Search

The Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR proposed for public consultation (‘the Guidance’) deal with a topic that has long puzzled the data protection community – the identification of international personal data transfers. The General Data Protection Regulation (GDPR) does not define international personal data transfers, though it requires their identification for the application of its transfer rules in Chapter V. It is therefore principally to be welcomed that the European Data Protection Board (EDPB) has tried to address the legal uncertainty stemming from the absence of a clear concept of international personal data transfer, especially in relation to the territorial scope of the GDPR regulated in Article 3. However, as legal researchers active in this area,1 we would nevertheless like to raise three areas to the attention of the EDPB that in our opinion are not sufficiently considered in the guidelines and should be addressed in the revised version after the public consultation. These are: i) the level of detail of the definition of ‘data transfer’ provided, ii) the potential inconsistency for the application of the GDPR by excluding from the definition of a transfer direct transmissions of personal data from an individual residing in the European Economic Area (EEA) to entities outside of it (‘direct transmission from the data subjects’), and iii) measures to ensure the protection of individuals is not undermined when Chapter V is not applicable in the latter situation.

During the last decade, managed runtime systems have been constantly evolving to become capable of exploiting underlying hardware accelerators, such as GPUs and FPGAs. Regardless of the programming language and their corresponding runtime systems, the majority of the work has been focusing on the compiler front trying to tackle the challenging task of how to enable just-in-time compilation and execution of arbitrary code segments on various accelerators. Besides this challenging task, another important aspect that defines both functional correctness and performance of managed runtime systems is that of automatic memory management. Although automatic memory management improves productivity by abstracting away memory allocation and maintenance, it hinders the capability of using specific memory regions, such as pinned memory, in order to perform data transfer times between the CPU and hardware accelerators. In this paper, we introduce and evaluate a series of memory optimizations specifically tailored for heterogeneous managed runtime systems. In particular, we propose: (i) transparent and automatic "parallel batch processing" for overlapping data transfers and computation between the host and hardware accelerators in order to enable pipeline parallelism, and (ii) "off-heap pinned memory" in combination with parallel batch processing in order to increase the performance of data transfers without posing any on-heap overheads. These two techniques have been implemented in the context of the state-of-the-art open-source TornadoVM and their combination can lead up to 2.5x end-to-end performance speedup against sequential batch processing.

During the last decade, managed runtime systems have been constantly evolving to become capable of exploiting underlying hardware accelerators, such as GPUs and FPGAs. Regardless of the programming language and their corresponding runtime systems, the majority of the work has been focusing on the compiler front trying to tackle the challenging task of how to enable just-in-time compilation and execution of arbitrary code segments on various accelerators. Besides this challenging task, another important aspect that defines both functional correctness and performance of managed runtime systems is that of automatic memory management. Although automatic memory management improves productivity by abstracting away memory allocation and maintenance, it hinders the capability of using specific memory regions, such as pinned memory, in order to perform data transfer times between the CPU and hardware accelerators.In this paper, we introduce and evaluate a series of memory optimizations specifically tailored for heterogeneous managed runtime systems. In particular, we propose: (i) transparent and automatic ''parallel batch processing'' for overlapping data transfers and computation between the host and hardware accelerators in order to enable pipeline parallelism, and (ii) ''off-heap pinned memory'' in combination with parallel batch processing in order to increase the performance of data transfers without posing any on-heap overheads. These two techniques have been implemented in the context of the state-of-the-art open-source TornadoVM and their combination can lead up to 2.5x end-to-end performance speedup against sequential batch processing.

The present report is part of a study analysing the implications for the work of the European Union (EU) / European Economic Area (EEA) data protection supervisory authorities (SAs) in relation to transfers of personal data to third countries after the Court of Justice of the European Union (CJEU) judgment C- 311/18 on Data Protection Commissioner v. Facebook Ireland Ltd, Maximilian Schrems (Schrems II)1. Data controllers and processors may transfer personal data to third countries or international organisations only if the controller or processor has provided appropriate safeguards, and on the condition that enforceable data subject rights and effective legal remedies for data subjects are available. Whereas it is the primary responsibility of data exporters and data importers to assess that the legislation of the country of destination enables the data importer to comply with any of the appropriate safeguards, SAs will play a key role when issuing further decisions on transfers to third countries. Hence, this report provides the European Data Protection Board (EDPB) and the SAs in the EEA/EU with information on the legislation and practice in China, India and Russia on their governments’ access to personal data processed by economic operators. The report contains an overview of the relevant information in order for the SAs to assess whether and to what extent legislation and practices in the abovementioned countries imply massive and/or indiscriminate access to personal data processed by economic operators. ispartof: Legal study on Government access to data in third countries status: Published online

