Samson Yoseph Esayas

Competition Law for the Digital Economy p. 126-172 Doi: https://doi.org/10.4337/9781788971836

Recent decisions from the European Commission recognise privacy as an important parameter of non-price (quality) competition in markets for communication services and professional social networks. This development acknowledges that privacy could be subject to competition as an element of quality, choice or innovation and thus a merger can reduce the incentives to compete based on this parameter. However, there is much uncertainty and scepticism as to what constitutes reduction in privacy, the incentive to reduce privacy and the ultimate anticompetitive effect of such a reduction. This chapter identifies and reflects on some of these uncertainties and scepticisms surrounding the privacy-as-a-quality parameter, including the lack of a link between privacy harms and accumulation of too much information; the lack of economic incentive to reduce privacy; the alleged trade-off between privacy harms and other quality improvements; and the role that data privacy law can play in understanding the degradation of privacy.

European Competition Law Review (ECLR) 40(4) p. 166-181

In recent years, privacy has started to attract considerable attention in competition discussions, particularly in mergers involving data-rich industries. Prime examples of such mergers include Google/DoubleClick, Facebook/WhatsApp and the recent acquisition of LinkedIn by Microsoft. Given the central role that personal data plays in these mergers and associated privacy concerns for users, competition authorities have started to experiment with ways to incorporate privacy into merger assessment. One emerging approach is to factor in privacy as a non-price competition parameter. In its merger decisions involving Facebook/WhatsApp and subsequently Microsoft/LinkedIn, the European Commission held that data privacy constitutes a key parameter of non-price competition in the market for consumer communications and for professional social networks. This article provides a critical analysis of these decisions regarding the competition in privacy and Privacy Enhancing Technologies (PETs). The analysis is conducted from two angles: one looking at the Commission’s approach in defining the market, particularly on how competition in privacy and PETs is manifested and when two firms are considered competitors based on these parameters and thereby of interest to competition law. The second angle takes aim at the competitive assessment and the theories of harm, particularly when a merger is considered to lead to reduction in privacy as a non-price competition parameter. The article maintains that the Commission’s decision in Microsoft/LinkedIn represents a step forward in the discussion of privacy as a non-price (quality) competition parameter and the use of market power to harm such competition.

International Data Privacy Law (IDPL) 8(3) p. 181-199 Doi: https://doi.org/10.1093/idpl/ipy014

Firms compete by offering consumers lower prices but also high-quality products, and a wide range of choices. With the increasing commercialization of personal, there is a growing consensus that the level of privacy protection and deployment of Privacy Enhancing Technologies (PETs) could be subject to competition, as an element of quality, choice or innovation. A case in point is the recognition by the European Commission that data privacy constitutes a key parameter of non-price (quality) competition in markets for consumer communications and professional social networks. This development signifies that market power may be exerted by reducing the level of data privacy and foreclosing competition on PETs deployment. Despite this, how market power affects competition on privacy and PETs remains unclear. This is partially because microeconomic theory offers little help in predicting how market power or lack thereof affects quality (including choice and innovation). The aim of this article is to examine how market power in the underlying services that generate data impacts competition in data privacy and whether the proxies for assessing market power in these underlying services cater to data privacy interests. To this end, first, the article begins by highlighting some emerging but inconclusive literature shedding some light on the link between market structure and competition in data privacy. Secondly, the article identifies and discusses the structural and behavioural considerations that might hinder effective competition through data privacy and PETs. Finally, it examines the role that competition law can play in promoting and maintaining such competition.

