Search

With global personal information flows increasing, efforts have been made to develop principles to standardize data protection regulations. However, no set of principles has yet achieved universal adoption. This note proposes a principle mandating that personal data be securely destroyed when it is no longer necessary for the purpose for which it was collected. Including a data deletion principle in future data protection standards will increase respect for individual autonomy and decrease the risk of abuse of personal data. Though data deletion is already practiced by many data controllers, including it in legal data protection mandates will further the goal of establishing an effective global data protection regime.

Data portability rights are viewed by policymakers worldwide as a significant legal innovation to stimulate competitive digital economies. These rights allow consumers and businesses to seamlessly receive and transfer data for commercialization and efficiency purposes. The newly implemented Australian Consumer Data Right (CDR) provides an illuminating example of the complex relationship between information privacy and competition law which is central to data portability initiatives. The CDR grants consumers and businesses access and transfer rights for consumer data in the Australian banking, energy, and telecommunications sectors, through the implementation of mandated API standards. There are three policy vectors at the heart of the CDR that parallel previous Australian, UK, and EU data portability developments. They are the type of regulated data covered by the CDR scheme, privacy and security protections and the overarching regulatory framework. We argue that the CDR, and its antecedents, primarily construct data portability as a competition law measure. However, while the general policy intention of the CDR is clear, we contend that the scheme reveals an uncertain role for information privacy law as part of its operation. Uncertainty is evident in how policymakers have considered the information privacy law issues inherent in the three policy vectors. We contend that the CDR could give rise to definitional problems with regulated data, duplicated privacy and security protections and a conceptually challenging regulatory framework. In conclusion, we suggest potential solutions that would assist with the operation of the CDR within Australia’s broader information privacy law framework, governed by the Privacy Act 1988 (Cth), which would also better align with the General Data Protection Regulation (GDPR).

Aim The paper investigates the new European Data Protection Regulation released in 2016. It highlights the data protection principles inspiring the Regulation and outlines its main innovative as well as critical aspects as regards the use of personal data for research purposes. Results: As far as scientific research is concerned, the new Regulation provides some interesting novelties in relation to informed consent and to use of personal data without consent. Conclusion: It is still early for the consideration of the new Regulation, in relation to which the transition period before it definitively comes into force in 2018 will be useful for making a complete and detailed assessment of its adequacy. However, it is precisely with reference to the collection of retrospective personal data that the greatest innovations are seen. It will therefore be interesting to follow the interpretative evolution of the principle of compatibility of purposes which renders - in fact - personal data already collected usable, even in the absence of consent from the data subject.

The 50th anniversary in 2020 of the world’ s first data privacy law, the Datenschutzgesetz 1970 of the state of Hesse in Germany marks the first half century of their development. This article focuses on changes in the global development of these data privacy laws in 2019-20. In summary, the number of countries that have enacted data privacy laws rose from 132 to 145, and most of the 13 new laws are from 2019, before COVID-19 slowed down legislative activity world-wide. At least 23 other countries have official Bills for new laws in various stages of progress. During 2019-20, at least 13 countries have updated or replaced existing laws (almost always influenced by the EU’s GDPR). At least a further 11 have introduced Bills to do so. All of this adds up to nearly 60 countries world-wide where there was legislative activity in 2019-20 concerning data privacy, resulting in new or updated laws in 26 countries. All of these changes are detailed in the article, and in the two accompanying global Tables.

This article examines the complex relationship between consumer protection law and data protection law, particularly within the EU's online environment, and highlights the problems that stem from this complexity. It suggests that, while there are significant similarities between their respective sources, tools and purposes, there are also arguable differences between consumer protection law and data protection law. One such arguable difference is found in that, while consumer protection law can be seen to merely set a floor in its pursuit of a sufficiently high level of consumer protection, data protection law – due to its clearly articulated dual purposes of (a) protecting individuals with regard to the processing of personal data and (b) providing for the free movement of such data – sets both a floor and a ceiling. Having discussed the relationship between consumer protection law and data protection law in more detail, the argument is made that it seems possible to conclude that the balance struck in the Data Protection Directive, and soon in the General Data Protection Regulation, places limitations on consumer protection law. The implications of this conclusion are then examined briefly in the context of some matters currently coming before the CJEU and the contours of a framework are presented, addressing situations where a data protection-based liability claim is pursued against a third-party non-controller under consumer protection law.

The consent model of privacy protection assumes that individuals control their personal information and are able to assess the risks associated with data sharing. The model is attractive for policy-makers and automakers because it has the effect of glossing over the conceptual ambiguities that are latent in definitions of privacy. Instead of formulating a substantive and normative position on what constitutes a reasonable expectation of privacy in the circumstance, individuals are said to have control over their data. Organizations have obligations to respect rights to notice, access and consent regarding the collection, use and disclosure of personal data once that data has been shared. The policy goal becomes how to provide individuals with control over their personal data in the consent model of privacy protection. This paper argues that the privacy issues raised by vehicular ad hoc networks make this approach increasingly untenable. It is argued that substantive rules that establish a basic set of privacy norms regarding the collection, use and disclosure of data are necessary. This can be realized in part via a privacy code of practice for the connected vehicle. This paper first explores the relationship between privacy, consent and personal information in relation to the connected car. This is followed by a description of vehicular ad hoc networks and a survey of the technical proposals aimed at securing data. The privacy issues that will likely remain unsolved by enhancing individual consent are then discussed. The last section provides some direction on how a code of practice can assist in determining when individual consent will need to be enhanced and when alternatives to consent will need to be implemented.

