Marcel Moura

Knut J Måløy

Renaud Toussaint

Critical behavior in porous media flow

Keywords: 47, 55, -t -Multiphase and stratified flows 47, 15, gp -Hele-Shaw flows 64, 60, Ht -Dynamic critical phenomena

come

ical and economical systems, such as the stick-slip motion 16 of a block on an inclined plane [33], the propagation of a fracture front in a disordered material [34][35][36], the number 18 of mutations in models of biological evolution [37], acoustic emissions from fracturing [38,39], variations in stock mar-20 kets [40], and the rate of energy transfer between scales in 21 fully developed turbulence [41,42]. Intermittent phenom-22 ena arise irrespective of the (certainly different) specific 23 details of each system. In the particular case of porous 24 media flows, it is caused by the interplay between an ex-25 ternal load (for example, an imposed pressure difference 26 across the system) and the internal random resistance due 27 to the broader or narrower pore-throats.

28

In the present work we show experimental results on 29 the burst dynamics during drainage in artificial porous media and investigate the question of how the pressure fluctuations (due to the burst activity) can encode useful information about the system. The flows studied are slow enough to be in the capillary regime, in which capillary forces are typically much stronger than viscous ones [START_REF] Måløy | [END_REF]43]. We have employed synthetic quasi-2D systems driven by a controlled imposed pressure (CIP) boundary condition. This boundary condition differs from the controlled withdrawal rate (CWR), more commonly used [START_REF] Måløy | [END_REF]9]. The dynamics is characterized both via direct imaging of the flow and by local pressure measurements. We present results related to the statistics of bursts, their morphology and orientation within the medium, and the power spectral density (PSD) associated with the fluctuations in the measured pressure signal. In particular, we show that for systems driven by the CIP boundary condition, the PSD presents a 1/f scaling regime. The presence of 1/f α power spectra is a widespread feature occurring in a myriad of contexts [44][START_REF] Mandelbrot | The fractal geometry of nature[END_REF][START_REF] Schroeder | Fractals, chaos, power laws: minutes from an infinite paradise[END_REF], commonly signaling the collective dynamics of critical systems. Some examples are the early measurements of flicker noise in vacuum tubes [START_REF] Johnson | [END_REF], fluctuations in neuronal activity in the brain [48], quantum dots fluorescence [49], loudness in music and speech [50,51] and fluctuations in the interplanetary magnetic field [52]. Although 1/f α power spectra have also been observed in some fluid systems, such as simulations and experiments on hydrodynamic and magnetohydrodynamic turbulence [53,54] and quasi-2D turbulence in electromag-netically forced flows [55], to the best of our knowledge the results reported here provide the first experimental observations of 1/f α power spectra in porous media flows.

Methodology. -Fig. 1 shows a schematic representation of the setup employed (additional details in Ref. [56]). . This mechanism guarantees that the pressure is only increased when the system is in a quasi-equilibrium situation (details in [56]). By slowly increasing the imposed pressure (via small steps in the height of the reservoir dh = 10µm =⇒ dp = ρgdh = 0.12 P a, where g is the acceleration of gravity), new pore-throats may become available to invasion. The value of dh was chosen to satisfy the accuracy condition that the height would typically have to be increased several times before new pores are invaded. As long as this condition is satisfied, the results obtained should be independent of the particular value of dh.

Burst size distribution. -We begin by analyzing the size distribution of invasion bursts in a CIP experiment. A burst is understood as any connected set of pores invaded in the interval Θ = t 2 -t 1 between two consecutive time instants, t 1 and t 2 , at which the imposed pressure was increased (i.e., the imposed pressure is constant during the interval Θ, being changed only at its extremes t 1 and t 2 ). Fig. 2 shows the individual bursts for experiment CIP-1 (the number identifies the model), colored according to their area (top) and randomly (bottom), the latter being done to aid the visualization of separate bursts. Only bursts having their centroids in the mid 90% of the model's length are considered, to avoid possible boundary effects [56]. A great deal of information can be obtained from this image. Initially, one can observe the homogeneity and isotropicality of the dynamics: the bursts don't seem to follow a well defined size gradient (the top image does not seem to transition from blue to red following a specific direction), nor have they a clear preferred orientation (they are not particularly elongated in any direction). It is hard, if not impossible, to say from this image in which direction the invasion takes place (it is from left to right). A reflection (vertical or horizontal) or a 180 • rotation would also not be clearly identified. The box counting fractal dimension [START_REF] Feder | Fractals[END_REF][START_REF] Stauffer | Introduction to percolation theory[END_REF] of the invading cluster was measured to be D = 1.76 ± 0.05. Fig. 3 shows the burst size distribution N (n) for 3 separate experiments (the number of pores n being measured by normalizing the burst area by a typical pore area ≈ 0.3mm 2 ). The system exhibits the scaling N (n) ∝ n -τ , with τ = 1.37 ± 0.08, over at least two decades. The burst dynamics is therefore spatially selfsimilar, a feature commonly associated with systems close to a critical transition [START_REF] Schroeder | Fractals, chaos, power laws: minutes from an infinite paradise[END_REF][START_REF] Feder | Fractals[END_REF]. The exponent τ has been calculated via maximum likelihood estimation (MLE) [START_REF] Clauset | [END_REF] using the data from Fig. 2 for burst sizes in the interval 1 pore < n < 150 pores. MLE was used in order to avoid possible biases from data binning (MLE is a binning free method), see also [60]. The scaling is shown in Fig. 3 on top of the logarithmically binned histogram of the data for the sake of visualization. Experiment CIP-4 was left out of the analysis because boundary effects rendered the results unreliable (model 4 is too narrow). The measured exponent is consistent with the value τ = 1.30 ± 0.05 predicted by numerical simulations and percolation theory [21,[START_REF] Stauffer | Introduction to percolation theory[END_REF]. Martys et al. [21] derived the analytical form

τ = 1 + D e -1/ν D , (1)
where D and D e are respectively the fractal dimensions 104 of the growing cluster and its external perimeter and ν = 105 4/3 is the exponent characterizing the divergence of the 106

Burst size (number of pores)

Bursts colored randomly correlation length [START_REF] Feder | Fractals[END_REF][START_REF] Stauffer | Introduction to percolation theory[END_REF]. Using the values D = 1.76

and D e = 4/3 [14], we obtain τ = 1.33, very close to the measured value τ = 1.37 ± 0.08 shown in Fig. 3. Our measurements provide a direct experimental verification of Eq. ( 1), proposed in Ref. [21].

Crandall et al. [61] performed measurements in a CWR system finding the exponent τ = 1.53, which is compared to the theoretical prediction of τ = 1.527 from Roux

and Guyon [62]. Nevertheless, Maslov [63] pointed out an inconsistency in this theoretical prediction, the correct expression being given in Eq. ( 1). Modified invasion percolation simulations and pressure measurements [START_REF] Måløy | [END_REF]4] have shown that, in a CWR, system very large bursts are split into smaller ones. A burst size distribution was observed, with exponent τ = 1.3 ± 0.05 for the simulations and τ = 1.45 ± 0.10 for the experiments (consistent with Eq. (1)), followed by an exponential cutoff [START_REF] Måløy | [END_REF]4]. In the CIP case large bursts can happen because the displaced liquid can freely flow out of the model but in the CWR case this is not possible since the available volume for the displaced liquid is bounded by the outlet syringe volume.

