Search

This article emphasizes the crucial significance of personal data and the potential dangers arising from its unauthorized processing, which can violate an individual's basic rights and freedoms. To address these worries, the European Union has implemented a comprehensive regulatory structure, widely recognized as the General Data Protection Regulation (GDPR). In the domain of data privacy and security, personal data is defined as encompassing any information with the capacity to identify an individual, whether it be anonymized, encrypted, or pseudonymized data. The regulatory purview of GDPR spans all modes of data processing, automated or manual, and remains indifferent to the storage medium or technology employed. Illustrative examples of personal data comprise an individual's name, identification number (like a CNP), location data (such as GPS coordinates), online identifiers (for instance, specific types of cookies), and a diverse array of attributes pertaining to an individual's physical, physiological, genetic, psychological, economic, cultural, or social identity. This classification also encompasses information such as IP addresses, email addresses, or residential addresses. It is of utmost importance to acknowledge that personal data, whether examined in isolation or in conjunction with other data elements, retains the potential to unveil the identity of an individual. This paper expands the scope of analysis to critically assess the multifaceted implications of GDPR within the contemporary landscape of data privacy and security, with a specific focus on its relevance within the realm of management practices. The examination encompasses an indepth exploration of the foundational principles of GDPR, its legal framework, and its global impact across businesses, individuals, and regulatory bodies. Additionally, the study delves into the complexities associated with GDPR compliance, illuminating the evolving dynamics of data protection within an increasingly digitized world. It emphasizes the essential role played by effective management strategies in addressing these challenges. [ABSTRACT FROM AUTHOR]

Since May 2018, the global concept of personal data transfer has seen major changes, driven by the reforms of the EU’s Data Protection Legislation, when the new regime of diversified mechanisms for transfer to third countries came into effect. The article aims to give an overview of the European Union’s contemporary legal framework and the tools for international data transfer. In addition, the article will briefly present the legal provisions for personal data transfer of some other countries, constructed and further developed under the influence and inspiration of the "almost perfect" EU regulatory solution. The purpose and the main value of the paper is to demonstrate that internationally harmonized mechanisms for transfer of personal data will not hinder, but positively govern the global international exchange, development and cooperation. The value of the article is increased due to the fact that improved mechanisms for international data flow are a relative novelty, and in certain parts of the economically developed world, which will be briefly covered, are in their absolute infancy. The main hypotheses of the paper are based on the following premise: GDPR’s data transfer tools are the best mechanisms so far, which tend, with certain improvements in practical implementation, to ensure the full realization of personal data protection right, in case of data flows outside the EU borders, and the legal provisions for personal data transfer of certain foreign countries (Middle East/Gulf Cooperation Council members) are a reflection of the GDPR, thus providing the same level of personal data protection during transfer to those countries. At the same time, the rules are not an obstacle for the smooth running of international business and other types of valuable transactions. [ABSTRACT FROM AUTHOR]

According to the General Data Protection Regulation (hereinafter GDPR), in each Member State of the European Union, one or more independent supervisory authorities of personal data processing must operate under conditions of full independence. Therefore, by this article we aim to achieve two main objectives. A first objective is to explain the notion of „full independence“ and the second objective is to find and analyze some of the essential elements for guaranteeing full independence. The methodology used has focused on the study of the European and national legislation (the European treaties, the GDPR, the Romanian Constitution, the Administrative Code), on the study of doctrine and on the analysis of the case law of the Court of Justice of the European Union (hereinafter CJEU) on the issue of full independence of the supervisory authorities. This paper concludes that the notion of the independence of the supervisory authorities is a fragile notion that requires the full attention of the Member States. The fundamental human rights and freedoms must survive any political movements or commercial interests. The Member States, by the national law, must ensure adequate safeguards to ensure full independence of the supervisory authorities and must establish effective rules on the sanctioning of those who infringe on their independent status. As the notion of independence is a fragile notion, in the future, the Member States' actions to safeguard the independence of the supervisory authorities must increase in direct proportion to the degree of risk of the new technologies to privacy and to the other fundamental rights and freedoms. Regarding the structure of the paper, in the Introduction, we discussed the necessity of existence of some national data protection authorities. In Section II, we briefly presented certain general considerations about supervisory authorities. In Section III, we set out certain general considerations about the legal regime of the autonomous administrative authorities in Romania. In Section IV.A we analyzed and defined the notion of „full independence“, and in Section IV.B we extracted from the legislation, doctrine and case law a part of the essential elements for guaranteeing a full independence and we briefly explained these elements. [ABSTRACT FROM AUTHOR]

Privacy and protection of personal data on the Internet have become issues of public concern in Indonesia. There is growing public distrust of institutions that manage personal data. Poor management of personal data provides a fertile ground for cybercrime and lack of accountability, especially in the context of the new digital economy. In response, the Indonesian Communication Ministry drafted the Personal Data Protection Bill, which has been submitted to the parliament. This paper analyzes the PDP Bill to determine whether it meets international data privacy standards. The EU GDPR is selected as the benchmark for assessment as it is regarded as the toughest privacy law worldwide. The study finds that Indonesian citizens do not have the same level of protection as their European counterparts. Nonetheless, the implementation of this bill when it becomes law will lead to a high level of personal data protection in the new digital economy. [ABSTRACT FROM AUTHOR]

