executive director of the Open Rights Group) filed a complaint with the UK Information Commissioner's Office (ICO) and the Irish Data Protection Commission (DPC), notifying the data protection authorities about systemic breaches of data protection law by the AdTech industry. They drew specific attention to mass surveillance of Internet users for the purposes of behavioural advertising, and the use of the data gathered and inferred to power real-time-bidding (RTB) auction systems. They suggested that the collection and processing of personal data by players in the adtech industry was without legitimate basis and conducted without legally valid consent, contrary to the GDPR. [44] [45] A later academic paper by Veale outlined their argument. [46]
In May 2019, the Irish DPC opened a formal investigation into the AdTech industry. [47]
In June 2019, the ICO responded to the complaint in a report, agreeing that the collection of personal data was "taking place unlawfully". It also agreed that there were "systemic concerns" about the AdTech industry's use of personal data. One of the ICO's deputy commissioners, Simon McDougall, warned the AdTech industry that there was a need for reform, saying "We have significant concerns about the lawfulness of the processing of special category data which we’ve seen in the industry, and the lack of explicit consent for that processing". [48] He also noted that the existing justifications offered by players in the AdTech industry appeared to be insufficient. McDougall also criticised the industry's failure to conduct proper Data Protection Impact Assessments (DPIAs) as required under the GDPR, describing the DPIAs the ICO had reviewed as "generally immature" and lacking "appropriate detail". [49] Veale criticised the ICO's response, stating that: [49] [50]
When an industry is premised and profiting from clear and entrenched illegality that breach individuals' fundamental rights, engagement is not a suitable remedy. The ICO cannot continue to look back at its past precedents for enforcement action, because it is exactly that timid approach that has led us to where we are now.
The ICO subsequently appeared to take no further action until May 2020, when it announced it was suspending its investigation to avoid putting "undue pressure" on the advertising industry during the COVID-19 pandemic. [51] [52] In letters to the complaints, the ICO stated that it was closing the complaint but claimed it intended to "recommence our industry wide investigation into RTB in due course". [53]
In November 2020, Killock and Veale challenged the ICO's decision to closing their complaint in the Upper Tribunal. [54]
Veale was part of the research team that developed the Decentralised Privacy-Preserving Proximity Tracing protocol (DP-3T) for contact tracing during the COVID-19 pandemic. [55] [56] [27]
On April 11, 2020, Veale contacted part of the team developing contact tracing apps for England and Wales, NHSX to warn them that Apple and Google's contact-tracing solutions only allowed for decentralised matching between phones which was incompatible with the UK government's proposed centralised approach. His email stated that:
Apple and Google's new API appears to break (or rather, not allow iPhones of Androids to use) NHS's proposed system, as it only allows decentralised local matching using background BLE [Bluetooth], and does not allow apps to directly access identifiers of individuals they have observed, only to query them with a downloaded list [57]
NHSX maintained that their contact-tracing app was capable of centralised contact-tracing despite these concerns. [58] [59] On 18 June 2020, the UK government announced it would abandon its centralised contact-tracing app, and switch to using Apple and Google's decentralised contact-tracing technology, which is based substantially on the DP-3T protocol. [60] [61]
The Information Commissioner's Office (ICO) is a non-departmental public body which reports directly to the Parliament of the United Kingdom and is sponsored by the Department for Science, Innovation and Technology. It is the independent regulatory office dealing with the Data Protection Act 2018 and the General Data Protection Regulation, the Privacy and Electronic Communications Regulations 2003 across the UK; and the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 in England, Wales and Northern Ireland and, to a limited extent, in Scotland. When they audit an organisation they use Symbiant's audit software.
Privacy International (PI) is a UK-based registered charity that defends and promotes the right to privacy across the world. First formed in 1990, registered as a non-profit company in 2002 and as a charity in 2012, PI is based in London. Its current executive director, since 2012, is Dr Gus Hosein.
Data portability is a concept to protect users from having their data stored in "silos" or "walled gardens" that are incompatible with one another, i.e. closed platforms, thus subjecting them to vendor lock-in and making the creation of data backups or moving accounts between services difficult.
The Interactive Advertising Bureau (IAB) is an American advertising business organization that develops industry standards, conducts research, and provides legal support for the online advertising industry. The organization represents many of the most prominent media outlets globally, but mostly in the United States, Canada and Europe.
Real-time bidding (RTB) is a means by which advertising inventory is bought and sold on a per-impression basis, via instantaneous programmatic auction, similar to financial markets. With real-time bidding, advertising buyers bid on an impression and, if the bid is won, the buyer's ad is instantly displayed on the publisher's site. Real-time bidding lets advertisers manage and optimize ads from multiple ad-networks, allowing them to create and launch advertising campaigns, prioritize networks, and allocate percentages of unsold inventory, known as backfill.
The General Data Protection Regulation, abbreviated GDPR, or French RGPD is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and human rights law, in particular Article 8(1) of the Charter of Fundamental Rights of the European Union. It also governs the transfer of personal data outside the EU and EEA. The GDPR's goals are to enhance individuals' control and rights over their personal information and to simplify the regulations for international business. It supersedes the Data Protection Directive 95/46/EC and, among other things, simplifies the terminology.
A dark pattern is "a user interface that has been carefully crafted to trick users into doing things, such as buying overpriced insurance with their purchase or signing up for recurring bills". User experience designer Harry Brignull coined the neologism on 28 July 2010 with the registration of darkpatterns.org, a "pattern library with the specific goal of naming and shaming deceptive user interfaces". In 2023 he released the book Deceptive Patterns.