Burst time distribution. -Let us now focus on the distribution G(Θ) of time intervals Θ between two successive increments in the imposed pressure during which invasion bursts have occurred. Fig. 4 shows this distribution, produced for all bursts with Θ > 120s, a cutoff related to the minimum time difference for proceeding the image analysis used in the feedback mechanism [56]. It scales as G(Θ) ∝ Θ -γ with γ = 2.04±0.15 (exponent was also computed via MLE [START_REF] Clauset | [END_REF]). In the inset we show the distribution of inverse intervals g(1/Θ), which is nearly uniform, since

it is related to G(Θ) by g(1/Θ) = G(Θ)Θ 2 ∝ Θ 2-γ .
The uniformity of g(1/Θ) will play an important role further burst is proportional to its number of pores n (see Fig. 3), 154 it follows that p(s) ∝ s -τ . Therefore,

155 G(Θ) ∝ s -τ ds/dΘ =⇒ G(Θ) ∝ Θ -γ , (3)

166

Fluctuations in the measured pressure signal. -Next, we analyze the fluctuations in the pressure signal, following the pore invasion events. In Fig. 5, we show the typical pressure signature in a CIP experiment. The observed pressure pulses present a characteristic exponential relaxation. We also observe that a pulse can trigger In the inset we show the nearly uniform distribution g(1/Θ).

others and even give rise to large avalanches with the invasion of several pores. A pulse can be divided into two phases: an initial fast drop in the capillary pressure p c and a slower exponential relaxation back to the pressure level ρgh set externally (see Fig. 1). The fast drop in p c occurs as the liquid is displaced (following the invasion of one or more pores) and subsequently redistributed to the surrounding menisci, causing a back-contraction of the interface [START_REF] Måløy | [END_REF]4,18]. The relaxation phase occurs as the liquid-air interface readjusts itself inside the available pore-throats and the liquid volume displaced from the pores flows out of the model. The fluid motion sets in viscous pressure drops which are reflected in the measured pressure, as seen in Fig. 5. These drops occur (see Fig. 1): 1) in the porous medium itself, 2) in the filter at the model's outlet and 3) in the external tubing (the numbers are in correspondence with Fig. 1). The height difference h between the surface of the liquid in the reservoir and the model level accounts for a hydrostatic component ρgh. Adding these contributions and assuming that the flow is governed by Darcy's equation, we have

p w -u µL 1 k 1 -u µL 2 k 2 -u S 1 µL 3 S 3 k 3 + ρgh = p 0 , (4)
where p w is the pressure in the wetting phase (liquid) just Since the capillary pressure across the liquid-air interface 174 is p c = p nw -p w = p 0 -p w , Eq. ( 4) becomes

p c + uR -ρgh = 0 , (5)
where is equivalent to an effective resistance to the flow. The volumetric flux in a pore is dV /dt = ua 2 /φ, where a is a characteristic pore length scale (for example the bead diameter) and φ is the porosity of the model. By introducing the concept of a capacitive volume κ = dV /dp c (used first in Ref. [START_REF] Måløy | [END_REF]), where dV is the liquid volume displaced from a pore throat in response to a change dp c in capillary pressure, we have

R = R 1 + R 2 + R 3 =⇒ R = µL 1 k 1 + µL 2 k 2 + S 1 µL 3 S 3 k 3 , (6)
dV dt = ua 2 φ =⇒ u = κφ a 2 dp c dt . (7)
Plugging this equation into Eq. ( 5),

κφR a 2 dp c dt + p c -ρgh = 0 =⇒ p c (t) = ρgh + Ce -t/tc , ( 8
)
thus producing the exponential behavior seen in Fig. 5. C = p c (0) -ρgh < 0 is a constant associated to how much the capillary pressure decreases during the invasion of a set of pores before it starts to rise again. The characteristic time scale of the exponential decay is

t c = κφR a 2 . ( 9
)
The invasion of one pore quite frequently triggers the invasion of others, in such a manner that before an exponential pulse decays completely, another one is seen in the pressure signal, see Fig. 5. This mechanism delays the complete relaxation of the pressure, effectively increasing the decay time from t c to t * ≥ t c . Indeed, if this relaxation-delaying mechanism was absent, the burst time distribution G(Θ) shown in Fig. 4 should be peaked around the value Θ = t c . Since we have shown that G(Θ) ∝ Θ -γ we expect the effective exponential decay time t * to follow the same distribution and, in particular, the effective decay rate λ = 1/t * should be uniformly distributed in an interval [λ min , λ max ] following the same distribution as 1/Θ (see inset of Fig. 4). λ max is related to the minimum decay time t * , i.e., λ max = 1/t c and we will sensor and unimportant to our analysis). We see from 214 Fig. 6 that the scaling properties of the power spectrum, 215 in particular the occurrence of 1/f noise, seem to remain 216 unchanged despite the changes in both sample dimensions 217 and pore-size distribution (the samples were rebuilt before 218 each experiment, thus changing the pore-size distribution 219 [56]). The 1/f regime is associated with events having fre-220 quency f < 10 -2 Hz, or alternatively, periods T > 100s.

221

From Fig. 5, we see that this corresponds to the charac- [START_REF] Johnson | [END_REF] (see also [66] and [67]). Apart from a nearly 232 constant offset, the pressure signal can be modeled as a 233 train of exponentially decaying pulses located at randomly

234 distributed discrete times t j , 235 p λ (t) = j AH(t -t j )e -λ(t-tj ) , (10)
where λ > 0 and A < 0 are initially taken to be constants (the characteristic decay rate and amplitude of the pulses) and H(t -t j ) is the Heaviside step function, i.e., H(tt j ) = 0 if t < t j and H(t -t j ) = 1 if t ≥ t j . Let P λ (f ) be the Fourier transform of p λ (t). The PSD S λ (f ) is

S λ (f ) = lim T →∞ 1 T |P λ (f )| 2 = A 2 r λ 2 + 4π 2 f 2 , ( 11
)
where r is the average rate of occurrence of pulses and the brackets are the expected value operator (since in practice one does not have access to an ensemble of measurements, we have employed Welch's method [64] to estimate the PSD, which is based on the concept of a periodogram [START_REF] Press | Numerical recipes in FORTRAN: the art of scientific computing[END_REF]). The PSD shown in Eq. ( 11) is a Lorentzian curve which is approximately constant for lower frequencies (f λ/2π) and decays as 1/f 2 for higher frequencies (f λ/2π).

A model with a single constant decay rate λ cannot incorporate the 1/f region but, as previously argued, we expect λ to follow the uniform distribution ξ(λ) = 1/λ max in the interval [0, λ max ]. Taking this distribution into account and writing λ max = 2 π f t , we have

S(f ) = λt 0 S λ (f )ξ(λ)dλ = A 2 r 4π 2 f t f arctan f t f . (12)
Eq. ( 12) has the asymptotic behavior

S(f ) = A 2 r 8πft 1 f if f f t A 2 r 4π 2 1 f 2 if f f t , (13)
thus presenting the 1/f to 1/f 2 transition observed in the experiments. The transition frequency f t in experiment CIP-1 is roughly f t = 1.5 10 -2 Hz (see Fig. 6). By using the constant A 2 r as a fitting parameter we can compare the measured PSD with the theoretical prediction in Eq. (12). Fig. 7 shows the resulting comparison produced using A 2 r = 1.5 P a 2 /s. The dashed red vertical line marks the transition frequency f t . The analytical result reproduces the experimental findings very well, scaling as 1/f for f f t and as 1/f 2 for f f t . Indeed, this theory not only captures the 1/f and 1/f 2 domains but also fits the data well for the crossover region between these domains.

The transition frequency f t can be estimated using Eq. ( 9) and the resistance R from Eq. ( 6). As a first order approximation, let us consider only the contribution to R from the term R 1 relative to the resistance in the porous medium itself. Using µ = ρν = 5.1 10 -2 P a.s, L 1 = 0.27m, a = 10 -3 m, κ = 1.1 10 -12 m 3 /P a (from Ref. [START_REF] Måløy | [END_REF]), k 1 = 1.6 10 -9 m 2 and φ = 0.63 (both measured in a similar model in Ref. [5]), we find

f t = 1 2πt c = k 1 a 2 2πκφµL 1 =⇒ f t ≈ 2.6 10 -2 Hz , (14)
not far from the transition frequency f t = 1.5 10 -2 Hz shown in Fig. 7. The overestimation comes from the terms R 2 and R 3 in Eq. ( 6), ignored in the calculation above.

Finally, notice also the existence of a single isolated point in the very low frequency part of the PSD, falling far from the scaling region (extreme left for all experiments in Fig. 6). This point is not an outlier in the data: its

= p c + u (R 1 + R 2 ),
where R 1 and R 2 are the resistance terms from the porous network and the filter. Using Eqs. ( 7) and ( 8), we have

p m = ρgh + C 1 - R 1 + R 2 R 1 + R 2 + R 3 e -t/tc . (15)
Therefore, by comparing Eqs. ( 8) and ( 15), we see that p m differs from p c only in the amplitude of the pulses, but not in their characteristic exponential decay. Since our analysis depended only on the distribution of the decay rates, the differences between p m and p c are not crucial.

