20/2023 L'Europe unie. EU Law and Politics at the
Crossroads: Navigating the Complexities of AI,
Digitalization, Data Protection, Security, and
Radicalization

Mihaela Daciana Natea, Simion Costea

► To cite this version:

Mihaela Daciana Natea, Simion Costea. 20/2023 L'Europe unie. EU Law and Politics at the Crossroads: Navigating the Complexities of AI, Digitalization, Data Protection, Security, and Radicalization. Revue L'EUROPE UNIE, 20/2023, pp.152, 2023, 10.13140/RG.2.2.33225.52329. hal-05010968

HAL Id: hal-05010968

https://hal.science/hal-05010968v1

Submitted on 2 Apr 2025

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/376785730

# EU Law and Politics at the Crossroads: Navigating the Complexities of AI, Digitalization, Data Protection, Security, and Radicalization, Paris

Research · December 2023

DOI: 10.13140/RG.2.2.33225.52329

CITATIONS

0

READS

295

2 authors:

<figure><img src="image_2.png" /></figure>

Simion Costea

George Emil Palade University of Medicine, Pharmacy, Science and Technology of ...

44 PUBLICATIONS

8 CITATIONS

SEE PROFILE

<figure><img src="image_3.png" /></figure>

Mihaela Daciana Natea

George Emil Palade University of Medicine, Pharmacy, Science and Technology of ...

35 PUBLICATIONS

13 CITATIONS

SEE PROFILE
Mihaela Daciana Natea, Simion Costea (coordinators)

EU Law and Politics at the Crossroads:
Navigating the Complexities of AI, Digitalization,
Data Protection, Security, and Radicalization

L'EUROPE UNIE
UNITED EUROPE

<figure><img src="image_4.png" /></figure>

No. 20 /

2023

Special volume

Revue d'études européennes

Paris
# SUMMARY

Argument (Mihaela NATEA, Simion COSTEA) .................................................................................. 3

EU Law: From Innovation to Regulation ................................................................................................ 4

Legal Technology: Concepts and Opportunities (Giorgi URTMELIDZE) ........................................ 5

The Main Legal And Ethical Challenges Posed By Autonomous Weapon Systems (AWS) (Mattia MORRESI) .................................................................................................................. 12

The phenomenon of legal professions being replaced by artificial intelligence – real danger or just a myth? (Ruxandra Andreea LĂPĂDAT) ........................................................................................................ 20

Responsible innovation. confidentiality, privacy and data protection (Daniela DUȚĂ) .................... 27

Legal Aspects of Vulnerability Disclosure: Navigating GDPR and NIS Directive Obligations for Data Protection and Cybersecurity (Ana KOIAVA) .................................................................................. 36

Post-mortem privacy and the latest GDPR legislative shifts (Marta TERLETSKA) ........................ 44

Inside Pandora's Box, finding the roots of Natural Law. Applicability in the Future of the European Law (Dr. Vlad BĂRBAT) ........................................................................................................ 54

Security challenges from the perspective of the constitutional courts' vulnerabilities (Professor Marieta SAFTA, PhD) .................................................................................................................. 62

Le notariat traditionnel face à la blockchain (Irina-Cristina APOSTOLESCU) .................................... 75

EU Security and Politics Highlights: Navigating Turbulent Waters ........................................ 83

Sociologie d'une jeunesse radicalisée. Pourquoi certains jeunes sont attirés par cette radicalisation? (Dr Hedi SAIDI) .................................................................................................................. 84

Measuring Performance Management in Albanian Public Administration (MSC.Sabina CENOLLI and Prof.Asoc Ulpian HOTI) ........................................................................................................ 93

Prioritizing security awareness in the fourth industrial revolution: strategies and considerations (Dr. Ana BUHALJOTI, Prof.Asoc. Mirela MERSINI) .................................................................................. 102

Solidarity of the international trade union movement in the post covid 19 era (Irina NICOLAESCU) .................................................................................................................. 108

The impact of digital transition on education (Andreea-Romana BAN) ........................................ 114

What Do National Parties Campaign on during European Elections? Trends from Romania (Dr. Mihaela IVĂNESCU and Dr. Luiza-Maria FILIMON) ........................................................................ 119

A Window of Opportunity with an Existential Stake: The European integration of the Republic of Moldova (Marcu-Andrei SOLOMON) ........................................................................................................ 136

Conclusions (Mihaela NATEA, Simion COSTEA) ................................................................................ 150
Mihaela Daciana Natea, Simion Costea
(coordinators)

EU Law and Politics at the Crossroads:
Navigating the Complexities of AI,
Digitalization, Data Protection,
Security, and Radicalization

L'Europe unie/ United Europe
Special volume
No 20/ 2023

Paris and Cluj, Napoca Star
<figure><img src="image_5.png" /></figure>

Co-funded by
the European Union

<figure><img src="image_6.png" /></figure>

GEORGE EMIL PALADE
UNIVERSITY OF MEDICINE,
PHARMACY, SCIENCE, AND
TECHNOLOGY OF TARGU MURES

<figure><img src="image_7.png" /></figure>

Acknowledgment

The present research is published with the support of the European Union and represents an outcome within the EU project Jean Monnet Center of Excellence in European Security and Disinformation in Multicultural Societies – no. 101047907 – ESDMS.

Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union. Neither the European Union nor the granting authority can be held responsible for them.

Descrierea CIP a Bibliotecii Naționale a României
EU Law and Politics at the Crossroads: Navigating the Complexities of AI, Digitalization, Data Protection, Security, and Radicalization / coord.: dr. Mihaela Daciana

Natea, dr. Simion Costea. –

Cluj-Napoca : Napoca Star, 2023

Conține bibliografie

ISBN 978-606-062-762-3

I. Natea, Mihaela Daciana (coord.)

II. Costea, Simion (coord.)
Argument

In the ever-evolving landscape of European Union law and politics, the profound impact of artificial intelligence, digitalization, data protection, security challenges, and radicalization is reshaping the foundations of governance and legal frameworks. This insightful volume, titled “EU Law and Politics at the Crossroads: Navigating the Complexities of AI, Digitalization, Data Protection, Security, and Radicalization,” serves as an intellectual compass, guiding readers through the intricate and interconnected challenges that define the contemporary European context.

*EU Law: From Innovation to Regulation* forms the initial segment of this anthology, offering a deep dive into the transformative role of technology within legal paradigms.

Giorgi URTMELIDZE explores the conceptual landscape of legal technology, while Mattia MORRESI navigates the ethical challenges posed by autonomous weapon systems (AWS). Ruxandra Andreea LĂPĂDAT critically examines the potential replacement of legal professions by artificial intelligence, and Daniela DUȚĂ investigates responsible innovation with a focus on confidentiality, privacy, and data protection. Ana KOIAVA sheds light on the legal aspects of vulnerability disclosure, and Marta TERLETSKA contributes insights into post-mortem privacy within the context of the latest GDPR legislative shifts. Vlad BĂRBAT delves into the roots of Natural Law and its applicability in the future of European law, while Marieta SAFTA addresses security challenges from the unique perspective of constitutional courts' vulnerabilities.

Irina-Cristina APOSTOLESCU concludes this section with a thought-provoking examination of traditional notariat in the face of blockchain technology.

The second section, *EU Security and Politics Highlights: Navigating Turbulent Waters*, amplifies the exploration by focusing on the intersection of security concerns and political dynamics.

Dr. Hedi SAIDI initiates this segment with an insightful sociological analysis of radicalized youth, probing into the factors that attract young individuals to radicalization. Sabina CENOLLI and Ulpian HOTI contribute an in-depth exploration of performance management in Albanian public administration, highlighting the interplay of work-life balance, work-family conflict, and family-work conflict with employee performance. Ana BUHALJOTI and Mirela MERSINI prioritize security awareness strategies in the Fourth Industrial Revolution, while Irina NICOLAESCU examines the solidarity of the international trade union movement in the post-COVID-19 era. Andreea-Romana BAN evaluates the impact of digital transition on education, offering critical insights into the evolving educational landscape. Dr. Mihaela IVĂNESCU and Dr. Luiza-Maria FILIMON dissect the campaign trends of national parties during European elections, providing an invaluable understanding of political dynamics. Marcu-Andrei Solomon concludes this section with a compelling analysis of the European integration of the Republic of Moldova, exploring the existential stake and opportunities presented by this process.

As coordinators of this anthology, we extend our gratitude to each esteemed contributor whose scholarly endeavors have enriched this volume. This collaborative effort represents a diverse array of perspectives and disciplines, contributing to a nuanced and comprehensive exploration of the intricate challenges faced by the European Union. It is our hope that this publication serves as a valuable resource for scholars, policymakers, legal professionals, and all those interested in the dynamic intersection of law and politics within the European context.

MIHAELA NATEA, SIMION COSTEA
*Coordinators*
# EU Law: From Innovation to Regulation
# Legal Technology: Concepts and Opportunities

GIORGI URTMELIDZE<fnref n="1" />

TALLINN UNIVERSITY OF TECHNOLOGY, ESTONIA

**Abstract:** Legal technology is commonly defined as the use of technology and software to assist individual attorneys, law firms, and medium- and large-sized businesses with practice management, document automation, document storage, and legal research. The paper examines the concept of legal engineering and the application of legal tech tools in legal practice. As technology advances, LegalTech methods such as artificial intelligence, machine learning, and automation are transforming many aspects of the legal profession. This paper focuses on the benefits of LegalTech, such as faster legal processes, improved document management, and increased legal research accuracy. It also investigates the potential stumbling blocks and ethical considerations associated with the usage of LegalTech. Legal technology startups have drawn significant investment around the world. According to Grand View Research, the worldwide tech industry was worth $17.02 billion in 2020 and is expected to grow to 39.6 billion by 2028. In short, LegalTech promotes technological innovation while offering up new prospects in the legal profession.

**Keywords:** EU, Legaltech, Legal technology, LegalTech Start-up

## INTRODUCTION

Legal technology is the operation of technology and software to the provision of legal services and the support of the legal sector. Although the sundries of Legaltech may appear to be new, Shepard produced a citation indicator grounded on the codification that applied to civil trial judgments in the United States as beforehand as 1873. The history of Legaltech spans several decades, starting with the colonist legal exploration databases similar as Westlaw and LexisNexis, which were introduced in the early 1970s. Initially, they offered digital access to legal cases and statutes. In the 1990s, after two decades, case management software was introduced, which helped lawyers organise case-related information. Only after 2010 did cloud-based platforms become popular, enabling secure storage, collaboration, and remote access to legal documents and data, which brings us to the present. Nowadays, Legaltech is continuing to grow rapidly with the help of AI<fnref n="2" />, and it is important to mention three stages of Legal Technology, which are indicated in the proposal by O. Goodenough.<fnref n="3" />

LegalTech 1.0 refers to software and technology supporting drafting, online services, and expert systems such as online communication with the courts, video conferencing, etc. These solutions are implemented within the context of existing procedures and the typical legal work process. The only difference is the mode of communication.

LegalTech 2.0 relates to more advanced technology, which offers solutions in many different activities, such as fact assessment, automatic document drafting, and claim drafting. Smart contracts or tokenization of processes are also counted among the solutions belonging to this category.

<footnote n="1">¹ Project Assistant, Tallinn University of Technology, Ehitajate tee 5, 19086 Tallinn, Estonia, Email: giurtm@taltech.ee</footnote>

<footnote n="2">² See e.g.: Joamets, K.; Chochia, A. (2020). Artificial Intelligence and its Impact on Labour Relations in Estonia. Slovak Journal of Political Sciences, 20 (2), 255–277. DOI: 10.34135/sjps.200204; Joamets, K.; Chochia, A. (2021). Access to Artificial Intelligence for Persons with Disabilities: Legal and Ethical Questions Concerning the Application of Trustworthy AI. Acta Baltica Historiae et Philosophiae Scientiarum, 9 (1), 51–66. DOI: 10.11590/abhps.2021.1.04.; Chochia, Archil; Sicat, Eden Grace Niñalga (2023). Ethics and Modern Technologies: Example of Navigating Children’s Rights in an AI-Powered Learning Environment. In: Ramiro Troitiño, D.; Kerikmäe, T.; Hamulák, O. (Ed.). Digital Development of the European Union. (129–141). Springer, Cham. DOI: 10.1007/978-3-031-27312-4_9.</footnote>

<footnote n="3">³ Oliver R. Goodenough, ‘Legal Technology 3.0’ (HuffPost, 2 April 2015) accessed 19 November 2020; see also Oliver R. Goodenough, ‘Legal Technology 3.0’ (HuffPost, 2 April 2015) accessed 19 November 2020.</footnote>
Lastly, in LegalTech 3.0, decisions refer to using AI and advanced algorithms, where decisions will be made by a system, on the basis of independently acquired data. Smart contracts are also included in LegalTech 3.0 as they are based on AI-based oracles.

The explosive growth in the volume of documents (mostly emails) that must be reviewed for litigation cases has also greatly accelerated the adoption of the technology used, with the incorporation of elements of machine language, artificial intelligence, and cloud-based services by law firms.

# CHAPTER 1. IMPORTANCE AND CATEGORIZATION OF LEGAL TECHNOLOGY

The legal tech sector is made up of law firms that provide legal services through technology as well as suppliers who create and offer technological solutions to such businesses. Apart from Legaltech, new concepts such as Fintech, Regtech, and Insurtech have emerged. They are tied to the use of information technology in their respective industries<fnref n="4" />.

Only 19% of in-house legal teams, according to Gartner, are well-positioned to support enterprise digital ambitions.<fnref n="5" /> Law firms perform even worse; according to the 2018 Georgetown Report, “most are still fighting the last war.” Digital transformation is not only Tech but it also refers to a business paradigm shift that enables customers easier access, transparency, speed, and cost-effectiveness.

<figure><img src="image_8.png" /><figcaption>**Figure 1.**<fnref n="6" /> Reason for using advanced technology:</figcaption></figure>

Figure 1 shows statistics on the reasons why law firm CEOs use advanced technology. It is important to acknowledge that for 70% of respondents, providing value to clients was their first – or second- ranked reason. Furthermore, 48% of respondents identified increased productivity as a primary or second-ranking factor. This demonstrates that advanced technology is more than just deploying technology; it is also satisfying clients’ needs and increasing productivity.

Lawyers nowadays must deal with the challenges of changing markets, data overload, and the rising complexity of information while satisfying clients’ expectations and remaining productive. Most of the challenges stem from the fast-changing regulatory environment. A perfect example of

<footnote n="4">⁴ Salmerón-Manzano, E. (2021). Legaltech and Lawtech: global perspectives, challenges, and opportunities. *Laws*, 10(2), 24.</footnote>

<footnote n="5">⁵ Cohen, M. A. (2018, December 20). Law Is Lagging Digital Transformation -- Why It Matters. Retrieved from https://www.forbes.com/sites/markcohen1/2018/12/20/law-is-lagging-digital-transformation-why-it-matters/</footnote>

<footnote n="6">⁶ 1. Thomoson Reuters. (n.d.). 2022 *Law Firm Business Leaders Report Optimism, challenges, and the need for careful strategy*. Georgetown Law. Retrieved from https://www.thomsonreuters.com/en-us/posts/wp-content/uploads/sites/20/2022/11/2022-Law-Firm-Business-Leaders-Report</footnote>
this are the recent regulations in the European Union affecting digital services, like GDPR and DSA. In addition to European Union regulations, national content monitoring laws like the German NEtzDG generate further legal obligations for tech organisations. It is important to point out that the regulatory burden has increased across industries in the past couple of decades.

In order to resolve a legal question, we may need to study thousands of pages of legal information if we evaluate EU-level legislation alongside national-level legislation in a specific situation. Certain legal responsibilities or procedures (for example, due diligence and compliance investigations) necessitate the evaluation of vast amounts of data by lawyers. As businesses collect more data and use digital tools, the number of documents that must be examined grows inexorably. This is where deploying tech solutions will be more efficient and cost-effective in the long run.

Legal technology is important for a variety of reasons, including:

1. Cost-effectiveness:

*   **Routine Task Automation:** Legal technology applications can automate repetitive and time-consuming operations like document screening, contract analysis, and legal research. These technologies can manage massive volumes of data and execute activities that would normally require significant human effort by employing artificial intelligence (AI) and machine learning algorithms. This automation reduces manual labour expenses while increasing operational efficiency.

*   **Workflow Streamlining:** Legal tech platforms offer streamlined workflows and standardised methods for legal tasks. These platforms frequently include document management, collaboration tools, and project management capabilities, allowing legal practitioners to operate more efficiently and spend less time on administrative responsibilities. Legal technology saves time and costs by eliminating inefficiencies and decreasing the possibility of errors or misinterpretations.

*   **Legal technology solutions** provide comprehensive document management systems that enable efficient organisation, storage, and retrieval of legal documents. Legal practitioners can access vital information more quickly by digitising and centralising records, decreasing the time spent searching for physical files or outdated versions. Improved document management saves money by boosting productivity and lowering the risk of document loss or duplication.

*   **Remote Work and Collaboration:** The COVID-19 pandemic has hastened the adoption of remote work practices, and legal technology has played an important part in easing this transition. Cloud-based platforms and collaboration technologies enable legal practitioners to operate from anywhere, lowering overhead costs associated with physical office space, commuting, and other expenses. Remote work also allows law firms to recruit legal professionals from a larger talent pool without the necessity for physical closeness.

2. Facilitating audits

*   **Compliance Monitoring:** Legal technology solutions can help track and monitor compliance with legal and regulatory standards. These tools assist auditors in determining if an organisation's operations are in accordance with applicable legal obligations by integrating relevant laws, rules, and compliance frameworks.

*   **Data Analytics:** Legal technology includes data analytics capabilities that allow auditors to quickly assess vast volumes of legal data. These technologies can extract important information, discover patterns, and provide insights for audit purposes by utilising machine learning and natural language processing algorithms. E-discovery, contract evaluation, and compliance monitoring are just a few of the applications for data analytics.

3. Increasing efficiency and productivity

*   **Time and Billing Management:** Legal technology platforms frequently offer time tracking and billing features. These applications automate timekeeping, allowing for the correct recording of
billable hours and expenses. This automation improves the invoicing process and ensures billing transparency, resulting in increased productivity and client satisfaction.

* Legal IT platforms frequently include project management features that assist legal teams in tracking and managing projects, deadlines, and milestones. These solutions increase project visibility, task allocation, and overall workflow optimization, ensuring effective resource usage and project completion on schedule.

### Categorization according to Rackwitz and Corveleyen

1. Platform: Access to legal services, given by IT technologies such as Neulexa, Lawkick, the Ask-a-Lawyer component of the Rocket Lawyer website, and LegalZoom.

2. Network: Network providers are great for dealing with a sudden increase in work volume, meeting a need for specific expertise, or temporarily replacing a team member. Their expertise in selecting, preparing, managing, and supporting temporary personnel or managed teams adds value.”
2017 (Rackwitz and Corveleyn)

3. Software suppliers can boost efficiency by facilitating and assisting with time-consuming operations such as information access, overview, collaboration, document processing, and document preparation.

4. Know-How: Managing, generating, and disseminating information, as supplied by Bloomberg Law, Thompson Reuters Practical Law Company, or Wolters Kluwer (including their recent acquisition of Smartlaw), which essentially provide tools to legal practitioners to facilitate legal research.

## CHAPTER 2. THE LANDSCAPE OF LEGAL START-UPS

* What is a LegalTech startup?