A recent Australian Federal Court decision has raised the issue of the scope of information protected under the Australian Privacy Act 1988. The Court failed to adequately address this question, leaving Australians unsure as to whether sections of their information, such as the IP addresses allocated to their mobile devices, will be considered personal information under the Act. The main consideration the Court dealt with was what it means for information to be “about” an individual. In this paper I address two questions: a) how is information determined to be “about” an individual under the Act; and b) how should this determination be made in the future? I conclude that currently available guidance from the courts, the Australian Information Commissioner and scholarly commentary are inadequate to enable individuals, organisations and agencies to consistently make such determinations. Accordingly I draw on approaches to this question taken in Canada, New Zealand, the European Union and the United Kingdom to argue that the definition should be broadly interpreted in a technologically-aware manner. This will help to ensure that personal information is more comprehensively protected under the Privacy Act.

This article discusses ways in which the General Agreement on Trade in Services (GATS) and post-GATS free trade agreements may limit the EU's ability to regulate privacy and personal data protection as fundamental rights. After discussing this issue in two dimensions – the vertical relationship between trade and national and European Union (EU) law, and the horizontal relationship between trade and human rights law – the author concludes that these limits are real and pose serious risks.Inspired by recent developments in safeguarding labour, and environmental standards and sustainable development, the article argues that privacy and personal data protection should be part of, and protected by, international trade deals made by the EU. The EU should negotiate future international trade agreements with the objective of allowing them to reflect the normative foundations of privacy and personal data protection. This article suggests a specific way to achieve this objective.

Personal data and its use have become the front-line of businesses in the digital market. With the potential to be extracted for information, making this available for various purposes, big data transforms into a powerful tool for data controllers for effective marketing, defining strategic business decisions, and establishing a strong foothold in the market. The use of personal data for targeted marketing exemplifies this. While privacy has been subject to the regime of privacy protection, privacy violation might entangle competition law analysis when it involves abuse of market dominance. This paper addresses these problems by discussing three key issues: first, how competition law addresses the use of personal data as the new frontier of innovation and competition; second, whether big data plays a role to qualify dominance; and third, if non-negotiable policy on privacy infringes the prohibition of dominance abuse under competition law.

The Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth) introduced a new Part IIIC into the Privacy Act to strengthen the existing information privacy laws by requiring the designated organisations to notify the Information Commissioner and affected individuals of data breaches that are likely to cause serious harm. The objective of this article is to consider the proper public policy basis for data breach notification laws, the likely ambit of operation of the new provisions and the merits of the law in enhancing data security. Whilst the article focuses on the Australian legislative framework, the provisions European Union’s new General Data Protection Regulation 2016/679, 27 April 2016, will also be considered to extend the discussion of appropriate law in this area. The article will conclude by identifying continuing areas of concern and suggesting initiatives to further strengthen the data privacy of individuals.

Despite its prominence, the Family Educational Rights and Privacy Act (FERPA) is often misinterpreted and misapplied. This chapter clarifies historical developments, common misconceptions, and modern applications of the law.

South Korea’s data privacy law has evolved rapidly despite a short history of relevant legislation and enforcement. South Korea’s data privacy law has exceedingly stringent consent requirements. In addition to consent, there are many other statutory provisions with onerous requirements, arguably making the overall data privacy law regime one of the strictest in the world. South Korea’s data privacy law, in particular the Personal Information Protection Act, has a similar structure to the EU’s data privacy law. However, the overall legal regime and enforcement mechanisms for data privacy reveal South Korea’s unique characteristics and the weaknesses of its data privacy law. Both the governance regime and the enforcement powers are too fragmented to achieve consistent policy outcomes. Data privacy has gained greater public attention in recent years in South Korea and, perhaps reflecting this phenomenon, relevant laws and regulations have been amended frequently. A notable trend is to strengthen penalty provisions such as the maximum amount of administrative fine, now set at 3% of relevant sales revenue. It remains to be seen if heightened penalty provisions will meaningfully help to address data privacy concerns.

The paper explores the conflict between users' right to privacy and data protection and the practices of online platforms such as Google and Facebook. Based on the collection of a data set of 13 complaints against the two companies in the period 2011 to 2016, the authors provide an overview of the field and a critical look at the current systems of privacy and data protection in the US and Europe, including the new General Data Protection Regulation (GDPR). The paper argues that whereas the two systems differ on a number of accounts neither of them critically engage with the online business model that lie beneath these platforms, including its incentive for maximising data collection.

As technology with surveillance capacities has advanced, the debate over the rights of the citizenry to be free from governmental breaches of personal privacy has intensified. Within the United States, government actions legally challenged as intrusions into personal privacy have been analyzed under the Fourth Amendment, but Supreme Court rulings in such cases lack a clear and consistent rationale. Additionally, while more than a dozen federal privacy statutes have been enacted, each piece of legislation pertains to a specific type of information (e.g. driver’s license information, education records, and financial records). There is no overarching federal legislation which protects the individual’s private affairs from warrantless government inspection. A key issue underlying the scope of the debate and the variation in court decisions and public policies pertinent to invasions of privacy by government agencies is the lack of a clear and cogent definition of ‘privacy.’ By means of a review of the ...

