Cybersecurity and privacy rights in EU law : moving beyond the trade-off model to appraise the role of technology

Defence date: 30 March 2017Examining Board: Professor Marise Cremona, EUI (Supervisor); Professor Deirdre Curtin, EUI; Professor Anne Flanagan, Queen Mary University of London; Professor Ronald Leenes, Tilburg UniversityThis thesis concerns a specific instance of the trade-off between security and ‘privacy rights’, namely cybersecurity, as it applies to EU Law. The research question is whether, and how, the pursuit of cybersecurity can be reconciled with the protection of personal data and respect for private and family life, which I treat as two independent rights. Classic legal argumentation is used to support a normative critique against the trade-off; an in-depth scrutiny of ‘(cyber)security’ and ‘privacy’ further shows that the trade-off is methodologically flawed: it is an inappropriate intellectual device that offers a biased understanding of the subject matter. Once the terms of discussion are reappraised, the relationship between cybersecurity and privacy appears more nuanced, and is mediated by elements otherwise overlooked, chiefly technology. If this fatally wounds the over-simplistic trade-off model, and even opens up avenues for integration between privacy and cybersecurity in EU law, on the other hand it also raises new questions. Looked at from the perspective of applicable law, technology can both protect and infringe privacy rights, which leads to the paradox of the same technology being both permissible and impermissible, resulting in a seeming impasse. I identify the problem as lying in the combination of technology neutrality, the courts’ avoidance in pronouncing on matters of technology, and the open-ended understanding of privacy rights. To appraise whether cybersecurity and privacy rights can be reconciled, I develop a method that bridges the technological and legal understandings of information security and privacy, based on the notions/methods of protection goals, attributes and core/periphery or essence, and which has the advantage of highlighting the independence of the two privacy rights. A trial run of the method discloses aspects of the ‘how’ question that were buried under the trade-off debate, viz. the re-appropriation of the political and judicial process vis-àvis technology.Chapter 4 draws upon an article in Neue Kriminalpolitik 4/201