Further generalizations of the PSD analytical framework. -One possible generalization of the model would be to consider a system with a distribution of amplitudes A instead of a single value (as we might expect from Fig. 5). In this case the scaling properties of the PSD would still be left unchanged but the constant A 2 in Eq. ( 12) and ( 13) would be replaced by the expected value of A 2 . Another possibility would be to consider a distribution for λ of the form ξ(λ) ∝ λ -δ . Here the 1/f 2 region is still left unchanged but the 1/f scaling is changed to 1/f (1+δ) [START_REF] Butz | [END_REF]. As previously noted, the distribution of de-324 caying rates λ is the crucial figure behind the 1/f scaling. 325

Conclusions. -We have analyzed the burst dynam-326 ics from slow drainage experiments in porous media. We 327 showed that this dynamics presents many features com-328 monly associated to critical systems. Intermittent bursts 329 of activity were observed over many time and length scales 330 and a theoretical expression for their size distribution scal-331 ing, Eq. ( 1), was verified experimentally. The pressure 332 signal of the invasion presented an interesting PSD scal-333 ing, with a 1/f scaling region which further transitions to 334 1/f 2 in the case of the CIP boundary condition. We have 335 employed an analytical framework [65] which satisfactorily 336 reproduces the scaling properties of the PSD. The deriva-337 tion of closed expressions relating the pressure signal PSD 338 to properties of the porous medium and the fluids can lead 339 to new techniques for indirectly probing such systems. For 340 example, if one has access to the PSD only and not to the 341 full pressure signal, the transition frequency f t can still be 342 measured and information on the ratio k 1 /φ between the 343 permeability and the porosity of the medium can be found 344 via Eq. ( 14). If the PSD and f t are known, Eq. ( 12) can be 345 fitted to measure the product A 2 r between the amplitudes 346 and rate of occurrence of bursts.

  The quasi-2D porous network is formed by a modified Hele-Shaw cell filled with a monolayer of glass beads having diameters a in the range 1.0mm < a < 1.2mm. The beads are kept in place by a pressurized cushion placed on the bottom plate of the cell. A spongeous filter with pores much smaller than those in the medium is placed between the porous network and the outlet of the model. This filter allows the dynamics to continue inside the medium even after breakthrough [56]. Pressure measurements are taken at the outlet with an electronic pressure sensor (Honeywell 26PCAFG6G) that records the difference between the air pressure (non-wetting phase) and the liquid pressure (wetting phase) at the outlet, i.e., p m = p nw -p out w . Since the inlet is open to the atmosphere, p nw = p 0 in all experiments, where p 0 is the atmospheric pressure. The porous matrix was initially filled with a mixture of glycerol (80% in weight) and water (20% in weight) having kinematic viscosity ν = 4.25 10 -5 m 2 /s, density ρ = 1.205 g/cm 3 and surface tension γ = 0.064 N.m -1 . We have performed experiments on 4 different porous media with dimensions: (1) 27.3cm x 11.0cm, (2) 14.0cm x 11.5cm, (3) 32.8cm x 14.6cm and (4) 32.0cm x 4.5cm, where the first number corresponds to the length (inlet-outlet direction) and the second to the width. The outlet of the model is connected to an external reservoir. The height difference h between the surface of the liquid in this reservoir and the model is used to control the imposed pressure via an adaptive feedback mechanism (CIP boundary condition)

Fig. 1 :

 1 Fig. 1: (color online) Diagram of the experimental setup and boundary conditions (CIP or CWR). The numbers (1), (2) and (3) denote the porous medium, filter and external tubing.

Fig. 2 :

 2 Fig. 2: (color online) Individual bursts for experiment CIP-1. The flow is from left to right, during ≈ 82h. Bursts color coded by their size normalized by a typical pore area (top) and randomly (bottom). The vast blue areas in the top image contain many smaller bursts (detail).

Fig. 3 :

 3 Fig.3: (color online) Burst size distribution N (n). The line shows the scaling N (n) ∝ n -τ , with τ = 1.37 ± 0.08, which is consistent with the theoretical value τ = 1.30 ± 0.05 predicted by numerical simulations and percolation theory[21,[START_REF] Stauffer | Introduction to percolation theory[END_REF]. The data has been shifted vertically to aid visualization.

  with γ = (τ -1 + β) /β = (τ -D e /D) / (1 -D e /D). Us-156 ing the literature values τ = 1.3[21,[START_REF] Stauffer | Introduction to percolation theory[END_REF], D e = 1.33 157 and D = 1.82[START_REF] Stauffer | Introduction to percolation theory[END_REF], we find γ = 2.11, quite close to the 158 measured value γ = 2.04 seen in Fig.4. As an imme-159 diate consequence of Eq. (3), the distribution of inverse 160 intervals scales as g(1/Θ) ∝ Θ -η , with η = γ -2 = 161 (τ -2 + D e /D) / (1 -D e /D). Using the literature values 162 above we find η = 0.11, which is in agreement with the 163 experimentally observed value η = γ -2 = 0.04 ± 0.15 164 -i.e. these theoretical considerations explain the nearly 165 uniform distribution observed in the inset of Fig.4.

Fig. 4 :

 4 Fig. 4: (color online) Burst time distribution G(Θ). The scaling (red line) corresponds to G(Θ) ∝ Θ -γ with γ = 2.04 ± 0.15.In the inset we show the nearly uniform distribution g(1/Θ).

167

  after the liquid-air interface, u is the average Darcy ve-168 locity of the flow in the porous network, µ = ρν is the 169 liquid's dynamic viscosity, L i and k i with i = {1, 2, 3} 170 are the length and permeability respectively of the porous 171 network, filter and the tubing and S 1 and S 3 are the 172 respective cross sections of the model and the tubing.

  173

Fig. 5 :

 5 Fig. 5: (color online) Typical exponential relaxation signature of pressure pulses. A pulse can trigger others and even give rise to a large avalanche (shown in the inset).

Fig. 6 :

 6 Fig. 6: (color online) Power spectral density comparison for CIP experiments (model's numbers in the legend). Guide-toeye lines are shown for the scaling S(f ) ∝ f -α , with α = 1 for lower frequencies and α = 2 for intermediate frequencies.

  213

222

  teristic time intervals between the pressure pulses, thus 223 indicating that they are associated with the presence of 224 the 1/f scaling in the PSD. 225 Analytical modeling of the pressure signal and 226 PSD scaling explanation. -The non-trivial scaling 227 of the CIP power spectral density can be explained by the 228 following mathematical framework, which is an adaptation 229 of an argument proposed in [65] to explain a similar 1/f 230 to 1/f 2 transition in the very first reported observation of 231 1/f noise

  existence signals the very slow positive drift of the pressure signal, which occurs since the capillary pressure has to increase to allow the invasion of narrower pores[START_REF] Måløy | [END_REF]56].Comparison with a system driven under a CWR boundary condition. -In order to test the effect of the boundary conditions in the PSD, we have run a controlled withdrawal rate (CWR) experiment using model(1). The resulting PSD is shown in the inset of Fig.7.The PSD still presents an interesting scaling, but with different scaling regimes: 1/f 1.5 , for lower frequencies, and 1/f 3.5 , for intermediate frequencies. The 1/f region is only observed for systems driven under the CIP boundary condition. The fact that the exponents for CWR differ from CIP is not surprising, since the pressure relaxation in that case no longer exponential, but linear, see Ref.[START_REF] Måløy | [END_REF].Connection between the measured pressure and the capillary pressure. -The pressure sensor measures the difference between the pressure in the air and the liquid at the outlet, i.e., p m = p nw -p out w . The measured signal is not exactly the capillary pressure p c = p nw -p w across the liquid-air interface, since p w = p out w given that viscous losses occur between the liquid-air interface and the outlet, thus generally making p w > p out w . Those losses occur in the porous medium itself and in the filter at the outlet of the model (numbers 1 and 2 in Fig.1). The connection between p m and p c is p m

Fig. 7 :

 7 Fig. 7: (color online) Comparison between theoretical prediction and experiments. The analytical result (thin blue line) is given by Eq. (12), where ft = 1.5 10 -2 Hz (vertical dashed red line) and A 2 r = 1.5P a 2 /s. The analytical prediction match the experimental measurements (green crosses, experiment CIP-1) well. On the inset we show the PSD for experiment CWR-1.

