skip to navigation skip to content

The Legal Framework for Data Sharing: Balancing Crime-fighting with Privacy and Data Protection Concerns

Aims & objectives

This project forms part of an interdisciplinary initiative based in the Computer Laboratory, the Cambridge Cybercrime Centre.  The aim is to study the legal framework governing data sharing and its relationship to patterns of crime in cyberspace.


Internet and telecommunications companies are receiving many thousands of data access requests every year from law enforcement agencies. Compliance may be in the interests of the companies themselves and of wider societal interests in cases where it can materially assist the detection and prosecution of crime. The legal framework governing such access requests is not clear, however.  Companies may find themselves subject to legal action by their users and may also risk breaching laws such as the US Electronic Communications Privacy Act (ECPA), which regulates access to stored electronic communications. Human rights laws and data protection laws in Europe also place limits on how far internet companies can share personal data with government agencies. 

There are three problems facing both companies and government agencies in this area:

  • Laws may be rendered uncertain or out of date because of advances in technology. The ECPA, for example, was drafted before email usage became common.  
  • Laws may clash.  For example, legal duties to assist government agencies may conflict with privacy or data protection laws. The latter may make exceptions for data relating to national security or criminal acts but the scope of such derogations may be unclear.
  • It may not be clear which jurisdiction applies to a particular data request.  US and European standards, as well as those other countries, differ significantly on points of both process and substance.


We are studying these issues through a multi-level approach.

The first level consists of a review of relevant laws and of the secondary literature on these issues.

The second level consists of the interviews with legal advisers, NGOs and government agencies in order to get an understanding of how the law is working in practice in different jurisdictions.

Results & dissemination

The first stage of the project consisted of developing a conceptual framework for analysing data sharing and exploring related issues of legal policy.  In the second stage, the emphasis has been on case studies of data sharing and its legal regulation, together with analysis of the risks and potential of new technologies in this area, including big data and artificial intelligence.

In March 2017 Julia Powles published the results of a study critically analysing the architecture, communication, and oversight of a foundational deal between Google DeepMind and the Royal Free London NHS Hospital Trust. The paper addressed questions of transparency, data value, and market power in data-driven healthcare. The paper  received wide press coverage, including in the BBCQuartzThe VergeBusiness InsiderWiredABC Radio National and numerous other outlets, and led to changes in the practice of data sharing in the NHS and UK public sector more generally. On 22 March 2017 Julia gave the Annual Lecture on Law and Emerging Technologies at the University of Leeds, entitled Data Kingdoms and Keys: The Case of Google and the NHS, which focused on the Google DeepMind. Julia and her co-author Hal Hodson are curently working on a second paper, analysing the terms of the revised DeepMind-Royal Free arrangement since November 2016 and ongoing regulatory investigations.

Simon Deakin and Christopher Markou gave a presentation on ‘Law, work and technology: a systems approach’ to the Rustat Conference on the Future of Work at Jesus College, Cambridge, on 22 November 2016. This presentation outlined a model of the law-technology relation which draws on and develops Niklas Luhmann’s social systems theory (SST) and applied to the model to emerging technologies including Bitcoin and Uber’s ride hailing service.  In the autumn of 2017 they completed a paper on ‘The law-technology cycle and the future of work’ which was presented at a conference held at the University of Brescia in October 2018 and subsequently published. In April 2018 Simon Deakin gave the Wedderburn Memorial Lecture at the Industrial Law Society in London on the theme ‘Uber and Luddism: Reflections from History on Law, Democracy and Technological Change’. In September 2018 Christopher Markou was awarded his PhD on the theme ‘Law and Artificial Intelligence: A Systems-Theoretical Analysis’.

Journal articles

Deakin, S., and Markou, C. (2018) ‘The law-technology cycle and the future of work’ Giornale di Diritto del Lavoro e di Relazioni Industriali, forthcoming.

Powles, J. and Hodson, H. (2017) ‘Google DeepMind and healthcare in an age of algorithms’ Health and Technology, published online.