General Data Protection Regulation (GDPR)—the European Union's data protection regulation—has two key principles. It recognizes that individuals own and control their personal (but not contractual) data in perpetuity, leading to three critical privacy rights, namely, the rights to (i) explicit consent (data opt-in), (ii) to be forgotten (data erasure), and (iii) portability (data transfer). It also includes data security mandates against privacy breaches through unauthorized access. We study GDPR's equilibrium impact by including these features in a dynamic two-period model of forward-looking firms and consumers. Firms collect consumer data for personalization and price discrimination. Consumers trade off gains from personalization relative to potential losses from privacy breaches and price discrimination in their purchase, data opt-in, erasure, and transfer decisions. Though data security mandates impose fines on firms for privacy breaches, firms can benefit from higher opt-in given lower breach risk. Surprisingly, data security mandates can hurt consumers. The effect of privacy rights is nuanced. Since the right to opt in separates goods exchange from the provision of personal data, it prevents market failure under high breach risk. But it also reduces consumer opt-in and personal data availability. Erasure and portability rights reduce consumers' hold-up concerns by disciplining firms to provide ongoing value by limiting price discrimination and not slacking off on data security; but they also reduce the incentive to offer lower initial prices that encourages opt-in. Overall, privacy rights always benefit consumers in competitive markets, but they can surprisingly hurt consumers under monopoly, as monopolists have less incentives to subsidize consumer opt-in. They raise (reduce) firm profit and social welfare when breach risk is high (low). Finally, privacy rights increase firm profit most at moderate levels of data transferability. This paper was accepted by Dmitri Kuksov, marketing. Funding: T. T. Ke acknowledges financial support from the General Research Fund of the Hong Kong Research Grants Council [Grant 14500421]. Supplemental Material: The e-companion is available at https://doi.org/10.1287/mnsc.2022.4614. [ABSTRACT FROM AUTHOR]

Background: In the European Union, the General Data Protection Regulation (GDPR) plays a central role in the complex health research legal framework. It aims to protect the fundamental right to the protection of individuals' personal data, while allowing the free movement of such data. However, it has been criticized for challenging the conduct of research. Existing scholarship has paid little attention to the experiences and views of the patient community. The aim of the study was to investigate 1) the awareness and knowledge of patients, carers, and members of patient organizations about the General Data Protection Regulation, 2) their experience with exercising data subject rights, and 3) their understanding of the notion of "data control" and preferences towards various data control tools. Methods: An online survey was disseminated between December 2022 and March 2023. Quantitative data was analyzed descriptively and inferentially. Answers to open-ended questions were analyzed using the thematic analysis method. Results: In total, 220 individuals from 28 European countries participated. The majority were patients (77%). Most participants had previously heard about the GDPR (90%) but had not exercised any of their data subject rights. Individual data control tools appeared to be marginally more important than collective tools. The willingness of participants to share personal data with data altruism organizations increased if patient representatives would be involved in the decision-making processes of such organizations. Conclusion: The results highlighted the importance of providing in-depth education about data protection. Although participants showed a slight preference towards individual control tools, the reflection based on existing scholarship identified that individual control holds risks that could be mitigated through carefully operationalized collective tools. The discussion of results was used to provide a critical view into the proposed European Health Data Space, which has yet to find a productive balance between individual control and allowing the reuse of personal data for research. [ABSTRACT FROM AUTHOR]

This article examines the supremacy accorded to free speech by the First Amendment of the American Constitution and in contrast, the European Union's 2018 General Data Protection Regulation [GDPR] that highlights data protection. It compares speech as a fundamental human right in US law with the GDPR that champions individual and social rights in personal data as constraints upon speech action. It evaluates US and EU law in light of the history of the law of privacy and the protection of personal information, as is reflected in the International Covenant on Civil and Political Rights [ICCPR]. The article concludes by proposing a uniform and consistent regime for limiting freedom of expression in an era of mass exposure of personal data to harmful online dissemination on the global Internet of Things [IoT]. [ABSTRACT FROM AUTHOR]

Autonomous or robot vehicles are manufactured with such advanced technologies that they are technically able to operate without human intervention. The number of sensors deployed in automated vehicles is increasing, which runs a high risk of the excessive collection and processing of personal data. Considering European Union and Finnish perspectives on robot buses as an instance of advancements of autonomous vehicles, this article briefly outlines the general legal issues related to developing robot buses, and focuses on public interest and legitimate interest as lawful bases for processing personal data in running such vehicles in the mass transportation system. [ABSTRACT FROM AUTHOR]

Copyright of IDP: Revista de Internet, Derecho y Politica is the property of Universitat Oberta de Catalunya and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The use of smart meters enables the emergence of innovations in the electricity sector, such as smart grids, prosumers and Peer-to-Peer trading, which can play an important role in realizing the energy transition. These developments rely on the processing of personal data, triggering the application of data protection legislation in addition to the legislation organizing the electricity markets. This article examines the interaction between the General Data Protection Regulation (GDPR) and the Directive (EU) 2019/944 on common rules for the internal market for electricity in the European Union, following the method of doctrinal legal research. Concretely, this article investigates what kinds of tensions may arise from the coexistence of these two legal regimes and whether there are mechanisms in place to prevent or mitigate such tensions. Three main tensions are identified. The first tension lies in the fact that some of the innovations facilitated by smart metering in the energy sector rely on technologies that might not be entirely compatible with the GDPR. A second tension follows from the existence of separate but interrelated regimes for access to data of the consumer/data subject in the two legal instruments here analysed. The third tension relates to a possible overlap of competences between the supervisory authorities of both regimes. This article is a contribution to the still scarce legal scholarship on the interplay between the GDPR the Recast Electricity Directive. The findings of this research are of interest not only for academics but also for practitioners, policymakers and supervisory authorities that have to deal with the issues here identified. [ABSTRACT FROM AUTHOR]