We acknowledge the support from the University of 348 Oslo, University of Strasbourg, the Research Council of 349 Norway through its Centre of Excellence funding scheme 350 with project number 262644, the CNRS-INSU ALEAS 351 program and the EU Marie Curie ITN FLOWTRANS net-352 work.


Felix Bieker
email: fbieker@datenschutzzentrum.de

Barbara Büttner
email: barbara.buettner@uni-kassel.de

Murat Karaboga
email: murat.karaboga@isi.fraunhofer.de

Smart Cars Cruising on the Road Paved with Good Intentions? -Workshop on Big Data Applications and Individual Rights Under the New European General Data Protection Regulation

Keywords: Smart Cars, Individual Rights, Big Data, General Data Protection Regulation, EU law

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

After years of political struggle, the General Data Protection Regulation (GDPR) has finally been adopted. Ever since the reform process was announced, questions arose on whether and to what extent the regulation would address the requirements of emerging technologies and applications. Among these, the topic of big data and its implications for data protection were particularly contentious. The purpose of this workshop was to analyse the effectiveness of the protection of individuals under the new European General Data Protection Regulation, which implements the fundamental rights to private life and the protection of personal data, with regard to big data applications. In order to introduce participants to this complex issue and to provide a basis for the discussion, we focused on one specific case of big data applications, namely smart cars. The ultimate goal of the workshop was a contribution to the question how personal data protection should be regulated in order to address the privacy challenges of big data applications while still preserving its benefits.

In the following we will give a short introduction to smart cars in the context of Big Data applications and their potential threats (section 2). We will then show how the EU data protection law protects individual rights (section 3). The next section presents the five smart car scenarios of the workshop and the discussion of the participants (section 4). We will discuss the results of the workshop (section 5), ending with a final conclusion (section 6).

Smart Cars and Big Data

The use of computerized systems in cars is not new. Features for safety or driver assistance began appearing in the 1970s with the anti-lock braking system (ABS) followed by the electronic stability program (ESP) and the standardization of on-board diagnostics (OBD) in the 1990s. These systems were already able to collect data and process this information to check the performance of various car systems (e.g. emission control; early warning of malfunctions by way of the dashboard "Check Engine" light). Since then, numerous additional in-car technologies like event data recorders (EDRs) or OBD-II standards were developed and are fitted almost as standard nowadays. Connectivity often complements these existing in-car technologies and also maximizes the data collection capabilities of a car [START_REF] Hansen | Das Netz im Auto & das Auto im Netz[END_REF][START_REF]Future of Privacy Forum: The connected car and privacy[END_REF].

What is Connectivity of Smart Cars?

The connectivity of smart cars refers to their ability to exchange information between the car and its surroundings. It can be differentiated between the data collected and stored inside the car which is only accessible through a physical connection and data that are transmitted. The interactions range from car to car, car to infrastructure, car to devices up to car to service providers and manufactures, usually referred to as car2x connectivity. Thus, connectivity describes the digital exchange between cars. The idea behind the concept is to send relevant traffic or road information to other cars around. The car can also communicate with the infrastructure and receive information about road conditions (e.g. construction sites) or other external objects (e.g. traffic lights or traffic signs). Furthermore, cars can set up a wireless connection to other devices, for instance helping the driver to navigate. Moreover, the car can connect with service providers and manufactures and send errors reports or get a reminder for the next check-up [START_REF]Future of Privacy Forum: The connected car and privacy[END_REF][START_REF] Cohen | IoT in automotive industry: Connecting cars[END_REF][START_REF]Internet of things. Connected cars[END_REF]. Consequently, car2x connectivity produces a vast amount of data and exacerbates the issue of data collection.

2.2

Which Data are Collected?

Typically, three groups of collected data can be differentiated: data of the car, data of the car occupants and data about the environment of the car.

Car. Every car has several identifiers which are transferred with every communication of the respective device. This can include the vehicle identification number (VIN), mobile device identifiers, SIM-cards, media access control (MAC) addresses, Bluetooth identifiers and radio frequency identification (RFID). The so called telematics data of a car include information on the location and changes of the location (e.g. geo tracking data, route, speed). Telematics can be compared to a black box that records information about the driving behaviour on how, when and where a person drives. Cars are also equipped with many sensors which collect the operational state and functionality of the single components during the drive (inter alia the engine, gear, brakes, tire pressure, fumes). In addition cars can be equipped with event data recorders (EDRs). They collect data shortly before, during and after a car accident and, for instance, store the direction of movement, longitudinal acceleration or the status of the brakes [START_REF] Hansen | Das Netz im Auto & das Auto im Netz[END_REF][START_REF] Hornung | Verfügungsrecht an fahrzugbezogenen Daten. Das vernetzte Automobil zwischen innovativer Wertschöpfung und Persönlichkeitsschutz[END_REF][START_REF] Lüdemann | Connected Cars. Das vernetzte Auto nimmt Fahrt auf, der Datenschutz bleibt zurück[END_REF].

Occupants. The car also collects a multitude of information referring directly to the occupants of a car. Using the connected components of the car for example requires registration with the provider (car manufacturer) and the creation of a user account. For registration, data such as name, address or date of purchase can be required. Additionally internal sensors might obtain information about the physical or biological characteristics using biometric detection systems to identify the driver. The car can keep personalized information about the voice or data communication from text messages and remember habits of the driver, for instance music choice or seat and mirror position. The car might even be able to test the physical fitness of the driver by analysing the heartbeat, breathing or head-and eye-movement [START_REF] Hansen | Das Netz im Auto & das Auto im Netz[END_REF][START_REF] Lüdemann | Connected Cars. Das vernetzte Auto nimmt Fahrt auf, der Datenschutz bleibt zurück[END_REF].

Environment. The car also collects information about its environment, be it the physical surrounding or the human environment. This includes information about upcoming obstacles, blind spots, traffic sign analysis or even the social network of the driver. Including, for example, if drivers connect their phone with the car, it might gain access to their address book. Smart cars can also function as Wi-Fi-Hotpots and through this, collect the identification and use data of other devices and their users and owners [START_REF] Hansen | Das Netz im Auto & das Auto im Netz[END_REF][START_REF]Future of Privacy Forum: The connected car and privacy[END_REF].

Although many of the collected data are not directly linked to a person, in many cases personal details can be revealed through other information (e.g. workplace information through geo tracking data). From a legal point of view, personal data are any information that relate to an identified or identifiable natural person according to Article 4(1) GDPR. Under this legal definition, a person is identifiable when he or she can be identified by reference to an identifier such as name, an identification number, location data or one or more factors specific to inter alia the physical, genetic, economic or cultural identity of the natural person in question. As smart cars use several identifiers for communications, these, in consequence, constitute personal data [START_REF] Hansen | Das Netz im Auto & das Auto im Netz[END_REF][START_REF] Kremer | Connected Carintelligente Kfz, intelligente Verkehrssysteme[END_REF]. Furthermore, the combined analysis of several attributes, which by themselves do not make a person identifiable, can turn the information in question into personal data [START_REF] Hansen | Das Netz im Auto & das Auto im Netz[END_REF]. This is especially true where location data, as explicitly referenced in Article 4(1) GDPR, are used. These types of data collected and the purposes of use receive new dynamism in the context of modern technologies of data collection and processing that can be subsumed under the term of big data which will be the topic of the next section.

2.3

What is Big Data?