A legal tech startup is an up-and-coming business that focuses on using technology to develop and deliver solutions in the legal industry. These startups create and provide software, platforms, or services aimed at streamlining and improving various elements of legal practice, such as legal research, document management, contract analysis, litigation support, compliance, and more. Artificial intelligence, machine learning, automation, data analytics, and cloud computing are common technologies used by legal tech businesses to change legal procedures, enhance efficiency, and address difficulties encountered by legal practitioners and organisations.

They frequently cater to law firms, in-house legal departments, legal service providers, or even individual clients, delivering innovative tools and services that optimise processes, expand access to legal information, and transform legal service delivery. Legal technology startups are critical to fostering innovation, transforming the legal business, and meeting the changing needs and wants of legal practitioners and clients.

### 1. The LegalTech Startup Market

Whether the growth is explosive or not, we are seeing an increase in the number of well-funded legal businesses. This, in turn, increases the industry's image and provides additional validation for businesses seeking their first clients in a traditionally risk-averse market.<fnref n="7" /> When it comes to knowledge acquisition, the legal services sector has been seen as difficult to penetrate, as liability, and hence costs, can escalate quickly. The introduction of marketplace models and document-focused entities is helping the problem. Increased transparency creates opportunities for startups to compete with more established firms.

In the last decade, there has been a huge increase in the number of legal startups. In April 2012, there were about 400 legal startups listed. According to Tracxn, by January 2022, LegalTech will

<footnote n="7">⁷ Rubin, Basha (6 December 2014). "Legal Tech Startups Have a Short History and a Bright Future". TechCrunch. Retrieved 1 May 2015.</footnote>
have over 6,000 startups, including firms that provide technological solutions to law firms and corporate legal departments. LegalTech is one of the most active sectors, with overall funding of USD 10.3 billion.

1. <sup>8</sup>Why are legal startups emerging?

Legal startups have the potential to meet the unmet legal needs of individuals and small businesses. They make legal solutions more accessible and affordable, allowing consumers to manage legal difficulties more efficiently and affordably.

• Self-Service Platforms:

Legal companies create simple systems that enable small enterprises and individuals to fulfil some legal obligations on their own. These systems include templates, guidance, and step-by-step instructions for common legal needs such as contract creation, company formation, and legal document filing. Legal startups save time and money for small enterprises and individuals by empowering users to handle fundamental legal concerns on their own. <fnref n="9" />

Providing an example from Estonia: Avokaado, a LegalTech start-up, which offers lawyers a digital workspace to create dynamic workflows. By automating documents for quick drafting, sharing, and signing, you may collaborate on contracts and legal knowledge with your team and clients.

Legal startups, in general, drive industry revolutions by making legal services more efficient, inexpensive, and accessible to a wider variety of customers.

CHAPTER 3. LEGALTECH IN GERMANY: COURTS AND LAW FIRMS

The phrase “Legal Tech” is frequently used to refer to legal advice delivered by lawyers employing cutting-edge technology. In Germany, legal tech refers to the application of cutting-edge technology such as artificial intelligence and blockchain/DLT to assist the legal professions and the judiciary. <fnref n="10" /> Promoting the application of artificial intelligence is also a main emphasis of the German government’s agenda. The German government’s national AI strategy<fnref n="11" /> has three main goals: making Germany and Europe leading centers for AI and ensuring Germany’s future competitiveness, integrating AI in society in ethical, legal, cultural, and institutional terms; and encouraging responsible development and use of AI for the good of society.

Specialised programs in the judiciary provide templates for various jurisdictions, such as organising a hearing, inviting witnesses, and text modules for judicial opinions. The use of computerised text modules and calculation algorithms to assist judges in the application of specific legal norms is one of the most essential features of this text. These applications can be used to assess a court’s local jurisdiction, and information technology can also make suggestions for substantive legal decisions. However, it is legally questionable to what extent a judge may have automatic decision ideas provided to him by an automated system. Furthermore, due to complex algorithms,

<footnote n="8">⁸ Tracxn. (2022, January 6). Emerging Startups 2022: Top Legal Tech Startups. Retrieved from https://tracxn.com/d/emerging-startups/top-legal-tech-startups-2022</footnote>

<footnote n="9">⁹ Praduroux, S., de Paiva, V., & di Caro, L. (2016, December). Legal tech start-ups: State of the art and trends. In Proceedings of the Workshop on MLing and REasoning with Legal texts collocated at the 29th International Conference on Legal Knowledge and Information Systems.</footnote>

<footnote n="10">¹⁰ Isabelle Désirée Biallaß in Stephan Oryand Stephan Weth (eds) Elektronischer Rechtsverkehr (1st edition, juris Allianz, 2020); Jens Wagner, Legaltech und Legal Robots. Der Wandel im Rechtswesen durch neue Technologien und Kunstliche Intelligenz, (Springer 2020).</footnote>

<footnote n="11">¹¹ Die Bundesregierung, ‘Künstliche Intelligenz (KI) ist ein Schlüssel zur Welt von morgen.’ (Die Bundesregierung), <www.ki-strategie-deutschland.de> accessed 26 February 2021.</footnote>
the suggested decisions are opaque to the judge, which could be interpreted as an attack on judicial independence. The employment of AI-supported programs in court service offices is becoming more frequent in Germany, as it allows judges to justify their decisions without having to resort to proposals given by an opaque AI-supported program.

Automation also benefits judicial officers, particularly when processing register matters. Since 2007, most registry courts have used the “electronic court and administrative mailbox (EGVP),” an encrypted platform with an integrated signature function. Individualized texts can be entered into dynamic document templates by lawyers, who can occasionally assign individual facts to predetermined categories or input answers in selection boxes. Expert systems (Legal Process Automation) assist lawyers in semi-automating recurring legal review steps for the purpose of advising clients, beginning with a simple deadline and fee calculations, and progressing to more intensive subsumption of common case constellations under the appropriate legal norms. Furthermore, legal digital platforms run by firms are expanding in Germany, allowing citizens to have their legal rights evaluated without having any legal knowledge of their own.

Individual legal advice is only permitted under the German Legal Services Act (Rechtsdienstleistungsgesetz) if supplied by a licensed lawyer. The Federal Court of Justice, on the other hand, recently determined that a platform that could be used to compute the allowable amount of apartment rents did not represent an illegal legal service<fnref n="12" />. A working committee of the German Bar Association (DAV) is conducting an in-depth discourse with its 63,000 members, as well as AI suppliers, to examine the existing and potential usage of AI. Changes to the BRAO (Act on the Legal Profession) and the RDG (Legal Services Act) are among the options.

## CONCLUSION

Advocates, legal advisers, judges, and prosecutors are all confronting a dramatic revolution in their operations, such as operating law companies, as well as in the substance and legal aspects of the legal help supplied, including court procedures. The transformations are already taking place. For some lawyers, they are evident and noticeable, and they willingly participate in them; for others, they are a problem, resulting in a denial and an attempt to retain the current status quo. Many people do not see the changes coming.

Technology is reshaping industries around the world, changing how businesses work, and paving the way for extraordinary developments. Artificial intelligence and machine learning, as well as automation and data analytics, are transforming industries such as healthcare, banking, manufacturing, and transportation. The integration of smart devices, cloud computing, and the Internet of Things (IoT) has resulted in increased efficiency, productivity, and connectivity, as well as the streamlining of operations and the creation of new opportunities. Technology's ability to collect, analyse, and interpret massive volumes of data enables businesses to make data-driven choices, tailor customer experiences, improve supply chains, and drive innovation. As industries embrace the digital revolution, technology drives them to increased competitiveness, sustainability, and growth in an ever-changing global landscape.

The digital transformation of the legal industry is crucial, while it is not only Tech but the adaptation to satisfy the necessity of customers. LegalTech shall be seen and used as a tool that provides significant help to lawyers who are burdened with various time-consuming tasks, such as document management, contract drafting, and legal research. In addition, as we can see, in Germany, the use of computerised text modules and calculation algorithms can assist judges in the application of specific legal norms.

<footnote n="12">¹² Judgment of the Federal Supreme Court (BGH) from 27 November 2019, VIII ZR 285/18, NJW 2020, 208.</footnote>
In short, as Esther Salmerón-Manzano described: “Legaltech offers us the opportunity and challenge to promote a just and equitable society and to empower individuals. Thus, giving greater access to legal services and the possibility of achieving the goal of universal access to justice.”

BIBLIOGRAPHY / References

23 Legal Technology Insights for 2023 | NetDocuments. (n.d.). Retrieved from https://www.netdocuments.com/global/23-insights-for-2023-thank-you

Balmer N. J., Buck, A., Patel, A., Deniver, C. and Pleasence, P., 2010. Knowledge, capability, and the experience of rights problems. Legal Services Research Centre, Research report March 2010, [online]. Available at: http://lawforlife.org.uk/wp-content/uploads/2010/05/ knowledge-capability-and-the-experience-of-rights-problems-lsrc[1]may-2010-255.pdf [Accessed 30 February 2018].

BDO, 2017. Technology is set to have the greatest impact on law firms over the next five years. BDO's Law Firm Leadership Survey, 16 May 2017, [online]. Available at: http://www.bdo.gg/en-gb/news/2017/technology-set-to-have-the-greatest-impact-on-law [Accessed 30 February 2018].

Buchholtz, G. (2020). Artificial intelligence and legal tech: Challenges to the rule of law. (“Artificial intelligence and legal liability: towards an international…”) Regulating artificial intelligence, 175-198.

Bues, Micha-Manuel, and Emilio Matthaei. 2017. “Legaltech on the rise: Technology changes legal work behaviours, but does not replace its profession.” In Liquid Legal. Cham: Springer, pp. 89–109.

Caserta, Salvatore. 2020. "Digitalization of the Legal Field and the Future of Large Law Firms." Laws 9: 14.Corrales, M., Fenwick, M., & Haapio, H. (Eds.). (2019). Legal Tech, Smart Contracts and Blockchain. Singapore: Springer.

Chochia, Archil; Sicat, Eden Grace Niñalga (2023). “Ethics and Modern Technologies: Example of Navigating Children’s Rights in an AI-Powered Learning Environment.” (“Springer”) In: Ramiro Troitiño, D.; Kerikmäe, T.; Hamulák, O. (Ed.). Digital Development of the European Union. (129–141). Springer, Cham. DOI: 10.1007/978-3-031-27312-4_9.

Future of Legal: Six Shifts GC Must Make by 2025. (n.d.). Retrieved from https://www.gartner.com/en/legal-compliance/trends/future-of-legal-2025

Joamets, K.; Chochia, A. (2020). Artificial Intelligence and its Impact on Labour Relations in Estonia. Slovak Journal of Political Sciences, 20 (2), 255–277. DOI: 10.34135/sjps.200204.

Joamets, K.; Chochia, A. (2021). Access to Artificial Intelligence for Persons with Disabilities: Legal and Ethical Questions Concerning the Application of Trustworthy AI. Acta Baltica Historiae et Philosophiae Scientiarum, 9 (1), 51–66. DOI: 10.11590/abhps.2021.1.04.

Kerikmäe, T., Hoffmann, T., & Chochia, A. (2018). Legal technology for law firms: Determining roadmaps for innovation. Croatian International Relations Review, 24(81), 91-112.

Mania, K. (2022). Legal Technology: Assessment of the Legal Tech Industry's Potential. Journal of the Knowledge Economy, 1-25.

Park, S. H., Lee, D. G., Park, J. S., & Kim, J. W. (2021). A survey of research on data analytics-based legal tech. Sustainability, 13(14), 8085.

Legal tech start-ups: State of the art and trends. In Proceedings of the Workshop on MLing and REasoning with Legal texts collocated at the 29th International Conference on Legal Knowledge and Information Systems.

Rubin, Basha (6 December 2014)."Legal Tech Startups Have a Short History and A Bright Future". TechCrunch. Retrieved 1 May 2015.

Salmerón-Manzano, E. (2021). Legaltech and Lawtech: global perspectives, challenges, and opportunities. Laws, 10(2), 24.

Stanford Law School (2016-11-27)."CodeX – Programs and Centers – Stanford Law School". Law.stanford.edu. Archived from the original on 2015-07-18. Retrieved 10-12-2016.

Szostek, D. S., & Zalucki, M. S. (2021). LegalTech [PDF version]. Dariusz Szostek | Mariusz Załucki. https://doi.org/10.5771/9783748922834

Jackson, D. (2016). Human-centered legal tech: integrating design in legal education. *The Law Teacher*, *50*(1), 82-97.

Schmitz, A. J., & Zeleznikow, J. (2022). Intelligent legal tech to empower self-represented litigants. *Ohio State Legal Studies Research Paper*, (688), 23.
# The Main Legal And Ethical Challenges Posed By Autonomous Weapon Systems (AWS)

MATTIA MORRESI<fnref n="1" />

RESEARCH ASSISTANT, DEPARTMENT OF LAW, TALLINN UNIVERSITY OF TECHNOLOGY, ESTONIA

**Abstract:** Current technological developments are paving the way to new and unknown circumstances in which artificial intelligence will carry out functions until now performed by human beings. These evolutions are affecting almost every aspect of our daily lives and that also includes the military domain. The ongoing trend of 'dehumanization' of warfare, intended as a shift in the degree of involvement of real people in the decision-making process leading to the adoption of critical decisions such as life and death, poses vital questions from a legal as well as an ethical perspective. The aim of this paper is therefore that of highlighting the main challenges posed by the potential deployment of Lethal Autonomous Weapon Systems while attempting to further draw the attention of the public opinion on the topic and possibly suggest solutions to the actual deadlock.

**Keywords:** EU, USA, UN, accountability, autonomous weapon systems, ethics, legal aspects of AI.

## INTRODUCTION

Warfare has always been among the most sensitive areas to technological improvements. Countries all over the world are constantly willing to gain strategic advantages over the others as “a core characteristics of warfare was, always had been and is the continuous development of new methods and means of warfare to overwhelm potential enemies with new, unexpected abilities of the military or to keep at least the potential threat level against attacks at is highest possible level”.<fnref n="2" />

Over the last few decades technological disruptions have given strong impetus to the debate dealing with the applicability of AI to many different domains that are already now, and will certainly even more in the future, affect nearly every aspect of our lives. Legal as well as ethical concerns are the main pillars of this discussion, and the military field is not exempt from it.<fnref n="3" /> The not too abstract possibility of having in a near future the so-called Lethal Autonomous Weapons Systems – also called Autonomous Weapons Systems or even Killer Robots – as the main actors in the battlefield played a pivotal role in bringing to the fore the debate over the potentially legal as well as moral controversial consequences of such deployment. Crucial from this perspective in helping the debate gain momentum has been the increased awareness fostered by multiple NGOs like Human Rights Watch that forced governments to include such argument in their agendas.<fnref n="4" />

<footnote n="1">¹ Mattia Morresi is MA graduate, International Relations and European Studies at the University of Florence, Italy, Research Assistant, Department of Law, Tallinn University of Technology, Estonia, Email: mattia.morresi@edu.unifi.it</footnote>

<footnote n="2">² Wolff Heintschel von Heinegg, Robert Frau, Tassilo Singer (2018) Dehumanization of Warfare. Legal implications of New Weapon Technologies, p. 9. Springer Cham. DOI: https://doi.org/10.1007/978-3-319-67266-3</footnote>

<footnote n="3">³ Joamets, K.; Chochia, A. (2020). Artificial Intelligence and its Impact on Labour Relations in Estonia. Slovak Journal of Political Sciences, 20 (2), 255–277. DOI: 10.34135/sjps.200204; Chochia, Archil; Sicat, Eden Grace Niñalga (2023). Ethics and Modern Technologies: Example of Navigating Children’s Rights in an AI-Powered Learning Environment. In: Ramiro Troitiño, D.; Kerikmäe, T.; Hamulák, O. (Ed.). Digital Development of the European Union. (129–141). Springer, Cham. DOI: 10.1007/978-3-031-27312-4_9; Joamets, K.; Chochia, A. (2021). Access to Artificial Intelligence for Persons with Disabilities: Legal and Ethical Questions Concerning the Application of Trustworthy AI. Acta Baltica Historiae et Philosophiae Scientiarum, 9 (1), 51–66. DOI: 10.11590/abhps.2021.1.04.</footnote>

<footnote n="4">⁴ Kohv, M.; Chochia, A. (2021). Unmanned Aerial Vehicles and the International Humanitarian Law. Case study: Russia. In: Mölder, H.; Sazonov, V.; Chochia, A.; Kerikmäe, T. (Ed.). The Russian Federation in the Global Knowledge Warfare: Influence Operations in Europe and Its Neighborhood. (213–231). Springer. DOI: 10.1007/978-3-030-73955-3_11.</footnote>
If from a legal perspective the development of new weapons is not a unique phenomenon, as the existence of broad and abstract norms devised to regulate the emergence of new means of warfare clearly reflect<fnref n="5" /> – however inadequate to regulate new challenges they might be – the ethical questions stemming from such advancements are daunting and ask for clear answers. There are at least two points that seem to be particularly problematic: first, is the decision over human life and death something that we can delegate to machines? Second, are AI systems able to act in an ethical/moral manner or it is just a human value/virtue? In other words, would they be able “to replicate the human decision-making process?”<fnref n="6" />

Whether this new kind of weapon should be regulated or banned is the other pillar of the ongoing debate that has developed. While advocates of the ban mainly argue over the concept of human dignity, meaning that no human being should be deprived of its life by the decision of a machine,<fnref n="7" /> on the other hand supporters of the deployment of these new weapons ground their arguments on the many benefits that, in their opinion, stems from the application of Autonomous Weapon Systems. Benefits that clearly outweigh the “costs”.

## LETHAL AUTONOMOUS WEAPON SYSTEMS AND THE MAIN LEGAL AND ETHICAL CHALLENGES

Before entering into any discussion about Autonomous Weapons System (AWS) what is important to do is to frame the issue at hand. To comprehensively understand AWS, it is therefore essential to first define them. Contrary to what one might think, the most important element to consider when defining this new kind of weapon system is not the technology applied. Rather, the definition mostly relies on the role of human operators when it comes to the selection and engagement of targets. In this light is it therefore possible to identify 3 main categories of weapons systems:

* Human-in-the-loop, also known as semi-autonomous systems which are not capable of self-selecting and self-engaging targets. These systems deeply rely on the role of human operators.

* Human-on-the-loop or human-supervised autonomous systems that unlike the previous ones are instead able to select and attack targets even though the human operator is oversighting the activities of the machine with the possibility to override the decisions taken by the machine itself.

* Human—out-of-the-loop or fully Autonomous Weapons systems for which a unique definition is still missing today although they can be broadly defined as systems capable of searching for targets and engaging them without any human supervision.

For the purpose of this paper, we will mostly deal with the last-mentioned category of autonomous weapons systems.

According to a 2023's document devised by the US Department of Defense AWS are “weapon system[s] that, once activated, can select and engage targets without further intervention by a human operator”<fnref n="8" /> while the International Committee of the Red Cross defines them as systems able to “independently select and attack targets, i.e., with autonomy in the ‘critical functions’ of acquiring, tracking, selecting and attacking targets”.<fnref n="9" />

<footnote n="5">⁵ Article 36 Additional Protocol I, Geneva Convention on the Protection of Victims of International Armed Conflicts and the United Nations Convention on Certain Conventional Weapons https://ihl-databases.icrc.org/ihl/INTRO/470</footnote>

<footnote n="6">⁶ Shea, A., *The Legal and Ethical Challenges Posed by Lethal Autonomous Weapons*, 24 Trinity C.L. Rev. 117 (2021) p.4.</footnote>

<footnote n="7">⁷ Noone, G., P., & Noone, D., C., *The debate over Autonomous Weapons Systems*, Case Western Reserve Journal of International Law, 47(1) p. 8. «In sum, the rise of autonomous weapons is creating understandable concern for the international community as it is impossible to predict exactly what will happen with the technology. This uncertainty has led some to advocate for a preemptive ban on the technology.»</footnote>

<footnote n="8">⁸ United States Department of Defence, Directive 3000.09, *Autonomy in Weapon Systems*, January 25th, 2023.</footnote>

<footnote n="9">⁹ International Committee of the Red Cross, *Views of the International Committee of the Red Cross (ICRC)*</footnote>
The enhanced capability of these autonomous weapons able to perform decision-making processes that have usually been performed by human beings is the most problematic question from both an ethical and legal perspective around which the whole debate has been revolving. If on the one hand the lack of human feelings such as fear, anger, revenge, frustration and so on seem to be a clear advantage, on the other it is exactly the lack of human qualities and feelings, such as empathy and compassion, that opponents to AWS point to in their argument to prevent the deployment of such weapons.

