Automatic Processing Of Personal Data Research Articles

Comparison of the Transformation of some Provisions of the Information Legislation of Russia and the EU in the Context of the Cyber Security Conception

Introduction. The article discusses the legislative framework in the field of information and cyber security in Russia and the European Union, as well as relevant changes to them. The changes in the legislation of the Russian Federation after the adoption on December 30, 2021 No. 441-FZ “On Amendments to Article 15.3 of the Federal Law “On Information, Information Technologies and Information Protection” and Articles 3 and 5 of the Federal Law “On Amendments to Certain Legislative Acts of the Russian Federation”, as well as Council of Europe Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data (T-PD) of 1981, Protocol amending the Convention for the Protection of Individuals with regard to the Processing of Personal Data, adopted by the Committee of Ministers on its 128th session in Elsinore on 18 May 2018. (Convention 108+), 2021 Guidelines for the Protection of Individuals with regard to the Processing of Personal Data by and for Political Campaigns.Materials and methods. The research materials were compiled by the Federal Law of December 30, 2021 No. 441-FZ “On Amending Article 15.3 of the Federal Law “On Information, Information Technologies and Information Protection” and Articles 3 and 5 of the Federal Law “On Amending Certain Legislative Acts of the Russian Federation ”, Federal Law of July 27, 2006 No. 152 “On Personal Data”, Federal Law “On measures of influence on persons involved in violations of fundamental human rights and freedoms, rights and freedoms of citizens of the Russian Federation” of December 28, 2012 No. 272, Federal Law “On Fundamental Guarantees of Electoral Rights and the Right to Participate in a Referendum of Citizens of the Russian Federation” No. 67-FZ of June 12, 2002, 108 of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (T-PD), Convention 108+ and the Guidelines on the Protection of Individuals with regard to the Processing of Personal Data by and for Political Campaigns 2021. The methodological basis of the study was the following general scientific and special methods of cognition of legal phenomena and processes in the field of personal data protection: the method of system-structural analysis; method of synthesis of social and legal phenomena; comparative legal method; formal-logical method.Results of the study. The Russian Federation implements many of the provisions of the Guidelines for the Protection of Individuals with regard to the processing of personal data. However, there are those proposals that are not reflected in Russian laws. In addition, the Guidelines for the Protection of Individuals with regard to the processing of personal data actually allow organizations to transfer data to social networks for advertising, which in Russia can be regarded as a violation of the law.Discussion and conclusion. At the moment, uncertainty remains in connection with the cooperation between Russia and European countries and Russia's withdrawal from the Council of Europe, the ECtHR and the HRC. In the near future, Russia will determine the list of European conventions that no longer meet its national interests, and denounce them. If Convention 108 is not included in this list, then Russia will be able to remain a party to the Convention and, consequently, to related documents. But still, even if the Convention under consideration and related documents are denounced, some of its positive practices can be adapted by Russian legislators and reflected in the Russian Federal Law in a slightly modified form.

LEGAL ENVIRONMENT OF HUMAN RIGHTS IN THE CONDITIONS OF DEVELOPMENT OF SOCIAL NETWORKS

This article is devoted to the consideration of the components of the legal provision ofhuman rights in the development of social networks. The issue of the legal status of persons –participants of Internet communication is considered. Such rights include: the right to association;the right to freedom of thought and speech; information rights related to the dissemination,transmission, receipt and use of information. Also, this article covers the issue of illegalmanifestations that entail violations of legal rights and interests. For an individual user, this isillegal access to personal data, disclosure of confidential information; defamation; copyrightinfringement; fraud, misuse of bank data, etc. Covers the security of personal data of users ofsocial networks. The main legal act in force today in the field of personal data protection onthe Internet is the Council of Europe Convention for the Protection of Individuals with regardto Automatic Processing of Personal Data. It is determined that social networks strengthen theright to participate in the management of state affairs, including through free elections, providingadditional opportunities for public debate, improving their quality, stimulating democraticprocesses, activity, initiative, awareness and involvement of citizens in issues related to relatedto public administration. It is stated that due to the potential threats arising in connectionwith the functioning of social networks and other institutions of Internet communication, apromising direction is the creation of legal regimes of human rights in terms of regulatingInternet relations to disseminate information while ensuring the balance of interests of allparticipants. and their harmonization with the basics of public order. At the same time, certainproblems, such as reputation protection, protection of intellectual property, should be solvedin line with the already established sectoral regulation, developing it taking into account thespecifics of Internet communication.