Reiff, M. and Markou, C. (2017) ‘On the personhood of artificial agents’ Journal of Legal and Political Philosophy, forthcoming.

Bateman, W. and Powles, J., (2017) ‘The problem of regressive bias in machine learning and normative systems’ (in progress for publication in Proc. 30th Conference on Neural Information Processing Systems).

Nithyanand, R. Khattak, S., Javed, M. Vallina-Rodriguez, N., Falahrastegar, M. Powles, J., De Cristofaro,E., Haddadi, H. and Murdoch,S. (2016) ‘Adblocking and counter blocking: a slice of the arms race’ Proc. 6th USENIX Workshop on Free and Open Communications on the Internet.

Powles, J. (2016) ‘UK patent decisions 2015’ International Review of Intellectual Property and Competition Law, 47: 189-.

Powles, J. and Hodson, H. (2016) ‘Google DeepMind and healthcare in an age of algorithms’, Journal of Health and Technology, forthcoming. 

Powles, J. (2015) ‘The case that won’t be forgotten’ Loyola University of Chicago Law Journal, 47: 583-.

Singh, J., Pasquier, T., Bacon, J., Powles, J., Diaconu, R. and Eyers, D. (2016) ‘Policy-Driven Middleware for a Legally-Compliant Internet of Things’ (2016) Proc. ACM/IFIP/USENIX 16th International Conference on Middleware. 

Conference/Workshop papers

Deakin, S. and Markou, C. (2016), ‘Law, work and technology: a systems approach’, Rustat Conference on the Future of Work, Jesus College, Cambridge, 22 November 2016.

Markou, C. ‘What Role For Law in AI?’ University of Krakow, Program in Private European Law, 20 January 2017.

Markou, C. ‘Complexity Theory as a Paradigm for Artificial Intelligence Regulation’ Cambridge Conference on Catastrophic Risk, Clare College, The University of Cambridge, 12 December 2016.

Markou, C.‘Courtroom Application of Virtual Reality’, London, Bar Standards Board, 8 December 2016.

Markou, C. ‘Law, Work and Technology: A Systems Approach’ Rustat Conference on the Future of Work, Jesus College, The University of Cambridge, 22 November 2016.

Markou, C. ‘How Should Law Think About AI?’ Society of Legal Scholars Conference, Jesus College, The University of Oxford, 5 October 2016.

Powles, J. (2017) ‘Data kingdoms and keys: the case of Google and the NHS’, Annual Lecture on Law and Emerging Technologies, School of Law, University of Leeds, 22 March 2017.

Deakin, S., ‘Uber and Luddism’ presentation to ETUI-ETUC Conference, Shaping the New World of Work: The Impacts of Globalisation and Digitalisation, Brussels, June 2016.

Powles, J., ‘Internet Intermediaries and the Right to Be Delisted’, iCLIC Annual Conference, University of Southampton, 17 September 2015.

Powles, J., ‘Digital Currencies’, Christine König Gallery, Vienna, 8 October 2015.

Powles, J., ‘Protecting Freedom of Expression Online: What is the Role of Intermediaries?’, Freedom of Expression and Democracy Conference, Council of Europe, Strasbourg, 14 October 2015.

Powles, J. ‘Monopolies and Unicorns: European Tech and Democracy’, Web Summit, Dublin, 4 November 2015.

Powles, J., ‘Technology, Regulation, Other: What Response to Mass Surveillance?’, Privacy Camp, Brussels, 26 January 2016.

Powles, J., ‘Boundaries of Law: Global Perspectives on Transparency, Accountability & Oversight of Government Surveillance’, Computers Privacy and Data Protection Conference, Brussels, 28 January 2016.

Powles, J., ‘Encryption and Information Sovereignty: Destroying the Internet to Save It?, RSA Conference, San Francisco, 1 March 2016.

Powles, J., ‘The Map is Not the Territory: Preoccupations of a Connected Planet’, Stiftung Datenschutz Symposium on the Culture of Privacy and Data Protection in the EU and the US, Frankfurt, 9 March 2016.