Although “the concept of AWS is not per se unlawful”<fnref n="10" />, from the legal side there are many challenges posed by the development of these weapons which are mostly related to practical questions such as how and to what extent are these new systems able to conform to the existing principle regulating war. Military necessity, proportionality, distinction, and humanity are just some of the main principles traditionally governing the Law of Armed Conflict, also known as International Humanitarian Law (IHL). Until now indeed the practical implementation of all of these principles into the battlefield has relied upon the judgment of human operators that through a context-based evaluation have decided whether a certain action was to be taken or not.<fnref n="11" /> As explained by the UN special rapporteur on extrajudicial killings in its 2013’s report “while robots are especially effective at dealing with quantitative issues, they have limited abilities to make the qualitative assessments that are often called for when dealing with human life”.<fnref n="12" />

According to the military necessity, military force should be used when ‘strictly necessary’. For instance, in the case of armed conflicts, to gain an advantage over the enemy, the adoption of certain measures is authorized as long as these actions do not provoke unnecessary suffering. The same goes when dealing with the principles of distinction whose grounds can be retrieved from article 51 of Additional Protocol I of the Geneva Conventions, according to which “the civilian population as such, as well as individual civilians, shall not be the object of attack” meaning that the targets of military attacks can only be military objectives while civilians must always be avoided and protected. As it regards to the proportionality of military attacks, in this case as well, the role of the human operators is fundamental as it is prohibited to unleash a strike expected to create “incidental loss of civilian life, injury to civilians, damage to civilian objects, or combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated”.<fnref n="13" />

The substitution of human operators with weapon systems allegedly capable of performing crucial decisions, including distinguishing between civilians and combatants or calculating and understanding the benefits and costs of specific military actions in particular environments, seems to pose a major legal threat either from a practical point of view – as it is not yet clear if such a highly intelligent system will never exists – and from a regulatory perspective – with the adequacy of existing rules designed to regulate human behavior that are questioned.

Subsequently this threat brings along with it another extraordinarily controversial legal issue, somehow inherently bound to the application of AI in almost every domain, which is the accountability question for the violation of existing norms. Suppose that in the future AWS would exist and be deployed in the battlefield, who should be held accountable in the not too unreal case of a violation of one of the above-mentioned principles governing the war? Even though it is yet unclear

<footnote>on autonomous weapon system, Geneva, April 11th, 2016.</footnote>

<footnote n="10">¹⁰ Ivi, p.6</footnote>

<footnote n="11">¹¹ See the HRW definition of judgment «Judgment requires human capabilities of reason and reflection to interpret information and formulate an opinion». *Shaking the Foundations, The Human rights implications of Killer Robots*. https://www.hrw.org/report/2014/05/12/shaking-foundations/human-rights-implications-killer-robots</footnote>

<footnote n="12">¹² Heyns, C., *Report of the Special Rapporteur on extrajudicial, summary, or arbitrary executions*, 9 April 2013. Report of the Special Rapporteur on extrajudicial,.pdf</footnote>

<footnote n="13">¹³ Article 51(5)b Additional Protocol I.</footnote>
who should bear the burden for such a crime in the case it might happen, according to the literature,
three seem to be the potentially liable actors within this context:

* The state, which would be held accountable for the misuse of weapons by its own armed forces.

* The commanding-officer who supervises the deployment of the AWS.

* The developer of AWS.

Despite what at first sight might appear to be a clear picture is instead a very blurry one. What is still missing is an agreement over the appropriate liability framework, as many are the difficulties that need to be considered when dealing with each of the above-mentioned entities, so much so that experts are mostly concerned about the possibility of facing what has been defined as “a responsibility gap”.<fnref n="14" />

As a result of this ‘dehumanization’ of warfare, embodied by the diminished role of human
being in the crucial decisions and actions of searching and engaging targets in the battlefield, brings
along with its multiple implications from a moral perspective as well. What seems to be particularly
controversial on this side is the possibility of machines taking over human life, an action that is
considered to be disrespectful of the intrinsic dignity of every human being. The main reason for that
is “that the person targeted by AWS is reduced to being an object that has to be destroyed, where
there is no possibility of appealing to the humanity of the enemy”.<fnref n="15" /> However a better and deeper
explanation is worth to be made.

According to Article 6 of the International Covenant on Civil and Political Rights (ICCPR) “Every human being has the inherent right to life. This right shall be protected by law”.16 Being the right to life a supreme right, since on it depends on all the others, it is easily understandable why being deprived of such a meaningful right by a machine that cannot understand the significance of human life and therefore cannot respect its value is considered to be disrespectful of the inherent dignity of every human being.

Advocates for a ban of AWS find in this reason the crux of their argument as many seems to
be the obstacles on the way to the creation of an unmanned system capable of carrying out decision-
making processes that do not rely just upon quantitative but also on a more complex situational
evaluation that requires proper human qualities.<fnref n="17" />

When dealing with the legal challenges posed by the likely future deployment of AWS, we
have already outlined how compliance with existing norms is one of the main difficulties that stems
from the development of these systems. These difficulties are due not just to the fact that the rules
concerned have been devised well before the development of such systems started, but it is also due
to the fact that AI, not matter how powerful it is, will probably always lack the so-called ‘situational
awareness’ to discern a real threat and deescalate potentially dangerous situation in which the
employment of human operators would presumably avoid irreversible mistakes leading to different
choices. Indeed, when it comes to the application of the various principles that lay at the heart of the
IHL to real life this is not just a matter of calculations based on the available data. There are an
infinite range of situations that no system developer can think of covering and most of the time the

<footnote n="14">¹⁴ Shea, A., *The Legal and Ethical Challenges Posed by Lethal Autonomous Weapons*, p.17</footnote>

<footnote n="15">¹⁵ Sharkey, A., Springer, 2018, p. 4. See also «Article 22 of the European Union's General Data Protection Regulation (GDPR), which affirms that people “shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her». https://ny.fes.de/fileadmin/user_upload/FES_Chat_summary_v1_-_LAWS_Partnership_VL.pdf</footnote>

<footnote n="16">¹⁶ *International Covenant on Civil and Political Rights*, article 6.</footnote>

<footnote n="17">¹⁷According to Sharkey (2018) «Decisions about military advantage and military necessity require ‘responsible accountable human commanders, who can weigh the options based on experience and situational awareness».</footnote>
application of such principles requires a deeper “understanding of human nature”.<fnref n="18" /> Bearing this in mind three are the major moral objections:

1. It is almost impossible, at least not in the near future, that we will have robots carrying out the distinctions required by the IHL during armed conflicts.

2. From a value-based approach, it is considered to be inherently and deeply wrong to let robots determine human's life and death decisions.

3. In the case of an accident caused by an AWS who is to be held accountable?

The debate over the morality of AWS is then further fueled by the likely consequences that would arise from their adoption. If we think about a war, it will probably become easier to wage it given the reduced risks both in terms of soldiers' lives and political consequences. Political consequences which would potentially result in a direct threat to the global security and peace.<fnref n="19" />

Moreover, the deployment of AWS would not be limited to an armed conflict. It is indeed obvious that “once available, this technology could be adapted to a range of other contexts that can be grouped under the heading of law enforcement”.<fnref n="20" /> Over the last few years we have already witnessed how thin is the border between democracies and autocracies, justice, and revenge and from this point of view the deployment of AWS could be another crucially problematic factor to be taken into account.

One of the possible answers to these objections could be the employment of a ‘mitigating’ concept such as that of ‘meaningful human control’.

## MEANINGFUL HUMAN CONTROL (HUMAN IN OR OUT OF THE LOOP?) AND THE QUESTION FOR BANNING OR REGULATING AWS

Since 2013, when the debate around AWS started to spread out with the establishment at hands of several non-governmental organizations of the campaign to stop killer robots<fnref n="21" />, the question over banning or regulating Autonomous Weapons gained momentum forcing national governments to start thinking about the best approach toward these new technologies. At the diplomatic level discussions started in 2014 within the framework of the United Nations and specifically within the Convention on Certain Conventional Weapons (CCW) whose objective is to limit the use of weapons deemed to provoke “unnecessary or unjustifiable suffering to combatants or to affect civilians indiscriminately”.<fnref n="22" /> The importance of the question was consequently formalized through the creation of a Group of Governmental Experts (GGE) whose work was eventually resumed in the 11 guiding principles on LAWS.<fnref n="23" />

Notwithstanding the efforts made we are still today a long way from having a proper regulation of these systems and this do not depend just on the ethical and legal challenges already mentioned but it is particularly due to the strategic concerns over the impact of such new weapon since “perceived military value is exceptionally high, and the current geopolitical landscape is not conducive to new arms control breakthroughs”. The question is then further exacerbated by the

<footnote n="18">¹⁸ HRW report, *Shaking the Foundations*, 2014, p. 7</footnote>

<footnote n="19">¹⁹ «the use of autonomous weapons denies the equality of persons since combatants using them are removed from physical risk at the same time as their targets are exposed to an increased risk». Sharkey (2018).</footnote>

<footnote n="20">²⁰ HRW report, *Shakingathea Foundations*, p. 4.</footnote>

<footnote n="21">²¹ https://www.stopkillerrobots.org/</footnote>

<footnote n="22">²² Amoroso, D., Amoroso, Daniele (2020) Autonomous Weapons Systems and Meaningful Human Control: Ethical and Legal Issues. Springer.</footnote>

<footnote n="23">²³ For a deeper view on the 11 Principles see https://www.diplomatie.gouv.fr/en/french-foreign-policy/united-nations/multilateralism-a-principle-of-action-for-france/alliance-for-multilateralism/article/11-principles-on-lethal-autonomous-weapons-systems-laws. For a critical commentary see https://article36.org/wp-content/uploads/2019/11/Commentary-on-the-guiding-principles.pdf</footnote>
underlying difficulty of conceptualizing LAWS. It is, indeed, not yet clear how much autonomy it is required in order to classify a weapon as LAWS as it also shows the attempts, made during the early stages of the debate, to exclude defense systems from the autonomy discussion by claiming that, unlike autonomous weapons, they have not too much room for maneuver since they "are designed to merely repeat a few pre-programmed actions in case of incoming munitions".<fnref n="24" />

One of the majors' concerns, as it was previously outlined, with the deployment of AWS is represented by the lack of human control over the crucial decisions and actions it might undertake. Either from a legal and ethical perspective the transfer of the decision-making process from humans to machine is the main argument driving the call for a preemptive ban over this new kind of weapon. Specifically, what seems to be problematic is the implicit requirement of human qualities – from a legal perspective – and feelings – from an ethical one – that lay at the roots of IHL.

This lack is also the main hurdle in the rift between pro-ban and pro-regulation<fnref n="25" /> which is still today quite polarized. Even though the debate is a fierce one with most of the involved actors entrenched in their opinions some common grounds on especially important questions can still be found, such as the existing need, for both sides, to eliminate the human error from the battlefield.<fnref n="26" /> Despite this common ground however, the tough question over which agreement has not yet been reached.

«If the control of acts and decisions, which have been met originally by humans, are increasingly delegated or transferred to unmanned systems or programs [...] the most relevant criterion for a legal distinction becomes human control».

A concept that might be useful from this perspective and which has been developing over the last few years to try to find a compromise, acting as a sort of mitigating factor, between supporters and opponents of AWS is that of “meaningful human control”.<fnref n="27" /> This principle, that has been devised in 2015 by the NGO Article 36 is meant to reiterate that “humans not computers and their algorithms should ultimately remain in control of, and thus [be] morally responsible for relevant decisions about (lethal) military operations”.

Indeed, if everyone's agree that the lessened role of human operators over the vital decisions of searching, assessing and whether attacking or not can be identified as the most challenging issue from either a legal or moral perspective, retaining adequate human control might work as a keystone to overcome existing obstacles to the acceptance of AWS as legitimate weapons.

Holding humans accountable by keeping them as decision-makers is nevertheless not a controversy-free task. The first problem that must be considered relates to the kind of technologies applied. AI is more and more moving from algorithms to deep learning solutions whose understanding is far beyond “the reach of a human brain”.<fnref n="28" /> As a result this brings along with it other 2 questions:

1. How can humans intervene in the decision-making process if we are not able to understand what are the factors which have determined such a decision? In a few words, the problem here is transparency.

2. The second question is a more practical, even though still an important one. If we allow humans to stay on the loop, what is the advantage of having these systems at all? AWS as all AI

<footnote n="24">²⁴ Sauer, F. (2020). "Stepping back from the brink: Why multilateral regulation of autonomy in weapons systems is difficult, yet imperative and feasible. *International Review of the Red Cross*, 102(913), 235-259. doi:10.1017/S1816383120000466</footnote>

<footnote n="25">²⁵ Lewis, J., *The Case for Regulating Fully Autonomous Weapons*, the Yale Law Journal, 2015.</footnote>

<footnote n="26">²⁶ Noone, G., P., & Noone, D., C., *The debate over Autonomous Weapons Systems*.</footnote>

<footnote n="27">²⁷ Article 36, *Key elements of meaningful human control*, April 2016.
https://article36.org/wp-content/uploads/2016/04/MHC-2016-FINAL.pdf</footnote>

<footnote n="28">²⁸ Chehtman, A., *New Technologies Symposium: Autonomous Weapons Systems*, Opinio Juris, 2019.
http://opiniojuris.org/2019/05/08/new-technologies-symposium-autonomous-weapons-systems-why-keeping-a-human-on-the-loop-is-not-enough/</footnote>
technologies are able to process big amount of data and therefore reach a decision in less than a few seconds giving a military advantage, how can we expect to have humans scrutinize these complex decisions – that we are not able to understand – in the same amount of time in order to preserve this advantage? It is practically impossible.

Therefore, even if from a regulative point of view this concept might be used to eventually find a common ground upon which a regulatory framework might be designed this is yet to be achieved. Moreover, the concept of meaningful human control is still in its embryonic phase as it shows the fact that the different actors involved understand it in different ways. Which phases should be considered when assessing the level of human control? is the design phase more or less important than the development and deployment ones? Not all the states at the international level agree on which kind of human control should be essential in determining the level of control over AWS.

A major cause for this confusion can be attributed to another key feature of the debate which is its future-orientation. These characteristics together with the strategic relevance of these systems, contribute in a fundamental way in making it difficult, to the actors involved, to formulate appropriate constraints to which then stick and commit.

## CONCLUSION

Even though it is not yet clear whether AWS has been already fully developed glimpses of what we might face in the future have been already provided over the last few years. The 2020 Nagorno-Karabakh war that was labelled by many experts as the first automated war and current developments in the Russian war of aggression toward Ukraine are just two examples. These enhanced capabilities of new technologies to perform tasks until now reserved to human operators have contributed to bring to the fore both legal and ethical concerns over their deployment.

On the one hand the development of such systems seems to be a major threat, not just from a legal and ethical perspective but also from a global security one. On the other hand, there is a profound disagreement between the main actors involved, that tend to perceive it in radically different ways.

Disagreements apart, however, the recent rise of the concept of “meaningful human control” was like a ray of sunshine in the darkness of the debate. Indeed, the concept was conceived as a potentially mitigating factor between the different perspectives, since most of the actors seem to agree on the desirability of having, for different reasons, humans rather than robots involved in some phases of the whole process. Despite the initial optimism, the stalemate about what must be done is still here though. The fact is that the US has rejected the call for regulating or banning killer robots calling instead for a “non-binding code of conduct”<fnref n="29" /> came as a smoking gun of that.

Given the strategic importance of these systems indeed and the lack of clarity surrounding the debate, formulating appropriate responses to the issue is challenging. Therefore, what we are still missing today is probably the starting point for the regulation of AWS, which consists of a clear and unique definition that wouldn't leave any grey zone.

Another challenge comes from the perspective used to frame the issue, that in turn affects the response. Changing the lens from the military to the humanitarian one would be a good step to overcome the stalemate. Keep reasoning in terms of military gains would in fact do nothing but feed the vicious circle in which we are trapped today. The moving force toward regulation should be the awareness of the disruptive effect that such systems might be able to produce. Only this can drive us to the same outcome that 50 years ago the development of nuclear weapons led us to.

<footnote n="29">²⁹ https://www.theguardian.com/us-news/2021/dec/02/us-rejects-calls-regulating-banning-killer-robots</footnote>
BIBLIOGRAPHY/ References

Amoroso, Daniele (2020) Autonomous Weapons Systems and Meaningful Human Control: Ethical and Legal Issues. Springer.

Annemarie, Shea (2021) “The Legal and Ethical Challenges Posed by Lethal Autonomous Weapons,” Trinity College Law Review 24, pp. 117-133.

Chehtaman, Alejandro (2019) New Technologies Symposium: Autonomous Weapons Systems – Why keeping a “human on the loop” is not enough. [Online]http://opiniojuris.org/2019/05/08/new-technologies-symposium-autonomous-weapons-systems-why-keeping-a-human-on-the-loop-is-not-enough/

Chochia, Archil; Sicat, Eden Grace Niñalga (2023). “Ethics and Modern Technologies: Example of Navigating Children’s Rights in an AI-Powered Learning Environment. In: Ramiro Troitiño, D.; Kerikmäe, T.; Hamuťák, O. (Ed.). Digital Development of the European Union. (129–141). Springer, Cham. DOI: 10.1007/978-3-031-27312-4_9.

Gregory P. Noone Dr. and Diana C. Noone Dr. (2015) The Debate Over Autonomous Weapons Systems, 47 Case W. Res. J. Int’l L. 25. https://scholarlycommons.law.case.edu/jil/vol47/iss1/6

Heyns Christof (2013) Report of the Special Rapporteur on extrajudicial, summary, or arbitrary executions. (“The UN Special Rapporteur on extrajudicial, summary or arbitrary…”) United Nation Report.

Human Rights Watch (2014) Shaking the Foundations. The Human rights implications of Killer robots. [Online]https://www.hrw.org/report/2014/05/12/shaking-foundations/human-rights-implications-killer-robots

Joamets, K.; Chochia, A. (2020). Artificial Intelligence and its Impact on Labour Relations in Estonia. Slovak Journal of Political Sciences, 20 (2), 255–277. DOI: 10.34135/sjps.200204

Joamets, K.; Chochia, A. (2021). Access to Artificial Intelligence for Persons with Disabilities: Legal and Ethical Questions Concerning the Application of Trustworthy AI. Acta Baltica Historiae et Philosophiae Scientiarum, 9 (1), 51–66. DOI: 10.11590/abhps.2021.1.04.