Big data is a controversial buzzword which is used by a variety of stakeholders (e.g. private sector, public sector, science, and press and media) to characterize modern tendencies of data collection and processing in the networked, digitized, informationdriven world. It is not a precise scientific concept, but rather a highly contested idea that differs depending on the context [START_REF] Bennett | Privacy Protection in the Era of 'Big Data': Regulatory Challenges and Social Assessments[END_REF].

Although there is no uniform definition of big data, many definitions revolve around an understanding which involves three major aspects of the phenomenon: volume, variety, and velocity, with volume referring to the vast amounts of data that are being generated and accumulated, variety referring to the different types of data and data sources that are brought together, and velocity referring to the ability of real time analyses based on elaborate algorithms, machine learning and statistic correlations. Over the time, the three V's were expanded to cover other important aspects, including particularly: veracity and value. The former refers to the correctness and accuracy of information, the latter to the assessment of the societal value, big data analyses may or may not offer [START_REF] Klous | Sustainable Harvesting of the Big Data Potential[END_REF][START_REF] Ward | Undefined by Data: A Survey of Big Data Definitions[END_REF][START_REF] Gartner | IT Glossary: Big Data[END_REF].

The types of data included in big data analyses might comprise any type of structured or unstructured (text, image, audio, or video) data. These data might be collected from public datasets (e.g. administrative data and statistics about populations, geography, economic indicators, education etc.), from businesses, web pages, newspapers, emails, online search indexes, and social media, or from any kind of sensors (mobile, such as sensors carried on the body or drones as well as stationary sensors such as CCTVs or Wi-Fi/Bluetooth beacons) [START_REF] Poel | Data for Policy: A Study of Big Data and Other Innovative Data-Driven Approaches for Evidence-Informed Policymaking (Report about the State-of-the-Art)[END_REF].

Big data analyses are used for several purposes that can be grouped under the terms of descriptive statistics and inductive statistics. The former relates to big data analyses that are based on the elaborate analysis of data sets with high information density to measure things, or to detect trends. The latter relates to the analysis of large data sets with low information density in order to reveal relationships and dependencies, and to predict outcomes and behaviour. However, one important characteristic of big data that spans all areas of application is that its analyses are not limited to specific purposes. Instead, the continuous analysis of data is supposed to generate new purposes for which the existing data can be used [START_REF] Gandomi | Beyond the Hype: Big Data Concepts, Methods, and Analytics[END_REF].

As a result, many observers agree that big data is a disruptive technology with possible implications for all economic and policy areas (transport, energy, education, security, health, research, taxation, etc.) and that it represents a particularly weighty shift that will affect society as a whole [START_REF] Poel | Data for Policy: A Study of Big Data and Other Innovative Data-Driven Approaches for Evidence-Informed Policymaking (Report about the State-of-the-Art)[END_REF][START_REF]Big Data: Seizing Opportunities, Preserving Values[END_REF][START_REF] Mayer-Schönberger | Big Data: A Revolution that will Transform how we Live, Work and Think[END_REF].

2.4

Who Profits from these Data?

Regarding smart cars, many promises are made to the public about the potential benefits of big data.

Users. New technologies in cars promise drivers advances in safety and convenience. Through intense car2x communication and background analyses of the collected data, the prevention of accidents and better traffic management (better traffic light control, avoidance of traffic jams, and so on), indications of discounts (special deals at a nearby petrol station, or restaurant, etc.) and many more potential benefits are promised not only to allow more secure travelling, but also to return monetary benefits to the car owners, allow more comfort and at the same time being less damaging to the environment [START_REF] Divsi | Lab. "Big Data[END_REF][START_REF] Xu | Smart Data for Mobility (SD4M): Eine Big-Data-Analytik-Plattform Für Multimodale Smart Mobility Services, Presented at the Bitkom Big Data Summit[END_REF].

The State. Big data opens new prospects of control for the state. Courts, financial authorities and law enforcement agencies could use the generated data for purposes of criminal prosecution, hazard prevention or the collection of public revenue. Very similar to how many other big data applications are framed, smart mobility concepts focus on emphasizing the societal surplus promised. Such promises include that traffic controls enhanced by big data analytics will be more economic, ecological, efficient, cost-effective, comfortable and secure. This may be achieved by an array of sensors that are spread all over a city and which allow the continuous collection of various data [START_REF] Divsi | Lab. "Big Data[END_REF][START_REF] Xu | Smart Data for Mobility (SD4M): Eine Big-Data-Analytik-Plattform Für Multimodale Smart Mobility Services, Presented at the Bitkom Big Data Summit[END_REF]. In the meantime, many cities around the world have already introduced smart city concepts to innovate and enhance city life through lower costs and less environmental pollution. These concepts, however, vary in scope and depth and range from pioneering cities such as Stockholm and Amsterdam which rely on individual agencies or research bodies to comprehensively networked and highly centralized smart cities such as Singapore [START_REF] Watts | Singapore Is Taking the 'Smart City' to a Whole New Level[END_REF][START_REF] Albino | Smart Cities: Definitions, Dimensions, Performance, and Initiatives[END_REF]. For many years, the rise in the numbers of cars caused problems regarding the maintenance and expansion of city infrastructures, especially regarding automobile traffic. In times of strict budgets, municipalities and government agencies welcome these new opportunities as means of a more cost-effective and ecologically sound urban infrastructure and land use planning.

Industry. The interrelation of big data applications and smart cars needs to be understood in the broader context of digitized, networked, sensor-laden environments. Therefore, the development of smart car services should not only be understood in the isolated context of catchwords such as smart mobility and smart traffic controls.

Rather, the whole environment, including all its artefacts such as infrastructures, buildings and inhabitants, should be regarded as both the provider of data and user of data-driven analyses [START_REF] Xu | Smart Data for Mobility (SD4M): Eine Big-Data-Analytik-Plattform Für Multimodale Smart Mobility Services, Presented at the Bitkom Big Data Summit[END_REF]. The main interest of the industry lies in the monetarization of the data that is generated in such environments either to improve their current business or to develop new business models. Manufacturers and garages can use the car's diagnostic and performance information to improve their products or develop new business models (e.g. customer relations management, marketing and after-sales services). The use of data surfaces also offers new business fields like traffic information, fuel price data banks, driver-apps, or hotel booking systems. Service providers might offer real time navigation or maintenance services based on telematics. Also, the advertising industry can profit from the vast amounts of data and initiate personalized advertising. Insurance companies may offer their customers personalized insurance rates based on their tracked individual driving behaviour [START_REF]Future of Privacy Forum: The connected car and privacy[END_REF][START_REF] Debord | World Economic Forum: Who owns connected car data?[END_REF][START_REF] Derikx | Can privacy concerns for insurance of connected cars be compensated?[END_REF][START_REF] Stöhring | Mein Auto, meine Daten? Fahrzeuggeneriertes Datenmaterial: Nutzung und Rechtsansprüche[END_REF].

Potential Risks

The generated data offer a variety of information about the users and therefore are open for misuse. These data are collected inter alia in the interest of car manufacturers, suppliers, garages, insurances, courts, financial authorities, law enforcement agencies, and municipalities. Interfaces unnoticeably transfer the data outside the connected car. The user cannot avoid this and/or is not aware of this fact. Every car will leave a digital trace which allows the deduction of detailed profiles of every movement, behaviour and the personality of the driver, passengers and any other person within range of the sensors. It offers potential for surveillance activities and unauthorized persons might be able to gain access to the car by exploiting security vulnerabilities. Furthermore, companies might use this data for their insurance or credit decisions or use it to reject warranty or guarantee claims of customers [6, 22 23].