NOYB – European Center for Digital Rights is a non-profit organization based in Vienna, Austria established in 2017 with a pan-European focus. Co-founded by Austrian lawyer and privacy activist Max Schrems, NOYB aims to launch strategic court cases and media initiatives in support of the General Data Protection Regulation (GDPR), the proposed ePrivacy Regulation, and information privacy in general. The organisation was established after a funding period during which it has raised annual donations of €250,000 by supporting members. Currently, NOYB is financed by more than 4,400 supporting members.
The Data Protection Act 2018 is a United Kingdom Act of Parliament which updates data protection laws in the UK. It is a national law which complements the European Union's General Data Protection Regulation (GDPR) and replaces the Data Protection Act 1998.
The General Data Protection Regulation (GDPR) is a European Union regulation that specifies standards for data protection and electronic privacy in the European Economic Area, and the rights of European citizens to control the processing and distribution of personally-identifiable information.
COVID-19 apps include mobile-software applications for digital contact-tracing—i.e. the process of identifying persons ("contacts") who may have been in contact with an infected individual—deployed during the COVID-19 pandemic.
The (Google/Apple) Exposure Notification System (GAEN) is a framework and protocol specification developed by Apple Inc. and Google to facilitate digital contact tracing during the COVID-19 pandemic. When used by health authorities, it augments more traditional contact tracing techniques by automatically logging close approaches among notification system users using Android or iOS smartphones. Exposure Notification is a decentralized reporting protocol built on a combination of Bluetooth Low Energy technology and privacy-preserving cryptography. It is an opt-in feature within COVID-19 apps developed and published by authorized health authorities. Unveiled on April 10, 2020, it was made available on iOS on May 20, 2020 as part of the iOS 13.5 update and on December 14, 2020 as part of the iOS 12.5 update for older iPhones. On Android, it was added to devices via a Google Play Services update, supporting all versions since Android Marshmallow.
COVIDSafe was a digital contact tracing app released by the Australian Government on 26 April 2020 to help combat the ongoing COVID-19 pandemic. The app was intended to augment traditional contact tracing by automatically tracking encounters between users and later allowing a state or territory health authority to warn a user they have come within 1.5 metres with an infected person for 15 minutes or more. To achieve this, it used the BlueTrace and Herald protocol, originally developed by the Singaporean Government and VMWare respectively, to passively collect an anonymised registry of near contacts. The efficacy of the app was questioned over its lifetime, ultimately identifying just 2 confirmed cases by the time it was decommissioned on 16 August 2022.
The Temporary Contact Numbers Protocol, or TCN Protocol, is an open source, decentralized, anonymous exposure alert protocol developed by Covid Watch in response to the COVID-19 pandemic. The Covid Watch team, started as an independent research collaboration between Stanford University and the University of Waterloo was the first in the world to publish a white paper, develop, and open source fully anonymous Bluetooth exposure alert technology in collaboration with CoEpi after writing a blog post on the topic in early March.
Digital contact tracing is a method of contact tracing relying on tracking systems, most often based on mobile devices, to determine contact between an infected patient and a user. It came to public prominence in the form of COVID-19 apps during the COVID-19 pandemic. Since the initial outbreak, many groups have developed nonstandard protocols designed to allow for wide-scale digital contact tracing, most notably BlueTrace and Exposure Notification.
NHS COVID-19 was a voluntary contact tracing app for monitoring the spread of the COVID-19 pandemic in England and Wales, in use from 24 September 2020 until 27 April 2023. It was available for Android and iOS smartphones, and could be used by anyone aged 16 or over.
Covid Watch was an open source nonprofit founded in February 2020 with the mission of building mobile technology to fight the COVID-19 pandemic while defending digital privacy. The Covid Watch founders became concerned about emerging, mass surveillance-enabling digital contact tracing technology and started the project to help preserve civil liberties during the pandemic.
Carmela González Troncoso is a Spanish telecommunication engineer and researcher specialized in privacy issues, and an LGBT+ activist. She is currently a tenure track assistant professor at École Polytechnique Fédérale de Lausanne (EPFL) in Switzerland and the head of the SPRING lab. Troncoso gained recognition for her leadership of the European team developing the DP-3T protocol that aims at the creation of an application to facilitate the tracing of COVID-19 infected persons without compromising on the privacy of citizens. Currently she is also member of the Swiss National COVID-19 Science Task Force in the expert group on Digital Epidemiology. In 2020, she was listed among Fortune magazine's 40 Under 40.
The Age appropriate design code, also known as the Children's Code, is a British internet safety and privacy code of practice created by the Information Commissioner's Office (ICO). The draft Code was published in April 2019, as instructed by the Data Protection Act 2018 (DPA). The final regulations were published on 27 January 2020 and took effect 2 September 2020, with a one-year grace period before the beginning of enforcement. The Children's Code is written to be consistent with GDPR and the DPA, meaning that compliance with the Code is enforceable under the latter.
The following is a list of laws providing an overview of laws and regulations that aim to protect consumers from microtransactions.
{{cite web}}
: CS1 maint: numeric names: authors list (link){{cite news}}
: |last=
has generic name (help)CS1 maint: multiple names: authors list (link)This article needs additional or more specific categories .(May 2021) |