European Competition and Regulatory Law Review (CoRe) 2(3) p. 187-202 Doi: https://doi.org/10.21552/core/2018/3/6

This article examines the new Australian consumer Comprehensive right to access and use data, also known as the Consumer Data Right, recently proposed by the Australian Productivity Commission, and adopts a comparative analysis with data protection, competition and consumer developments in the European Union (EU). Firstly, a brief overview is given of the legal context and relevant Big Data developments in Australia. Then, current EU developments, particularly the data portability right under the General Data Protection Regulation (GDPR), and recent proposals from the Commission aiming at fostering access and transfer of data including the data producer’s right to use and authorise the data and the portability of non-personal data for professional users are considered. This is followed by an explanation of the Australian Productivity Commission’s proposed Consumer Right to access and use data, before an analysis is conducted to understand the extent to which this proposed right accords with the European situation. Given the coming into force of the GDPR and its extraterritorial reach, and the EU-Australia Free Trade Agreement currently under negotiation, as well as the transnational reach of Big Data and Cloud services, standardisation across the two jurisdictions is desirable. In this regard, the article examines to what extent the recent initiatives contribute to such standardisation and their implications for the extent to which Australia’s legal framework for data may be considered ‘adequate’ by the EU.

Alternative Law Journal 43(4) p. 275-282 Doi: https://doi.org/10.1177/1037969X18813402

There is a clear trend of a hardening attitude towards digital platforms. In Australia this trend is exemplified by the Australian Competition and Consumer Commission’s current inquiry specifically into digital platforms. Further, it can also be seen in court decisions. Having discussed one such court decision, we give a brief overview of the Australian Competition and Consumer Commission’s digital platforms inquiry. We then seek to bring attention to a selection of particularly relevant European developments that may usefully inform how Australia proceeds in this arena and that may be considered in the Australian Competition and Consumer Commission’s final report due to be provided to the Treasurer on 3 June 2019.

CPI Antitrust Chronicle 1(2) p. 57-64

This note comments on the Commission’s decision in the Facebook/WhatsApp merger regarding the competition in privacy and privacy policies between the two firms. In assessing the competition between WhatsApp and Facebook Messenger, the Commission used the differences in privacy policies as a factor that makes the messaging services complementary rather than competitors. The Commission’s approach is based on the conventional view that the more identical the products are, the more substitutable they are and the more fiercely they compete. This article questions the application of such an approach to competition in privacy. First, if privacy and data security are competition parameters, one way this competition can be manifested is through deploying privacy enhancing technology (e.g. end-to-end encryption) and privacy policies (offering better conditions of data collection and processing). Thus, when it comes to privacy and privacy policies, dissimilarity either in the technology or policy can be just the beginning of a competition that exerts competitive pressure on others, rather than make the firms complementary. Secondly, when a service attempts to draw users from an established network by offering superior privacy, the existence of an established network such as Facebook, albeit with a different privacy policy, can still discipline the former’s behavior.

International Journal of Law and Information Technology 25(2) p. 139-178 Doi: https://doi.org/10.1093/ijlit/eaw015

‘The whole is more than the sum of its parts.’1 This article applies lessons from the concept of ‘emergent properties’ in systems for data privacy law. This concept, rooted in the Aristotelian dictum ‘the whole is more than the sum of its parts’, where the ‘whole’ represents the ‘emergent property’, allows systems engineers to look beyond the properties of individual components of a system and understand the system as a single complex. Applying this concept, the article argues that the current European Union data privacy rules focus on individual Processing activity based on a specific and legitimate purpose, with little or no attention to the totality of the processing activities—ie the whole—based on separate purposes. This implies that when an entity processes personal data for multiple purposes, each Processing must comply with the data privacy principles separately, in light of the specific purpose and the relevant legal basis. This (atomized) approach is premised on two underlying assumptions: (i) distinguishing among different processing activities and relating every piece of personal data to a particular processing is possible, and (ii) if each processing is compliant, the data privacy rights of individuals are not endangered. However, these assumptions are untenable in an era where companies process personal data for a panoply of purposes, where almost all processing generates personal data and where data are combined across several processing activities. These practices blur the lines between different processing activities and complicate attributing every piece of data to a particular processing. Moreover, when entities engage in these practices, there are privacy interests independent of and/or in combination with the individual processing activities. Informed by the discussion about emergent property, the article calls for a holistic approach with enhanced responsibility for certain actors based on the totality of the Processing activities and data aggregation practices.