International audience; This study, which focuses on the commercial use of personal data by U.S. airlines, uses actual cases to help analyze the application of the EU General Data Protection Regulation (GDPR) to the airline industry. It is one of the first studies to do so, and as such contributes to the literature. It begins by highlighting the British Airways GDPR penalty case, in which the UK regulator publicized its notice of intention to issue the highest administrative fine to-date under the GDPR. When the GDPR applies to them, airlines should become fully aware of key provisions of the GDPR, starting with those related to its scope and its underlying data protection principles, discussed in this study. In addition, airlines must have a legal basis to process personal data under the GDPR and, as this study shows, must have adequately prepared for data subject requests to exercise rights and potential data breaches.Several examples of the first GDPR sanctions in the airline industry are detailed, and lessons drawn. In this context, security of data is a key element. Finally, the recent Schrems II decision invalidating the EU-U.S. Privacy Shield Decision is examined, and its potential impact on the transfer of personal data from the European Union to the United States by airlines is studied, following an analysis of their privacy policies available on the Internet in the European Union.

The Court of Justice of the European Union (CJEU) emphasised in the ‘Schrems II’ judgment the importance of ensuring ‘effective and enforceable rights and effective administrative and judicial redress’ for data subjects whenever personal data about them are transferred to third countries. The availability of ‘(e)nforceable data subject rights and effective legal remedies for data subjects’ is actually a necessary condition for data exporters to rely on any transfer mechanisms under Article 46 of the General Data Protection Regulation (GDPR). Data subject rights and remedies, however, can only be effectively available to individuals if the data subjects are aware of the existence of such rights and remedies, and if they know how to exercise them. The CJEU has previously stressed that information about data processing directly affects the exercise of data subject rights, and that information obligations imposed on data controllers – beyond being directly connected to the principle of transparency – are also necessary to comply with the principle of fairness

In this document we provide a series of recommendations regarding the wording of the proposed Commission Implementing Decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council and its Annex. Concretely, we focus on recommendations for the proposed Annex (Annex to the Commission Implementing Decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council), referring when relevant to the Implementing Decision.

The race to create local cloud solutions has become a constant in the digital development programs of member States. Italy is promoting the establishment of the so-called "national cloud", and Germany and France have been working for some time on the Gaia-X project. At European level, the development of cloud computing is taking a strategic role, at least for the immediate future. The declared objective is to free us from solutions that today are almost entirely dependent on infrastructures made available by international providers. Contributing to the debate - more by superimposition than composition - there are broadly geopolitical motivations, aspirations to global technological predominance and concerns associated with personal data protection for third party interference due to the extraterritorial application of foreign legislation. The recent "Schrems II" ruling by the Court of Justice of the European Union, and previously, but with less impact in the broader public, the results of the joint EDPB (European Data Protection Board)-EDPS (European Data Protection Supervisor) study on the United States' Cloud Act, have forced the question of the international acquisition of personal data flows (and non-personal, we may add) and the associated assurances. This paper intends to offer an analysis of the subject, aimed above all at unravelling the multiple levels of the questions raised, which touch not only on legal but on political matters and give an initial, reasoned census of the various bodies of applicable law. Above and beyond hard-hitting declarations, we need to determine to what point the independence of a local European cloud is effectively possible or desirable compared to non-EU providers and, in more concrete terms, to what point an autonomous solution is economically and technically practicable in terms of services that are essential for the States, and that enable the exercise of other fundamental rights and freedoms, for individuals, and therefore must not be susceptible to impairment or interruption. We also have to understand to what point it would be opportune in terms of security, even if this, at first glance, may seem counter-intuitive. In this sense, at least in the overall assessment, we have to consider the high levels of service stability and the existence of high-tech measures to contrast cybercrime that the major international providers can ensure, levels it would be inadvisable to forgo if it were possible to keep the benefits, thereby significantly reducing the associated risks. Indeed, the protection of processed data from external interference must also be measured on a different, but nonetheless significant, level to that of any potential "extraterritorial" threat, represented by criminal activity and security breaches. Another factor that must be considered is the availability of solutions, already entirely actual and "in the hands" of users, which offer immediate protection, such as encryption or the segregation of strategic data sets. In other words, if there are possible measures that significantly reduce the extraterritorial risk and that retain the advantages in terms of contrasting cybercrime, these must be duly included in the overall assessment. Our analysis will also shed light on inconsistencies in terms of data protection within the European Union, and misalignments between national efforts toward localization and the principle of the free circulation of data. In short, we intend to offer a more articulate, less obvious outline of the subjects we are dealing with, which cannot be reduced (if not at the cost of excessive simplification) to the simple contraposition of E.U. versus non-EU, but which reveal lateral synergies and joint misalignments on fronts apparently united; rather, it would be better to think in terms of the creation of a shared ecosystem that draws the most significant advantage from the solutions available today and acknowledges the need to adopt concrete forms of protection. This does not in any way mean evading the serious, but not immediately solvable extraterritorial questions, but preferably using them, if anything, as a mechanism for obtaining a critical reconsideration of the shortcomings and lack of legal harmonization that emerge even within the European Union. Nor does it mean embarking on a path toward domestic solutions that offer little, or at least less protection than those currently available, but instead maintaining high levels of protection against unlawful activity through more advanced technological solutions, and at the same time identifying legal instruments which assure greater national control of the infrastructures and data, and reduce risk to a legally acceptable level.