The right to privacy generally belongs to constitutionally protected rights and is listed with fundamental human rights in international human rights instruments. Personal health information is particularly important element of private life, and health data is defined and accepted as sensitive personal data. Modern computer and information technology is capable of processing enormous amounts of data concerning health, which entails a growing risk of violations of privacy by both public authorities and private entities. This article addresses the concept of privacy, as a legal term and a human right, and judicial remedies to enforce the right before national authorities. Whereas no single comprehensive federal law exists in the US for instance, regulating the collection and use of personal data, European states have adopted an extensive regulatory framework on the issue. The European Court of Human Rights in Strasbourg has repeatedly confirmed that information about a person’s health is an important element of one’s private life. Accordingly, processing of health information is an interference with the right to privacy, which may however be justified with a reference to public interests such as scientific research, subject to certain legal requirements. Finding a fair balance between the competing public and private interests is a complicated task. A case study will be made of Iceland, where the European treaties and regulations on protection of personal data have been implemented into domestic law. The Icelandic courts have resolved questions related to processing of health data and violations of privacy, and inter alia declared unconstitutional, legislation on the establishment of a centralised health sector database. This illustrates how legislation, accompanied with effective individual access to the courts, may offer legal reliefs to individuals claiming violation of their right to privacy.

The notionof privacy has longhad a central rolein human rights law, not least in connection to health and medicine.International, regional and national bodies have enacted a number of binding and non-binding document for physicians and researchers to adhere to, in order to protect the autonomy, dignity and privacy of patients and research subjects. With the development of new technologies, the right to privacy has gained a new perspective; the right to protection of personal data with in information and communication technologies. The right to data protection has been attributed an increasing importance within EU law. Accordingly, the use of health data in medical research in general and in biobankrelated medical research in particular, has made data protection law highly relevant. In medical research involving biobanks, transferring human biological samples and/or individual health data is taking place on a daily basis.These transfers involve several oversight bodies, institutional review boards (IRBs), research ethics committees, or even data protection authorities. This article investigates the role of these national oversight bodies in the transfer of health data in cross border research, from an EU law point of view. A special focus is laid on transfer of health data for research purposes from the EU to the US, in the light of the recently enacted EU US Privacy Shield.The main question posed is how American oversight bodies for medical research can be expected to handle the increasingly strict EU requirements for the processing of health data in medical research review. B3Africa

Hungary’s special approach to political and social questions is frequently analysed by the media. Taking a closer look at the details of the privacy regulations, we can also identify several unique features. For Hungary, the era of socialism ended with the proclamation of the new Republic of Hungary on 23rd October, 1989. The substantially renewed constitution was entered into force on the same day. The fundamental rights defined in the European Convention of Human Rights were included in it and, in addition, the right to the protection of personal data. The main characteristic of the legal system is that politicians understand the constitution so that it would always require passing a new law whenever they want a public authority to collect personal data for some purpose. By now, Hungary has several hundred laws and decrees in effect on the obligatory collection and transfer of personal data. The nature of such types of regulation ab ovo excludes the possibility of objection and challenging a regulation before the court. Turning our attention to healthcare, we see that medical authorities and researchers are authorized by the law to collect personal medical data without providing information and the right to object to data subjects. The author has been studying the changes in the medical privacy regulations since 2004. Here, he gives an account of the key characteristics of the Hungarian legislation and provides a comparison with the relevant European Union legislation in relation to medical data. When the EU General Data Protection Regulation came into force, the conflict between the two became obvious. This paper gives the reader an expert’s view of the Hungarian data protection policy, while attempting to pave the way to stimulate social debate concerning the necessity for better, and more privacy aware legislation.

The ‘globalisation’ of Council of Europe data protection Convention 108 through non-European accessions has continued steadily, with eight such accessions since the first in 2013. The ‘modernisation’ of the Convention was completed on 10 October 2018 when the amending protocol for the new ‘Convention 108+’ became open for signature. Any new countries from outside Europe wishing to accede will have to accede to both Convention 108 and the amending Protocol (ie to 108+). The standards required of the laws of acceding countries by 108+ are higher than those required by 108, and are arguably mid-way between 108 and those of the European Union's General Data Protection Regulation (GDPR). This article examines to what extent each of the 26 ‘countries’ (separate jurisdictions) in Asia are likely to be able to accede to 108+, if they wish to. As yet, none have acceded to 108. It proposes an efficient way to consider such a question across such a complex set of jurisdictions. Fifteen of the 26 Asian countries already have data privacy laws, and two others have official Bills for such laws. An assessment of the prospects for accession can be done by considering in order the following grounds which may be impediments to accession: Jurisdictions which are not States; States which are not democratic; Laws of inadequate scope; Laws lacking an independent data protection authority; Laws with substantive provisions falling short of 108+ ‘accession standards’; States with proposed Bills only; and States with no relevant laws or proposed Bills. The most difficult step in this procedure is in deciding which of the substantive provisions of 108+ constitute its ‘accession standards’, or elements essential for accession to be invited. Neither the Convention, nor the guidelines issued by its Consultative Committee, shed much light on this question. However, previous practice under Convention 108, show there is some flexibility involved. The article concludes with suggestions as to how such flexibility can be made more transparent, and observations on which Asian countries, in light of the seven step assessment carried out in the article, are the most likely candidates to be able to accede to 108+, in both the short and medium terms.