Senter for Rettsinformatikk

Lecture Notes in Computer Science (LNCS) 9881 p. 39-56 Doi: https://doi.org/10.1007/978-3-319-46963-8_4

The following article evaluates two models for providing purchasers of online digital content, including cloud computing services, with visual notice of contract terms and data collection practises. Visualisation of contract terms and privacy policies has the potential to provide cloud consumers with an improved means of understanding the contract terms they are accepting when entering into an agreement with a Cloud Service Provider (CSP). The following paper examines two concrete proposals or models for the visualisation of contract terms and privacy practises as compliance tools in the European context. The article focuses primarily on consumer and data protection law. Although the visualisation models are not currently binding or legally required, they start an important conversation on how such terms can be more effectively conveyed.

Artificial Intelligence and Law 23(3) p. 271-300 Doi: https://doi.org/10.1007/s10506-015-9174-x

This article presents a structured and systematic approach for identifying and modelling compliance risks. The sophistication with which modern business is carried out and the unprecedented access to a global market means that businesses are exposed to increasing and diverse regulatory requirements in and across jurisdictions. Compliance with such requirements is practically challenging, partly due to the complexity of regulatory environments. One possibility in this regard is a risk-based approach to compliance, where resources are allocated to those compliance issues that are most risky. Despite the need for risk-based compliance, few specific methods and techniques for identifying and modelling compliance risks have been developed. Due to the lack of methodological and tool support, compliance risk identification often involves unstructured brainstorming, with uncertain outcomes. The proposed approach consists of a five-step process for the structured identification and assessment of compliance risks. This process aims at facilitating the identification of compliance risks and their documentation in a consistent and reusable fashion. As part of the process, the article provides a systematic approach for a graphical modelling of compliance risks, which aims at facilitating communication among experts from different backgrounds. The creation of graphical models can be partly automated based on natural language patterns for regulatory requirements. Furthermore, the structuring of the compliance requirement in a template aims at simplifying the modelling of compliance risks and facilitating a potential future automated model.

European Journal of Law and Technology 6(2)

Substantial uncertainty exists on the role of anonymised or pseudonymised data in the data privacy discourse; this is all the more so as de-anonymisation science advances and the ubiquity of information increases. Such uncertainty affects not only the wider usage of such measures but also creates the temptation, both on the part of the entities and the individuals, to downplay privacy risks associated with anonymised or pseudonymised data. Crucial to mitigating such risks and promoting the use of anonymisation and pseudonymisation as privacy-enhancing techniques is understanding the role of such measures under data privacy rules. This article aims to contribute towards the achievement of such an objective by examining the role of anonymisation and pseudonymisation under the EU data privacy rules, particularly the Data Protection Directive, Regulation 611/2013, the eIDAS Regulation, and the proposed General Data Protection Regulation. This article identifies three major roles of anonymisation and pseudonymisation under the current and en route rules. First, anonymisation and pseudonymisation can serve as a safe harbour from the entire application of data privacy rules provided they are used to irreversibly prevent identification, although achieving this goal seems increasingly challenging in the current state of technological advancement. Second, anonymisation and pseudonymisation can provide a safe harbour from certain data privacy obligations, such as the notification of personal data breaches, provided they are engineered appropriately and complemented by adequate organisational measures. Third, anonymisation and pseudonymisation can constitute mandated measures for compliance with data privacy obligations, such as the data security and purpose specification and limitation principles. All legal perspectives are drawn at EU level, although examples are given from member states when relevant.

2015 IEEE Conference on Communications and Network Security (CNS), Florence, 28-30 September, 2015 p. 568-576 Doi: https://doi.org/10.1109/CNS.2015.7346870

This paper presents an integrated method for risk and compliance assessment and its evaluation in a case study. The sophistication with which modern business is carried out and the unprecedented access to a global market means that businesses are exposed to diverse regulatory requirements in and across jurisdictions. Compliance with such requirements is practically challenging, partly due to the complexity of regulatory environments. One possibility in this regard is a riskbased approach to compliance where resources are allocated to those compliance issues that are most risky. Despite the need for risk-based compliance, few specific methods and techniques for identifying and modeling compliance risks have been developed. The lack of methodological and tool support means the compliance risk identification often involves unstructured brainstorming, with uncertain outcomes. As part of the integrated method, a structured approach for the identification of compliance risks and their graphical modelling is provided. The main goal of the structured approach is to facilitate the identification and assessment of compliance risks and their subsequent documentation in a consistent and reusable fashion. The method is applied in a case study with the aim of assessing the compliance concerns in adopting cloud services. Our experience in the case study demonstrates that the integrated method enables a better structuring in the identification of compliance risks and yields reusable results. As well, the method facilitates communication among different expertise and mitigates subjectivity in making compliance decisions.

