Margot Kaminski is a 2017-2018 Fulbright-Schuman Innovation Grant Research Scholar and an Associate Professor at the University of Colorado Law and the Director of the Privacy Initiative at Silicon Flatirons. She specializes in the law of new technologies, focusing on information governance, privacy, and freedom of expression. Recently, her work has examined autonomous systems, including AI, robots, and drones (UAS). In 2018, she researched comparative and transatlantic approaches to sensor privacy in the Netherlands and Italy as a recipient of the Fulbright-Schuman Innovation Grant. Her academic work has been published in UCLA Law Review, Minnesota Law Review, Boston University Law Review, and Southern California Law Review, among others, and she frequently writes for the popular press.
I could not have picked a better year to research data privacy law in the EU. I also could not have predicted, at the start of my Fulbright-Schuman Innovation Grant, the amount of serendipity the experience would entail, nor where my research would ultimately go. Having a rewarding Fulbright experience—especially for a Fulbright Schuman Scholar, who works in at least two member states to develop an understanding of EU-wide policy—requires being open and flexible, and being responsive to both opportunities and more challenging changes. The six months I spent in Europe this year were a profound gift, both professionally and personally. And much of the value of that gift—I would say, a surprising amount of the value of that gift for a legal researcher—came from living in Europe, which enabled me to be able to shift to where the research took me, both academically and physically.
Remember all of those privacy-related pop-ups and emails that you received in spring 2018? Those were the result of the EU’s General Data Protection Regulation going into effect. When I crafted my research proposal for the Fulbright back in 2016, I knew that the GDPR would have a big impact, and I wanted to be in Europe when that happened. That experience alone made it all worthwhile. I could, as a “data subject who was in the Union,” read revised privacy policies and tamper with my privacy settings, and better understand what the law looked like as a consumer, on the ground.
Being in Europe in the year of the GDPR also put me ahead of the curve for a U.S. professor. While at the 2018 annual U.S. Privacy Law Scholars Conference, only two or three papers out of the more than sixty papers presented focused on the GDPR, at the equivalent Brussels-based privacy conference that I was able to attend, session after session went into deep detail on the GDPR. I met practicing attorneys, talked to civil society advocates and government officials, and spoke to leading academic experts I otherwise wouldn’t have met.
If I had to encapsulate the Fulbright experience, however, I would say that it is not about the conferences. It is about letting what happens take you in unexpected and exciting directions. I came into my Fulbright Schuman grant with a plan to address privacy law and robotics, with a focus on sensor privacy: the increasing use of sensors, ranging from video recording to location tracking, to gather information about us in physical spaces. The U.S. has (or had) one approach to sensor privacy; the EU approach looks very different. My research then took me to a different, though related, place.
I thought that after an initial quick look into how the GDPR treats Artificial Intelligence (AI), the bulk of the project would focus on privacy in public places, or on notice and consent. But my research actually stayed at stage one. In the first month of the grant, I workshopped a fascinating paper about, and got stuck on, Article 22 of the GDPR, which addresses “automated decision-making”— the kind of AI or computer-based decision-making that might go into analyzing sensor data, or serving you online advertisements, or steering a robot or a drone. What I thought was going to be a one- or two-month initial project ended up leading me in new directions, away from notice and consent to different kinds of transparency rights in privacy law, like the right to an explanation of decisions computers make about you. This focus in turn gave me a perspective on how the GDPR works as a whole, which I might never have obtained, had I stuck with the initial research plan. So far—and this is just the beginning—this has led to an op-ed in The Economist, one of my fastest downloaded papers, an article in a top law review, an invited chapter on robots and data protection in an EU casebook, and an ongoing project with a European co-author.
This is not to say that the proposed project was abandoned. But by being in the EU, engaging with what people were actually talking about, and being open to serendipity and to outreach by researchers in the EU, I was able to both acquire subject-matter expertise in a fast-growing area, and find a broader perspective on the GDPR that adds to the discussion of how the law actually works. I still ended up writing on sensor privacy, in a way (Article 22 was in fact part of my research proposal), but on an aspect I never would have been able to predict would be so important, or so exciting.
Serendipity played a big role in my experience at my host institutions, too. The plan, at least on paper, was to spend the first half of the Fulbright-Schuman grant at the Institute for Information Law (IViR) at the University of Amsterdam, researching privacy, and the second at the Scuola Sant’Anna in Pisa, studying the EU law of robotics. But by the time I made it to Amsterdam, a number of the resident experts on data protection had in fact moved to other countries. Instead, I found myself regularly engaging with resident experts on consumer protection, a member of the Council of Europe Committee on Human Rights and AI, and an amazing group of post-docs who have been working on an ongoing project about “personalized media”, focusing on transparency and decisional fairness in the context of media targeting. In other words, where I thought I was going to be mainly discussing privacy, I ended up discussing fairness, transparency, and algorithms/AI. Then in the latter half of the grant, in Pisa, where my plan had been to spend most of my time talking robots with the great researchers located there, I ended up talking and thinking a lot about data privacy law, too. To my surprise, it turned out that two of the leading experts on the GDPR’s Article 22 were in fact located in Pisa, at Sant’Anna, and a CS expert in algorithmic accountability was located in Pisa, too.
Being physically located in Europe let me both meet people in person (I give more context below for why this was so crucial at the time), and email back and forth in real time with academics in other countries but in the same time zone. In January, as mentioned, I was able to attend the annual European privacy law conference in Brussels. In February, I participated in the incredible Fulbright-Schuman event, which gave us deep access to a number of EU institutions, the highlight of which for this lawyer was watching a case argued at the European Court of Justice, followed by lunch with Koen Lenaerts, the President of the ECJ (equivalent to Chief Justice Roberts on the U.S. Supreme Court). In April and May, I was able to workshop my project at Sant’Anna with local experts at important early stages. In May, too, I was able to participate in a comparative law event on Regulating Robotics and Artificial Intelligence at the nearby European University Institute (EUI) in Florence, which brought together researchers and regulators from both sides of the Atlantic. In between these more formal events, I went for lunch and took coffee breaks with colleagues. I learned important cultural differences between how lunch is done in the Netherlands, versus Italy. And I learned that for all the enthusiasm about robots, Italians will never drink coffee out of those automated espresso machines.
No discussion of challenges and changes would be complete without mentioning the biggest ones my spouse and I faced: moving to two different countries in Europe with our then-six-month-old daughter and our dog. This entailed figuring out all the little things, and some very big things, from what kinds of baby food are sold in each country (Italy has some amazing ones), to navigating public transportation with a small child, to where and when to register your dog. I could not have done it without the most adventurous and supportive spouse (thank you, Matt!). But this timing in our daughter’s life also meant that anything that brought me physically closer to other researchers meant the world of difference to my ability to engage with them. The serendipity of receiving the Fulbright the same year we had our daughter made for a life-altering experience for our family, one my husband and I will never forget. It made us more resilient, and by the end far more easily transportable as a family unit, than we ever could have imagined going into it all. From the shopkeeper in Amsterdam who held onto the package of baby things that was accidentally delivered downstairs, to our incredibly kind Italian landlords who loaned us all of their baby toys, the experience was made more wonderful by the many people who reached out to us as new parents and recognized that we were in a new place. In a world of increasing tensions, it was heart-warming to keep meeting generous strangers.
So, in short, to future Fulbrighters, I’d say: come in with your plans, and be ready to abandon them. There is no telling where your months will take you, but I promise it will be good.