Knight Will (2017) The dark secret at the heart of AI. [Online] https://www.technologyreview.com/2017/04/11/5113/the-dark-secret-at-the-heart-of-ai/

Kohv, M.; Chochia, A. (2021). Unmanned Aerial Vehicles and the International Humanitarian Law. Case study: Russia. In: Mölder, H.; Sazonov, V.; Chochia, A.; Kerikmäe, T. (Ed.). The Russian Federation in the Global Knowledge Warfare: Influence Operations in Europe and Its Neighborhood. (213–231). Springer. DOI: 10.1007/978-3-030-73955-3_11.

Lewis, John (2015) The case for regulating Fully Autonomous Weapons. (“The Case for Regulating Fully Autonomous Weapons – ResearchGate”) Yale Law Journal, Volume 124, nr. 4. https://www.yalelawjournal.org/comment/the-case-for-regulating-fully-autonomous-weapons

Sauer, F. (2020). “Stepping back from the brink: Why multilateral regulation of autonomy in weapons systems is difficult, yet imperative and feasible. *International Review of the Red Cross*, *102*(913), 235-259.
doi:10.1017/S1816383120000466

The Guardian (2021) US rejects calls for regulating or banning “killer robots”. [Online]https://www.theguardian.com/us-news/2021/dec/02/us-rejects-calls-regulating-banning-killer-robots.

United Nations Convention on Certain Conventional Weapons. Geneva Convention on the Protection of Victims of International Armed Conflicts. [Online]https://ihl-databases.icrc.org/ihl/INTRO/470

Wolff Heintschel von Heinegg, Robert Frau, Tassilo Singer (2018) Dehumanization of Warfare. Legal implications of New Weapon Technologies. Springer Cham. DOI: https://doi.org/10.1007/978-3-319-67266-3
# The phenomenon of legal professions being replaced by artificial intelligence – real danger or just a myth?

RUXANDRA ANDREEA LĂPĂDAT

Ph.D STUDENT, BUCHAREST UNIVERSITY OF ECONOMIC STUDIES

**Abstract:** In a world that seems to have moved completely online, the temptation to think that the physical world is abandoned and everything can be done in the virtual environment from now on is obvious. But if we look around the corner, we will still find ourselves, those in physical reality. The illusion of the easiness and practicality of the virtual environment is maintained until the appearance of the first palpable problem, which directly impacts our quality of life. Until the first serious health problem, until the first risky legal process in which we are involved. The need to have an empathetic human contact with a specialist to whom we can confess and who can offer us real and honest solutions will always be present and extremely difficult to replace by a robotic factor. Despite the fact that the existence of an instinct to turn to the advice of some AI at the expense of human contact in such situations is hard to imagine, we have nevertheless carried out a thorough analysis in relation to the mediatized initiatives with the potential to completely replace some legal professions with AI. As a result, we will find that, although we are bombarded with a multitude of scenarios in which these robots are already functional and in current use, we are in the presence of an exacerbation of technological evolution at this time. The way to transfer critical thinking and human-to-artificial intelligence empathy has not been decoded yet, and simple imitations of these exclusively human skills can lead to disastrous consequences.

**Keywords:** digitization, legal professions, ChatGPT, robot

With the onset of the pandemic, the topic of using the benefits of remote technical means, as well as those involving a certain type of artificial intelligence, has grown in direct proportion with the severity of the consequences of the pandemic. Governments have been forced to quickly adopt solutions that allow a life similar to the one existing before the pandemic, easing the restrictions and their effects generated by a health crisis of proportions.

After the mitigation of the virulence of the pandemic, which at the same time allowed the return to an almost normal life, the technical solutions adopted on the run were kept, moreover, their effects were briefly analyzed, quickly deciding to expand the use and format of these solutions in the future. Today, we are witnessing aggressive marketing on the rapid proliferation of software that could successfully replace various legal professions, as well as on their unsurpassed efficiency. After carefully analyzing these steps, as well as the news that appeared regarding this aspect, I decided to create a realistic X-ray, which goes beyond the superficial layer of a summary information, as well as the sensationalism aimed at by some publications.

In addition to the ethical discussions raised on the side of these initiatives, we will try to shed light including from the point of view of the technical capabilities that an AI possesses, as well as its limitations, at this time. We are also facing a phenomenon of fake news in the legal field, as well as an exacerbation of the speed of the development of artificial intelligence, which does not take into account the global rudimentary level at which the confluence of legal and technical is located, nor the fundamental incompatibility between a humanistic science and a possible translation of it through the lens of an exact science.

We consider the following topics of discussion appropriate:

## a) the appearance of robot judges:

A first phenomenon that appeared regarding the integration of AI in the legal field was related to the automatization of the judge's duties, in an attempt to relieve the courts of the increased number of legal requests. Estonia would have been a pioneer in this field, continuing its reputation as a
European country promoting the digitalization of public services<fnref n="1" />, being one of the first countries to support the need to declare Internet access as a human right<fnref n="2" />. So, how does this robot judge implemented in Estonia work, or, at least, how was this aspect speculated online? With a simple online search, we quickly find either articles overflowing with enthusiasm, looking with optimism towards the rapid technological evolution in the judicial sector, culminating in the invention of a robot judge by Estonia, or headlines clearly worried about the future of justice<fnref n="3" />. The articles dating back to 2019 do not provide official sources to substantiate the existence or use of this type of AI in Estonian courts, most of them being consecutive takeovers and reformulations of a single article, probably appearing as a result of a faulty translation. We mention this aspect because the first international article published on this subject seems to be that of the American magazine Wired<fnref n="4" />, developed by David Engstrom, an expert in digital governance at Stanford University<fnref n="5" />. However, this article only mentions the intention to develop a “robot judge” that could resolve disputes over claims in court whose damage does not exceed 7,000 EUR (about 8,000 USD), and not that this robot already exists, judging cases.

In the context of an advanced search, however, we find an official statement from the Ministry of Justice of Estonia, which, surprisingly, completely denies this information, stating that they are not developing a robot judge for the small claims procedure, nor general court procedures to replace the human judge, on 16.02.2022.

Specifically, the Ministry of Justice is looking for opportunities to optimize and automate procedural steps in all types of procedures, including procedural decisions, if possible. At this moment, it is mentioned in the official statement that one of the objectives is for all judicial cases to be carried out digitally, and for the processes to be optimized and automated as much as possible. The confusion started in the context of Estonia's plan to automate a national payment order procedure, a simple procedure that is almost fully automated at the moment and could be fully automated in the future.<fnref n="6" />

Following the unmasking of this non-existent robot judge, we continue to investigate other similar initiatives. In this sense, we find another initiative of a robot judge type in China. After a thorough analysis, we find that, indeed, the digitization of the courts seems to reach new heights, without creating a robot judge. Among the relevant aspects found in the online articles, we mention the following aspects:

* an application called “Smart Court SoS” analyzes court cases for references and provides judges with recommendations on both laws and regulations;

* the same application prepares supporting documents for arguing decisions regarding the settlement of cases, an aspect that could prevent errors in the verdicts of human judges;<fnref n="7" />

<footnote n="1">¹ According to international analyses, the most relevant being represented by the OECD – Government at a Glance 2021 – Country Fact Sheet – Estonia: https://www.oecd.org/gov/gov-at-a-glance-2021-estonia.pdf</footnote>

<footnote n="2">² Right to access the Internet: the countries and the laws that proclaim it – Diplo, 2011, https://www.diplomacy.edu/blog/right-to-access-the-internet-countries-and-laws-proclaim-it/</footnote>

<footnote n="3">³ Can AI replace a judge in the courtroom? UNSW Sydney, 2021 – https://newsroom.unsw.edu.au/news/business-law/can-ai-replace-judge-courtroom?fbclid=IwAR0EXRAp8pOlJXYt5ZuwUJeqifR117i1NRxQnZQKE7PREBeU5Tw878Eg1yo</footnote>

<footnote n="4">⁴ Can AI Be a Fair Judge in Court? Estonia Thinks So, Wired, 2019, https://www.wired.com/story/can-ai-be-fair-judge-court-estonia-thinks-so/</footnote>

<footnote n="5">⁵ David Freeman Engstrom, Biography – https://law.stanford.edu/directory/david-freeman-engstrom/</footnote>

<footnote n="6">⁶ *Estonia does not develop AI Judge*, Ministry of Justice, 2022 – https://www.just.ee/en/news/estonia-does-not-develop-ai-judge</footnote>

<footnote n="7">⁷ *AI helps judges decide court cases in China*, AI business 2022, https://aibusiness.com/verticals/ai-helps-judges-decide-court-cases-in-china</footnote>
● we also learn that, in the event that a judge does not share the AI's recommendation regarding the verdict that should be given in a particular case, he should justify his different decision. This aspect would be attributed to the non-unitary jurisprudence existing on Chinese territory, the Supreme Court issuing an act that obliges the use of this AI to standardize the decisions given in identical cases.

Although the steps really sound initiatory, without entering into the debate of the ethical aspects concerning the use of the existing technical components in the Chinese courts these days, we note the fact that no official source has confirmed the information according to which a human judge should justify a decision different from the recommendation of the AI, subject to the fact that no sources in Chinese were consulted, but only official sources translated into international languages (for example, the website of the Ministry of Justice of the People's Republic of China, as well as the website of the Supreme People's Court<fnref n="8" />).

We highlight the need for detailed and fundamental information about the digitalization initiatives of some legal professions, in order to have a real empirical perspective on the evolution of the integration of technology in the context of the administration of justice. At this moment, there are various initiatives to automate the administrative aspects of judicial procedures, with an emphasis on ODR (online dispute resolution), and more and more advanced methods are being tested to go further and replace or help the judge in the context of decision-making. However, we are far from successfully replacing or automating human critical thinking and making such far-reaching decisions as those in justice. We believe that we are only at the beginning of awareness of the technical limitations and ethical issues raised by the use of AI, as well as the beginning of effective risk analyzes of the use of AI at the lowest level in court, and we will then elaborate the solid legal framework of the functioning and controlled use of AI in justice.

### b) replacement of lawyers – legal advice provided by AI

Another profession hit by fake news and a hypothetical early disappearance is the legal profession of lawyers. The first large-scale initiative of this kind appeared in 2016, when a software called ROSS was hired by a US law firm to assist with legal consultancy work in the field of insolvency. Of course, the AI has never done independent work that rivals the capabilities of a human lawyer, largely filling out the necessary legal and doctrinal research work of the already existing team of lawyers in the US firm Baker & Hostetler's cases. Basically, the AI in question reduced the necessary time allocated to a legal research on the applicable legislation and jurisprudence, without making value judgments or interpreting the legal provisions in force. A vital aid in the context of rapid execution of qualitative research, yet remaining a mere technical aid with no intellectual capacity to think up defense strategies for clients or hold pleadings in court.

This approach was succeeded by the robot lawyer initiative created by the American company DoNotPay, which was followed by severe public consequences for the initiator.

Startup DoNotPay, which self-proclaimed inventing “the world’s first robot lawyer,” intended to use AI in court pleadings, teaching defendants how to respond to assigned judges.

Founder Joshua Browder enthuses that “law is almost like code and language combined, so it’s the perfect use case for AI.” We believe that nothing could be more false, minimizing the essential human component in the context of the administration of justice.

In addition, the founder mentioned that measures on preventing AI weaknesses were also taken, in order to avoid problems with exaggeration of facts or the existence of an overly polite behavior that responds to everything the judge says – including rhetorical statements. Another effort by the company to encourage the use of this robot lawyer was pecuniary in nature, with DoNotPay agreeing to cover any fines and defendants to be compensated for participating in the experiment.

<footnote n="8">⁸ The Supreme People's Court in China – https://english.court.gov.cn/</footnote>
What's more, the DoNotPay founder said he would pay anyone with an upcoming US Supreme Court case $1 million to wear AirPods and let his robot lawyer provide legal assistance in that case.<fnref n="9" />

Following the development of this initiative, which was supposed to debut on February 22, 2023, we learn that it has been withdrawn. The reason presented by the CEO would be the pressures carried out by the national bars who would have felt threatened by the capabilities of this invention

We couldn't find any official statement on this, so we don't know if these pressures existed, or if the company realized the multitude of legal and ethical issues it could face in the context of actually using AI in court, so it withdrew the prototype.

The issue of court records was also raised, with the AI using records to function. Thus, DoNotPay's technology could not have been legal in most US courtrooms, as some states require all parties to consent to being recorded, which precludes the possibility of a robot lawyer participating in multiple courtrooms<fnref n="10" />.

We wonder, however, whether this initiative can be categorized as a evasion of admission to the legal profession, and thus, practicing without permission? In order to be able to defend citizens in court, however, prior training and a passing exam are required, subsequently acquiring the status of lawyer and the right to practice in the field, which could not be transferred by the persons holding it to an AI. This precedent is also dangerous for the stability of the legal profession, as well as for its prestige.

Despite all the previous news, the main purpose of which was to exaggerate the reality and improve the PR of the company involved. We believe that there is no real danger of replacing lawyers with robots at this time. Ensuring an effective legal defense is a complex process, which starts from an analysis and a correct legal framing of the facts, carried out by the lawyer, facts related most of the time by the client in a simple, informal, unclear, distant language by the wooden legal language. We do not believe that an AI currently possesses this human intellect-like ability to legally frame facts, to develop an optimal defense strategy, to anticipate the other side's defenses and counter them, to correlate with practicalities known only to a lawyer from his past experience, not to mention the impact of a person that can support human empathy and demand a just verdict tailored to a specific situation.

### c) ChatGPT phenomenon

ChatGPT (Chat Generative Pre-Trained Transformer) is a chatbot software with artificial intelligence programmed to answer any questions asked by users, in any field, including legal, containing 175 billion machine learning parameters, updated until the year 2021¹¹.

A chatbot is a software application designed to mimic a human-like conversation based on user cues. It's part of a new generation of artificial intelligence systems that can converse, generate readable text on demand, and even produce novel images and videos based on what they've learned from a vast database of digital books, online writing and other media. The popularity of this software is unprecedented, reaching over one million users in less than a week after its release.<fnref n="12" />

How does this software impact the legal field?

First of all, it has been used since the first day as a tool available for students, for the development of various topics in the context of fulfilling the requirements of the courses they follow (reports, analyses). This aspect can raise long-term problems in the development of personal skills

<footnote n="9">⁹ DoNotPay says it's pivoting from plans to argue speeding tickets in court with AI, USA Today Tech – https://eu.usatoday.com/story/tech/2023/01/09/first-ai-robot-lawyer-donotpay/11018060002/</footnote>

<footnote n="10">¹⁰ AI-powered "robot" lawyer won't argue in court after jail threats, CBS News, 2023 https://www.cbsnews.com/news/robot-lawyer-wont-argue-court-jail-threats-do-not-pay/</footnote>

<footnote n="11">¹¹ Tech Target, 2023, https://www.techtarget.com/searchenterpriscai/definition/GPT-3</footnote>

<footnote n="12">¹² ChatGPT Statistics for 2023: Comprehensive Facts and Data, Demand Sage, 2023 https://www.demandsage.com/chatgpt-statistics/</footnote>
that are acquired during university studies and that are vital in the context of carrying out activity in the legal field. We are talking here about building critical thinking, increasing memory capacity through learning an increased amount of information, as well as analytical and research skills, which can be sabotaged by using these tools. In addition, various issues regarding copyright and permission to use the material presented by ChatGPT are also raised. I directly asked the software if its answers were original, and its response clarified the situation from a legal point of view, pointing out that the answers do not belong to it<fnref n="13" />:

*Q: Are the content and answers you produce original?*

*A: No, the content I produce is generated based on patterns in the datasets I have been trained to use and does not come from my own thoughts or experiences. I can provide relevant information and answer questions based on the information I have been trained, but the content I produce is not original in the sense that it is not created from scratch by me.*

Also, if we ask ChatGPT to, in the context of developing an answer, insert the bibliographic references on which its compiled answer is based, we will receive a series of references, but we cannot be sure that they are complete or correctly cited, since the references are not highlighted distinctly for each idea taken over. At the same time, the links it presents are not updated, the information being available online until 2021.

On the same line of ideas, the team from the University of Minnesota <fnref n="14" /> tested ChatGPT in the context of some exams within the related Faculty of Law, in order to carry out a study on the real capabilities of AI. They chose four separate final exams in the following subjects: Constitutional Law, Labor Law, Tax Law and Torts, to be passed by this software. The results of ChatGPT were anonymized and mixed with the works of real students, being later sent for teacher's evaluation. ChatGPT passed all four exams with minimum passing marks. The authors of the study dedicated a chapter to the study and AI weaknesses, emphasizing among them the lack of coherence in the approach to the cases, as well as the omission of the treatment of some aspects that were not expressly mentioned in the phrasing of the exam subjects. As a conclusion, the authors of the study highlighted an amazing, albeit uneven, performance, suggesting that ChatGPT represents both a promise for the future and a considerable danger, expecting such language models to be important tools for practicing lawyers, such as and a great help to students who use them (legally or illegally) in law exams. Going forward, a study by two experts from the Stanford Center for Legal Technology <fnref n="15" /> revealed shocking results regarding AI's future possibility to pass including the U.S. Bar Exam. The authors concluded that AI significantly outperformed the base rate of random guessing, and without any adjustment, currently achieves a passing grade on two subjects on the bar exam, confirming his general understanding of the legal domain.

Second, could it be used as an auxiliary in the work of professionals in the field? In the main, we think so, given the rigorous testing of correctness provided by AI. In this regard, the first news has already appeared with judges testing the use of ChatGPT in the context of court decision-making. We cite the case of the judge in Colombia who stated that he used ChatGPT in the context of a decision about whether an autistic child's insurance should cover all or only part of the costs of his medical treatment<fnref n="16" />. The judge's statement should not be taken out of context, but understood

<footnote n="13">¹³ Research conducted by the authors through direct use of ChatGPT.</footnote>

<footnote n="14">¹⁴ The study can be consulted in detail here: https://ssrn.com/abstract=4335905 or http://dx.doi.org/10.2139/ssrn.4335905
Choi, Jonathan H. and Hickman, Kristin E. and Monahan, Amy and Schwarcz, Daniel B., ChatGPT Goes to Law School
(January 23, 2023).</footnote>

<footnote n="15">¹⁵ Bommarito, Michael James and Katz, Daniel Martin, *GPT Takes the Bar Exam* (December 29, 2022). Available at the
following web page: https://ssrn.com/abstract=4314839 sau http://dx.doi.org/10.2139/ssrn.4314839</footnote>

<footnote n="16">¹⁶ *Colombian judge says he used ChatGPT in ruling*, The Guardian, 2023 -https://www.theguardian.com/technology/2023/feb/03/colombia-judge-chatgpt-ruling</footnote>
through the prism of a man excited to check the current advances in technology, without extrapolating and feeding the fake news phenomenon that captured the statement. The reality is that the judge did not base his ruling on this software<fnref n="17" />, simply giving an interview on a local radio about the fact that, considering the application of Law no. 2213/2022 of Colombia encouraging the use of technological tools in the legal field, it also tested ChatGPT in a case to see if it can provide a fair solution, not the first time it tries to observe the usefulness of AI in the justice system. The solution given by ChatGPT was correct, it applied the law exactly, but the judge had already made this assessment and decided the solution, not being influenced by this application or leaving the final decision up to him.

The AI's interpretation of the legislative provisions can be useful, in the context in which it has an impressive database of doctrine, citing the sources on the basis of which it makes the interpretation. However, we do not understand exactly what kind of compilation and interpretation ChatGPT does. Does it restate information it already has, draw conclusions from it, or offer an original interpretation? If we ask the software, we still get the information that it does not have the ability to interpret the legal provisions, emphasizing that its understanding of this information is limited to the patterns and associations it has learned from this data, being able to provide information about the provisions legal and can answer questions to the extent possible, but cannot provide legal advice or interpretation. Basically, the accuracy of its information depends on how well the information exposed by the user matches the data sets that ChatGPT holds.