Indonesia’s draft Law on the Protection of Personal Data was submitted by the President to the House of Representatives in January 2020. Although the responsible Minister stated that he expected the Bill would be the first legislation to be enacted in 2020, Indonesian experts soon expect delays as a result of the COVID-19 pandemic, and so it has eventuated, with parliamentary consideration continuing a year later. This article analyses the Bill in the context of other Asian data privacy laws and the EU’s General Data Protection Regulation (GDPR). The most striking aspect of the Bill is that it fails to include what is generally considered to be the essential element of a data privacy law: a separate, specialised (and usually independent) data protection authority (DPA). Instead, all enforcement powers are in the hands of the Minister of Communication and Information. There have been quite a few earlier versions of a data privacy Bill drafted by the Indonesian government, but all have involved a specialised DPA. In a recent version, the Public Information Commission was going to act as the DPA, a combination of data privacy responsibilities with Freedom of Information/Right to Information (FOI/RTI) responsibilities. Otherwise, there are many aspects of the Bill with similarities to the GDPR. Its obligations apply comprehensively, to individuals, corporations, public agencies and other institutions, and it has extra-territorial scope. Processing of personal data may only occur if it has a legitimate basis. Indonesia has adopted the term ‘personal data owner’, and gives such ‘owners’ eight types of rights with GDPR influences. Seventeen GDPR-influenced types of obligations apply to data controllers. The Bill allows exports of personal data from Indonesia in four situations, one of which involves a ‘white list’ of countries with a level of data protection to or higher than Indonesia’s law. The Bill makes a wide range of enforcement measures possible, including administrative fines and compensation, but the are all largely at the discretion of actions by the Minister, with the risk that inadequate enforcement will mean that the Bill will be ignored by both data controllers and data owners. The article concludes that Indonesia is trading influence for irrelevance, by abandoning the inclusion of a separate DPA. It could have had one of the strongest and most influential laws in Asia, but the absence of a data protection authority will mean that it does not.

This paper builds on the general survey of post-mortem privacy set out in the author’s earlier work. The concept of post-mortem privacy is further developed both at a theoretical level (underpinned by theories of autonomy) and a doctrinal level (considering concepts such as testamentary freedom, and the protection of personal data). Finally, the paper looks at some current developments of technology (tech solutions for the protection of post-mortem privacy) and law/policy (work done by the US Uniform Law Commission on the Uniform Fiduciary Access to Digital Assets Act – UFADAA). The argument is that both of these regulatory modalities provide examples and illustrations of how post-mortem privacy can be recognised practically, especially in the online environment. The paper is, therefore, setting the scene further in this under-explored area, also aiming to set the basis for the author’s subsequent empirical research (attitudes towards post-mortem privacy, quantitative and qualitative).

Summary There are increasing threats to healthcare data protection in the United States. Most federal data privacy laws apply only to specific sectors, such as healthcare, education, communications, or financial services. In the absence of comprehensive data protection legislation there are multiple, sectoral approaches. These privacy laws are noticeably limited in their vertical scope, preferring downstream protections such as confidentiality, security, and breach notification. Hardly any US laws contain upstream requirements that minimize or otherwise limit data collection. The imminent “EU General Data Protection Regulation” (GDPR) is considerably more comprehensive. Horizontally, it applies to all sectors of the economy, all broadly defined “personal data,” and all who control or process data. Vertically, it applies protective standards throughout the lifespan of data. In the US, the primary federal law applying to healthcare data comprises of regulations known as the “HIPAA Privacy and Security Rules.” The HIPAA rules provide considerably weaker protection than the GDPR, although they are far stronger that the protections applicable to other commercial sectors in the US HIPAA has relatively narrow scope, essentially only applying to data held by traditional healthcare providers and applying only downstream protections; confidentiality, security, and breach notification. Notwithstanding its weaknesses, the HIPAA rules are quite detailed and generally well enforced. Thus, HIPAA has created expectations in patients that all their healthcare data are safe. This is no longer the case, either within the HIPAA “zone” or outside of it. First, traditional providers have almost completed their transition from paper to electronic health records, during which they swap the protections inherent in unconnected file rooms for far riskier computerized longitudinal databases. Second, multiple parties outside of healthcare view healthcare data by as having great value; “big data” brokers collect healthcare data or medically-inflected data for their predictive analytics products, while cybercriminals long since have recognized the profit in stealing health records. Third, consumer electronics companies continue to disrupt healthcare data markets (and data protection) by encouraging consumers to themselves collect and curate data from mobile health apps, wearable devices and the “internet of things.” These challenges to healthcare data protection highlight the fundamental flaws of domain-limited protections and over-reliance on a limited set of protective models. The former because disruptive businesses and technological innovations can make a nonsense of narrowly-defined sectoral protections. The latter because policymakers need a broader array of tools to combat modern challenges while reliance on downstream models intrinsically concedes the correctness of unregulated data collection. The outlook for US healthcare data protection is increasingly bleak. In the aftermath of the 2016 US election, it is quite likely that HIPAA rules will be enforced with less enthusiasm, encouraging an increase in data leaks from the health care system. Further, those victorious in the election are no friends of pro-privacy regulatory agencies and some of their data protection activities may be reined in. It is also extremely unlikely that comprehensive privacy legislation will be passed by the incoming administration. Yet, technological progress and consumer choice almost inevitably will result in increasing amounts of healthcare data being created and processed outside the HIPAA-protected zone. Not surprisingly therefore, healthcare data protection in the US faces a perilous future and one that increasingly will be at odds with the protections offered by its trading partners.