Towards the issue on Ukraine’s compliance with its international obligations to establish the institution of information ombudsman: some conceptual and applied aspects

In recent decades, one of the priorities for Ukraine in domestic and foreign policy has been to establish and en-sure the high standards of human rights recognized by the Council of Europe.The article examines the obligations of Ukraine as a member state of the Council of Europe in terms of in-troducing an information ombudsman into the system of state bodies. It also analyzes the main world models for functioning of this state institution. The author considers the requirements of the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data, the Additional Protocol thereto, as well as the recommendations of the Council of Europe on the principles of formation and operation of information ombudsmen. 
 Based on the content of Ukraine’s international obligations as a member state of the Council of Europe, the pa-per proves that the competence of the Information Ombudsman should mainly extend to legal relations concerning access to public information and protection of personal data. Special attention is paid to the shortcomings and advantages of each of the world’s most common models of in-formation ombudsmen. The author also identifies the features of the content of the competence of this body, as well as outlines the main means of its activities. In addition, the article considers the ways in which Ukraine fulfills the obligations of a member state of the Council of Europe related to the establishment of an information ombudsman, and defines the criteria for the effective implementation of these obligations.According to the results of the study, it is substantiated that the most optimal model for functioning of the infor-mation ombudsman for Ukraine is its formation as an independent collegial central executive body with a special status, which should be answerable to the President of Ukraine and accountable to the Verkhovna Rada of Ukraine. Along with this, the article proves the need to combine control and regulatory powers in the structure of the competence of the information ombudsman. The author also proves the need to empower this body with administrative and jurisdictional functions. It is proposed to impose on the Information Ombudsman the obligations of the authorized body in the field of cross-border processing of personal data.

Council of Europe convention 108+: A modernised international treaty for the protection of personal data

The Council of Europe has modernized its Convention 108 for the protection of individuals with regard to automatic processing of personal data: in 2018 it adopted Convention 108+. The modernised version of Convention 108 seeks to respond to the challenges posed, in terms of human rights, by the use of new information and communication technologies. This article presents a detailed analysis of this new international text. Convention 108+ contains important innovations: it proclaims the importance of protecting the right to informational autonomy and human dignity in the face of technological developments. It consolidates the proportionality requirement for data processing and strengthens the arsenal of rights of the data subjects. It reinforces the responsibility of those in charge of data processing as well as its transparency. It requires notification of security breaches. It strengthens the independence, powers and means of action of the supervisory authorities. It also strengthens the mechanism to ensure its effective implementation by entrusting the Committee set up by the Convention with the task of verifying compliance with the commitments made by Parties.

International experience in personal data protection

The article is devoted to the analysis of various approaches to the protection of personal data in Russia and the European Union. In order to determine the importance of observing the right to protection of personal data, a number of documents of the European Commission adopted over the past few years have been analyzed. General scientific and special legal methods of cognition allowed for a comparative analysis of Regulation 2016/679 on the Protection of Individuals in the Processing of Personal Data and Their Free Movement (2018) and EU Directive 2016/680. Although Russia has ratified the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (1981), it has not been able to solve a number of problems related to the mandatory notification about personal data leaks, protection of personal data during their processing and against unauthorized access, etc. As a result, conclusions are drawn regarding the prevailing approaches to the definition of personal data and a unified conceptual and categorical apparatus in the field of personal data. Proposals for the modernization of Russian legislation based on international experience are made as well.

Інституалізація державного контролю за додержанням законодавства України про захист персональних даних