Of course, his answers that eliminate the possibility of interpretation <fnref n="18" /> they are not to be believed word for word, but we share the same opinion. We believe that at this point, although the software presents very good coherence, an impressive variety of information, as well as a correlation of them beyond expectations, we cannot discuss a specialized AI that will completely transform the legal field as we know it.

Finally, we express our opinion that the danger of using this software also comes from the fact that it is free software, available to anyone who has access to the Internet, the application not being so strong from the point of view of the security of its coding. Some users managed in early December 2022 to crack the initial code of the software that holds certain censorship parameters (for example, censoring information with sexual, violent content), using various techniques to bypass these restrictions. They successfully tricked ChatGPT into giving instructions on how to create a Molotov cocktail or a nuclear bomb, or generate arguments in the style of a neo-Nazi. In addition, ChatGPT was tricked into presenting favorable arguments regarding the Russian invasion of Ukraine<fnref n="19" />.

The consequences of these reports are very serious, and may have an echo even in the legal field. There may be situations where individuals may request legal advice from this software regarding the legal or illegal nature of an action they wish to undertake in the near future. If we are not clear what this software will advise a person in general, what do we do if it is diverted from its purpose by advising people to commit crimes? We wonder how we will be able to control this phenomenon in the future, a simple disclaimer that the content generated by ChatGPT does not constitute legal advice is not enough.

<footnote n="17">¹⁷ Colombia Judge Uses ChatGPT In Ruling, Sparks Controversy, NDTV, 2023 -https://www.ndtv.com/feature/colombia-judge-uses-chatgpt-in-ruling-sparks-controversy-3754717</footnote>

<footnote n="18">¹⁸ AI proves that it owns the definition of interpretation in the legal field, providing the following explanation: Interpretation of legal provisions refers to the process of understanding the meaning and intent of laws and regulations. This involves analyzing the language of the provisions and considering how they apply to specific situations. Interpretation of legal provisions is important to ensure consistent and fair application of the law and is usually carried out by legal experts such as judges, lawyers and scientists. Interpretation of statutory provisions can have a significant impact on the outcome of legal cases and can help ensure that the law is applied in a way that is consistent with its intended purpose.</footnote>

<footnote n="19">¹⁹ ChatGPT definition, Wikipedia – https://en.wikipedia.org/wiki/ChatGPT</footnote>
As a conclusion, we note that this software presents significant developments, which could in the future change the world of justice as we know it today. However, we believe that claims that legal professionals will be replaced by robots are exaggerated, with even ChatGPT noting that it is unlikely that AI will ever be more than high-performance tools to support human resource work<fnref n="20" />.

When publicly approaching all these digital initiatives, as well as its capabilities, we recommend caution. Avoiding exacerbating the alleged capabilities of AI at this moment, as well as the conspiratorial promotion of a gloomy future in which justice will be replaced by robots, are vital, in order to stop the weakening of the image of justice, which has already been constantly attacked in recent decades. It is true that we cannot fully know the future, but a dose of realism and correct information about these initiatives will reveal the actuality and the need to respect the ancient principles of law, which have led justice on its uninterrupted path for over 2000 years. At the same time, these initiatives can always be subject to prohibitions, precisely aiming to prevent the situation of completely robotizing society and impacting the labor market at an unprecedented level, as well as the quality of justice offered to people.

<footnote n="20">²⁰ ChatGPT's answer to the question of whether AI will replace humans in the future It is unlikely that AI will completely replace humans in the future. While AI has the ability to automate certain tasks and make certain processes more efficient, it is unlikely to fully replace human capabilities in areas that require human creativity, empathy and judgment. Instead, AI and humans are likely to complement each other and work together across industries and domains to achieve common goals. However, the impact of AI on the labor market and the economy is a complex issue and will depend on various factors, such as the speed of technological progress, government policies and societal attitudes towards AI.</footnote>
Responsible innovation. confidentiality, privacy and
data protection

DANIELA DUȚĂ<fnref n="1" />

PHD. CANDIDATE, INSTITUTE OF LEGAL RESEARCH „ACAD. ANDREI RĂDULESCU” OF THE ROMANIAN ACADEMY

***Abstract:*** In the era of technology, artificial intelligence and digitalization, responsible development and innovation are more important than ever. Confidentiality, privacy and data protection are important aspects of responsible innovation. These refer to individuals' right to protect their personal information and have control over how it is collected, stored and used, starting with the moment of conception and, implicitly, throughout the lifetime of the resulted technological product. To promote responsible innovation, it is important for technology developers to implement appropriate security and data protection measures and to comply with applicable legislation. This can help develop technologies that are beneficial to society and individuals while protecting the fundamental rights and freedoms of users. In addition to complying with data protection regulations, transparency and user's information, security, data minimization/ anonymization and privacy impact assessment, what other aspects should be considered for responsible innovation?

**Key words:** artificial intelligence, confidentiality, privacy, data protection, fundamental rights, security

# 1. INTRODUCTION

In the current age of rapid technological advancement, responsible development and innovation are more important than ever. As technology continues to transform every aspect of our lives, it is essential to ensure that this transformation is done ethically and with responsibility. The present research represents an overview of the concept of responsible innovation and its importance in the current era of technology, artificial intelligence and digitalization and the importance of confidentiality, privacy and data protection in responsible innovation.

Increasingly, a large proportion of innovation is taking place in the digital economy. Innovation in business models based on Big Data, deep-learning algorithms and Internet of Things (IoT) is expected to dramatically alter many paradigms such as employment, communication, health and productivity that are fundamental to our lives. Acting responsibly in this area is therefore of primary importance in shaping society and the values of tomorrow.<fnref n="2" />

Confidentiality refers to the safeguarding of personal, sensitive, or private information, by protecting data from unauthorized access, use, or disclosure, and in compliance with contractual or legislative provisions. It is essential to ensure that users have control over how their personal information is collected, stored and used, from the inception of the product through its entire lifecycle.

Privacy is also a vital aspect of responsible innovation, users have the right to control their personal information, and developers must ensure that they are transparent about how user data is collected and used, and users must be able to make informed decisions about whether to share their information.

<footnote n="1">¹ Daniela Duță is a PhD student at the Institute of Legal Research „Acad. Andrei Rădulescu” of the Romanian Academy. She can be contacted at ghituleasad@yahoo.com</footnote>

<footnote n="2">² Marc Dreyer, Luc Chefneux, Anne Goldberg, Joachim Von Heimburg, Norberto Patrignani, Chris Shilling, Monica Schofield, Responsible Innovation: A Complementary View from Industry with Proposals for Bridging Different Perspectives, Sustainability, 2017; https://doi.org/10.3390/su9101719, Available online: Sustainability | Free Full-Text | Responsible Innovation: A Complementary View from Industry with Proposals for Bridging Different Perspectives (mdpi.com) (accessed on 05.05.2023)</footnote>
Data protection is also a critical consideration for responsible innovation, developers must implement appropriate technical and security measures to protect the data subject from unauthorized access, theft, or misuse. This includes data encryption, data minimization/anonymization, secure data storage and access controls, to ensure that only authorized personnel can access the data.

Digital innovation should not be based on algorithms or databases that lead to manipulation of information, infringement of freedom of expression, shortcomings in data protection and privacy or freedom of association. Neither should it negatively affect the right to education and multilingualism, consumer rights and capacity building in the context of the right to economic development.<fnref n="3" />

There are other aspects that should be taken into consideration for responsible innovation such as social responsibility and the potential impact of the products and services on society; the developers must minimize any adverse effects and maximize the social benefits of their innovation, product safety. This can help ensure that technologies are beneficial to society and individuals while simultaneously protecting the fundamental rights and freedoms of users, but these aspects are not the subject of the present research.

Several research methods have been used in documenting the issues under scientific research, analyzed from a legal point of view. Among these, the *comparative method* is used to identify the similarities and differences regarding responsible innovation and the responsibility principle, and the data protection accountability principle. Through the *legal method*, the national and European legislative framework was identified and that could be applicable.

## 2. APPLICABLE RECOMMENDATIONS, GUIDELINES, AND LAW PROVISIONS

There are several recommendations, guidelines and legal provisions related to the responsible innovation, including:

**The Artificial Intelligence Act**<fnref n="4" /> – This proposal imposes some restrictions on the freedom to conduct business (article 16) and the freedom of art and science (article 13) to ensure compliance with overriding reasons of public interest such as health, safety, consumer protection and the protection of other fundamental rights ('responsible innovation') when high-risk AI technology is developed and used. Those restrictions are proportionate and limited to the minimum necessary to prevent and mitigate serious safety risks and likely infringements of fundamental rights<fnref n="5" />.

Artificial intelligence is a rapidly developing family of technologies that require novel forms of regulatory oversight and a safe space for experimentation, while ensuring responsible innovation and integration of appropriate safeguards and risk mitigation measures. To ensure a legal framework that is innovation-friendly, future-proof and resilient to disruption, national competent authorities from one or more Member States should be encouraged to establish artificial intelligence regulatory sandboxes to facilitate the development and testing of innovative AI systems under strict regulatory oversight before these systems are placed on the market or otherwise put into service.<fnref n="6" />

<footnote n="3">³ Marc Dreyer, Luc Chefneux, Anne Goldberg, Joachim Von Heimburg, Norberto Patrignani, Chris Shilling, Monica Schofield, Responsible Innovation: A Complementary View from Industry with Proposals for Bridging Different Perspectives, *Sustainability* 2017; https://doi.org/10.3390/su9101719, Available online: *Sustainability* | Free Full-Text | Responsible Innovation: A Complementary View from Industry with Proposals for Bridging Different Perspectives (mdpi.com) (accessed on 05.05.2023)</footnote>

<footnote n="4">⁴ Proposal for a Regulation of the European Parliament and of the Council laying down harmonized rules on artificial intelligence (ARTIFICIAL INTELLIGENCE ACT) and amending certain union legislatives acts, Brussels, 21.4.2021, COM(2021) 206 final, 2021/0106(COD)</footnote>

<footnote n="5">⁵ Ibid., Context of the proposal, 3.5</footnote>

<footnote n="6">⁶ Ibid., para. 71</footnote>
**The European Declaration on Digital Rights and Principles for the Digital Decade**<sup>7</sup> presents the EU's commitment to a secure, safe and sustainable digital transformation that puts people at the center, in line with EU core values and fundamental rights. <sup>8</sup>

Because the digital transformation affects every aspect of people's lives and presents challenges for our democratic societies, our economies and for individuals, the Declaration should serve as a reference point for businesses and other relevant actors when developing and deploying new technologies. Promoting research and innovation is important in this respect.<fnref n="9" /> The Declaration aims to promote that:

- People are at the center of the digital transformation in the European Union. Technology should serve and benefit all people living in the EU and empower them to pursue their aspirations, in full security and respect for their fundamental rights ensuring responsible and diligent action by all actors, public and private, in the digital environment.<fnref n="10" />

- Technology should be used to unite, and not divide, people. The digital transformation should contribute to a fair and inclusive society and economy in the EU, making sure that the design, development, deployment and use of technological solutions respect fundamental rights, enable their exercise, and promote solidarity and inclusion.<fnref n="11" />

- Everyone should be empowered to benefit from the advantages of algorithmic and artificial intelligence systems including by making their own, informed choices in the digital environment, while being protected against risks and harm to one's health, safety, and fundamental rights, promoting human-centric, trustworthy and ethical artificial intelligence systems throughout their development, deployment and use, in line with EU values.<fnref n="12" />

- Everyone should have access to digital technologies, products and services that are by design safe, secure, and privacy-protective, resulting in a high level of confidentiality, integrity, availability, and authenticity of the information processed, protecting the interests of people, businesses and public institutions against cybersecurity risks and cybercrime, including data breaches and identity theft or manipulation. This includes cybersecurity requirements for connected products placed on the single market.<fnref n="13" />

The Organization for Economic Co-operation and Development (OECD) Recommendation of the Council on Artificial Intelligence<sup>14</sup> identifies five complementary values-based principles for the responsible stewardship of trustworthy AI and calls on AI actors to promote and implement them: a) inclusive growth, sustainable development and well-being; b) human-centered values and fairness; c) transparency and explainability; d) robustness, security and safety; d) and accountability.

Based on the accountability principle, the AI actors should be responsible for the proper functioning of AI systems and for the respect of the above principles, based on their roles, the context and consistent with the state of art.

<footnote n="7"><sup>7</sup> European Declaration on Digital Rights and Principles for the Digital Decade 2023/C 23/01, PUB/2023/89
JO C 23, 23.1.2023, p. 1-7</footnote>

<footnote n="8"><sup>8</sup> Available online: European Declaration on Digital Rights and Principles | Shaping Europe's digital future (europa.eu),
(accessed on 05.05.2023)</footnote>

<footnote n="9"><sup>9</sup> Ibid., para. 8.</footnote>

<footnote n="10"><sup>10</sup> European Declaration on Digital Rights and Principles for the Digital Decade 2023/C 23/01, PUB/2023/89, JO C 23,
23.1.2023, p. 1-7, Chapter I</footnote>

<footnote n="11"><sup>11</sup> Ibid., Chapter II</footnote>

<footnote n="12"><sup>12</sup> Ibid., Chapter III</footnote>

<footnote n="13"><sup>13</sup> Ibid., Chapter V</footnote>

<footnote n="14"><sup>14</sup> OECD, Recommendation of the Council on Artificial Intelligence, OECD/LEGAL/0449</footnote>
**The UNESCO Recommendation on the Ethics of Artificial Intelligence**<fnref n="15" /> represents a historic and unique agreement of 193 Member States on the fundamental values, principles and policies that should govern the development of this game-changing technology. It provides concrete pathways, including innovative tools, methodologies, and initiatives to ensure maximizing the positive impact of AI, while addressing the associated risks. The Recommendation is addressed to Member States, but it provides ethical guidance to all AI actors, including the private sector.<fnref n="16" />

According to the UNESCO Recommendation, AI actors and Member States should respect, protect, and promote human rights and fundamental freedoms, (...), assuming their respective ethical and legal responsibility, in accordance with national and international law, in particular Member States' human rights obligations and ethical guidance throughout the life cycle of AI systems, including with respect to AI actors within their effective territory and control. The ethical responsibility and liability for the decisions and actions based in any way on an AI system should always ultimately be attributable to AI actors corresponding to their role in the life cycle of the AI system.<fnref n="17" />

Appropriate oversight, impact assessment, audit, and due diligence mechanisms, including
whistle-blowers' protection, should be developed to ensure accountability for AI systems and their
impact throughout their life cycle. Both technical and institutional designs should ensure auditability
and traceability of (the working of) AI systems to address any conflicts with human rights norms
and standards and threats to environmental and ecosystem well-being.<fnref n="18" />

**White Paper on Artificial Intelligence – A European approach to excellence and trust**<fnref n="19" />
provides that AI systems – and certainly high-risk AI applications – must be technically robust and
accurate to be trustworthy. That means that such systems need to be developed in a responsible
manner and with an ex-ante due and proper consideration of the risks that they may generate. Their
development and functioning must ensure that AI systems behave reliably and as intended. All
reasonable measures should be taken to minimize the risk of harm being caused.

**The Ethics Guidelines for Trustworthy Artificial Intelligence**<fnref n="20" /> prepared by the High-Level European Commission Expert Group on Artificial Intelligence which includes principles such as transparency, accountability, and fairness. It is necessary that mechanisms be put in place to ensure responsibility and accountability for AI systems and their outcomes, both before and after their development, deployment, and use.

Auditability entails the enablement of the assessment of algorithms, data, and design
processes. Evaluation by internal and external auditors and the availability of such evaluation reports
can contribute to the trustworthiness of the technology. In applications affecting fundamental rights,
including safety-critical applications, AI systems should be able to be independently audited.<fnref n="21" />

Minimization and reporting of negative impacts, both the ability to report on actions or
decisions that contribute to a certain system outcome, and to respond to the consequences of such an
outcome, must be ensured. Identifying, assessing, documenting, and minimizing the potential
negative impacts of AI systems is especially crucial for those (in)directly affected. The use of impact
assessments (e.g., red teaming or forms of Algorithmic Impact Assessment) both prior to and during

<footnote n="15">¹⁵ Published in 2022 by the United Nations Educational, Scientific and Cultural Organization (UNESCO), France, adopted on 23 November 2021</footnote>

<footnote n="16">¹⁶ Ohchr.org/UNESCO Recommendation on the Ethics of Artificial Intelligence</footnote>

<footnote n="17">¹⁷ Ibid., para. 42.</footnote>

<footnote n="18">¹⁸ Ibid., para. 43.</footnote>

<footnote n="19">¹⁹ White Paper on Artificial Intelligence – A European approach to excellence and trust, Brussels, 19.2.2020 COM(2020) 65 final</footnote>

<footnote n="20">²⁰ The Ethics Guidelines for Trustworthy Artificial Intelligence prepared by the High-Level European Commission Expert Group on Artificial Intelligence, 2019</footnote>

<footnote n="21">²¹ Ibid. p.19</footnote>
the development, deployment and use of AI systems can be helpful to minimize negative impact. These assessments must be proportionate to the risk that the AI systems pose.

**The General Data Protection Regulation**<fnref n="22" /> places obligations on organizations to protect personal data and ensures that individuals have the right to know what information is held about them and to have it corrected or deleted if necessary.

Accountability principles require controllers to actively and continuously implement measures to promote and safeguard data protection in their processing activities and are responsible for compliance of their processing operations with data protection law and their respective obligations.

Also, controllers must be able to demonstrate compliance with data protection provisions to data subjects, the public and supervisory authorities at any time. Processors must also comply with some obligations strictly linked to accountability, such as keeping a record of processing operations and appointing a Data Protection Officer.<fnref n="23" />

OECD also adopted the **Guidelines on the Protection of Privacy and Transborder Flows of Personal Data** that highlighted that controllers have an important role in making data protection work in practice. The guidelines comprise an accountability principle to the effect that a data controller should be accountable for complying with measures which give effect to the principles stated above.<fnref n="24" />

New developments in Artificial Intelligence are transforming the world, from science and industry to government administration and finance. The rise of AI decision-making also implicates fundamental rights of fairness, accountability, and transparency as per the **Universal Guidelines for Artificial Intelligence**<fnref n="25" />. The assessment and accountability obligation relate that an AI system should be deployed only after an adequate evaluation of its purpose and objectives, its benefits, as well as its risks and the institutions must be responsible for decisions made by an AI system.

As research evaluates algorithms that could rule our lives, code should be open and auditable. With the general complexity and issue of transparency of design and functionality of deep-learning and big data, this is becoming even more sensitive, and a call that we should establish a framework for algorithm design. One such framework is the Asilomar principles for the design of AI, with the goal of creating beneficial rather than undirected intelligence, using principles, such as transparency in failure, clarity in responsibility, alignment to human values, robustness with respect to security, or respect of privacy<fnref n="26" />.

