Report on Legal Issues
This Deliverable identifies and examines various legal issues that are relevant to the production of, access to, linking of and re-use of big data in the transport sector. Chapter 2 sets the scene and introduces the concept of big data, its particular characteristics, its possible use in the transport sector, the existing policy framework, and the identified legal issues. In Chapter 3, the authors examine the various identified legal issues and discuss the challenges and opportunities that may arise in this respect, coming up with notably the following findings: Privacy and data protection: Some concepts, principles and obligations under data protection law appear to be problematic for the uptake of big data. In particular, the broad definition of "personal data" and "processing", the qualification of the various actors involved as (joint-)controllers or processors, the core data protection principles, the need to identify a ground for processing, the requirement to conduct data protection impact assessments, the implementation of privacy by design and by default measures, the rights of data subjects, and the requirement to put in place adequate data transfer mechanisms seem difficult to reconcile with the concept of big data. (Cyber-)Security: The requirement to put in place security measures is imposed in various legislations at EU and national level, including key instruments like the GDPR and the NIS Directive. However, such legislative framework remains rather general and vague as to which specific measures are deemed appropriate. In order to comply with this requirement, organisations involved in big data analytics generally need to rely on security experts and take into account the evolving guiding documents published by authorities such as ENISA. Relying on certification mechanisms, seals, marks, and codes of conduct will enable companies complying with their legal obligations and demonstrate their compliance. Breach-related obligations: The various actors of the (big) data value chain need to implement ...