However, these characteristics apply not only to smart cars; rather they can be seen as an illustration of the potential risks of big data in the age of the internet of things. The ability of smart devices to connect and the resulting system of systems (thinking for example of smart homes or smart cities) offers many opportunities to collect personal data and to use it for further purposes. And while data protection is still predominantly considered as an individual right, proponents of big data analyses often frame their initiatives by means of the societal benefits that big data promises in a variety of sectors (aside from traffic management, a special focus is on the health care sector) [START_REF] Mayer-Schönberger | Big Data: A Revolution that will Transform how we Live, Work and Think[END_REF][START_REF] Van Der Sloot | The Individuals in the Big Data Era: Moving towards an Agent-Based Privacy Paradigm[END_REF]. Regardless of whether personal data are included in the underlying datasets [which may or may not be the case, cf. 25], the results of any big data analysis might very well impact certain individuals 1 as well as groups or even society at large. The Article 29 Working Party draws particular attention to the issues of insufficient data security, loss of transparency for users, inaccurate, discriminatory or otherwise illegitimate analysis results as well as increased possibilities of government surveillance [26]. Group discrimination along racial lines, for example, as opposed to obvious and nowadays illegal racial profiling practices of past decades, might simply result from (for example, credit scoring or risk assessment) decisions based on algorithms that evaluate the data in a biased and inaccurate way [START_REF] Angwin | Machine Bias: There's software used across the country to predict future criminals. And it's biased against blacks[END_REF][START_REF] Yu | Big Data: A Big Disappointment for Scoring Consumer Credit Risk[END_REF].

When the legislative procedure for the GDPR officially started in January 2012, critics of big data hoped it would provide a legal solution. The following section will provide some insights if the GDPR achieved this and how it tries to protect individual rights in the digital age.

EU Data Protection Law and Individual Rights

The GDPR will become applicable in May 2018. It aims to further harmonize the EU data protection law. At its core, data protection addresses the imbalance in power between the data subject and the controller who offers services that require personal data. Thus, the raison d'être of data protection law is to protect the rights of the individual, as is stipulated by Article 1 para. 2 GDPR. In order to achieve this, the processing of personal data is not allowed, unless there is an explicit legal basis according to Article 6(1) GDPR and Article 8 CFR. Special categories of personal data, such as inter alia on ethnicity, sexual orientation, political opinions, as well as genetic or health data demand special safeguards under Article 9 GDPR. Generally, the data may only be processed for the purposes for which they were collected, as prescribed by Article 5(1)(b) GDPR.

Fundamental Rights to Private Life and the Protection of Personal Data

The protection of personal data on the EU level is also enshrined in the Union's primary law: the EU Charter of Fundamental Rights protects the right to private life in its Article 7. It also explicitly provides for a right to the protection of personal data in Article 8 CFR. According to the settled case-law of the Court of Justice of the EU (ECJ), any processing of personal data is an interference with these fundamental rights of the individual [START_REF] Ecj | /01 Österreichischer Rundfunk and Others[END_REF][START_REF] Ecj | Joined Cases C-92/09 and 93/09 Schecke and Eifert[END_REF][START_REF] Ecj | Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger[END_REF][START_REF] Ecj | Case C-362/14 Schrems[END_REF]. While such an interference may be justified under the jects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects." conditions of Article 52(1) CFR, this provision requires that any processing has to be permitted by law and proportionate. Further, Article 8 CFR imposes requirements as to the storing of the data and access rights: the purpose of the data collection must be sufficiently clear, access to and use of the data have to be limited on a technical and procedural level and the relevant provisions have to provide sufficient safeguards against abuse and unlawful access or use [START_REF] Ecj | Case C-362/14 Schrems[END_REF].

Individual Rights in the General Data Protection Regulation

These abstract principles are implemented in the rules of the GDPR. Chapter III of the GDPR includes various specific rights of data subjects vis-à-vis the controller. As all personal data has to be processed lawfully, fairly and in a transparent manner, as stipulated by Article 5(1)(a) GDPR, Article 12 GDPR generally requires that all information and the modalities for the exercise of these rights have to be transparent for data subjects and presented to them in a concise, transparent and comprehensible way. When data are collected, the data subjects must be informed of the controllers, the purposes and legal basis for the processing, the recipients of the data and the transfer to third countries. Access to this information is also enshrined as a right of the data subject in Article 15 GDPR. While these rights are applicable for any data collection, this information is particularly important in cases where the legal basis of the processing is the consent of the data subject. According to Article 4(11) GDPR consent is any freely given, specific and unambiguous indication by the data subject. Thus, without the appropriate information, consent is not possible. The data subject may withdraw his or her consent with regard to future processing according to Article 7(3) GDPR at any time. If there is no other legal basis for the processing, it has to be ceased. However, this does not affect the lawfulness of the processing prior to the withdrawal of consent.

When there no longer is a legal basis for the processing, the purpose of the processing has been achieved, the data subject objected to the processing or data have been processed unlawfully, the data subject has the right to demand the erasure of the data from the controller under Article 17 GDPR.

In addition to erasure of data and restriction of the processing, the data subject under Article 20(1) GDPR now has a right to data portability. The right applies whenever automated processing of data is based on consent or a contract with the controller and concerns data provided by the data subject him-or herself. It entitles the data subject to receive his or her personal data in a structured, commonly used and machine-readable format. Data subjects may also demand that the controller transmits the personal data directly to another controller.

4

Can the Data Subject's Rights Resolve the Concerns for Individuals with Regard to Smart Cars?

The third part of the workshop was aimed at identifying and analysing the rights of individuals relevant in the legislative process for the GDPR with regard to smart car scenarios.

Application of Individual Rights to Smart Car Scenarios

Participants were divided in small working groups in order to assess different scenarios with regard to the effectiveness of data subject's rights in a smart car and big data context. The scenarios touch upon issues which arise in smart cars with regard to data processing and the rights of data subjects (e.g. collection of data, acquisition of the data subject's informed consent in the car, managing various drivers, right to data portability, right to deletion, exercise of right to withdraw consent, objection to direct marketing, notification of breaches, transfer of data, categories of data stored and who has access to which data). The scenarios furthermore strove to test the limits of data protection law with regard to the protection of individuals by raising issues such as societal disadvantages that might be the result of big data processing in a smart car context and demonstrate its limitation with regard to the practical implementation in everyday situations.

After the group work session, participants discussed whether the new EU data protection legislation adequately addresses and effectively resolves the identified issues and if these could be resolved in a more appropriate manner.

Scenario 1: Owning a Smart Car. After six months of driving her new smart car without any incident, A suddenly receives a call from the dealership's garage, asking her to bring her car in for repairs. When A inquires as to the nature of these repairs, the garage replies that her car has been sending error messages and therefore needs to be taken in for a check-up. Please consider the following alternate scenarios: ─ A does not want to receive further calls. She tells the garage to delete her personal data, as she wants an independent garage to take care of necessary repairs. The garage refuses, as  the error messages relate to an issue with the airbag deployment, which may occur at random. Due to this potentially life-threatening situation, the garage states it had a responsibility to inform A.  the error messages relate to an issue with the infotainment system, but a repair at the dealership was necessary if A wanted to keep the manufacturer's warranty. ─ A does not take the car for repair at the garage. However, three weeks later she has an accident due to a failure of the electronic stabilization programme. The garage links the failure to the error messages and, stating that A had been informed of the need for a repair, the manufacturer whose erroneous programming caused the failure refuses to pay for the necessary repairs, which resulted from the accident.

After these experiences, A considers buying a smart car by another manufacturer. However, as she has personalized many of her current cars features, she is reluctant to switch brands, until she reads about the right to data portability in a tech blog. After ordering the new car, she requests that all of her data stored in her old car is transferred to the manufacturer of her new car. Please consider the following alternate scenarios: ─ The old car's manufacturer refuses to submit the data to the other manufacturer, arguing that the systems are not compatible. When A insists she is provided with a text file including the code containing her data ─ The old car's manufacturer states that it can only transfer certain types of data, relating to the infotainment system, but not all personal data. For instance it is not possible to transfer the data concerning the seat adjustments, as another manufacturer has different specifications and the data can thus not be converted.

Discussion among the Participants. Regarding the first part of the scenario, the participants pointed out that A can generally request the deletion of her data in case she turns to an independent garage for the necessary repairs. However, if the contract included a valid service contract with the dealership's garage, her right to consult another garage could be limited. In the case at hand it was only a warranty offered by the manufacturer, which A is free to waive and choose another garage. If the processing of A's data is dependent on her consent, she can freely revoke it and the garage must not contact her anymore. When the data are processed for the purpose of direct marketing, as is the case here, the data subject may object at any time and the controller has to cease the processing immediately (Article 21(2) GDPR). However, in the case of a life-threating situation, the manufacturer may continue to use her data under Article 6(1)(d) GDPR, independent of her consent. Another danger for data subjects highlighted in the second indent of the first part is that the manufacturer might use data of the car against the owner in order to limit its own responsibility. This illustrates the importance of transparent data processing and informed consent of the data subject.