The **Digital Services Act** (DSA)<fnref n="27" /> defines clear responsibilities for providers of intermediary services and in particular online platforms, such as social media and marketplaces and mandatory risk assessments and more transparency over algorithms. The DSA includes provisions related to the responsibility of online platforms in ensuring the safety, security, and rights of their users. This includes measures to prevent the spread of illegal content such as hate speech, terrorist content and

<footnote n="22">²² Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119, 4.5.2016, p. 1–88</footnote>

<footnote n="23">²³ Handbook on European data protection law, European Union Agency for Fundamental Rights and Council of Europe, 2018, p. 134</footnote>

<footnote n="24">²⁴ OECD (2013), Guidelines on governing the Protection of Privacy and transborder flows of personal data, Art. 14</footnote>

<footnote n="25">²⁵ Universal Guidelines for Artificial Intelligence, 23 October 2018, Brussels, Belgium, AI Universal Guidelines – thepublicvoice.org</footnote>

<footnote n="26">²⁶ Future of life Institute. Asilomar AI Principles. Available online: https://futureoflife.org/ai-principles/ (accessed on 05.05.2023)</footnote>

<footnote n="27">²⁷ Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) PE/30/2022/REV/1, OJ L 277, 27.10.2022, p. 1–102</footnote>
counterfeit products, as well as requirements for transparency in online advertising and data protection.

The promotion of AI-driven innovation is also closely linked to the Data Governance Act<fnref n="28" />, the Open Data Directive<fnref n="29" /> and other initiatives under the EU strategy for data<fnref n="30" />, which will establish trusted mechanisms and services for the re-use, sharing and pooling of data that are essential for the development of data-driven AI models of high quality.

### 3. THE ACCOUNTABILITY PRINCIPLE

General Data Protection Regulation and Modernized Convention 108³¹ determine that the controller is responsible for, and should be able to ensure, compliance with the data protection principles.<fnref n="32" /> Controllers can facilitate compliance with this requirement in various ways, which include:
* recording processing activities and making them available to the supervisory authority upon request;
* in certain situations, designating a data protection officer who is involved in all issues relating to personal data protection;
* undertaking data protection impact assessments for types of processing likely to result in a high risk to the rights and freedoms of natural persons;
* ensuring data protection by design and by default;
* implementing modalities and procedures for the exercise of the rights of the data subjects;
* adhering to approved codes of conduct or certification mechanisms.<fnref n="33" />

Responsibility is a specific principle for personal data processing, as well as setting out an obligation for controllers to demonstrate their compliance with the provisions of the data protection law. This accountability is a continuous obligation. It does not manifest itself only at the end of a data processing operation when something goes wrong; rather, it is a proactive obligation to develop adequate data management in practice. Moreover, in keeping with the idea that individual control over personal data should operate as a default setting, it shift the burden of proof to the organization conducting data processing in many instances and focuses on accountability for responsible data stewardship, rather than mere compliance while ensuring that expectations and protection of privacy is preserved.<fnref n="34" />

Accountability is not an easy task. For the controller to be accountable in today's data driven society, it requires an organization that is able to show a regulator, customer or business partner evidence of having met, and continuing to meet, all of the obligations under the GDPR. This is not just a few documents and a database with records of processing activities. Accountability requires the organization to have a data protection policy, a statement that sets out how an organization protects personal data. It requires transparency about data protection responsibilities across the organization and indeed awareness that everyone in the organization who comes into contact with personal data is partly responsible for compliance with the GDPR.<fnref n="35" />

<footnote n="28">²⁸ Proposal for a Regulation on European data governance (Data Governance Act) COM/2020/767</footnote>

<footnote n="29">²⁹ Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information, PE/28/2019/REV/1, OJ L 172, 26.6.2019, p. 56–83</footnote>

<footnote n="30">³⁰ Commission Communication, A European strategy for data COM/2020/66 final, https://eur-lex.europa.eu/legal-content/EN/TXT/Commission%20Communication,%20A%20European%20strategy%20for%20data%20COM/2020/66%20final.</footnote>

<footnote n="31">³¹ Modernized Convention for the Protection of Individuals with Regard to the Processing of Personal Data, CM/Inf(2018)15-final, 18 May 2018, Art. 7 (2)</footnote>

<footnote n="32">³² Handbook on European data protection law, European Union Agency for Fundamental Rights and Council of Europe, 2018, p. 134</footnote>

<footnote n="33">³³ Handbook on European data protection law, European Union Agency for Fundamental Rights and Council of Europe, 2018, p.135</footnote>

<footnote n="34">³⁴ Orla Lynskey, The foundations of EU Data protection Law, Oxford University Press, 2015, p.260</footnote>

<footnote n="35">³⁵ Leo Besemer, Privacy and data protection based on the GDPR. Understanding The General Data Protection Regulation, Van Haren Publishing, 2020, p.35</footnote>
4. DATA PROTECTION BY DESIGN AND BY DEFAULT

Another proponent of accountability is the implementation of data protection by design and by default. To achieve this, a cultural shift may be required to ensure that data protection is considered at the outset of every new project and for the duration of its life.<fnref n="36" />

Data protection by design requires that controllers put in place measures to effectively implement data protection principles and to integrate the necessary safeguards to meet the requirements of the regulation and protect the rights of data subjects.<fnref n="37" /> These measures should be implemented both at the time of processing and when determining the means for processing. In implementing these measures, the controller needs to consider the state of the art, the costs of implementation, the nature, scope and purposes of personal data processing and the risks and severity for the rights and freedoms of the data subject.<fnref n="38" />

Data protection by default requires that the controller implements appropriate measures to ensure that only personal data which are necessary for the purposes will be processed by default. This obligation applies to the amount of personal data collected, the extent of the processing, the storage period and accessibility.<fnref n="39" />

5. PENALTIES

For violating the principle of accountability, I will mention some sanctions applied by the supervisory authorities:

5.1 The Irish DPA (DPC) has imposed a fine of EUR 17 million on Meta Platforms Ireland Limited<fnref n="40" /> (former Facebook Ireland Limited) on 15.03.2022. The decision is based on twelve notifications of data breaches that occurred between June 7, 2018, and December 4, 2018. The outcome of the DPC's investigation revealed that Meta had violated Article 5 (2) and Article 24 (1) GDPR. During its investigation, the DPC found that Meta failed to demonstrate that it had taken appropriate technical and organizational measures to protect the data of EU users. The fine proceedings involved cross-border data processing, which is why the decision was subject to the co-decision procedure under Art. 60 GDPR involving all other European supervisory authorities as co-decision-makers.

5.2 Vodafone Italia S.p.A.<fnref n="41" /> was fined EUR 12,251,601 on 12.11.2020 for unlawfully processing personal data of millions of customers for telemarketing purposes. The proceedings were preceded by hundreds of complaints from data subjects about unsolicited telephone calls, which led to an investigation by the data protection authority. This investigation revealed several violations of the data protection law, including the violation of consent requirements and the violation of general data protection obligations such as accountability. Moreover, further violations could be found in the handling of contact lists purchased from external providers. Finally, security measures for the management of customer data were also considered inadequate.

5.3 The Danish DPA has imposed a fine of EUR 1.3 million on Danske Bank<fnref n="42" /> on 05.04.2022. The DPA opened an investigation against the bank after it informed the DPA that it had

<footnote n="36">³⁶ Leo Besemer, Privacy and data protection based on the GDPR. Understanding The General Data Protection Regulation, Van Haren Publishing, 2020, p.36</footnote>

<footnote n="37">³⁷ General Data Protection Regulation, art. 25 (1).</footnote>

<footnote n="38">³⁸ Handbook on European data protection law, European Union Agency for Fundamental Rights and Council of Europe, 2018, p.183</footnote>

<footnote n="39">³⁹ General Data Protection Regulation, Art. 25 (2).</footnote>

<footnote n="40">⁴⁰ https://www.enforcementtracker.com/ETid-1094</footnote>

<footnote n="41">⁴¹ https://www.enforcementtracker.com/ETid-438</footnote>

<footnote n="42">⁴² https://www.enforcementtracker.com/ETid-1114</footnote>
a problem with the deletion of personal data. During the investigation, the DPA found that the bank had failed to document the rules for deletion and storage of personal data in more than 400 systems. Consequently, the bank was unable to prove that such rules, which are required under the GDPR, existed. The DPA considered this to be a breach of the bank's accountability obligation under Art. 5 (2) GDPR.

## 6. CONCLUSION

Confidentiality, privacy, and data protection are crucial aspects of responsible innovation, these concepts pertain to individuals' right to safeguard their personal information and have control over how it is collected, stored, and used, starting from the point of the conception and throughout the life of the resulting technological product.

For responsible innovation, in addition to complying with data protection regulations, transparency and user's information, security, data minimization/anonymization and privacy impact assessment, other aspects that should be considered in technical and institutional designs are auditability and traceability of (the working of) AI systems to address any conflicts with human rights norms and standards.

## BIBLIOGRAPHY

### Studies published in journals:

1. Leo Besemer, Privacy and data protection based on the GDPR. Understanding The General Data Protection Regulation, Van Haren Publishing, 2020, p.35

2. Orla Lynskey, The foundations of EU Data protection Law, Oxford University Press, 2015;

3. Marc Dreyer, Luc Chefneux, Anne Goldberg, Joachim Von Heimburg, Norberto Patrignani, Chris Shilling, Monica Schofield, Responsible Innovation: A Complementary View from Industry with Proposals for Bridging Different Perspectives, Sustainability, 2017;

4. Handbook on European data protection law, European Union Agency for Fundamental Rights and Council of Europe, 2018;

### Recommendations, guidelines, proposals, and laws

1. Proposal for a Regulation of the European Parliament and of the Council laying down harmonized rules on artificial intelligence (ARTIFICIAL INTELLIGENCE ACT) and amending certain union legislatives acts, Brussels, 21.4.2021, COM(2021) 206 final, 2021/0106(COD)

2. European Declaration on Digital Rights and Principles for the Digital Decade 2023/C 23/01, PUB/2023/89

3. OECD, Recommendation of the Council on Artificial Intelligence, OECD/LEGAL/0449

4. United Nations Educational, Scientific and Cultural Organization (UNESCO), France, adopted on 23 November 2021

5. White Paper on Artificial Intelligence – A European approach to excellence and trust, Brussels, 19.2.2020 COM (2020) 65 final

6. The Ethics Guidelines for Trustworthy Artificial Intelligence prepared by the High-Level European Commission Expert Group on Artificial Intelligence, 2019

7. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119, 4.5.2016, p. 1–88

8. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119, 4.5.2016, p. 1–88

9. OECD (2013), Guidelines on governing the Protection of Privacy and transborder flows of personal data, Art. 14
10. Universal Guidelines for Artificial Intelligence, 23 October 2018, Brussels, Belgium, AI Universal Guidelines - thepublicvoice.org

11. Future of life Institute. Asilomar AI Principles. Available online: https://futureoflife.org/ai-principles/ (accessed on 05.05.2023)

12. Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) PE/30/2022/REV/1, OJ L 277, 27.10.2022, p. 1–102

13. Proposal for a Regulation on European data governance (Data Governance Act) COM/2020/767

14. Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information, PE/28/2019/REV/1, OJ L 172, 26.6.2019, p. 56–83

15. Commission Communication, A European strategy for data COM/2020/66 final

16. Modernized Convention for the Protection of Individuals with Regard to the Processing of Personal Data, CM/Inf(2018)15-final, 18 May 2018, Art. 7 (2)
# Legal Aspects of Vulnerability Disclosure: Navigating GDPR and NIS Directive Obligations for Data Protection and Cybersecurity

ANA KOIAVA<fnref n="1" />

TALLINN UNIVERSITY OF TECHNOLOGY

**Abstract:** The disclosure of vulnerabilities in the context of data protection and cybersecurity raises numerous legal aspects that require careful navigation. This paper examines the legal implications of vulnerability disclosure within the context of data protection and cybersecurity, with a specific focus on the General Data Protection Regulation (GDPR) and the Network and Information Systems (NIS2) Directive. The research problem addressed in this study is the need to understand the legal obligations and challenges associated with vulnerability disclosure under these regulatory frameworks. The research aims to explore the legal requirements, identify conflicts, and provide insights into vulnerability disclosure practices. The study employs a methodology that involves a comprehensive review and analysis of legal documents, guidelines, and scholarly literature. This approach allows for a thorough examination of the legal aspects surrounding vulnerability disclosure. The findings contribute to a better understanding of the legal landscape and provide valuable insights.

**Keywords:** EU, Cybersecurity, GDPR, NIS2D, Vulnerability Disclosure

## 1. INTRODUCTION

In today's digital landscape, the discovery and disclosure of vulnerabilities have become critical concerns that require careful attention and adherence to legal obligations. The disclosure of vulnerabilities has been a topic of debate within the information security community for a considerable period. The urgency to address cybersecurity and software vulnerabilities stems from the increasing connectivity of devices and individuals<fnref n="2" />. The General Data Protection Regulation (GDPR) and the Network and Information Systems (NIS2) Directive are two key legal frameworks that aim to safeguard data protection and cybersecurity within the European Union (EU)<fnref n="3" />. Navigating the obligations imposed by these regulations when disclosing vulnerabilities is of utmost importance to ensure compliance, protect personal data, and maintain a secure online environment. These efforts promote accountability, uphold the rule of law, and contribute to a safer digital environment for all while ensuring the protection of personal data<fnref n="4" />. This article examines the legal aspects of vulnerability disclosure and explores the challenges and considerations involved in balancing the requirements of the GDPR and the NIS2 Directive.

The primary focus of this research is the examination of the legal aspects associated with vulnerability. Thus, it is essential to establish a comprehensive understanding of the concept of vulnerability in order to address these legal considerations effectively<fnref n="5" />. Vulnerabilities are typically

<footnote n="1">¹ Project Assistant, Department of Law, Tallinn University of Technology, Ehitajate tee 5, 19086 Tallinn, Estonia
Email: ankoia@taltech.ee</footnote>

<footnote n="2">² Technology, Policies and Legal Challenges Report of a CEPS Task Force, June 2018, Chair: Marietje Schaake
Rapporteurs: Lorenzo Pupillo Afonso Ferreira Gianluca Varisco</footnote>

<footnote n="3">³ Tropp, E.-M.; Hoffmann, T.; Chochia, A. (2022). Open Data – a stepchild in e-Estonia’s Data Management Strategy?
TalTech Journal of European Studies, 12 (1), 123–144. DOI: 10.2478/bjes-2022-0006.</footnote>

<footnote n="4">⁴ Technology, Policies and Legal Challenges Report of a CEPS Task Force, June 2018, Chair: Marietje Schaake
Rapporteurs: Lorenzo Pupillo Afonso Ferreira Gianluca Varisco</footnote>

<footnote n="5">⁵ See also: Mazur, V.; Chochia, A. (2022). Definition and Regulation as an Effective Measure to Fight Fake News in the European Union. European Studies: The Review of European Law, Economics and Politics, 9 (1), 15–40. DOI: 10.2478/eustu-2022-0001.</footnote>
defined by three fundamental characteristics. Firstly, they involve the existence of a flaw or weakness within a system, serving as a potential entry point for attackers. Secondly, vulnerabilities possess the capacity for threats, including hackers, to exploit the identified flaw. Lastly, the exploitation of vulnerabilities can result in compromised information security, posing a significant risk to both software and hardware systems<fnref n="6" />. These elements collectively highlight the potential dangers that vulnerabilities pose to the overall security of digital environments.

## 2. CHALLENGES REGARDING VULNERABILITY DISCLOSURE

Vulnerability disclosure involves the process of identifying, reporting, and resolving weaknesses in software, hardware, or services that have the potential to be exploited<fnref n="7" />. The vulnerability disclosure process presents a range of significant challenges that must be effectively addressed. These challenges include navigating complex legal considerations, as individuals disclosing vulnerabilities may face potential legal threats due to the methods used and the manner of disclosure. The acquisition of vulnerabilities for national security purposes may result in intentional non-disclosure, leaving users vulnerable without a solution. User's failure to implement patches promptly further exacerbates the risks, often due to a lack of understanding or knowledge. Moreover, variations in discoverer motivation, influenced by bug bounty programs and monetary rewards, can impact the disclosure decisions made.<fnref n="8" /> To overcome these challenges, it is crucial to carefully consider these factors and establish effective mechanisms that promote responsible vulnerability disclosure, prompt patch implementation, and foster collaboration among all stakeholders involved.

The process of vulnerability disclosure refers to the steps taken to handle the dissemination of software vulnerability knowledge after it has been identified by a user. Responsible vulnerability disclosure aims to minimize the negative impact of vulnerabilities by determining how and when vulnerability information should be shared with the appropriate parties through the appropriate channels<fnref n="9" />. The lack of consensus arises from the fact that vulnerability information has varying relevance to different stakeholders, including the software vendor, software users, and potential hackers. The way vulnerability knowledge is managed, including the sequence and timing of its announcement, can significantly impact the overall cost of the vulnerability to society<fnref n="10" />.

The disclosure of vulnerabilities raises significant questions due to the sensitive nature of the information involved. These questions arise from the presence of diverging and conflicting interests among stakeholders, as well as legal constraints on their actions<fnref n="11" />. As digital and software-dependent technologies become more integrated into everyday life, it becomes essential for the economy and society as a whole to establish appropriate procedures for vulnerability disclosure. While it is clear that vulnerability disclosure is necessary from the perspective of end-users such as businesses and home users, important questions remain unanswered. It is essential to address several critical aspects when it comes to disclosure, including identifying the responsible party, establishing the appropriate

<footnote n="6">⁶ Good Practice Guide on Vulnerability Disclosure From challenges to recommendations, November 2015, European Union Agency for Network and Information Security</footnote>

<footnote n="7">⁷ Vulnerability Disclosure, https://www.enisa.europa.eu/topics/vulnerability-disclosure, 20 May 2023</footnote>

<footnote n="8">⁸ Good Practice Guide on Vulnerability Disclosure From challenges to recommendations November 2015, European Union Agency for Network and Information Security</footnote>

<footnote n="9">⁹ Cavusoglu, H., Raghunathan, S. (2007). The efficiency of vulnerability disclosure mechanisms to disseminate vulnerability knowledge. *IEEE Transactions on Software Engineering*, 33(3), 171–185.</footnote>

<footnote n="10">¹⁰ *Ibid*</footnote>

<footnote n="11">¹¹ Technology, Policies and Legal Challenges Report of a CEPS Task Force, June 2018, Chair: Marietje Schaake
Rapporteurs: Lorenzo Pupillo Afonso Ferreira Gianluca Varisco</footnote>
disclosure methods, and determining the right timing for making vulnerabilities public. Careful consideration and consensus among stakeholders are vital to safeguard the security of end-users<fnref n="12" />.

Vulnerability disclosure entails several important legal aspects that must be considered to ensure responsible and lawful practices. These aspects include adhering to legal rights and obligations, establishing responsible disclosure policies, maintaining confidentiality and non-disclosure agreements, complying with personal data protection laws, coordinating with relevant authorities, ensuring liability protection, and considering public interest implications. It is crucial for individuals and organizations engaged in vulnerability disclosure to navigate these legal aspects carefully and collaborate with researchers, software vendors, security organizations, and legal experts to ensure compliance and protect the rights and interests of all parties involved<fnref n="13" />.

It is worth noting that two crucial legal instruments, namely the General Data Protection Regulation (GDPR) and the Network and Information Systems (NIS2) Directive, were implemented to uphold adequate security standards for information technology (IT) and its associated data processing. While both the GDPR and the NIS2 Directive incorporate risk-based security measures, they serve distinct purposes and objectives.<fnref n="14" />

The GDPR is a comprehensive data protection regulation in the European Union that establishes rules and requirements for the protection of personal data. It emphasizes the importance of data security and imposes obligations on organizations to ensure the confidentiality, integrity, and availability of personal data. Vulnerability disclosure is closely tied to data security, and organizations are expected to promptly address and disclose vulnerabilities that may impact the security of personal data<fnref n="15" />.

The NIS2 Directive, on the other hand, focuses on the security of network and information systems in critical sectors such as energy, transportation, banking, and healthcare. It sets out requirements for risk management, incident reporting, and cooperation between member states. Vulnerability disclosure is crucial in the context of the NIS2 Directive, as timely reporting and handling of vulnerabilities can help prevent security incidents and mitigate risks to critical infrastructure<fnref n="16" />.

