Menu

Filter by
content
PONT Data&Privacy
  • PONT home
    • mill

    0

    Privacy in the social domain
    Gemeenten zijn verantwoordelijk voor de uitvoering van taken in het sociaal domein, waarbij veel gevoelige gegevens worden verwerkt. Dit brengt privacyrisico's met zich mee.

    Report Privacy Congress 2025: Jaap-Henk Hoepman critical of technical developments CSAM, eIDAS and European digital currency

    At the annual Privacy Conference last week, Dr. Jaap-Henk Hoepman spoke about a number of new European laws that use technical solutions to achieve privacy. These include the eIDAS, CSAM and Digital Euro regulation. Dr. Hoepman provided technical insight into the privacy engineering involved in the new laws and gave his critical view on the chosen techniques. His conclusion? "Technical standards in legislation are far too rarely developed in consultation with academics and NGOs." Dr. Jaap-Henk Hoepman is visiting professor of computer science at Karlstad University and senior lecturer in computer science at Radboud University.

    Christian Cordoba Lenis
    February 6, 2025

    Presentations

    Presentations
     
    Image by Gerrit Davelaar

    eIDAS 2.0

    The European Digital Identity (eIDAS) aims to give citizens a secure and widely accepted digital identifier. This system would allow citizens to purchase online services without revealing their full identity. In theory this sounds great, but in practice the technical implementation leaves much to be desired, according to Dr. Jaap-Henk Hoepman.
     
    A major criticism is the lack of a truly privacy-friendly architecture. The implementation of digital signatures in the current eIDAS 2.0 standard means that users can still be tracked across different services. This undermines the fundamental principle of an anonymous and secure digital identity. Cryptographic alternatives such as zero-knowledge proofs, which allow attributes to be selectively revealed without revealing full identity, are not used. Hoepman emphasizes that standardization of cryptography within governments is problematic. A limited set of "approved" cryptographic techniques are allowed, many of which are outdated and inefficient for modern privacy applications.

    Privacy-friendly digital Euro?

    With the rise of digital payments and cryptocurrencies, the European Central Bank (ECB) aims to provide a digital alternative to cash. The Digital Euro should, according to the European Central Bank (ECB) have a similar level of privacy as cash, but in the current setup that seems like an empty promise states Hoepman.
     
    Hoepman doubts the technical feasibility of a truly anonymous digital euro. Cash has fundamental properties such as anonymity, freedom of transaction and independence from central infrastructures. The digital euro should mimic this, but the current technical implementation does not sufficiently guarantee anonymity, according to Hoepman. After all, all transactions are recorded and monitored, leading to far-reaching control over transactions. He argues that the privacy-friendly digital euro should be "cash-like," with the identity of the payer and recipient remaining unknown unless explicitly desired.
     
    Another problem is the so-called "double-spending" challenge with offline payments. Cash works without the intervention of banks or network connections. A digital currency should be able to do the same, but current proposals require payments to be processed through centralized systems, which negates privacy. Hoepman points out that technical solutions such as Trusted Execution Environments (TEE) and secure elements on cell phones could theoretically provide a solution, but it depends on the reliability of hardware manufacturers and the infrastructure that controls them. This leads to a central dependency, which goes against the fundamental properties of cash.
     

    CSAM client-side scanning

    The most controversial of the three laws is the CSAM regulation, which aims to stop the distribution of child abuse materials. The goal is undoubtedly important, but the approach taken raises serious privacy and security concerns, according to Hoepman.
     
    The most recent bill proposes applying "client-side scanning" to chat services such as Whatsapp or Signal, in which software checks photos and messages locally, i.e. on the device itself, for images of child abuse before sending them. If images of child abuse are detected, it can lead to a report to authorities. Hoepman compares the model to a "snitch installed on your phone" that scans every message before it is sent. This effectively means that every communication device acts as a potential surveillance tool, leading to a serious breach of letter secrecy, according to Hoepman.
     
    In addition, Hoepman points to the unverifiability of the database containing hashes of illegal images. This database can be misused to block other types of content, such as political opinions or journalistic disclosures. Because the hashes are secret, there is no transparency about what is being monitored. This opens the door for censorship and abuse by governments and large tech companies.
     