Regarding the data portability part of scenario 1, the participants indicated that the Article 20 GDPR only specifies that personal data have to be provided in a structured, commonly used and machine-readable format. The question of compatibility, however, is not solved in the Regulation as Article 20 [START_REF]Future of Privacy Forum: The connected car and privacy[END_REF] states that the transmission of personal data directly from one controller to another should only occur where technically feasible, which leaves much room for interpretation.

Scenario 2: Renting a Smart Car. B rents a car with his local car rental company.

Arriving at the company, he is pleasantly surprised to find a brand new car. The rental company agent informs him that the car is fitted with a telematics device, which electronically transmits data on the car's location, the speed and acceleration. The agent assures B that the device does not store any personal data. B signs the contract, including a separate section where he consents to the use of the telematics device.

As B gets in the car, he connects his smartphone via Bluetooth to listen to his music. On the way he receives a phone call from his friend. B is surprised to find that the call is relayed through the car's infotainment system using the built-in microphone and speakers. When B returns the car after two days, he is in a hurry to get to his appointment and just grabs his phone as he leaves the car. After two days, he remembers the phone call and wonders whether the contact information is still stored in the car. He calls the rental company and asks them whether his data was deleted from the car, however, the rental company does not answer his question and instead refers B to the manufacturer of the car. In turn, the manufacturer claims that this is the rental company's responsibility.

Two months after the return of the rental car, B receives a letter from the police relating to a hit-and-run accident, where a witness saw a black car of the same model as the one rented by B swerve on the road and hit a parked car's side-view mirror, before speeding away. The police then requested the data from the telematics device of the rental company's car as well as their costumer database and found that B had been at the site of the incident. B is surprised that his data was handed to the police so easily, especially as the agent had specifically told him that the telematics device collected no personal data. He thinks the car rental company had no legal basis to submit his data.

Discussion among the Participants. The participants argued that the collection of personal data is only lawful in case that the consent of the user was obtained on the basis of the principles of fairness and transparency which includes the provision of specific and unambiguous information about the processing operation and its purposes (Article 4 [START_REF] Gartner | IT Glossary: Big Data[END_REF]; Article 5(1)(a) and Article 13 GDPR). It was stressed, that in the scenario at hand, the specific contents of the contract are crucial in order to assess whether the controller met his obligations under the relevant provisions. However, the misleading information by the agent suggests that this was not the case. Participants also stated that the contract would have to specify the purpose of collection in order to be lawful. If the data were lawfully collected they would have to be deleted after a certain time. In case the data were collected unlawfully they would have to be deleted right away. However, as the scenario suggested, it may be difficult in practice for the data subject to find the controller and have his or her data deleted. Especially in the context of smart cars it can be a challenge even for lawyers to determine who is responsible for the data processing.

Regarding the request of information by authorities, it was stated that such provisions are specified in the context of national laws, but that the collection of data, and especially telematics data, could induce the national legislator to pass provisions for access of public authorities, which intensified the risks for the individuals.

Scenario 3: Lending a Smart Carwithout the Ability to Distinguish between

Individual Driversto a Friend. A, the owner of a smart car, lends his car to his good friend B who wants to use the car to visit her mother at a retirement home several times a week. Since her mother suffers from various illnesses, B sometimes has to rush to help her and assist the nurses at the retirement home or at the nearest hospital. A chose an insurance company which analyses his driving habits. While this may serve to offer special conditions and financial benefits, the opposite may also be the case under the contract's conditions: as a result of the dangerous driving style of B (driving fast, approaching other cars too fast, and driving too close to others cars), and as there is no method to assess whether A or B was the one driving dangerously, the insurance company increases the annual fee of A.

Further, B, a tech-enthusiast with an information science background,as opposed to A, who never does thatregularly uses the integrated infotainment system (with Internet functionality) of the car (for example, sometimes when her mother undergoes special medical treatment that she is not allowed to attend or when she has to wait for her children when picking them up from school, etc.). She researches information on hotshot technologies such as virtual reality glasses and high-speed computers to use the glasses and on specialized computer-issues. As the car's search history relates to A and not B, and with the help of cookies and third-party cookies, the customer profile of A changes considerably due to the search input which indicates that A is quite wealthy. Subsequently A is regarded as a tech-affine person, not only resulting in a change of the advertising displayed to A, but also in higher prices for flight tickets and for several kinds of devices, he buys online. The price-conscious A is irritated by the increasing prices and contacts one of the shops, why he has to pay more for a flight than other customers have stated on online-comparison websites. The shop's customer service assures that there is no discrimination, as prices may change from minute to minute.

Discussion among the Participants. Regarding the inability to distinguish between different drivers it was stated that this scenario poses a serious issue as only more surveillance would help to solve the problem, but which would also raise new privacy issues. The insurance company would have to collect even more data to differentiate between the two persons.

Regarding the issue of profiling, Article 15(h) GDPR was mentioned which requires the data controller to provide meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject in cases of automated decision-making, including profiling. However, the definition of meaningful information remains unclear: it has not been decided on a European level what kind of information this involves (i.e. the whole algorithm list or only parts). Concerning this question, it was stated that trade secrets, as mentioned in recital 63 GDRP, are protected right of others and may restrict the right of access to personal data.

Further, the question arose whether A had been discriminated against. In the Regulation discrimination is not an independent category. It has to be related to other characteristics which is not the case in scenario 3. Article 9(1) only prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Additionally, the lawfulness of processing personal data depends on the content of the insurance contract. The insurance company can prescribe that only A can use the car and that B would need an extra insurance package. The insurance contract could also include a lifelong tracking consent, which, however, would have to be transparent for the user. Nevertheless, in case that personal data of another person was erroneously used for profiling of the user, he or she has the right to either demand rectification of the data or even to object such processing according to Article 15(e). However, although there is the same difficulty to distinguish between different persons, as in the first part of the scenario, detailed information on which products were bought and which websites were visited might help to distinguish between different users. Yet, this would also raise the potential threat of revealing personal data of B to A. Scenario 4: Lending a Smart Carwith the Ability to Distinguish between individual Driversto a Friend. A, the owner of a smart car, lends his car to his friend B. B, the proud upholder of public transportation, tells him that he needs the car to buy larger quantities of goods from the wholesaler. The smart car is a pretty new model and hasamong several other high-tech featuresfacial, voice and haptic recognition technology on board in order to distinguish different drivers. The majority of these features, however, are only accessible when the system recognizes the car owner, A. Although details like photographs and voices of other drivers are not stored, A is able to access the routes driven by any other driver.

After shopping, B calls his friend A and asks him whether the car stores any information on routes and destinations. A thinks that his friend sounds particularly nervous and finds his behaviour suspicious. A assures B that no such data is stored by the car. Out of curiosity, A opens the route of his happily married friend B. This is when he realizes that his friend was not driving to the wholesaler, but to a remote brothel with poor public transportation connections. Following the shock of the unveiling and as he is also friends with B's wife, he decides to inform her about her husband's infidelity.