The John Marshall Journal of Computer & Information Law 31(3) p. 317-368

The European Union (EU) legal landscape on data privacy and information security is undergoing significant changes. A prominent legislative development in recent years is the introduction of breach notification requirements within a number of regulatory instruments. In only the past two years, the Community legislator has adopted, and proposed, four different regulatory instruments containing breach notification requirements. There are also existing requirements for the telecom sector. This creates a complex mesh of regulatory frameworks for breach notification where different aspects of the same breach within the same company might have to be dealt with under different regulatory instruments, making compliance with such requirements challenging. In this article, the existing and en route breach notification requirements under the EU legal framework are examined – elaborating their potential areas of convergence or conflict and the resulting complexity in compliance with such requirements. To this end, the article examines the scope of the notification regimes, the types of breaches, when a breach is considered to occur under the relevant rules, and the relevant requirements to notify stakeholders. Furthermore, the article examines why a proactive approach to compliance with breach notification requirements is essential and suggests the need to address breach notification requirements in conjunction with security risk analysis, which is being mandated in most of the regulatory instruments.

Journal of Information Technology & Politics (JITP) 11(1) p. 102-122 Doi: https://doi.org/10.1080/19331681.2013.873362

There is discontentment among certain developing countries with regard to the geographical distribution of IPv4 addresses. They blame the IPv4 policies for creating an imbalanced distribution between developed and developing nations. With the introduction of IPv6, there are no signs of these concerns becoming things of the past, as evidenced in various initiatives that call for a UN-based address distribution regime. By reviewing the respective policies for IPv4 and IPv6 distribution, this article argues that at the heart of such concerns and initiatives lies the fact that the core policy features in IPv4 distribution, which are considered responsible for creating the imbalance, have made their way into IPv6 distribution policies. In addition, the assessment of other distribution alternatives reveals that an ITU-based IP address regime or at least the ITU-based proposals on the table thus far do not address the concerns raised by developing countries. Efforts to address such a concern should rather be directed at introducing policy options that would ensure a balanced distribution of IP addresses into the current regime. Ultimately, this article seeks to contribute to the discussion on future directions by suggesting a policy option that the current regime could embrace to alleviate such a genuine concern.

Risk Assessment and Risk-Driven Testing. First International Workshop, RISK 2013. Held in Conjunction with ICTSS 2013, Istanbul, Turkey, November 12, 2013. Revised Selected Papers p. 51-67 Doi: https://doi.org/10.1007/978-3-319-07076-6_4

In recent years, businesses have faced large regulatory fines as a result of information security breaches. This signifies the need for businesses to account for legal issues when addressing their information security risks and to ensure that their day-to-day business operations do not violate legal norms of relevance to information security, such as data privacy laws. This paper offers a twofold contribution to this issue. First, it purposes that organizations’ security risk analysis should be accompanied by an assessment of the legal implications of identified security risks. This enables organizations understand the associated legal risks they would face if the identified security risks were to materialize and prioritize the risks accordingly. Second, the paper underlines the need for security testing to support compliance checking. Particularly, the use of conformance testing would enhance organizations’ level of assurance regarding their compliance with legal norms of relevance to information security.