Summary This article outlines the need for, and possible solutions to the problem of third parties’ legally untrammelled ability to collect and use identified or identifiable personal, sometimes very sensitive, health data. A solution would be implementation of a comprehensive legal framework – from international treaties through national legislation to operationalising data privacy and ethics by design at the level computer software (algorithmic) instructions. At least since the last decade of the twentieth century, digitisation of health data and creation of national electronic health records infrastructure has held the promise of enabling the attainment of such public health goals as personal health management, health care delivery, health-related research, and population health surveillance. Great advances in Big Data technology, and even more so, the algorithmic revolution, has facilitated these four goals, though not necessarily in the ways envisaged by scholars and policy-makers of the time. Thus, personal health management is supported by apps such as Apple Health; telemedicine and teleradiology systems enable health care delivery to patients wherever they are located. Health-related medical, commercial, socio-economic and socio-political research based on Big Data is booming, while national electronic health record systems allow national and international agencies to track and scrutinize health of individuals and populations. However, unregulated and rampant “datafication” of identified or identifiable personal health information about individuals collected, managed, and disseminated without their knowledge and informed consent effectively treats data subjects – us – as mere means to an end. The law has been lagging a long way behind technical and commercial development, yet it is possible to safeguard privacy and other fundamental rights of data subjects. For example, as part of the European Union's Digital Single Market Strategy, the European Parliament adopted Regulation (EU) 2016/679 on the “protection of natural persons with regard to the processing of personal data and on the free movement of such data”, and the Directive (EU) 2016/680 on the “protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data”. The Regulation shall apply, and the Directive will enter into force (requiring EU Member States to transpose it into their national law) in May 2018. In the United Kingdom, the Investigative Powers Act (UK) 2016 has systemically incorporated approach to statutory controls in form of proportionality and necessity tests on powers that national security and law enforcement agencies must intercept, communications, access, collect and manage massive volumes of data (known as “bulk powers”). These controls aim to create privacy safeguards for intentionally or inadvertently targeted individuals. Thus, the law seems to be “awakening”. However, a comprehensive and systematic regulatory framework of controls and protections is yet to be postulated. This article outlines an approach consisting of vertical tiers that can be implemented separately or in total. The article has two parts. The first part provides background to the interface between developments in technology and unconsented to “datafication” of our personal health from which, unbeknown to us, third party algorithms create our digital identity. The second part outlines proposal that envisages a five-tier legal framework for protection of identifiable personal health data. Protections at each tier would be discrete yet capable of integration. At the base – the design level – it possible for software engineers and computer programmers to specify precisely defined algorithmic instructions for processing personal data in accordance with privacy laws and ethical standards. At the next level – data operators and/or analysts (whether human or an automated algorithmic program) – legal tests of proportionality and necessity and ethical conduct could be implemented by legislation and embedded in the algorithm design. At the third level – individuals and organizations storing and using the data – responsibility for its integrity and security as well as privacy and ethics could be governed by legislation. At the top level, international treaties could provide for uniform standards and approach.

The article aims to analyse the evolution of the EU data protection legislation against the rule of law standards related to quality of law, formal justice and protection of human rights, focusing on some recent controversial issues related to the application of EU data protection model to technological environment. The analysis looks into the concepts of data controller and data processor as they are essential for the allocation of responsibilities in the processing of personal data as well as for the identification of applicable legislation. Further it considers the right to be forgotten and the implementation of the balance test in cases when there are opposing rights and legitimate interests of the data subject and data controller. The analysis is made on the basis of the EU data protection legislation, that is currently in force, the Opinions of the Article 29 Working Party and the case law of the Court of Justice of the EU (CJEU), which provides guidance on the uniform interpretation of the data protection concepts at EU level. The article also takes in consideration the current reform in the field of data protection in the frames of which in 2016 the new General Data Protection Regulation has been adopted.

EU data protection law has, to date, been monitored and enforced in a decentralised way by independent supervisory authorities in each Member State. While the independence of these supervisory authorities is an essential element of EU data protection law, this decentralised governance structure has led to competing claims from supervisory authorities regarding the national law applicable to a data processing operation and the national authority responsible for enforcing the data protection rules. These competing claims – evident in investigations conducted into the data protection compliance of Google and Facebook – jeopardise the objectives of the EU data protection regime. The new General Data Protection Regulation will revolutionise data protection governance by providing for a centralised decision-making body, the European Data Protection Board. While this agency will ensure the ‘Europeanisation’ of data protection law, given the nature and the extent of this Board’s powers, it marks another significant shift in the EU’s agency-creating process and must, therefore, also be considered in its broader EU context.

The regulatory environment of the Russian Federation is attracting increasing interest due to its recent focus on the aspects of data protection and the Internet governance. Starting from 2006, a comprehensive regulation of the information issues in Russia began to emerge, having immediate practical effect not only on national parties, but also – due to developments in approaches to jurisdiction – to parties acting in digital environment internationally. The purpose of the research is to consider ‘narrow’ approach to the legal definition of personal data (as the trigger of personal data legislation) in the regulatory environment of the Russian Federation in the context of regulation of informational and telecommunication technologies with a particular focus on ‘Big Data’. The problem considered implies the balance between the principle of formal certainty of legal norms, on the one hand, and technological developments, on the other. The formal definition of personal data shall be interpreted uniformly to ensure consistent and predictable application of law which appears not reliably possible at the moment, although the Russian definition of personal data corresponds to the CETS Convention No. 108 which Russia is a party to. As the analysis of the Russian court practice shows, the courts are applying the broad definition interpreting it as if it has at least two additional criteria: that a set of data should be enough to identify an individual and that only a set of data in possession of a particular operator should be considered. It is suggested that these criteria find reflection in “surgical” amendments to the legislation, and the United Kingdom's Data Protection Act, 1998 can serve as a source of adoption in terms of comparative law. Furthermore, the article discusses whether the ‘narrow’ approach may be viewed as contributing to privacy protection in the age of Big Data, rather than lowering barriers of privacy. The authors explain that the ‘narrow’ approach may be considered positive in this aspect because it allows keeping the existing general privacy regulation workable in a reasonably predictable manner. Besides, the research may serve as an introductory material into the Russian data protection legislation.