Powles, J., ‘How Do We Engage People With Thinking Ethically About Big Data?’, Ethics of Big Data Workshop, University of Cambridge, 10 June 2016.

Powles, J., ‘Right to Oblivion: Technical and Legal Controversies’, Seventh Annual Privacy and Personal Data Protection Seminar, São Paulo, 25 August 2016.

Powles, J. ‘Out of Sync? Time, Technology and the Media’, AHRC International Doctoral Conference in the Humanities, University of Cambridge, 14 September 2016.

Powles, J., ‘From Smart Homes to Smart Everything’, EDPS-BEUC Joint Conference on Big Data, Individual Rights and Smart Enforcement, European Commission, Brussels, 29 September 2016.

Powles, J., ‘Blood Data: The Ethics of Our Big Data Society’, Festival of Ideas, Cambridge, 22 October 2016.

Powles, J., ‘Patent Law’s Elephant’, Sheffield Institute of Corporate and Commercial Law, University of Sheffield, 2 November 2016.

Powles, J., ‘Algorithmic Accountability and Transparency in the Digital Market’, European Parliament, Brussels, 7 November 2016.

Powles, J., ‘Perils and Promises of Artificial Intelligence’, IEEE AI & Ethics Summit, Brussels, 15 November 2016.

Powles, J., ‘Beyond Things’, LAVITS: Latin American Network on Surveillance Studies Annual Conference, Buenos Aires, 22 November 2016. 

Powles, J., ‘Implementing the Right to Obscurity’, Computers Privacy and Data Protection Conference, Brussels, 25 January 2017.

Powles, J., ‘Annual Lecture on Law and Emerging Technologies, University of Leeds, 30 January 2017.

Media coverage

Markou, C. ‘AI: Artificial Intelligence Could Start a Global Arms Race—Will We Be Able to Control it?’, News Week, June 27 2017.

Markou, C. ‘Why using AI in sentencing criminals might be a bad idea’, We Forum, May 16 2017.

Markou, C. ‘Neuralink Wants to Wire Your Brain to the Internet–What Could Possibly Go Wrong?’, 3 May 2017.

Markou, C. ‘We Could Soon face a Robot Crimewave: The Law Needs to be Ready’, The Independent, 19 April 2017.

Markou, C .‘AI experts warn humanity has to prepare now for ‘The Reckoning’ when robots demand equal rights’, The Daily Mail, 24 February 2017.

Markou, C . ‘AI could kickstart a new global arms race – we need better ways to govern it before it’s too late’ The Conversation.

Markou, C. ‘Why using AI to sentence criminals is a dangerous idea’ The Conversation.

Markou, C. ‘Neuralink wants to wire your brain to the internet – what could possibly go wrong?’ The Conversation.

Markou, C. ‘We could soon face a robot crimewave … the law needs to be ready’ The Conversation.

Markou, C. ‘Robots and AI could soon have feelings, hopes and rights … we must prepare for the reckoning’ The Conversation.

Markou, C .Creative Review (the ‘AI Issue’).

Markou, C. Computer Weekly (‘Algorithmic Transparency’).

Markou, C .The Independent (Several occasions).

Markou, C. Wired (quoted in several articles).

Powles, J. ‘Why are we giving away our most sensitive health data to Google?’ The Guardian, 5 July 2017.

Markou, C. Newstalk 1010 (Ireland) Sean Moncrieff Radio Show .

Markou, C. CBC Radio 1 (Canada).

Markou, C. BBC Radio 4 (UK).

Markou, C. Boni Sones Podcasts.

MPhil students supervised

Simon Deakin supervised Christopher Markou (PhD), ‘The conflict of law and technology: a systems theoretical analysis of artificial intelligence’.

Project leader

Simon Deakin
Julia Powles (Cornell University)
Christopher Markou (Faculty of Law, University of Cambridge)

Project status


Project dates