Proceedings IEEE 25th International Symposium on Software Reliability Engineering Workshops ISSREW 2014, 3-6 November, 2014, Naples, Italy p. 281-286 Doi: https://doi.org/10.1109/ISSREW.2014.67

The global scale of modern business and information technology enables companies to trade across borders but at the risk of being subject to laws in diverse jurisdictions. The regulatory requirements with which businesses have to comply are drastically increasing not only in sheer number but also in complexity, confronting businesses with the need to adapt to a complex, evolving regulatory environment. Crucial to a business’s survival and profitability in such environment are understanding and managing legal and compliance risks. This need has spurred significant recent interest in integrated governance, risk, and compliance (GRC) management. A central element in integrated GRC management is following a risk-based approach to compliance which prioritizes compliance requirements based on their level of risk. Despite the need for risk-based compliance, few specific methods or approaches for identifying compliance risks have been developed. This paper presents a structured method for identifying compliance risks from compliance requirements and the business environment.

Computer Law and Security Review 28(6) p. 662-678 Doi: https://doi.org/10.1016/j.clsr.2012.09.007

Yulex 2012 p. 139-162

123(3) p. 21-24

D-box nettverksmøtet

Global Network of Centers Learning Call

Members meeting

Oslo Big Data Day

Co-Designing Generative Futures: A Global Conversation About AI

The Norwegian Tax Administration (Skatteetaten)

Co-Designing Generative Futures: A Global Conversation About AI

Oslo Big Data Day

Privacy Law Scholars Conference (PLSC)

At the center of antitrust rules is the ban on price fixing or cartels. As users increasingly exchange their personal information for access to digital services — essentially 'paying' with their data —privacy concerns are attracting scrutiny as a potential arena for collusion. In a recent antitrust lawsuit led by Texas, Google is accused of “privacy fixing,” or coordinating with rivals to harm user privacy in violation of antitrust laws prohibiting cartels. The complaint cites several instances where Google allegedly attempted to influence Microsoft's privacy-related promotional activities, sought alignment on 'privacy goals and strategies' with rivals including Facebook and Microsoft and coordinated efforts to thwart privacy legislation. By examining this example, together with another involving Google and Eyeo, the owner of anti-tracking and ad-blocking software Adblock Plus, this paper seeks to shed light into the emerging concept of privacy fixing and its place in antitrust. This includes exploring why digital companies may find it worthwhile to fix the level of privacy, how this may harm consumers, and the extent to which antitrust law can tackle such harms. The discussions reveal that how these examples of privacy fixing could fit into existing precedents that both restrict advertising and prohibit collaborative efforts leading to uniform trading conditions. Similarly, while antitrust rules offer companies with some immunity from antitrust liability for joint lobbying efforts and subsequent government-imposed restrictions on competition, such immunity does not extend to actions that simply serve as a facade to interfere directly with a competitor's business relationships. Moreover, the examples illustrate the vital role antitrust laws can play in protecting user privacy by tackling supply-side issues arising from anti-competitive collaboration. Addressing privacy concerns within the realm of antitrust does not signify an expansion of antitrust regulations' scope to compensate for data protection legislation shortcomings. Instead, it highlights that certain privacy-related harms fall squarely within the purview of antitrust, for which data privacy legislation alone cannot provide an adequate solution.

dScience lunch seminar

In the last few years, we have seen widespread adoption of artificial intelligence (AI) both by private and public agencies. Increasingly, AI is used to make important decisions including whom to hire for a job, what unemployment benefits someone gets, predicting where or when a crime might occur, whether a defendant is likely to re-offend and ought to be denied bail, how long a person might be in jail, whether someone is at risk of cancer, or who sees an advertisement for a specific job. While these uses generate some societal gains, they also raise several concerns about the fundamental rights of individuals due to the lack of transparency of the systems, risks of discrimination, and manipulation. Despite the heightened risks to fundamental rights, AI governance discourse has primarily focused on ethical frameworks and a patchwork of data and consumer protection rules. This is changing, and we are now seeing countries enacting laws specifically targeting AI. For example, in April 2021, the European Commission presented a proposal for a Regulation on AI. This is the first initiative towards a comprehensive legal framework on AI in the world and aims to guarantee the highest level of protection for fundamental rights and safety while promoting innovation. In this talk, we will look at some of the challenges to fundamental rights resulting from the increasing deployment of AI and how the draft EU AI Act tries to tackle some of the concerns.