The right to personal data protection is, without doubt, an important right in the jurisprudence of rights in the contemporary information society. It is becoming as crucial as other orthodox human rights and also attracting significant attention from academics, lawyers, human rights activists and policy makers. In spite of the growing attention data protection receives at international and regional levels, Nigeria is still lagging behind many competitor states like South Africa in establishing an effective legal framework to protect personal data. Individuals’ personal data is being collected and used without any serious form of control to check against abuse. This paper reflects on opportunities, option and challenges to legal reforms on data protection in Nigeria. It contends that certain legislative and practical challenges stand in the way of an effective legal regime on personal data protection. The paper suggests appropriate legal reforms that are needed to enable prevent the increasing risks of violating the right to data protection in a country that is making rapid advances in Information and Communication Technology but hamstrung by an outdated regulatory framework.

In Big Data, the application of sophisticated data analytics to very large datasets makes it possible to infer or derive (“to discover”) additional personal information about consumers that would otherwise not be known from examining the underlying data. The discovery and use of this type of personal information for consumer profiling raises significant information privacy concerns, challenging privacy regulators around the globe. This article finds appropriate privacy principles to protect consumers' privacy in this context. It draws insights from a comparative law study of information privacy laws in the United States and Australia. It examines draft consumer privacy legislation from the United States to reveal its strengths and weaknesses in terms of addressing the significant privacy concerns that relate to Big Data's discovery of personal data and subsequent profiling by businesses.

This paper integrates and cuts through domains of privacy law and biometrics. Specifically, this paper presents a legal analysis on the use of Automated Facial Recognition Systems (the AFRS) in commercial (retail store) settings within the European Union data protection framework. The AFRS is a typical instance of biometric technologies, where a distributed system of dozens of low-cost cameras uses psychological states, sociodemographic characteristics, and identity recognition algorithms on thousands of passers-by and customers. Current use cases and theoretical possibilities are discussed due to the technology's potential of becoming a substantial privacy issue. First, this paper introduces the AFRS and EU data protection law. This is followed by an analysis of European Data protection law and its application in relation to the use of the AFRS, including requirements concerning data quality and legitimate processing of personal data, which, finally, leads to an overview of measures that traders can take to comply with data protection law, including by means of information, consent, and anonymization.

This article presents results of a survey of primarily, although not exclusively, European drone industry representatives, regulators and civil society organisations that examined privacy, data protection and ethics with respect to civil drone operations. The article provides snapshot information about the diversity of the drone industry, including information about the types of companies, the types of drones being manufactured and operated, their payloads, capabilities and applications. Using self-reported information from industry representatives, it also demonstrates that these stakeholders do not have a clear understanding of European privacy and data protection law, which can impact their levels of liability and protections for individuals on the ground. With respect to regulators and civil society watchdogs, the results demonstrate that law enforcement, commercial and private (or recreational) drone operators are all thought to be associated with significant privacy, data protection and ethical risks, and that recreational operators are thought to carry the highest risks. However, perceptions of high-risk operators vary among different organisations, raising a potential for regulatory fragmentation. The article concludes with a consideration of the implications of these findings for the regulation of privacy, data protection and ethics for civil drone operations.

This short essay introduces papers presented at the symposium Contracting over Privacy, which took place at the Coase-Sandor Institute for Law and Economics at the University of Chicago in fall 2015. The essay highlights a quiet legal transformation whereby the entire area of data privacy law has been subsumed by consumer contract law. It offers a research agenda for privacy law based on the contracting-over-privacy paradigm.

The main legislative instrument for the protection of personal data in the EU is the Data Protection Directive. It has an extremely wide scope because most data that is shared can be classed as personal data and most activities concerning data can be seen as the processing of it. It also covers a large amount of modern communication methods that fall under the protection of the right to freedom of expression and information under Article 11 of the Charter of Fundamental Right of the European Unions. To address the tension between the rights, the Data Protection Directive provides for different mechanisms to balance them. This article departs from the premise that European courts prioritize certain interests in a given social context through this balancing exercise. The purpose of this article is to verify how the Court of Justice of the European Union (CJEU) sets those priorities where the rights to data protection and freedom of expression and information conflict, especially in the context of developing communication technologies.

While privacy online is governed through formal privacy notices, little is known about the impact of privacy notices on trust online. I use a factorial vignette study to examine how the introduction of formal privacy governance (privacy notices) impacts consumer trust and compare the importance of respecting informal privacy norms versus formal privacy notices on consumer trust. The results show that invoking formal privacy notices decreases trust in a website. Further, violating informal privacy norms negatively impacts trust in the website even when the information exchange conforms to or is not mentioned in the privacy notice. The results suggest that respecting privacy norms is key to trust online and challenge the reliance on privacy notices to maintain consumer trust. The consumer, who is the exchange partner most vulnerable to information asymmetries and uncertainty, is not a party to the development of the formal privacy contract and instead relies on informal privacy norms.