International audience; Today, cross-border data flows are an important component of international trade and an element of digital service models. However, they are impeded by restrictions on cross-border personal data transfers and data localization legislation. This Article focuses primarily on these complexities and on the impact of the new European Union ("EU") legislation on personal data protection-the GDPR. First, this Article introduces its discussion of these flows by placing them in their economic and geopolitical setting, including a discussion of the results of a lack of international harmonization of law in the area. In this framework, rule overlap and rival standards are relevant. Once this situation is established, this Article turns to an analysis of the legal measures that have filled the gap left by the lack of international regulation and the failure to harmonize law: extraterritorial laws in the European Union (regional legislation) and the United States (state legislation);and data localization laws in China and Russia. Specific provisionsrestricting cross-border personal data transfers are detailed under EU legislation, as are the international agreements that have been invaluable in allowing flows between the United States and the European Union to continue—first the Safe Harbor, and now the Privacy Shield. Finally, in this context, the role of data governance is investigated, both in the context of data controllers’ accountability for the actions of other actors in global supplychains under EU law and under the Privacy Shield. Thus, this Article goes beyond the law itself, to place requirements in the context of the globalized business world of data flows, and to suggest ways that companies may improve their compliance position worldwide.; Aujourd’hui, les flux transfrontaliers de données sont un élément important du commerce international et un élément des modèles de services numériques. Toutefois, elles sont entravées par des restrictions sur les transferts transfrontaliers de données à caractère personnel et la législation sur la localisation des données. Le présent article met principalement l’accent sur ces complexités et sur l’impact de la nouvelle législation de l’Union européenne (UE) sur la protection des données à caractère personnel - le RGPD. Tout d’abord, cet article présente sa discussion sur ces flux en les plaçant dans leur contexte économique et géopolitique, y compris une discussion sur les résultats d’un manque d’harmonisation internationale du droit dans le domaine. Dans ce cadre, le chevauchement des règles et les normes rivales sont pertinents. Une fois cette situation établie, cet article se tourne vers une analyse des mesures juridiques qui ont comblé le vide laissé par l’absence de réglementation internationale et l’absence d’harmonisation du droit : lois extraterritoriales dans l’Union européenne (législation régionale) et les États-Unis (législation des États); et lois sur la localisation des données en Chine et en Russie. Des dispositions spécifiques restreignant les transferts transfrontaliers de données à caractère personnel sont détaillées dans la législation de l’UE, de même que les accords internationaux qui ont été précieux pour permettre aux flux entre les États-Unis et l’Union européenne de continuer, d’abord la sphère de sécurité (Safe Harbor), et maintenant le bouclier de protection de la vie privée (Privacy Shield. Enfin, dans ce contexte, le rôle de la gouvernance des données est étudié, tant dans le contexte de la responsabilité des responsables du traitement pour les actions d’autres acteurs de l’offre mondiale en vertu du droit de l’UE et dans le cadre du Bouclier de protection de la vie privée (Privacy Shield). Ainsi, cet article va au-delà de la loi elle-même, pour placer des exigences dans le contexte du monde des affaires mondialisé des flux de données, et pour suggérer des moyens que les entreprises peuvent améliorer leur position de conformité dans le monde entier.