Internet Governance Forum 2022

Internet Governance Forum 2022

The diffusion of artificial intelligence (AI) tools in the daily life of several societies urge regulations that embrace its global character, with a lens for inclusion and diversity, so that technology works as a tool for achieving the Sustainable Development Goals (SDGs). In view of the benefits and harms of AI, it is imperative to focus on propositional debates, in order to enhance the positive aspects and diminish the destructive potential of technology through regulation. This panel should follow on a major global endeavor from the proponents and will bring multiple perspectives and regulatory backgrounds to debate the relationship between inclusion and AI regulation. The aim is to leverage globally diverse viewpoints, and practical experience, thereby contributing to the development of regulatory efforts of AI technologies to foster inclusion and diversity. The main questions to be addressed on the panel are: What are the salient concerns and drivers of the AI governance discourse related to inclusion and diversity in your region? Are the main stakeholders participating in the debate on AI regulation? Are their aspirations contemplated? Are there outside key actors who should be included in the regulatory and governance process? What do you think other regions can learn from the initiatives and responses from your region? How do you see (and hope to see) the discourse developing in your region in the coming years? The session will explore a two part methodology, one thought-provoking experience and a second interactive. In the first part, the dynamic will be an exchange between the panelists, focusing on the proposed questions from their regional perspectives. In the second part, the floor will be opened to the audience. Individuals will be able to bring forward their perceptions regarding the future of inclusive regulation for AI. Throughout the whole session, there will be a digital mural where people may present their views of inclusive regulation of AI. The moderator and the rapporteur will be in charge of cataloging the perceptions and insights noted starting with the 4 speakers and moving on with the speakers. In the end we should have a cloud of words and map of perceptions.

Juristenes Utdanningssenter (JUS

17 Academic Society for Competition Law Conference

Fagpåfyll - Tirsdagskaffeseminar

Årlige møtet ved Kommunal- og distriktsdepartementet

Webinar

Faglig Påfyll Datatilsynet

Webinar

ASCOLA Nordic Webinar

International Conference on Competition, Digital Platforms and Big Data

It is widely accepted that firms compete by offering consumers lower prices, high-quality products, and a wide range of choices. With the increasing commercialization of personal, there is now a growing consensus that the level of privacy protection and deployment of Privacy Enhancing Technologies (PETs) could be subject to competition by companies. A case in point is the recognition by the European Commission that data privacy constitutes a key parameter of non-price competition in the market for consumer communications and for professional social networks. This approach treats privacy as a quality, choice or innovation component of the product/service offered to consumers and certain privacy harms as reductions in these parameters that need to be accounted for in the competition analysis. However, little attention has been paid in laying out a concrete theory of harm that outlines how data privacy can be incorporated into competition analysis as a non-price parameter and what constitutes reduction in privacy. This paper is an attempt to fill in this apparent gap. To this end, the paper provides a critical analysis, in light of EU competition law, of three theories harm for incorporating privacy as a non-price competition parameter into merger assessment, namely the privacy-as-a-quality, the consumer choice theory and the maverick-firm theory. Additionally, the paper examines what dimensions of privacy are relevant for competition and what is the (added) value of incorporating privacy into competition analysis.

Public seminar

Internal seminar

Amsterdam Privacy Conference

Privatrett Instituttseminar

Lunch seminar

Guest lecture

Jon Bing Seminar

Nordic Academic Network in Competition Law Conferenc

12th Ascola Conference

XXXII Nordic Conference on Legal Informatics

Foredrag ved SINTEF

2015 IEEE CNS

Public Seminar on Legal Aspects of Cloud Computing

CircleID Internet Infrastructure

25th IEEE International Symposium on Software Reliability Engineering (ISSRE)

The global scale of modern business and information technology enables companies to trade across borders but at the risk of being subject to laws in diverse jurisdictions. The regulatory requirements with which businesses have to comply are drastically increasing not only in sheer number but also in complexity, confronting businesses with the need to adapt to a complex, evolving regulatory environment. Crucial to a business’s survival and profitability in such environment are understanding and managing legal and compliance risks. This need has spurred significant recent interest in integrated governance, risk, and compliance (GRC) management. A central element in integrated GRC management is following a risk-based approach to compliance which prioritizes compliance requirements based on their level of risk. Despite the need for risk-based compliance, few specific methods or approaches for identifying compliance risks have been developed. This paper presents a structured method for identifying compliance risks from compliance requirements and the business environment.