NIS2 Directive prioritizes the availability of services, with confidentiality and integrity being secondary considerations. It is worth noting that information security incidents can often impact personal data. While the NIS2 Directive has a broader scope, covering digital data related to network and information systems and their provision and continuity, it is more limited in terms of its applicability, targeting only identified operators of essential services (OES) and digital service providers<fnref n="17" />. These legal instruments work together to establish a comprehensive framework for protecting data and ensuring the security of IT systems. The GDPR focuses on the rights and privacy of individuals, while the NIS2 Directive concentrates on the resilience and security of critical infrastructures<fnref n="18" />.

<footnote n="12">¹² *Ibid.*</footnote>

<footnote n="13">¹³ *Ibid.*</footnote>

<footnote n="14">¹⁴ Sandra Schmitz-Berndt, Stefan Schiffner (2021) Don't tell them now (or at all) – responsible disclosure of security incidents under NIS Directive and GDPR, *International Review of Law, Computers and Technology*, 35:2, 101-115.</footnote>

<footnote n="15">¹⁵ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).</footnote>

<footnote n="16">¹⁶ Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.</footnote>

<footnote n="17">¹⁷ Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.</footnote>

<footnote n="18">¹⁸ Sandra Schmitz-Berndt, Stefan Schiffner. Op.cit.,</footnote>
### 3. REPORTING OBLIGATIONS

This article aims to analyze the reporting requirements prescribed by the NIS 2 Directive and the GDPR, with a focus on highlighting the similarities and differences between these regulatory frameworks. Both directives impose obligations on organizations to report incidents, however, they diverge in terms of their scope. The NIS 2 Directive centers on incidents concerning network and information systems that have an impact on essential services, while the GDPR primarily concerns personal data breaches. By examining these aspects in detail, this study seeks to provide a comprehensive understanding of the incident reporting processes within the purview of both frameworks.

#### 3.1. Data Breach Reporting in Accordance with the GDPR

The issue of data breach reporting under the GDPR is intricately intertwined with vulnerability disclosure and cybersecurity challenges. In the event of a data breach, it is common for the breach to exploit vulnerabilities within a system, resulting in unauthorized access, data leakage, or other security-related incidents.

Under the General Data Protection Regulation (GDPR), organizations are required to report data breaches that pose a risk to individuals' rights and freedoms. This reporting obligation is outlined in Article 33 of the GDPR. Article 33 states that in the event of a data breach, data controllers must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The notification should include details such as the nature of the breach, the categories and an approximate number of affected individuals, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects<fnref n="19" />.

In addition, the provision outlined in Article 34 of the GDPR, which mandates the communication of data breaches to affected individuals, serves a crucial purpose in enhancing transparency and accountability in data protection practices. By requiring data controllers to promptly notify individuals of breaches that pose a high risk to their rights and freedoms, the GDPR aims to empower individuals and regulatory authorities with timely information to take necessary actions and mitigate potential harm. The requirement for clear and easily understandable communication ensures that individuals can comprehend the breach and comprehend the recommended steps to safeguard themselves.<fnref n="20" /> Nonetheless, challenges arise from subjective risk evaluation, ambiguous reporting timelines, and individuals' limited awareness. Resolving these issues requires clear guidelines to standardize risk assessment and reporting, alongside cybersecurity measures to enhance breach notifications, safeguard individual rights, and minimize harm.

Organizations must prioritize their understanding of the specific requirements outlined in Articles 33 and 34 of the GDPR. They should establish robust processes and procedures to promptly and efficiently handle data breaches. Non-compliance with these reporting obligations can lead to severe penalties and reputational harm for organizations. Hence, taking proactive steps to comply with the GDPR's data breach reporting requirements is essential to safeguard the organization's reputation, maintain regulatory compliance, and protect individuals' rights and privacy.

<footnote n="19">¹⁹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Article 33.</footnote>

<footnote n="20">²⁰ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Article 34.</footnote>
## 3.2. Incident Reporting Obligations under the NIS Directive

On the Other hand, NIS Directive 2 (Network and Information Systems Directive 2) is a regulatory framework introduced by the European Union to strengthen cybersecurity measures and protect critical infrastructure and digital services. A significant component of NIS2 is the establishment of a comprehensive framework for coordinated vulnerability disclosure<fnref n="21" />. Under NIS2, key actors are assigned specific responsibilities in handling newly discovered vulnerabilities throughout the European Union. This coordinated approach ensures that vulnerabilities are promptly and responsibly disclosed to relevant parties, minimizing the potential risks they pose<fnref n="22" />.

Additionally, NIS2 mandates the creation of an EU vulnerability database, managed and maintained by the EU Agency for Cybersecurity (ENISA). This database serves as a central repository for publicly known vulnerabilities in information and communication technology (ICT) products and services<fnref n="23" />. One of the strengths of this approach is the potential for a centralized and comprehensive database that can streamline vulnerability management efforts. Having a single repository can facilitate efficient identification, tracking, and mitigation of vulnerabilities across various ICT products and services. This can lead to faster patching and improved security measures, reducing the risk of cyber incidents and enhancing overall cybersecurity posture.<fnref n="24" />

NIS2 presents a holistic structure for businesses, comprising 10 essential components that need to be acknowledged and incorporated into their cybersecurity protocols. These components span a range of domains, including incident management, safeguarding the supply chain, handling and disclosing vulnerabilities, and responsibly employing cryptography and encryption.<fnref n="25" />

When it comes to incident reporting, striking the right balance between swift reporting and in-depth analysis is crucial. The new Directive adopts a multi-stage approach to incident reporting. In the event of an incident, companies have a 24-hour window from the time they become aware of it to submit an early warning to the Computer Security Incident Response Team (CSIRT) or the competent national authority. This early warning also enables companies to seek assistance, such as guidance or operational advice on implementing mitigation measures if needed<fnref n="26" />. Following the early warning, companies are required to provide an incident notification within 72 hours of becoming aware of the incident.<fnref n="27" /> Finally, affected companies must submit a final report no later than one month after becoming aware of the incident. By adopting this multi-stage approach to incident reporting, NIS2 aims to strike a balance between prompt reporting to prevent incident

<footnote n="21">21 NIS Cooperation Group, Retrieved from https://digital-strategy.ec.europa.eu/en/policies/nis-cooperation-group, 20 May 2023</footnote>

<footnote n="22">22 NIS Cooperation Group, Retrieved from https://digital-strategy.ec.europa.eu/en/policies/nis-cooperation-group, 20 May 2023</footnote>

<footnote n="23">23 Coordinated vulnerability disclosure practices in the EU, April 2022, European Union Agency for Network and Information Security</footnote>

<footnote n="24">24 Directive on measures for a high common level of cybersecurity across the Union (NIS2 Directive), Retrieved from, https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive 15 May 2023</footnote>

<footnote n="25">25 Directive on measures for a high common level of cybersecurity across the Union (NIS2 Directive), Retrieved from, https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive 15 May 2023</footnote>

<footnote n="26">26 Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), Article 23, 4(a)</footnote>

<footnote n="27">27 Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), Article 23, 4(b)</footnote>
escalation and detailed reporting to extract valuable insights from each incident<fnref n="28" />. This iterative reporting process enhances incident management capabilities, strengthens cybersecurity practices, and contributes to a more resilient and secure digital environment.

Yet, the 24-hour reporting window in the multi-stage incident reporting approach poses challenges. Rushed reporting may hinder thorough incident analysis, understanding of causes, and impact. Balancing speed with accuracy is crucial. Effective implementation relies on capable authorities providing timely assistance. Insufficient resources or expertise may hinder support to organizations. Smaller organizations may struggle to meet reporting requirements promptly, considering limited resources. Addressing challenges for all organizations is important for effective incident reporting systems.

## 4. BALANCING GDPR AND NIS DIRECTIVE 2

The disclosure obligations in both the GDPR and the NIS2 Directive share some similarities. Both frameworks require organizations to report incidents, although the scope of reporting differs. The differing objectives of the GDPR and the NIS2 Directive can create challenges when it comes to advising on incident notification. The GDPR places a strong emphasis on safeguarding personal data and advocates for immediate notification to enable affected individuals to mitigate potential harm. In contrast, the NIS2 Directive is primarily concerned with restoring and maintaining information security, and incident disclosure under this framework may be limited to cases where public awareness is crucial for preventing or addressing ongoing incidents or when disclosure serves the public interest.

Recital 86 of the GDPR recognizes the challenge of early disclosure and acknowledges the need for prompt communication with data subjects to mitigate immediate risks. However, this justification specifically applies to continuing and ongoing data breaches and does not cover ongoing security incidents in general<fnref n="29" />. As a result, incidents that inadvertently compromise consumer data but lead to ongoing attacks on other critical systems may not be adequately addressed. It is important to note that while Recital 86 provides interpretative guidance, it does not establish legally binding limits on the scope of Article 34 of the GDPR, which governs incident notification. Additionally, when determining administrative fines for non-compliance with Article 34, the effectiveness of incident mitigation and an appropriate NIS response are factors considered<fnref n="30" />.

The GDPR does not have explicit regulations that specifically cover incident containment and recovery, or provide exceptions for delaying the notification of data subjects in cases involving law enforcement or other relevant interests. This ongoing disagreement persists due to the absence of such provisions in the GDPR framework<fnref n="31" />.

However, the NIS 2.0 Proposal resolves one aspect of the conflict by eliminating the possibility of facing legal consequences for non-compliance under both the GDPR and the NIS instrument<fnref n="32" />. Article 32(2) of the NIS 2.0 Proposal clarifies that if a Data Protection Authority (DPA) imposes an administrative fine, a National Competent Authority (NCA) cannot impose an additional

<footnote n="28">²⁸ Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), Article 23, 4 (c, d)</footnote>

<footnote n="29">²⁹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Recital 86.</footnote>

<footnote n="30">³⁰ Sandra Schmitz and Stefan Schiffner, 2021 Responsible Vulnerability Disclosure under the NIS 2.0 Proposal</footnote>

<footnote n="31">³¹ Position Paper – Roadmap NIS-Review Bitkom views concerning the combined Evaluation Roadmap / Inception Impact Assessment, 13 of August 2020</footnote>

<footnote n="32">³² Sandra Schmitz and Stefan Schiffner, 2021 Responsible Vulnerability Disclosure under the NIS 2.0 Proposal</footnote>
administrative fine for the same infringement. It is important to note that failing to comply with notification obligations towards the regulatory authority and failing to comply with the notification obligation towards the data subject or service recipient are considered separate infringements<fnref n="33" />.

To explore deeply, the division of notification obligations in NIS2 may lead to a fragmented incident reporting approach. Organizations might prioritize fulfilling their duties towards the regulatory authority, potentially neglecting their obligations towards affected individuals or service recipients. This neglect has the potential to compromise the rights and interests of individuals whose personal data is impacted by the incident. Consequently, an entity that informs the DPA and NCA about a security incident involving personal data but fails to inform the data subject without undue delay to handle the incident may potentially face legal sanctions under the GDPR<fnref n="34" />.

## CONCLUSION

In conclusion, this research has highlighted the legal aspects of vulnerability disclosure in connection with data protection and cybersecurity. The conflicting objectives of the GDPR and the NIS2 Directive create a delicate balance between immediate data protection notification and the need for the delay to address cybersecurity concerns.

It is essential to acknowledge and address the inherent limitations and challenges associated with this research. The dynamic nature of legal frameworks introduces ongoing complexities as regulations and guidelines evolve over time. Furthermore, successfully navigating vulnerability disclosure requires careful management of the intricate interplay between data protection and cybersecurity considerations.

Despite these challenges, this research provides valuable insights into the legal landscape surrounding vulnerability disclosure. By thoroughly understanding the explicit requirements outlined in the General Data Protection Regulation (GDPR) and the Network and Information Security (NIS2) Directive, organizations can enhance their incident reporting practices while ensuring diligent compliance with regulatory obligations.

To thrive in this ever-changing environment, organizations must maintain constant vigilance, continuously monitoring and adapting to changes in legal frameworks. It is of utmost importance to carefully consider and balance both data protection and cybersecurity aspects when disclosing vulnerabilities. Through these measures, organizations can effectively mitigate risks, protect individuals' data, and contribute to the creation of a safer and more secure digital ecosystem.

## BIBLIOGRAPHY/ References

### Primary Resources / EU Legislation

1. Coordinated vulnerability disclosure practices in the EU, April 2022, European Union Agency for Network and Information Security.

2. Directive on measures for a high common level of cybersecurity across the Union (NIS2 Directive), Retrieved from, https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive 15 May 2023.

3. Good Practice Guide on Vulnerability Disclosure From challenges to recommendations November 2015, European Union Agency for Network and Information Security.

4. NIS Cooperation Group, Retrieved from https://digital-strategy.ec.europa.eu/en/policies/nis-cooperation-group, 20 May 2023.

<footnote n="33">³³ Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), Article 32(2)</footnote>

<footnote n="34">³⁴ *Ibid.*</footnote>
5. Technology, Policies and Legal Challenges Report of a CEPS Task Force, June 2018, Chair: Marietje Schaake Rapporteurs: Lorenzo Pupillo Afonso Ferreira Gianluca Varisco.

6. Vulnerability Disclosure, https://www.enisa.europa.eu/topics/vulnerability-disclosure, 20 May 2023.

7. Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.

8. Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive).

9. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

## Scholarly Articles

1. Cavusoglu, H., Raghunathan, S. (2007). The efficiency of vulnerability disclosure mechanisms to disseminate vulnerability knowledge. *IEEE Transactions on Software Engineering*, 33(3), 171–185.

2. Mazur, V.; Chochia, A. (2022). Definition and Regulation as an Effective Measure to Fight Fake News in the European Union. *European Studies: The Review of European Law, Economics and Politics*, 9 (1), 15–40. DOI: 10.2478/eustu-2022-0001.

3. Federal Association for Information Technology, Telecommunications and New Media. 13 August 2020. Roadmap NIS-Review Bitkom views concerning the combined Evaluation Roadmap / Inception Impact Assessment.

4. Schmitz-Berndt, Sandra, Schiffner Stefan (2021), Don't tell them now (or at all) – responsible disclosure of security incidents under NIS Directive and GDPR, *International Review of Law, Computers, and Technology*, 35:2, 101-115.

5. Schmitz Sandra and Stefan Schiffner, 2021 Responsible Vulnerability Disclosure under the NIS 2.0 Proposal.

6. Tropp, E.-M.; Hoffmann, T.; Chochia, A. (2022). Open Data – a stepchild in e-Estonia’s Data Management Strategy? *TalTech Journal of European Studies*, 12 (1), 123–144. DOI: 10.2478/bjes-2022-0006.
# Post-mortem privacy and the latest GDPR legislative shifts

MARTA TERLETSKA<fnref n="1" />

TALLINN UNIVERSITY OF TECHNOLOGY, ESTONIA

**Abstract:** The decision in the LG Berlin Facebook case caused a fierce debate in the field of digital inheritance and became the first in a number of cases throughout Europe on the issue of access to the accounts of deceased relatives by their heirs. On the contrary, the issue of posthumous privacy, which is inseparably interconnected to a digital succession, has not received such comprehensive research, and is lacking it in the context of the civil legal system, and the EU in particular. This study systematises the knowledge about and the right to decide the fate of the assets by a legal predecessor after no longer being in a position to exercise human autonomy and contextualises it within the framework of recent regulatory developments, namely the implementation of GDPR for the protection of post-mortem data and recent relevant case-laws.

**Keywords:** EU, post-mortem privacy, posthumous privacy, digital assets, GDPR post-mortem, social media accounts post-mortem.

## INTRODUCTION: DEFINING POST-MORTEM PRIVACY

Post-mortem privacy is not a legal term or category. At the current stage of legislative development post-mortem, privacy is still a predominantly abstract notion, which in most cases is understood as a right of the person to preserve and control what becomes of his reputation, dignity, integrity, secrets, or memory after death, meaning after no longer being able to exercise human autonomy as an active agent.<fnref n="2" />

Considering the issue from a social perspective, post-mortem privacy is often associated with aspects such as the protection of personality rights, the author's moral rights, dignity, and protection against defamation.<fnref n="3" />

The controversy of the phenomena of post-mortem privacy lies not only in the absence of the right codified but also in the natural controversy of the very idea of posthumous privacy in relation to the fundamental principles and pillars of certain jurisdictions, for example, the maxim of the English law "*actio personalis moritur cum persona*"<fnref n="4" /> implying that "a personal right of action dies with the person".

In contrast to the common law system, the idea of posthumous privacy cannot be called foreign and uncharacteristic of the civil law system: although not in the scope of what we understand as modern digital posthumous privacy regulation, the concept-related manifestations and indications can be found in numerous related cases and laws. For example, Malgieri, in his work, considers being such an Application n. 8741/79, 47, in which the Commission admitted that the applicant's wish to have his ashes spread out over his own land" was so closely connected to private life that it fell within the sphere of Art. 8 of the European Convention on Human Rights (ECHR)”, correctly

<footnote n="1">¹ Project assistant, Department of Law, Tallinn University of Technology, Ehitajate tee 5, 19086 Tallinn, Estonia, Email: materl@taltech.ee</footnote>

<footnote n="2">² Lilian Edwards, Edina Harbina. "Protecting post-mortem privacy: Reconsidering the privacy interests of the deceased in a digital world." in *Cardozo Arts & Entertainment Law Journal*, vol. 32, 2013, p. 85.</footnote>

<footnote n="3">³ Edina Harbinja, "Does the EU data protection regime protect post-mortem privacy and what could be the potential alternatives" in *Scripted*. Vol. 10, 2013, p. 19.</footnote>

<footnote n="4">⁴ Asta Tūbaitė-Stalauskienė, "Data Protection Post-Mortem" in *International Comparative Jurisprudence*, Vol. 4, 2018, p. 98.</footnote>
defining it as life-transcending decisional privacy<fnref n="5" /> and the Danish Act on Coroner's Inquest, post-mortem examinations and transplantation, which prohibits interference with a corpse of a deceased person without his prior consent in writing.<fnref n="6" />

Of course, there are also many contrary opinions and testimonies.

In particular, under the general practice, Article 8 of the European Convention on Human Rights (ECHR), which is dedicated to the protection of the private and family, home, and correspondence, is limited to the protection of living individuals only unless case concerns very exceptional circumstances constituting an inseparable and direct link between the deceased's privacy and the rights or interests (sometimes economic) of the living individuals.<fnref n="7" />

But even in situations where the objective of protecting posthumous privacy seems entirely legitimate, as for example, in the case of Rb Amsterdam 12 December 2003, KG 2003, 1363 m.nt. GJZ, where the daughter of two Holocaust victims applied to the court to remove her parents' personal information from the Digital Monument to the Jewish Community in the Netherlands, as this identification violates their and her data protection rights and evokes painful memories, other factors often prevail, such as ensuring freedom of expression.<fnref n="8" />

Despite the lack of global legal clarity on the matter, in light of the increasing threats to both our ante-mortem<fnref n="9" /> and post-mortem privacy associated with the rapid development of technology and the growing influence of private corporations, many scholars take a firm normative stance supporting and proclaiming the existence and the need to regulate the post-mortem privacy and data justifying it from the different perspectives. The works of Sperling, Smolensky, Harbinja, Buitelaar and many other legal and social scholars constitute a paramount contribution to the theoretical conceptualisation of the posthumous privacy phenomena.<fnref n="10" />

Thus, based on the idea that, although not all, the interests of individuals survive their death and deserve to receive legal protection,<fnref n="11" /> this work, without further consideration of the theoretical basis, will proceed to consider the practical aspects of the implementation and regulation of posthumous privacy and data protection.

