Data Protection Legislation

Abstract

Abstract Data protection legislation regulates the acquisition, storage, transfer and processing of personal data of all kinds. The article introduces the key distinction between data security and wider data protection, and further explores the key legal requirements for data protection. The approach to data protection differs between the European Union and the United States. These differences and the rules for transfer of data between different data protection regimes are explained. In both Europe and the United States, personal health data are seen as a particularly sensitive type of data and they are therefore protected more strictly than most other types of data. This has implications for the type of consent needed to collect health data, and the type of anonymisation techniques needed to make them non‐identifiable. Key Concepts The purpose of data protection legislation is to ensure (1) the security of the data, (2) that the acquisition and processing of data is lawful and (3) that the data subjects have an appropriate degree of control over the use of their data. Data acquisition usually requires informed consent from the data subject. There are different rules for the processing of identifiable and non‐identifiable personal data. There are specific protections in relation to sensitive data, including health data. Identifiability is only absent if deductive identification is very difficult. The approach to data protection differs significantly between the European Union and the United States.