У статті висвітлено окремі питання інституалізації державного контролю за додержанням законодавства про захист персональних даних в Україні. Установлено, що однією з вимог Конвенції про захист фізичних осіб у зв’язку з автоматизованою обробкою персональних даних та інших міжнародних актів у цій сфері є утворення державами-учасницями незалежного наглядового органу, який відповідав би за забезпечення дотримання державними органами вимог щодо захисту персональних даних особи. Визначено, що посадовою особою, яка за законодавством України наділена повноваженнями у сфері здійснення державного контролю за дотриманням законодавства про захист персональних даних, є Уповноважений Верховної Ради України з прав людини. Автором проведено аналіз здійснення Уповноваженим Верховної Ради України з прав людини контрольних, адміністративно-юрисдикційних повноважень у сфері забезпечення додержання законодавства про захист персональних даних, а також повноважень щодо його участі в розробці нормативно-правових актів у відповідній сфері. Досліджено критерії незалежності державного органу при здійсненні своїх контрольних повноважень, визначені в міжнародних актах; проведено оцінку інституціональної спроможності Уповноваженого Верховної Ради України з прав людини у сфері здійснення державного контролю за додержанням законодавства про захист персональних даних. На підставі проведеного аналізу обґрунтовано доцільність утворення окремого незалежного наглядового органу у сфері захисту персональних даних, наділення його належними повноваженнями та забезпечення високого ступеня його незалежності, що відповідатиме досвіду деяких зарубіжних держав та сприятиме виконанню Україною прийнятих на себе зобов’язань відповідно до Угоди про асоціацію між Україною, з однієї сторони, та Європейським Союзом, Європейським співтовариством з атомної енергії і їхніми державами-членами, з іншої сторони.

Convention 108: Present importance and implementation

The purpose of this paper is to highlight the significance of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) in the overall system of personal data protection, especially from the perspective of non-EU countries that are members of the Council of Europe. This is attempted primarily through the evaluation of correlation between the Convention 108 and ECHR and GDPR in its segment that regulates relationship between the EU and third countries. The interest for the issue of personal data protection has been increasing among legal and ICT professionals, academics, government officials and even a general public over the years. This has been particularly intensified by adopting General Data Protection Regulation (GDPR). However, the adoption of the GDPR did not diminish importance of the Convention 108. On the contrary, it seems that the 'adequacy' principle regarding the third countries proclaimed by the GDPR, stresses its importance. The paper begins with the brief overview of the Convention 108 principles and the modernization that is brought by Protocol of 2018, which coincides with the entry into force of much-mentioned GDPR. It continues with analysis of the relationship between the GDPR and Convention 108, with focus on elements decisively influencing the assessment of the adequacy of the level of protection. Even though there is no sign of equivalence between the right to privacy and personal data protection these matters inevitably intersect in practice. Therefore, the final section of the text summarizes the cases of the European Court of Human Rights invoking Convention 108, with the aim to demonstrate how it is interpreted by the highest judicial instance in Europe.

A Study on the Extraterritorial Application of the General Data Protection Regulation with a Focus on Computing

A Study on the Extraterritorial Application of the General Data Protection Regulation with a Focus on Computing

African accession to Council of Europe Privacy Convention 108

The past five years have seen increasing interest by African states to request for accession and subsequently accede to the Council of Europe Convention 108 on automatic processing of personal data and its Additional Protocol. Apart from Uruguay, a Latin American country, the remaining requests and accessions to Convention 108 by non-European states originate from the African continent. This development signifies the maturity of privacy policies in Africa. Overall, it is an important step towards the realisation of a global data privacy treaty as Convention 108 is the only international legally binding instrument that grants individuals the right to the protection of their personal data and is open for accession by any country around the globe. This article discusses this watershed moment for the evolution of African privacy policies.

Protection of Personal Data Requirement of Modern Times for the Functioning of the Security, Individual Freedoms and the Rule of Law

Rule of law, human rights, freedoms, and security; are the three main pillars to the new trend of global developments, especially in the development of democratic values, where the protection of individual freedoms is among the fundamental principles that have data protection as the center point. In the years 2015-2016 we have seen the major cases of confrontation regarding the wiretapping to that point as the intervention even in the system of the "US election campaign by the Russian hackers", then sending of Macedonia to the "early elections, due to the extraction and publication of wiretaps by Zaev", the review of the "Safe Harbor" Agreement, of the EU and the US regarding the transfer of personal data during free "transatlantic" trade among EU and USA, etc. In this time of globalization, and developments of major movements is been said: "no home", "no time", "no limit", by digitized devices and social networks, privacy of the individual is excessively violated through abuse of personal data, personal security is violated and security of the systems vital to society. Therefore, this way, the national security of a country is been violated and endangered as well. Therefore, the development of institutions for protection of personal data, their independence and empowerment are of particular importance due to the vital interests of the country; where security, justice and freedom have a leading role in the development of a free and democratic society, where the individual human rights and freedoms, have a main place in modern developments of our time, in the society with the rule of law and the diversity of values. Freedoms and human rights, data and privacy protection; according to the European Convention of freedoms and human rights and the 108 Convention of the protection of personal data in automated processing, even though Kosovo has still not signed them. These rights are guaranteed by the constitution. On May 26, 2018 New Rules for the Protection of Personal Data of the EC and the European Union, will be no binding power for all EU countries. The entire legal measures of protection of personal data of the new Rules of PPD, should be forwarded to legislation interior PPD of EU member states and the EC and those who are already signatories to Convention 108 of PPD during the automatic processing of personal data. Among other things, we will give our assessments in question, where Kosovo really stands in this direction, with its commitment and aspirations for integration into European institutions and mechanisms.