    Another criticism is the lack of technical reliability of content detection algorithms. False positives, where innocent images are flagged as illegal, can have serious consequences for innocent users. The speaker argues that the European Commission has not adequately thought through the real implications of this technology and that the focus on encryption preservation is a fallacious argument. "Arguing that encryption remains intact while a device preemptively analyzes messages is like saying you keep a letter locked while the government reads the contents before you send it," Dr. Hoepman said.
     

    Legislation and technology run alongside each other

      What these three laws have in common is that they all attempt to solve an important legal and societal challenge using technology. However, in all cases, Hoepman says, it appears that the technical implementation is not thought through enough, putting privacy at risk.
     
    Dr. Hoepman emphasizes that there is a fundamental problem with how technological regulation is created. Policymakers formulate legislation without sufficient technical understanding and rely on existing standards that are often inadequate for privacy-friendly implementations. This results in laws that are developed in legislative circles without the technical insights of experts who better understand the implications of the systems chosen. Jaap-Henk describes how he often sees it go wrong in legislation that uses technology: "First, a college is then appointed, which tries to describe in legal terms what the system should do. A kind of requirements document, but not written by technicians, but by lawyers. With the very best of intentions, but it doesn't describe well enough what the system should really do in the end."
     
    To solve this problem, he recommends closer cooperation between legislators, scientists and NGOs early in the legislative process. According to Jaap-Henk, technical knowledge is indispensable for the use of technology in legislation: "The technical specifications determine how it will really work in the end. So how those are implemented is ultimately essential to know what the privacy and security properties of these systems are."

    Share article

    Comments

    MORE REACTIONS

    Leave a comment

    You must be logged in to post a comment.

    NEWS

    Data Processing by Collaborative Groups Act (WGS): legal basis for information sharing against crime

    Blog

    Privacy Awards 2025: Innovative data collaboration GERDA nominated

    Interviews

    Conflict of duties: keep quiet or report?

    Blog

    Innovative data sharing while preserving privacy: Roseman Labs nominated again for Privacy Awards

    Interviews

    The Municipality of Rotterdam and Roseman Labs have been nominated for the Privacy Awards 2025. This recognition follows their win in 2024, when they won the top prize with a project focused...

    Findings from 'Government Sector Assessment' by the Personal Data Authority (Part 1)

    Blog
    Mookhoek, Nico

    Data Processing by Collaborative Organizations Act (Wgs) - part 3: The regulation for RIECs and Care and Safety Homes

    Blog

    Data Processing by Partnerships Act (Wgs) - part 2: what safeguards does the Wgs regulate?

    Blog

    Data Processing by Partnerships Act (Wgs) - Part 1: What does the Wgs enable for partnerships?

    Blog

    Municipality of Geertruidenberg leaks financial data of citizens due to printing error

    News press release
    Information Security Netherlands

    AI in IT contracts: legally watertight and flexible

    The AI Act is an important European law that will impose requirements on AI, including with respect to test data, transparency and the control of outcomes by natural persons. It is essential to take this legislation into account in contracts to avoid potential legal problems. How do you address this?

    Learn more

    IT contracts: depth and practical tips

    In this in-depth two-day course, you'll learn all about creating and managing IT contracts. Whether you're dealing with hardware and software licensing, custom projects or the challenges of cloud contracts and data transfers, this course will provide you with the knowledge and tools to create strong, watertight agreements. Of course, the latest cybersecurity requirements are also covered.

    Learn more

    Expert membership

    Expert membership

    Benefit now

    AI Officer for the Public Sector

    Learn more

    AI in practice: the legal aspects

    In this course you will receive insight into Artificial Intelligence from a specialized lawyer (Martin Hemmer, attorney at AKD) as well as a data scientist (Nienke Bakx, data science consultant at Datacation). Partly based on practical examples, the lecturers will discuss the legal backgrounds and pitfalls. You will work with a practical case to apply the knowledge immediately.

    Learn more

    Join PONT | Data & Privacy

  • Access to Knowledge Base
  • Read e-books
  • Contact with peers
  • Own news overview
    • BECOME A MEMBER

    General

    Service

    Navigate

    Berghauser Pont Media Group

    CONTACT

    𝕏

    Copyright 2025 Berghauser Pont | Website created by Buro Zero