RIPE 68

There is discontentment among certain developing countries with regard to the geographical distribution of IPv4 addresses. They blame the IPv4 policies for creating an imbalanced distribution between developed and developing nations. With the introduction of IPv6, there are no signs of these concerns becoming things of the past as evidenced in various initiatives that call for a UN-based address distribution regime. The research work examines the rationale behind such concerns in light of historical institutionalism. By reviewing the respective policies for IPv4 and IPv6 distribution, the paper maintains that at the heart of such concerns and initiatives lies the fact that the core policy features in IPv4 distribution, which are considered responsible for creating the imbalance, have made their way into IPv6 distribution policies. In so doing, the historical institutionalism is used to explain why such concerns persist within the IPv6 regime and how they are affected by the previous IPv4 address regime. Having identified the rationale behind the concerns, the research underlines the need for embracing such concerns of developing countries as a way forward to ease the political pressure on multistakeholderism that is anchored on the fear of another potential imbalance in the distribution of IP addresses. This would be through some kind of institutional change, which according to historical institutionalism has much to do with a change in “idea” rather than the constitution of the entities per se. To that end, the paper assesses other alternative IP distribution policy ideas and reveals that an ITU-based IP address regime or at least the ITU-based proposals on the table thus far do not address the concerns raised by developing countries. Efforts to address such a concern should rather be directed at introducing policy options that would ensure a balanced distribution of IP addresses into the current regime. In an attempt to contribute to the discussion on future directions, the paper suggests a policy option that the current regime could embrace to alleviate such a genuine concern. The proposal offered in the article seeks for the introduction of a distribution system that allocates IPv6 address space blocks from IANA to RIRs at regular time intervals atop of the current system based on demonstrated need. If the model is tested to be workable, it can be further extended to RIRs level to achieve a similar goal among various countries. This would signify that necessary measures are established to ensure that similar mistakes are not committed again and instill some broad confidence among those in the developing world that the current IP address governance regime can establish a stable and enduring platform for an equitable distribution of global Internet resources.

Seminar om Cloud Computing i helsesektoren

1st International Workshop on Risk Assessment and Risk-driven Testing (RISK)

In recent years, businesses have faced large regulatory fines as a result of information security breaches. This signifies the need for businesses to account for legal issues when addressing their information security risks and to ensure that their day-to-day business operations do not violate legal norms of relevance to information security, such as data privacy laws. This paper offers a twofold contribution to this issue. First, it purposes that organizations’ security risk analysis should be accompanied by an assessment of the legal implications of identified security risks. This enables organizations understand the associated legal risks they would face if the identified security risks were to materialize and prioritize the risks accordingly. Second, the paper underlines the need for security testing to support compliance checking. Particularly, the use of conformance testing would enhance organizations’ level of assurance regarding their compliance with legal norms of relevance to information security.

SASSI13 – Security Assessment for Systems, Services and Infrastructures

It is commonplace that legal services are often sought reactively i.e. when a legal problem has already occurred. Such an approach has not always been viewed as satisfactory because disputes and litigation consumes time and resources which could otherwise be used more productively. In the book ‘The Future of Law’, Richard Susskind predicts a paradigm shift in the approach to a legal problem: from problem solving to problem prevention: where understanding legal problems and identifying associated risks and controlling them before any question of escalation becomes a priority. This raises the questions of what kind of methods a lawyer can employ to ensure legal risk management. One possibility is to supplement the conventional legal method of identifying which law applies to a given case with methods for risk analysis developed in other disciplines, such as IT Security. In such disciplines, the risks can be identified, analyzed and addressed in a structured way. The question remains: to what extent, and in which way, such methods for risk management may be applied within the legal domain.

CircleID Internet Infrastructure

Igov2 Symposium

Tirsdagskaffeseminar (TKS)