Since the terrorist attacks of 11 September 2001 in the United States, the association between migration and security has been continuously strengthened, with multiple States working to tighten their border controls. In the European Union (EU), this trend has been shown by the frequent overlap between asylum application and migration policies and the agenda concerning border control, security, and terrorism. This securitization of migration discourse is claimed to justify the use of controversial practices to examine asylum applications. Against this background, the article reflects on the use of technology-assisted and automated decisions in this area. In particular, it questions whether the existing safeguards provided in the EU data protection framework ensure asylum seekers’ rights to privacy and the protection of personal data. In doing so, the article seeks to offer a more nuanced understanding of European asylum policy and the potential flaws therein that allow individuals’ fundamental rights – enshrined in the EU Charter and the European Convention on Human Rights – to be infringed. In conclusion, the article engages with the debate relating to the use of automated decisions, in particular those based on artificial intelligence, and whether they should be excluded from certain policy areas, such as migration.

Artificial intelligence systems have become ubiquitous in everyday life, and their potential to improve efficiency in a broad range of activities that involve finding patterns or making predictions have made them an attractive technology for the humanitarian sector. However, concerns over their intrusion on the right to privacy and their possible incompatibility with data protection principles may pose a challenge to their deployment. Furthermore, in the humanitarian sector, compliance with data protection principles is not enough, because organisations providing humanitarian assistance also need to comply with humanitarian principles to ensure the provision of impartial and neutral aid that does not harm beneficiaries in any way. In view of this, the present contribution analyses a hypothetical facial recognition system based on artificial intelligence that could assist humanitarian organisations in their efforts to identify missing persons. Recognising that such a system could create risks by providing information on missing persons that could potentially be used by harmful actors to identify and target vulnerable groups, such a system ought only to be deployed after a holistic impact assessment has been made, to ensure its adherence to both data protection and humanitarian principles.

In this paper we explore EU data protection authorities' (DPAs) role as leaders and educators, particularly in relation to awareness-raising efforts with Small and Medium-sized Enterprises (SMEs). The GDPR made awareness raising duties of DPAs explicit whilst SMEs face challenges complying with data protection law. We posit that DPAS should make better strategic use of collaboration with SME Associations as intermediaries to better access and understand the needs of SMEs. This collaboration could facilitate dissemination of guidance and information addressed to SMEs. It could also help to overcome concerns expressed by SME representatives about the existing guidance provided by DPAs as being overly generic, focused on legal theory, and in some states arriving too late for implementation. We suggest that by working together SME Associations and DPAs could increase their own working efficiency as well as the one of SMEs. We build our arguments on the findings of an online survey of 52-60 SMEs representatives and semi-structured qualitative interviews with 18 DPAs, 22 SME Association representatives and 11 SME representatives.

Technology & Society (LSTS) of the Vrije Universiteit Brussel (VUB), and Trilateral Research Ltd (TRI IE) between August 2018 and December 2020. STAR II consortium members included academics with extensive theoretical background in privacy and data protection -Lina Jasmontaitė-Zaniewicz and Alessandra Calvi -of VUB-LSTS, researcher and practitioner from TRI IE -David Barnard-Wills -who provides multidisciplinary research and consultancy services in the field of data protection; and Renata Nagy -the representative of the Hungarian Data Protection Authority, who has been actively engaged in awareness raising activities for SMEs. The main goal of the project was to promote compliance with the General Data Protection Regulation (EU) 2016/679, commonly referred to as GDPR, by assisting Data Protection Authorities (DPAs) and Small and Medium-sized Enterprises (SMEs). To this end, the STAR II project prepared a Guidance for DPAs on running hotline services dedicated to SMEs and the handbook on European data protection law for SMEs outlining obligations and good practices concerning the processing of personal data. The STARII project materials are available atwww.star-project-2.eu. The STAR II project is a follow-up of the STAR project that developed easily customizable training materials for data protection professionals, 9 Annika Linck EU Policy Manager European DIGITAL SME Alliance 1 European Commission, 'Communication -Two Years of Application of the General Data Protection Regulation | European Commission' (2020) https://ec.europa.eu/info/law/law-topic/data-protection/communication-twoyears-application-general-data-protection-regulation_en; European Data Protection Board, 'Contribution of the EDPB to the Evaluationof the GDPR under Article 97' (18 February 2020) https://edpb.europa.eu/sites/edpb/files/files/file1/ edpb_contributiongdprevaluation_20200218.pdf. 2 European Union, 'Special Eurobarometer 487a: The General Data Protection Regulation' (2019).3 For example, personal data are processed in order to execute payments for employees, or to contact clients. CCTV systems at the premises of an SME in the footage also capture personal data. EDPB, 'The Belgian DPA has imposed a fine of € 15,000 on a website specialized in legal news' https://edpb.europa.eu/news/national-news/2019/ belgian-dpa-has-imposed-fine-eu15000-website-specialized-legal-news_sv.