International audience; Today, cross-border data flows are an important component of international trade and an element of digital service models. However, they are impeded by restrictions on cross-border personal data transfers and data localization legislation. This Article focuses primarily on these complexities and on the impact of the new European Union ("EU") legislation on personal data protection-the GDPR. First, this Article introduces its discussion of these flows by placing them in their economic and geopolitical setting, including a discussion of the results of a lack of international harmonization of law in the area. In this framework, rule overlap and rival standards are relevant. Once this situation is established, this Article turns to an analysis of the legal measures that have filled the gap left by the lack of international regulation and the failure to harmonize law: extraterritorial laws in the European Union (regional legislation) and the United States (state legislation);and data localization laws in China and Russia. Specific provisionsrestricting cross-border personal data transfers are detailed under EU legislation, as are the international agreements that have been invaluable in allowing flows between the United States and the European Union to continue—first the Safe Harbor, and now the Privacy Shield. Finally, in this context, the role of data governance is investigated, both in the context of data controllers’ accountability for the actions of other actors in global supplychains under EU law and under the Privacy Shield. Thus, this Article goes beyond the law itself, to place requirements in the context of the globalized business world of data flows, and to suggest ways that companies may improve their compliance position worldwide.; Aujourd’hui, les flux transfrontaliers de données sont un élément important du commerce international et un élément des modèles de services numériques. Toutefois, elles sont entravées par des restrictions sur les transferts transfrontaliers de données à caractère personnel et la législation sur la localisation des données. Le présent article met principalement l’accent sur ces complexités et sur l’impact de la nouvelle législation de l’Union européenne (UE) sur la protection des données à caractère personnel - le RGPD. Tout d’abord, cet article présente sa discussion sur ces flux en les plaçant dans leur contexte économique et géopolitique, y compris une discussion sur les résultats d’un manque d’harmonisation internationale du droit dans le domaine. Dans ce cadre, le chevauchement des règles et les normes rivales sont pertinents. Une fois cette situation établie, cet article se tourne vers une analyse des mesures juridiques qui ont comblé le vide laissé par l’absence de réglementation internationale et l’absence d’harmonisation du droit : lois extraterritoriales dans l’Union européenne (législation régionale) et les États-Unis (législation des États); et lois sur la localisation des données en Chine et en Russie. Des dispositions spécifiques restreignant les transferts transfrontaliers de données à caractère personnel sont détaillées dans la législation de l’UE, de même que les accords internationaux qui ont été précieux pour permettre aux flux entre les États-Unis et l’Union européenne de continuer, d’abord la sphère de sécurité (Safe Harbor), et maintenant le bouclier de protection de la vie privée (Privacy Shield. Enfin, dans ce contexte, le rôle de la gouvernance des données est étudié, tant dans le contexte de la responsabilité des responsables du traitement pour les actions d’autres acteurs de l’offre mondiale en vertu du droit de l’UE et dans le cadre du Bouclier de protection de la vie privée (Privacy Shield). Ainsi, cet article va au-delà de la loi elle-même, pour placer des exigences dans le contexte du monde des affaires mondialisé des flux de données, et pour suggérer des moyens que les entreprises peuvent améliorer leur position de conformité dans le monde entier.

Our paper compares legislation on data protection and research ethics requirements for health-related data and particularly personalised medicine across seven jurisdictions. Personalised medicine can improve both public and individual health by providing targeted preventative and therapeutic healthcare. For these benefits to be realised, doctors, healthcare providers, and researchers must be encouraged to share patient health data between institutions. Data sharing is an integral part of multisite research, and may require transfer across jurisdictional boundaries. However, whilst data protection, privacy, and research ethics laws protect patient confidentiality, safety, and security, they also may act as impediments to multisite research. This effect is exacerbated when transferring data across jurisdictions due to the divergences in data protection and research ethics laws. Accordingly, we adopt a comparative approach using the concept of data accessibility when examining data protection and research ethics laws in seven jurisdictions. These jurisdictions include Switzerland, Italy, Spain, the United Kingdom (which have implemented the General Data Protection Regulation), the United States, Canada, and Australia. Our paper then identifies the most significant regulatory barriers to the sharing of health-related data for multisite research. According to our research, we identify these barriers as the requirements for consent, the standards for anonymisation or pseudonymisation, and adequacy of protection between jurisdictions. We also identify differences between the European Union and other jurisdictions as a significant barrier for data accessibility in cross jurisdictional multisite research. Our paper then concludes by considering how contractual and organisational solutions can be used to overcome these legislative differences. These solutions include data transfer agreements and organisational collaborations designed to ‘front load’ the process of ethics approval, so that subsequent research protocols are standardised. We also allude to the potential of technical solutions, such as distributed computing, secure multiparty computation and homomorphic encryption., Journal of Law and the Biosciences, 7 (1)