Summary: In November 2014, the Consumer Financial Protection Law entered into force in Federation BIH. The basic intention of the legislator was to achieve complete compliance with primary and secondary sources of EU law governing the issue of consumer protection, respectively users of financial services, and in particular with Directive of the European Union 93/13 / EEC from 5th April 1993, with Directive 2005/29 / EC of the European Parliament and of the Council from 11th of May 2005 and Directive 2006/114 / EC of the European Parliament and of the Council from 12th of December 2006. In the respective Act, special attention was paid to prohibiting unfair terms in consumer contracts, misleading commercial practices and the obligation of consistent implementation of good faith principle. The author analyses the actual level of compliance in regard to the relevant regulations of the European Union, and on the basis of empirical experience in the implementation of this law through the entire banking business, analyses the existing regulations and makes proposals for future legislation that will improve the protection of both, consumers and providers of financial services. Special attention in the work is drawn to provisions that have a direct impact on the protection of contracting unfair contract terms.

The European Union's policy on open data aims at generating value through re-use of public sector information, such as mapping data. Open data policies should be applied in full compliance with the principles relating to the protection of personal data of the EU Data Protection Directive. Increased computer power, advancing data mining techniques and the increasing amount of publicly available big data extend the reach of the EU Data Protection Directive to much more data than currently assumed and acted upon. Especially mapping data are a key factor to identify individual data subjects and consequently subject to the EU Data Protection Directive and the recently approved EU General Data Protection Regulation. This could in effect obstruct the implementation of open data policies in the EU. The very hungry data protection legislation results in a need to rethink either the concept of personal data or the conditions for use of mapping data that are considered personal data.

The proposal for a new European Data Protection Regulation introduces the novel obligation of performing data protection assessments. Since these assessments will become a mandatory exercise for those in control of data processing systems, they will become an important apparatus for the governance of new and emerging information technologies. This tool, and in particular the notion of “risks to the rights and freedoms of data subjects” which is at its core, epitomises the shift from classical legal practice to more risk-based approaches. Merging risks and rights in the proposed fashion could change their meanings into something hardly predictable. This contribution proposes to explore the nature of the relation between both concepts within the assessment of a “risk to a right”. It will start by mapping out the various relations that exist between risks and rights in different practices. This should serve to identify gaps in the way DPIAs are currently operationalised and might well determine whether the introduction of this methodology in its current form might itself pose a risk to the rights of privacy and data protection. In turn however, it can provide opportunities for improvement and for lessons to be drawn from other practices and expertise that strike different relations between risks and rights, like the ones found in environmental governance and courts.

In the big data era, new technologies and powerful analytics make it possible to collect and analyse large amounts of data in order to identify patterns in the behaviour of groups, communities and even entire countries. Existing case law and regulations are inadequate to address the potential risks and issues related to this change of paradigm in social investigation. This is due to the fact that both the right to privacy and the more recent right to data protection are protected as individual rights. The social dimension of these rights has been taken into account by courts and policymakers in various countries. Nevertheless, the rights holder has always been the data subject and the rights related to informational privacy have mainly been exercised by individuals. This atomistic approach shows its limits in the existing context of mass predictive analysis, where the larger scale of data processing and the deeper analysis of information make it necessary to consider another layer, which is different from individual rights. This new layer is represented by the collective dimension of data protection, which protects groups of persons from the potential harms of discriminatory and invasive forms of data processing. On the basis of the distinction between individual, group and collective dimensions of privacy and data protection, the author outlines the main elements that characterise the collective dimension of these rights and the representation of the underlying interests.

Given global concern over the increasing conflict between “informational privacy” and protection of online communication, this article examines the post– Google Spain impact on the right to be forgotten in the European Union and its worldwide impact.

Thailand’s Personal Data Protection Act of 2019 may become one of the strongest data privacy laws in Asia. It is much stronger than the previous Bill, both in terms of its principles and its enforcement. However, the picture will not be complete until the many rules that can be made by its data protection authority (the PDPC), and any Royal Decrees granting exemptions, are developed. The main significance of the Thai law is that it is the first explicitly ‘GDPR-based’ law to yet be enacted in Asia, ahead of the GDPR-informed draft Bills in India and Indonesia, While not all of the innovations of the EU GDPR’s data protection principles are included in the PDPA, a substantial set are included. Following the Thai 2019 elections, the EU is again willing to re-commence negotiations on a free trade agreement (FTA) with Thailand and is its third-largest trading partner. For businesses operating in Thailand, this Act imposes serious obligations, but to assess their full extent they will need to obtain much further information which is not yet available. For data subjects the PDPA creates serious rights and remedies not previously available, and the Act overall is a major step forward. From the perspective of Civil Society, the complex administrative and enforcement structure of the Act raises difficulties in determining who could be held responsible for effective enforcement. The potential scope of exemptions are also of great concern. The enforcement mechanisms in the Act are all much stronger than in the previous Bill. Rights of appeal against administrative fines and other decisions of the PDPC or its expert Committees, and in criminal prosecutions, might benefit from some further clarity. All of these matters are examined in detail in this article.

In the early 1970s, Congress considered enacting comprehensive privacy legislation, but it was unable to do so. In 1974, it passed the Privacy Act, applicable only to information in the possession of the federal government. In the intervening years, other information privacy laws enacted by Congress, such as the Health Insurance Portability and Accountability Act, have been weak and sector specific. With the explosion of information technology and the growing concerns about an absence of effective federal privacy laws, the legal focus has shifted to the states. Signaling a new direction in state data privacy and consumer protection law, the California Consumer Privacy Act establishes important rights and protections for California residents with regard to the collection, use, disclosure, and sale of their personal information. The CCPA is certain to spur similar legislation and to affect national and international businesses that collect data from California's residents. Understanding the new law is important for all data-driven industries, including health care.