GENERAL REMARKS AND IMPORTANT CATEGORISATIONS

As was previously stated, the discussion and consideration of the notion of post-mortem privacy in general and in the legal dimensions, in particular, are mainly caused by the increased level of concern both in the ordinary and in the legal discourses about the lack of regulation and

<footnote n="5">⁵ Bart Van der Sloot, "Decisional privacy 2.0: the procedural requirements implicit in Article 8 ECHR and its potential impact on profiling." in *International Data Privacy Law*, Vol. 7(3), 2017, pp. 190-201.</footnote>

<footnote n="6">⁶ Gianclaudio Malgieri, “RIP: Rest in privacy or rest in (quasi-) property? Personal data protection of deceased data subjects between theoretical scenarios and national solutions. Personal Data Protection of Deceased Data Subjects between Theoretical Scenarios and National Solutions.” in *Data Protection and Privacy: The Internet of Bodies*, 2018, p. 10; European Commission on Human Rights, Application N° 8741/79, déc. 10.3.81, D.R. 24, pp. 140-143</footnote>

<footnote n="7">⁷ Bo Zhao, “Posthumous Defamation and Posthumous Privacy Cases in the Digital Age” in *Savannah Law Review*, Vol. 3, 2016, p. 4.</footnote>

<footnote n="8">⁸ Bo Zhao, 2016, *supra nota*, p. 2; Rb Amsterdam 12 December 2003, KG 2003, 1363 m.nt. GJZ (Uitspraakvoorzieningen-rechter particulier/Stichting Digitaal Monument Joodse Gemeenschap)</footnote>

<footnote n="9">⁹ See Jan Buitelaar, “Privacy: Back to the roots” in *German Law Journal*, vol. 13, 2012, pp. 185-187.</footnote>

<footnote n="10">¹⁰ See: Daniel Sperling, “Posthumous interests: legal and ethical perspectives” in *Cambridge: Cambridge University Press*, 2008, p.8; Kirsten Rabe Smolensky, “Rights of the Dead” in *Hofstra Law Review*, vol. 37, 2008, pp. 763-803; Lilian Edwards, Edina Harbina, “Protecting post-mortem privacy: Reconsidering the privacy interests of the deceased in a digital world” in *Cardozo Arts & Entertainment Law Journal*, vol. 32, 2013, p. 11; Jan Buitelaar, “Post-mortem privacy and informational self-determination” in *Ethics and Information Technology*, vol. 19(2), 2017, pp. 129-142.</footnote>

<footnote n="11">¹¹ Daniel Sperling, 2008, *Supra nota*, p. 304; Kirsten Rabe Smolensky, 2009, *Supra nota*, p. 765.</footnote>
inscrutability of legal elements or their aggregates, usually designated as components or influencing factors of what we understand as digital posthumous privacy within the discourse.

These components, among other fields, include:

* property and essentially succession law: the principle of universal succession is generally governing the posthumous transfer of assets.<fnref n="12" />

* intellectual property law regimes: transferability is usually dependent on the classification of the assets in question.

* contract law: the contract of service is essential for the usage of digital intermediaries' services; it also sets the normative basis for the internal procedures of the assets and data processing activities conducted by the intermediary.

* data protection law: sets standards for data processing, control, and transmission, defining the scope of data subjects' and controllers' (the intermediary/platform service-providers) conduct.

The abovementioned conditional categorisation is primarily based on the observations of issues considered by the civil legal system courts in the event of ruling and substantiating the account-related transfer issues.

There are also various stakeholders relevant to the issues surrounding post-mortem privacy online, namely, internet users, their families, service providers (intermediaries) and society.<fnref n="13" /> As the author takes a normative stance and promotes the interests of the users over their family or intermediaries, this work will focus on the practical aspects of the implementation of digital posthumous privacy directly related to the possibility and accessibility of individuals to control the fate of their digital assets in their own interests after death in within the framework of international and national legislation of the EU member states, trying to shed light on their nature, prospects and peculiarities.

## POST-MORTEM PRIVACY ON THE EU-LEVEL DATA PROTECTION LEGISLATION

As was already mentioned above, due to the relative novelty of the phenomena in general, the fate of our digital assets and their post-mortem aspects after our death currently remains in the so-called “grey area”. Also, no European-wide piece of legislation harmonises or sets explicit standards for either succession of digital assets or posthumous privacy regulation.

According to recital 27 of the General Data Protection Regulation (GDPR), the European GDPR is not applicable to the personal data of deceased persons.<fnref n="14" /> However, the Member States were left free to implement their own decisions and regulations regarding the post-mortem data and data subjects’ protection. Despite the recommendation’s non-mandatory nature, GDPR has stirred a wave of post-mortem property and data regulation that is forcing us to rethink our vision of these phenomena.<fnref n="15" /> Legislative responses to the encouragement to self-regulate post-mortem privacy vary widely from MS to MS: non-implementation and various examples of partial implementation. There have also been court proceedings, which in this context, can give us a better understanding of the consequences of these regulations and help form an idea of the potential for harmonisation.

<footnote n="12">¹² George Pelletier Jr., Michael Roy Sonnenreich, “A Comparative Analysis of Civil Law Succession” in *Villanova Law Review*, vol. 11, 1966, p. 326.</footnote>

<footnote n="13">¹³ Edina Harbinja, “Post-mortem privacy 2.0: theory, law, and technology” in *International Review of Law, Computers & Technology*, vol. 31(1), 2017, p. 27.</footnote>

<footnote n="14">¹⁴ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ (Official Journal of the European Union) L 119/1, recital 27.</footnote>

<footnote n="15">¹⁵ Giorgio Resta, “Personal data and digital assets after death: a comparative law perspective on the BGH Facebook ruling” in *Journal of European Consumer and Market Law*, vol. 7(5), 2018, p. 201.</footnote>
In the next section, as part of a comparative analysis, the approaches of such countries as Germany, Italy and France will be carefully assessed.

# EU MEMBER STATES' NATIONAL LEVEL REGULATION

## 3.1 *Germany*

Germany, in the context of conditional categorisation, belongs to countries in which the issue of posthumous privacy in the absence of GDPR incorporation for its regulation is considered in the context of **the conflict of contract law, meaning the contract of services between the intermediary platform and the user, and inheritance law.**

The assessment of the right to inherit and the right to access the account within the six instances of the court of the fundamental LG Berlin, 20 O 172/15¹⁶, (“LG Berlin”) case – the first major European case on the issues of digital inheritance of social media accounts and, accordingly, posthumous data privacy directly linked to the transfer accompanying it, clearly and in detail demonstrates the logic and specificity of the approach from the position of reaching the objectives of protection of property rights in the context of the principle of universal succession.<fnref n="17" />

LG Berlin concerned the parents' right of access to the Facebook account of their underaged daughter who had committed suicide: the mother tried to log into the account, but the access was restricted, as Facebook transferred the account to a memorialised status in accordance with the internal rules of Facebook and the provisions of “Terms of service”, and on the deceased's mother's request for access was refused with reference to internal rules and principles of Facebook. <fnref n="18" />

As part of its arguments in the first instance of the court, Facebook claimed the non-transferability clause in the service contract between the provider and the original owner of the account prevents the heirs from succeeding and accessing the account. The court, instead, declared that this contractual provision has no effect and cannot prevent the inheritance of a service contract, which is the same property as any other. The Berlin Regional Court noted that one of the reasons for the invalidity of the memorialisation and non-transferability clause is the disproportionate and unreasonable disadvantage to the heirs that these regulations cause.

The Berlin Court of Appeal denied the existence of the successor's right to access of account on the basis of the secrecy of telecommunications designed to protect the communications of the legal predecessor of the account and their communication partners.

In turn, the Federal Supreme Court returned the decision of the court of the first instance, emphasising the priority of the principle of universal inheritance over contractual provisions. Also, an essential and fundamental explanation of the rules of inheritance of digital assets was made: according to the Court, digital assets should be equated with physical ones and be inherited accordingly, that is, identically based on this equivalence. The secrecy of telecommunications, which Facebook put forward as an argument for denying access to the account, would not be valid if it was a paper letter communication – thus, messages should be inheritable as well.

This argument quite reasonably raises doubts in the context of the interpretation of the protection of the data of these third parties in the context of the GDPR: at the same time, as the court notes, the right of access to this data of their testator should be extended to the heirs within the framework of Art. 6 GDPR 1 (b), as they are now effectively the beneficiaries and party to the agreement that is the basis of this basis for processing.<fnref n="19" />

<footnote n="16">¹⁶ LG Berlin, 20 O 172/15, ECLI:DE:LGBE:2015:1217.20O172.15.0A</footnote>

<footnote n="17">¹⁷ Ibid.</footnote>

<footnote n="18">¹⁸ Ibid.</footnote>

<footnote n="19">¹⁹ BGH III ZR 183/17, ECLI:DE:BGH:2018:120718UIIZR183.17.0 para 72-73.</footnote>
Despite the apparent inheritance rights-centred position regarding access to account data and, accordingly, posthumous privacy, which is actually excluded, since the consent given by the legal predecessor to memorialisation was not considered even potentially as an expression of will<fnref n="20" />, it is worth noting that, nevertheless, probably, not all factors posthumous personal rights are entirely rejected by the German legislation. A strong argument in support of this is the advisory ban on granting heirs the right to actively use the page<fnref n="21" />: that is, despite the order to provide access to all information from the account and the actual transfer of the account with all rights to it to the hands of the heirs in accordance with the law of universal succession, the court considers it appropriate to limit the right of use such functions as sending messages from the face of the deceased or editing the account.

Mikk and Sein, concluded that such a prohibition may be related to an exception to the principle of universal succession, which excludes rights and obligations of a personal nature, that is, those that are inextricably linked and directly depend on the personality of the owner from the list of “universal inheritance”.<fnref n="22" /> At the same time, as the court rightly noted, this principle, in accordance with the norms of German law,<fnref n="23" /> is difficult to apply to the contractual provisions of General Terms and Conditions due to their lack of personal character.

Despite the undeniable fundamental nature of the case, considering the many subtleties associated with such aspects of it as the age of the original data subject, which directly affects the validity of the consent, the parent's reasons for seeking access, namely suicide, and the procedural flaws in the attempts at contractual regulation Facebook, LG Berlin cannot be considered unequivocally indicative and decisive of the post-mortem privacy in Germany as a whole. Nevertheless, given Facebook's abolition of the memorialisation procedure for German accounts, the prospect of considering the aspect of standardised and non-standardised contractual clauses as a potential way to ensure posthumous privacy in the context of the 1922 BGB anywhere other than in scholarly discourse seems unlikely.<fnref n="24" />

A similar, i.e., primarily based on the principle of universal succession, approach to the regulation of posthumous privacy is likely to be used in most EU countries that have not incorporated or deliberately excluded the potential possibility of incorporating (Sweden) <fnref n="25" /> provisions on posthumous data protection into their codes, given prevalence of the principle of the universal succession in European legal systems.<fnref n="26" />

However, to consider this approach the only possible, given the lack of harmonisation in the issue of digital inheritance, would be too presumptuous considering the additional factors of its regulation, in each country countries, such as the definition and classification of “digital assets”, the level of their heritability, additional aspects of privacy or the interpretation and weight of contract law. For example, if we proceed from the LG Berlin judgement's idea of equating the inheritance of digital assets with their material counterparts in the context of Polish legislation, then taking into

<footnote n="20">²⁰ Angelika Fuchs, ‘What happens to your social media account when you die? The first German judgments on digital legacy” *ERA Forum Springer Berlin Heidelberg*, vol. 22 (1), 2021, p. 3.</footnote>

<footnote n="21">²¹ Angelika Fuchs, 2021, *supra nota*, p. 5</footnote>

<footnote n="22">²² Tiina Mikk, Karin Sein, “Digital Inheritance: Heirs' Right to Claim Access to Online Accounts under Estonian Law” in *Juridica International*, vol. 27, 2018, pp. 121-122.</footnote>

<footnote n="23">²³ MüKoBGB/Leipold (Note 13), §1922 sn. 28</footnote>

<footnote n="24">²⁴ Angelika Fuchs, 2021, *supra nota*, p. 7.</footnote>

<footnote n="25">²⁵ Ondre Hamulák, Hovsep Kocharyan, Tanel Kerikmäe, “The Contemporary Issues of Post-Mortem Personal Data Protection in the EU after GDPR Entering into Force” in *Czech Yearbook of Public & Private International Law*, vol. 11, 2020, p. 226.</footnote>

<footnote n="26">²⁶ George Pelletier Jr., Michael Roy Sonnenreich, 1966, *supra nota*, p. 326.</footnote>
account the Polish rule of the limitation of disclosure of private correspondence to specific categories of people only, the disclosure of the messages would already be assessed differently.<fnref n="27" />

## 3.2 *Italy*

Italy is one of the countries that has taken the opportunity to extend some provisions of the GDPR to post-mortem data. Legislative Decree no. 101 of 2018, incorporates Articles 15 to 22 of the GDPR into law in such a way that they can be used by legal successors or a designated person to protect the interests of the deceased in relation to the management of their data.<fnref n="28" />

Also, according to the new decree, it became possible for persons to partially regulate the post-mortem data by means of a direct written will regarding the further fate of digital assets to the address of the data controller, i.e. the service provider in the case of social networks and digital storage, which includes the possibility to prohibit legal successors from using the rights within the framework of the above-mentioned Articles 15-22 of the GDPR.<fnref n="29" />

It is crucial that the law itself neither overrides the fundamental principle of universal succession, nor excludes the factor of “unfair contractual provisions”<fnref n="30" />, but only partially models the inheritance process with respect to some of its components, actually expanding freedom of testation to the application on the data, but not directly to the control of the economic-related aspects of the data. It would seem that such an approach can be called consensual from the point of view of the balance of the right of inheritance, the practical and economic interests of the successor and informational self-determination, but despite both the standard contractual conditions, which were recognised as insufficient to protect the will of the predecessor, as well as the possibility of the will to be expressed within the framework of the legislative decree, inheritance and access to data according to universal succession remains the default position.

This pattern is clearly observed in the court case Tribunale Ordinario di Milano, N. R.G. 2020/44578, which can also give us a general idea of the practical side of the procedure for establishing the will of the legal predecessor.

Tribunale Ordinario di Milano, N.R.G. 2020/44578 concerned the request of the deceased man's parents for access to his Apple account to store photos and information from there to “make it easier to cope with the loss”. Counting this as a valid reason, after dismissing the non-transferability clause-related counterclaims, the court proceeded to a practical consideration of the will or lack of will regarding providing access to the deceased's information:

> «From the correspondence between the appellants and the respondent company, it emerges clearly that Mr. XX has not expressly prohibited the exercise of the rights connected to his post-mortem personal data...»<fnref n="31" />

In general, comparing the Italian and German approaches from the point of view of posthumous privacy, the Italian one, despite the apparent shortcomings, can be considered more beneficial for posthumous privacy, since, unlike the German one, it developed the primary mechanisms for its regulation, thus still incorporating into legislation and developing the adjustment mechanism, even if not a perfect one. The identity of the approach with the principles and

<footnote n="27">²⁷ Michal Grochowski, “Inheritance of the social media accounts in Poland” in *European Review of Private Law*, 27(5), 2019, p.1201.</footnote>

<footnote n="28">²⁸ Paolo Francesco Patti, Francesca Bartolini, “Digital Inheritance and Post Mortem Data Protection: The Italian Reform” in *European Review of Private Law*, *Bocconi Legal Studies Research Paper*, 2019, p. 1182.</footnote>

<footnote n="29">²⁹ Decreto legislativo 10 agosto 2018, n. 101: ‘Disposizioni per l’adeguamento della normativa nazionale alle disposizioni del regolamento (UE) 2016/679 del Parlamento europeo e del Consiglio, del 27 aprile 2016, relativo alla protezione delle persone fisiche con riguardo al trattamento dei dati personali, nonché alla libera circolazione di tali dati e che abroga la direttiva 95/46/CE’</footnote>

<footnote n="30">³⁰ Paolo Francesco Patti, Francesca Bartolini, 2019, *Supra nota*, p. 1183.</footnote>

<footnote n="31">³¹ Tribunale Ordinario di Milano, N. R.G. 2020/44578 p.4</footnote>
characteristics of what we understand as post-mortem privacy is also evident. Italian law refers to the potential intentions of the predecessor-data subject of the information as a reasonable person to determine its application, emphasising the connection with concepts such as identity, individual autonomy, and dignity, implying that these things are valid and relevant even after the death of an individual.<fnref n="32" />

### 3.3 France

The French model of protection of posthumous privacy incorporated on the basis of GDPR is considered one of the most complete and detailed in terms of many aspects. What considerably differs it from previous examples is the possibility to leave precise instructions on the desired regulation of the posthumous data – decrees under the responsibility of third parties certified directly by the CNIL<fnref n="33" />.<fnref n="34" /> As in the previous two cases, the sole consent to the „terms and conditions” cannot be considered such an instruction, and, accordingly, cannot affect the regulation of post-mortem data as it does not contain explicit consent on which the decrees are based, however, as in the Italian example, specific instructions left through direct personal communication with the controller may be such a legal basis.<fnref n="35" />

A particular person can be appointed to activate the execution of left decrees. The law clearly states that if a person was not appointed, or died before being able to fulfil his obligations, the decrees can also be activated by the heirs.<fnref n="36" />

A key factor and a significant feature of the French approach is the actual division of rights related to digital assets into economic rights related to digital goods and personal ones, where the legal predecessor, that is, the deceased, has the right to regulate both the first and the second, and where the second always prevails over the first, which is “actually an absolute form of posthumous privacy”.<fnref n="37" />

It would seem that the lack of division into economic and personal aspects of personality rights in approaches to the regulation of posthumous privacy in aforementioned Germany actually leads to the opposite result: personality rights are complementary to economic rights. But is it actually, correct?

In fact, Germany considered the heritability of an account from the point of view of counterbalancing the rights to it within the framework of the contract, defining it as a legal basis covering all the assets in it, while the French classification and approach are based on the idea of judging by the content, not form: assets from the account are formed under the influence of the personality-linked activity of the user and therefore are personality-linked assets, freedom to testate regarding which is considered unlimited.<fnref n="38" />

In the German example, the court put forward the idea that the right to actively continue using the account as it was done by the legal predecessor is not included in the list of inherited rights, which theoretically can also be interpreted as a restriction made on the basis of the deeply personal nature

<footnote n="32">³² Tribunale Ordinario di Milano, N. R.G. 2020/44578 p.4. Translated from Italian: «...also in the case in question the legislator – with a view to protecting the same rights to dignity and self-determination (rights that concern both the physical dimension of the person and that which pertains to the relationship with the personal data which express and create a part of the identity of the person himself) has expressly valued the autonomy of the individual, leaving him the choice of whether to leave the right to access his personal data (and exercise all or part of the related rights) to heirs and legitimated successors or deny access to such information to the third parties...»</footnote>

<footnote n="33">³³ The French Data Protection Authority.</footnote>

<footnote n="34">³⁴ Malgieri, G. (2018), *supra nota*, p. 15</footnote>

<footnote n="35">³⁵ Ibid.</footnote>

<footnote n="36">³⁶ LOI n° 2016-1321 du 7 octobre 2016 pour une République numérique, art 40.</footnote>

<footnote n="37">³⁷ Malgieri, G. (2018), *Supra nota*, p. 16</footnote>

<footnote n="38">³⁸ Ibid.</footnote>