Search

This article emphasizes the crucial significance of personal data and the potential dangers arising from its unauthorized processing, which can violate an individual's basic rights and freedoms. To address these worries, the European Union has implemented a comprehensive regulatory structure, widely recognized as the General Data Protection Regulation (GDPR). In the domain of data privacy and security, personal data is defined as encompassing any information with the capacity to identify an individual, whether it be anonymized, encrypted, or pseudonymized data. The regulatory purview of GDPR spans all modes of data processing, automated or manual, and remains indifferent to the storage medium or technology employed. Illustrative examples of personal data comprise an individual's name, identification number (like a CNP), location data (such as GPS coordinates), online identifiers (for instance, specific types of cookies), and a diverse array of attributes pertaining to an individual's physical, physiological, genetic, psychological, economic, cultural, or social identity. This classification also encompasses information such as IP addresses, email addresses, or residential addresses. It is of utmost importance to acknowledge that personal data, whether examined in isolation or in conjunction with other data elements, retains the potential to unveil the identity of an individual. This paper expands the scope of analysis to critically assess the multifaceted implications of GDPR within the contemporary landscape of data privacy and security, with a specific focus on its relevance within the realm of management practices. The examination encompasses an indepth exploration of the foundational principles of GDPR, its legal framework, and its global impact across businesses, individuals, and regulatory bodies. Additionally, the study delves into the complexities associated with GDPR compliance, illuminating the evolving dynamics of data protection within an increasingly digitized world. It emphasizes the essential role played by effective management strategies in addressing these challenges. [ABSTRACT FROM AUTHOR]

According to the General Data Protection Regulation (hereinafter GDPR), in each Member State of the European Union, one or more independent supervisory authorities of personal data processing must operate under conditions of full independence. Therefore, by this article we aim to achieve two main objectives. A first objective is to explain the notion of „full independence“ and the second objective is to find and analyze some of the essential elements for guaranteeing full independence. The methodology used has focused on the study of the European and national legislation (the European treaties, the GDPR, the Romanian Constitution, the Administrative Code), on the study of doctrine and on the analysis of the case law of the Court of Justice of the European Union (hereinafter CJEU) on the issue of full independence of the supervisory authorities. This paper concludes that the notion of the independence of the supervisory authorities is a fragile notion that requires the full attention of the Member States. The fundamental human rights and freedoms must survive any political movements or commercial interests. The Member States, by the national law, must ensure adequate safeguards to ensure full independence of the supervisory authorities and must establish effective rules on the sanctioning of those who infringe on their independent status. As the notion of independence is a fragile notion, in the future, the Member States' actions to safeguard the independence of the supervisory authorities must increase in direct proportion to the degree of risk of the new technologies to privacy and to the other fundamental rights and freedoms. Regarding the structure of the paper, in the Introduction, we discussed the necessity of existence of some national data protection authorities. In Section II, we briefly presented certain general considerations about supervisory authorities. In Section III, we set out certain general considerations about the legal regime of the autonomous administrative authorities in Romania. In Section IV.A we analyzed and defined the notion of „full independence“, and in Section IV.B we extracted from the legislation, doctrine and case law a part of the essential elements for guaranteeing a full independence and we briefly explained these elements. [ABSTRACT FROM AUTHOR]

General Data Protection Regulation (GDPR)—the European Union's data protection regulation—has two key principles. It recognizes that individuals own and control their personal (but not contractual) data in perpetuity, leading to three critical privacy rights, namely, the rights to (i) explicit consent (data opt-in), (ii) to be forgotten (data erasure), and (iii) portability (data transfer). It also includes data security mandates against privacy breaches through unauthorized access. We study GDPR's equilibrium impact by including these features in a dynamic two-period model of forward-looking firms and consumers. Firms collect consumer data for personalization and price discrimination. Consumers trade off gains from personalization relative to potential losses from privacy breaches and price discrimination in their purchase, data opt-in, erasure, and transfer decisions. Though data security mandates impose fines on firms for privacy breaches, firms can benefit from higher opt-in given lower breach risk. Surprisingly, data security mandates can hurt consumers. The effect of privacy rights is nuanced. Since the right to opt in separates goods exchange from the provision of personal data, it prevents market failure under high breach risk. But it also reduces consumer opt-in and personal data availability. Erasure and portability rights reduce consumers' hold-up concerns by disciplining firms to provide ongoing value by limiting price discrimination and not slacking off on data security; but they also reduce the incentive to offer lower initial prices that encourages opt-in. Overall, privacy rights always benefit consumers in competitive markets, but they can surprisingly hurt consumers under monopoly, as monopolists have less incentives to subsidize consumer opt-in. They raise (reduce) firm profit and social welfare when breach risk is high (low). Finally, privacy rights increase firm profit most at moderate levels of data transferability. This paper was accepted by Dmitri Kuksov, marketing. Funding: T. T. Ke acknowledges financial support from the General Research Fund of the Hong Kong Research Grants Council [Grant 14500421]. Supplemental Material: The e-companion is available at https://doi.org/10.1287/mnsc.2022.4614. [ABSTRACT FROM AUTHOR]