This article was originally presented at the 7th International Conference on Information Law and Ethics (ICIL) that was held at the University of Pretoria, South Africa on 22-23 February 2016.

There is already evidence that “governmental mass surveillance emerges as a dangerous habit”. Despite the serious interests at stake, we are far from fully comprehending the ramifications of the systematic and pervasive violation of privacy online. This article underscores the reasons that policy-makers and lawyers must comprehend and value privacy not only as a human rights issue, but also as a fundamental technical property for the well-functioning of the Internet. The analysis makes two main arguments. First, it argues that the effective protection of online privacy cannot be thought of only in terms of compliance with legal frameworks but that – in practice - it also needs to be secured through technological means, such as privacy enhancing technologies and, most importantly, Privacy by Design. Recent developments in the standardization work of the Internet Advisory Board and the Internet Engineering Task Force suggest a paradigm shift with respect to integrating Privacy by Design into the core Internet protocols. The consideration of privacy as a requirement in the design of the Internet will have a significant impact on reducing states’ capability to conduct mass surveillance and on protecting the privacy of global end-users. Second, the article argues that Internet standards should not be seen as “living a parallel life” to, or as displacing or merely complementing, international human rights law. Technical standards and international law can actively inform one another. The analysis and findings demonstrate how the technical perspective on privacy can inform and enrich policy-making and legal reasoning.

Every person has the right to privacy and protection of personal data and these rights may be restricted only in order to protect the general interest or the preservation of important values in society. If there is a certain degree of suspicion that a person committed a criminal offense, the competent authorities are authorized to limit his/her privacy rights and to collect and process personal data for the purposes of criminal proceedings, by taking certain actions and measures in accordance with the law. On the basis of legal authorization certain subjects may take regular and special evidentiary actions and measures, but possible privacy infringement and data collection should be limited to the extent necessary to suppress a specific criminal offense in accordance with the principle of proportionality. It is necessary and useful to apply the methods and techniques of information technology in order to detect and prove criminal offenses. However, uncritical regulation and voluntary application of advanced methods and techniques of surveillance and monitoring of user’s activities (whose daily activities increasingly rely on information technology) would create a real risk of expanding and deepening the scope of spheres of life to be monitored to a much greater extent than legitimate monitoring within the concept of pro­activity and creation of a complete and panoptic surveillance of personal data. This could not be justified by the needs to oppose even the most severe forms of criminal offenses. Thus, actions and measures based on the use of these techniques and methods should be laid down and applied in accordance with the principles of specificity, necessity and proportionality, and with control of the judicial authorities, so the right to privacy would not be jeopardized. It is necessary to find a proper balance between the needs of criminal proceedings and respect for human rights, with regard to regulating powers of investigative bodies in collecting data of individuals. In online environment, the protection of the right to legal personality and the right to free development of personality through the right to privacy as well as the protection of personal data are necessary to be provided by legal regulations containing even stricter and more precise rules (comparing to offline environment) that determine the scope of powers of the authorities to collect evidence for the purposes of criminal proceedings, because certain actions or measures can greatly interfere with the private sphere of individuals in the direction of a complete privacy annulment.

The article introduces the theme of the protection of the right to privacy in a world characterized by rapid developments in digital technology and the need to fight terrorism. It identifies the challenges that surveillance policies raise on privacy and data protection and explains how the contributions to the Special Issue connect to the ongoing legal and policy debate in the field of European and comparative constitutional law.

The tensions between transnational data exchange by police authorities as well as intelligence agencies on the one hand and the need for data privacy on the other hand are increasing. The European Union follows an ambivalent approach intensifying data exchange as well as reforming data protection in the context of police and judicial cooperation in criminal matters. Based on eu constitutional law, the cjeu defends privacy rights in the eu. Beyond the European perspective, the paper argues based on a comparison of data privacy in the eu, us and Australia in favour of the establishment and strengthening of international data privacy rights. A more detailed concept of international digital rights would be necessary to address all different issues of data privacy in the context of trans-border surveillance. While intelligence agencies and police cooperation are already linked on a global level, the protection of data privacy is not organized on an international level in an equivalent way.

How can we limit the amount of data distribution for both security and privacy? Let's encourage organizations to push for a common privacy policy in licenses. Better privacy terms might gain adherents and become important enough for marketing that most vendors adopt them.

The article contextualizes contemporary cyber-surveillance practices in the light of Edward Snowden’s revelations of massive espionage by intelligences services and shows the results of an online survey on the public perceptions of privacy in public telecommunication networks in Slovenia. The results relate to types and frequency of victimization; self-reported study on violating of the privacy of others; concern for the protection of one’s own privacy; perception of those carrying out surveillance; the value of privacy; views on abrogated data retention regulation; and awarness of personal data protection remedies.Despite growing distrust of large internet corporations and – after Edward Snowden’s revelations – Intelligence agencies, the findings indicate a low degree of awareness and care for the protection of personal data. In regard to the perception of primary subjects of surveillance, 56 percent of respondents chose internet corporations as the greatest threat to their privacy, followed by telecommunications companies (25 percent), and shops with loyalty programs (23 percent). According to chi-square and Cramer's coefficient calculations, gender correlation is weak, but men feel more threatened by foreign intelligence services and the Slovene Intelligence and Security Agency. By comparing responses before and after the Datagate affair, we noted that prior to this date, only a handful of people felt threatened by foreign or domestic intelligence agencies. An increased feeling of threat after this date is evident in men as well as women.