Motivation: As the size of high-throughput DNA sequence datasets continues to grow, the cost of transferring and storing the datasets may prevent their processing in all but the largest data centers or commercial cloud providers. To lower this cost, it should be possible to process only a subset of the original data while still preserving the biological information of interest. Results: Using 4 high-throughput DNA sequence datasets of differing sequencing depth from 2 species as use cases, we demonstrate the effect of processing partial datasets on the number of detected RNA transcripts using an RNA-Seq workflow. We used transcript detection to decide on a cutoff point. We then physically transferred the minimal partial dataset and compared with the transfer of the full dataset, which showed a reduction of approximately 25% in the total transfer time. These results suggest that as sequencing datasets get larger, one way to speed up analysis is to simply transfer the minimal amount of data that still sufficiently detects biological signal. Availability: All results were generated using public datasets from NCBI and publicly available open source software.

The Linac Coherent Light Source (LCLS) located at SLAC National Accelerator Laboratory has been essential to over 1023 publications since 2009. The LCLS produces vast quantities of data - thousands of gigabytes per experiment. The data must be analyzed and stored at large data centers to be available to the world-wide user community. Due to the vast quantities of data flowing through the network, many abnormal data transfers remain unnoticed. This work focuses on identifying network failures that could slow down the data transfer process. This work aims to develop a diagnostic tool to detect when network transfers become anomalously slow. The tool uses an algorithm based on the hampel filter to detect poor performance and alert SLAC administrators to bottlenecks in each phase of the workflow. We will describe our experience of preparing the data and modifying the hampel filter to enhance its effectiveness. We found that applying a heuristic to the algorithm in conjunction with parsing the data along key features improved performance.

Ülkemizde dünyada olduğu gibi evcil hayvan sahiplenme oranı gün geçtikçe artmaktadır. Evcil hayvan sahipleri hayvanlarının sağlıklarını takip etmek için çeşitli araçlar ve yöntemler kullanmaktadırlar. Hayvan sağlığının takibi için kullanılan yöntemlerin başında hayvanın hareketlilik seviyesinin gözlemlenmesi gelmektedir. Hareketlik seviyesinde azalma çoğu hayvan hastalığında ilk ve en belirgin semptomlardandır. Bu çalışmada, evcil hayvanların eylemlerinin otomatik olarak tanınması ve takibi için bir Nesnelerin Interneti sistemi geliştirilmiştir. Sistemde evcil hayvanın tasmasına takılan bir sensör düğüm, bu düğümün topladığı verileri bulut mimarisine aktaran bir mobil uygulama ve bulut mimaride verileri otomatik olarak sınıflandıran ve görselleştiren bir yazılım ve arayüz bulunmaktadır. Elde edilen veriler ile evcil hayvanın bir gün içindeki hareketliliği farklı eylem sınıfları (oturma, yürüme, koşma) gösterilerek belirlenmiştir. Çalışmada denek olarak köpek kullanılmıştır. In our country, as in the world, domestic animal ownership rate is increasing day by day. Pet owners use a variety of tools and methods to monitor their animals' health. One of the most commonly used methods to track animal health is to observe animal activity level. A decrease in animal's activity level is the first and most obvious symptom in most animal diseases. In this study, an IoT system is developed to automatically recognize and track the activities of domestic animals. The system includes a sensor node attached to the pet's collar, a mobile application that transfers the data collected by this sensor node to the cloud architecture, and a software and user interface that automatically classifies and visualizes data in the cloud architecture. With the obtained data, the pet's activities within a day were determined by showing different classes of action (sitting, walking, running). Dogs were used as subjects in the study. Publisher's Version

International audience; —We review the research literature investigating systems in which mobile entities can carry data while they move. These entities can be either mobile by nature (e.g., human beings and animals) or mobile by design (e.g., trains, airplanes, and cars). The movements of such entities equipped with storage capabilities create a communication channel which can help overcome the limitations or the lack of conventional data networks. Common limitations include the mismatch between the capacity offered by these networks and the traffic demand or their limited deployment owing to environmental factors. Application scenarios include offloading traffic off legacy networks for capacity improvement, bridging connectivity gaps, or deploying ad hoc networks in challenging environments for coverage enhancement.

Certification and seals as a form of co-regulation have been on the EU agenda for over a decade. Enhancing consumer trust and promoting transparency and compliance are central arguments in the policy endorsement for certification. In the field of data protection, the General Data Protection Regulation has substanti- ated considerably these policy objectives of the European Commission. Our con- tribution discusses the new legal EU regime for data protection certification. Starting from the background of data protection certification and the preparatory works of the General Data Protection Regulation, the chapter analyses the legal provisions in the new EU data protection framework and reflects on the steps after the Regulation starts to apply.