Background: In the European Union, the General Data Protection Regulation (GDPR) plays a central role in the complex health research legal framework. It aims to protect the fundamental right to the protection of individuals' personal data, while allowing the free movement of such data. However, it has been criticized for challenging the conduct of research. Existing scholarship has paid little attention to the experiences and views of the patient community. The aim of the study was to investigate 1) the awareness and knowledge of patients, carers, and members of patient organizations about the General Data Protection Regulation, 2) their experience with exercising data subject rights, and 3) their understanding of the notion of "data control" and preferences towards various data control tools. Methods: An online survey was disseminated between December 2022 and March 2023. Quantitative data was analyzed descriptively and inferentially. Answers to open-ended questions were analyzed using the thematic analysis method. Results: In total, 220 individuals from 28 European countries participated. The majority were patients (77%). Most participants had previously heard about the GDPR (90%) but had not exercised any of their data subject rights. Individual data control tools appeared to be marginally more important than collective tools. The willingness of participants to share personal data with data altruism organizations increased if patient representatives would be involved in the decision-making processes of such organizations. Conclusion: The results highlighted the importance of providing in-depth education about data protection. Although participants showed a slight preference towards individual control tools, the reflection based on existing scholarship identified that individual control holds risks that could be mitigated through carefully operationalized collective tools. The discussion of results was used to provide a critical view into the proposed European Health Data Space, which has yet to find a productive balance between individual control and allowing the reuse of personal data for research. [ABSTRACT FROM AUTHOR]

Copyright of IDP: Revista de Internet, Derecho y Politica is the property of Universitat Oberta de Catalunya and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The article focuses on the intersections of the regulation of electronic identification as provided in the eIDAS Regulation and data protection rules in the European Union. The first part of the article is devoted to the explanation of the basic notions and framework related to the electronic identity in the European Union--the eIDAS Regulation. The second part of the article discusses specific intersections of the eIDAS Regulation with the General Data Protection Regulation (GDPR), specifically scope, the general data protection clause and mainly personal data processing in the context of mutual recognition of electronic identification means. The article aims to discuss the overlapping issues of the regulation of the GDPR and the eIDAS Regulation and provides a further guide for interpretation and implementation of the outcomes in practice. [ABSTRACT FROM AUTHOR]

The use of smart meters enables the emergence of innovations in the electricity sector, such as smart grids, prosumers and Peer-to-Peer trading, which can play an important role in realizing the energy transition. These developments rely on the processing of personal data, triggering the application of data protection legislation in addition to the legislation organizing the electricity markets. This article examines the interaction between the General Data Protection Regulation (GDPR) and the Directive (EU) 2019/944 on common rules for the internal market for electricity in the European Union, following the method of doctrinal legal research. Concretely, this article investigates what kinds of tensions may arise from the coexistence of these two legal regimes and whether there are mechanisms in place to prevent or mitigate such tensions. Three main tensions are identified. The first tension lies in the fact that some of the innovations facilitated by smart metering in the energy sector rely on technologies that might not be entirely compatible with the GDPR. A second tension follows from the existence of separate but interrelated regimes for access to data of the consumer/data subject in the two legal instruments here analysed. The third tension relates to a possible overlap of competences between the supervisory authorities of both regimes. This article is a contribution to the still scarce legal scholarship on the interplay between the GDPR the Recast Electricity Directive. The findings of this research are of interest not only for academics but also for practitioners, policymakers and supervisory authorities that have to deal with the issues here identified. [ABSTRACT FROM AUTHOR]