Discussion among the Participants. The participants especially discussed whether A might be regarded as a data controller in the context of this scenario. Article 4 [START_REF] Kremer | Connected Carintelligente Kfz, intelligente Verkehrssysteme[END_REF] defines the controller as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Opinions, however, were divided: some participants regarded A as responsible for providing all the information that needs to be provided by a data controller and that it is unlawful to link information of A (marriage status) with the information that is unlawfully obtained by accessing the route of B and using the conclusion for the purpose of telling another person about it. Other participants stated that the responsibility also lies with the car/service manufacturer that has to shape its products in a way that such an abuse is not possible. From a legal perspective it depends on whether A is actually the person determining the purposes and means of the processing. It is thus a crucial factor whether B could potentially also turn it off. Certainly, his influence on the means of collection is rather limited. These two factors point to the car's manufacturer as the actual controller. However, it was pointed out that this is one of the yet unresolved legal issues of smart cars. A lives in a small town that suffers under a chronic budget deficit. After an intense public debate on the economic opportunities and privacy risks, which traffic monitoring would impose on citizens, the municipalities eventually decide to introduce the new smart city concept. However, due to limited financial resources, the responsible members of the city's smart mobility working group decide not to distribute expensive sensors around the city. Instead, a traffic management system is introduced which is based on low-priced sensors that use Bluetooth technology. By connecting with car drivers' smartphones or directly with smart cars via Bluetooth, this new system promises to collect anonymized data on which routes are preferred most amongst the city dwellers. By this, municipalities strive to provide a better and evidence-based traffic management and lower the costs of building new roads or maintaining existing ones. In the meantime, the municipalities reduced staff numbers in the traffic office to compensate the smart city concept's costs. As a result of staff shortages and following the idea of "smart regulation", the maintenance and construction of roads is increasingly based on the data generated from the Bluetooth sensor network.

However, A and most of his neighbours are privacy-aware citizens who opposed the smart city concept in this form and would have preferred either none or at least a more ecologically oriented concept that could have provided alternatives to driving by car but which, due to budget problems, were rejected by their municipality. Thus, many people in his district turn off the Bluetooth functionality of their smart cars and smartphones so that they are not detected by the city's Bluetooth sensor arrays. Thereby, the district inhabitants' driving habits are no longer registered by the municipality as they are not recorded by the Bluetooth sensors. Thus, in contrast to other districts, where a lot more inhabitants agreed to the data policy and allowed the automated Bluetooth connections of their phones and cars, the district's roads are not maintained in a proper way and the much needed construction of new roads is currently not in sight. From the newspaper, A learns that similar problems also occur in other districts of the city. Accordingly, the situation is even worse in poor districts.

Discussion among the Participants. In the discussion it was pointed out that it is not possible to anonymize route data in a small town and that the Bluetooth solution has fundamental problems, as it raises several privacy issues. According to the participants, it is basically an engineering problem which could be solved by using appropriate technology. A less privacy-invasive low-tech solution minimizing the collected data would thus be preferable.

In contrast, some participants stressed that, apart from the concrete technology used, the action of the municipality does not really meet the requirements of good democratic governance, while other participants indicated that municipalities do not have to initiate referenda on such matters as the introduction of traffic surveillance and CCTV prove. It was furthermore stressed that data protection rights of the mentioned groups (privacy-aware citizens and citizens of poor districts) might have been violated even in case of a referendum if the vote was in favour of the municipalities' proposal.

Results of the Workshop

The discussion showed that the upcoming GDPR still leaves several issues relating to big data applications in a smart car context unresolved. From the discussions of the participants, the following general themes could be identified:

The discussion of the importance of specific contents of contracts (see discussion of scenario 1 and scenario 2) shows that some issues are difficult to solve with rather general data protection laws. At the same time, it highlights the lack of transparency in current contract clauses, especially with regard to obtaining the consent of the data subject. Consumers are confronted with opaque consent forms on a regular basis. In many instances, the clauses cannot be the basis of a valid consent. However, the requirements for valid consent had already been addressed in the Data Protection Regulation. While this is therefore an issue that has been solved legally, it is not properly implemented in practice. With regard to smart cars, manufacturers have to be sure to properly inform customers of the capabilities of their cars and obtain valid consent for processing operations which cannot be based on another legal basis. The data subject must be aware of processing that takes place in a smart car. However, this legal requirement is not easily implemented in such an environment. While ideas like a privacy dashboard [START_REF]Security and Privacy in your Car Act" by the Senators Markey und Blumenthal from 21.7[END_REF] have been put forward, it has to be borne in mind that the driver also has to be able to focus on the driving itself.

Similar to the issue of valid consent, the problem of identifying the controller of data processing operations is also inherited from the former legislation. However, it can be seen that concepts such as the question of who controls a data processing operation may be difficult to answer in practice, especially in complex environments with many data flows, such as in the context of smart cars. Especially with regard to such new technology, a definition of data flows, as it is required by a data protection impact assessment under Article 35 GDPR, is essential. Furthermore, while the GDPR follows a technology neutral approach based on the risks for the individual [START_REF] Boehme-Neßler | Big Data und Demokratie -Warum Demokratie ohne Datenschutz nicht funktioniert[END_REF], specific complex technologies such as smart cars may also require more detailed risk adequate provisions, either in the form of codes of conduct or sector specific regulation.

The discussion on the new right to data portability (see scenario 1), the difficulty of distinguishing two persons that use the same car (see scenario 3) and the question of responsibility in case of multiple controllers (see scenario 4) point to the necessity of specific decisions of the supervisory authorities, which will coordinate their efforts in the upcoming European Data Protection Board (EDPB), as well as judgments of the European Court of Justice on the interpretation of specific legal terms and concepts.

In scenario 3 the issue of discrimination based on data processing was discussed. The discussion showed how difficult it is to prevent or prove discrimination through scoring activities and to supervise the use of such technologies while respecting the interests of businesses, such as trade secrets. The GDPR does not answer this question, but instead resorts to the abstract legal definition of 'meaningful information', which will have to be interpreted by those applying the law in practice. For the individual, in most instances, the only possibility may be to provide additional personal information in order to rectify the data. However, this creates a privacy conundrum, as the data subject has to reveal even more information.

The discussion concerning scenario 5 indicated that the balance of the needs of individuals (data protection rights) and of the needs of society (more efficient and costeffective road infrastructure management) might regularly be decided in favour of the greater societal benefits. However, rather than choosing one option over another, an actual balancing of positions has to reconcile both positions as far as possible. Furthermore, it should be emphasised that data protection in itself is a value for society as a whole: to determine what others know about a person is part of their autonomy in a free society. Data protection thus is at the heart of democratic processes [START_REF] Van Der Sloot | The Individuals in the Big Data Era: Moving towards an Agent-Based Privacy Paradigm[END_REF][START_REF] Roßnagel | Schriftliche Stellungnahme zum öffentlichen Fachgespräch zur Datenschutz-Grundverordnung am 24[END_REF].

Conclusions

As has been shown, the GDPR does not exhaustively solve all issues relating to the protection of individuals with regard to big data analyses in the context of smart cars. While the Regulation offers some new solutions, such as the right to data portability, these will have to be interpreted and implemented in a meaningful way in practice. Further, the new legislation inherited some of the problems of the old legislation, such as the proper implementation of a valid consent or the question of responsibility for data processing operations. Especially the latter becomes relevant with regard to the specifics of smart cars. Moreover, it remains to be seen whether some member states will make use of opening clauses (including in particular Art. 6(2) but also Art. 9(4) and Art. [START_REF] Stöhring | Mein Auto, meine Daten? Fahrzeuggeneriertes Datenmaterial: Nutzung und Rechtsansprüche[END_REF](2) GDPR) to establish more accurate sector-specific rules and if other member states will harmonize their legislation accordingly (maybe in tandem with the EDPB and CoJ rulings) or if this, in contrary, will lead to a patchwork of different rules [START_REF] Roßnagel | Datenschutzrecht 2016 "Smart" genug für die Zukunft?[END_REF]. In conjunction with legal regulation, and especially in complex data processing structures, as is the case with smart cars and big data, the development and application of Privacy by Design (PbD) and Privacy Enhancing Technologies (PETs) remains an important but not yet effectively implemented cornerstone. All in all, the workshop has served both to raise awareness of individual rights under data protection law in general and also to show some of the deficits in practice. However, in order to address the challenges of big data to society in a more democratic way, we need societal debates and further development of institutional structures addressing the power imbalances of different voices and interests. The debates on the GDPR and the ongoing discussions on the review of the e-Privacy-Directive can be regarded as a good starting point, but an expansion of these discussions both within the member states and within non data protection-affine communities is essential.

Scenario 5 :

 5 Car Manufacturers and Service Providers as Part of Road Traffic Management.

Recital 75 GDPR lists some risks that may result from data processing and may "lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data sub-

* This work is partially funded by the German Ministry of Education and Research within the project 'Forum Privacy and Self-determined Life in the Digital World'.