Expanding the European data protection scope beyond territory: Article 3 of the General Data Protection Regulation in its wider context

Jurisdiction based solely on the territoriality principle is becoming less evident in the digital age This article engages in a discussion with authors such as Kuner and Svantesson, that have expressed a critical view on expansive jurisdiction of the EU data protection regime in issue 4, November 2015, of this Journal. Our contribution focuses on the choices with regard to scope and jurisdiction made by the EU co-legislators in Article 3 of the new EU General Data Protection Regulation (hereinafter, ‘General Regulation’ or ‘GDPR’),6 which will apply from 25 May 2018, and compares this to the current regime under Article 4 of the Data Protection Directive. It also assesses whether the modernized Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (No 108) is heading in a similar direction and highlights the Court of Justice of the European Union (CJEU) position on the territorial scope of the EU data protection law.

Update on Privacy Legislation (Presentation Slides)

Presentation part of course 'Leadership challenges with big data.' The presentation leads to two conclusions against the background of big data. Four important legal developments; Update of fundamental legal building blocks: OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data => updated in 2013. Council of Europe: Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) => stems from 1981 and under review. EU revision of the e-Privacy Directive 2002/58/EC amended by 2009/136/EC => review has started. Regulation (EU) 2016/679 of 27 April 2016 repealing Directive 95/46/EC.

The Council of Europe Data Protection Convention reform: Analysis of the new text and critical comment on its global ambition

The year 2010 set an important milestone in the development of data protection law in Europe: both Europe's basic regulatory texts, the EU Data Protection Directive and the Council's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), were placed at an amendment process, having served individual data protection for many years and witnessed in the meantime technological developments that threatened to make their provisions obsolete. After briefly presenting Convention 108, the analysis that follows will highlight the Council's data protection system currently in effect as well as developments relating to the Convention's amendment so far with the aim of identifying improvements and shortcomings. While doing this two separate points of view shall be adopted: at first a micro point of view will attempt to identify improvements and shortcomings through an ‘insider’ perspective, that is, judging only the merits and difficulties of the draft text at hand. Afterwards a macroscopic view will be adopted, whereby strategic issues will be discussed pertaining to the important issue of the relationship of the suggested draft with the EU data protection system, as well as, the same draft's potential to constitute the next global information privacy standard.

Reflections Upon the Interaction between Domestic and European Personal Data Protection Legislation

The European Council has established the first legal framework for the fundamental right to the protection of personal data, namely the Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data (Convention 108). The right to the protection of personal data is closely linked - but not identical - to the right of private life established by Article 8 of the European Convention for the Protection of Human Rights (hereinafter, the ECHR). Article 8 of the Charter of Fundamental Rights of the European Union (hereinafter, the Charter) expressly recognized the right of private life as an autonomous fundamental right. The importance awarded by the EU to the protection of personal data is also highlighted at Article 16 of the TFEU. The protection of personal data arises out of the question of the protection of individual rights by the State and has evolved into the question of how the the State treats and uses its citizens' personal data. On the contrary, in private commercial relationships, the right to the protection of personal data has a horizontal dimension. Does the Charter's fundamental right of personal data protection have direct effect in domestic legal orders? The CJEU has not yet pronounced on the enforceability of this right, however the legal scholar has already considered that Article 16 of the TFEU can be directly invoked. To be directly enforceable in front of domestic jurisdiction, the right to the protection of personal data should be specified by a specific legislation in the EU. To have a full picture it is thus paramount to consider the details of legislation in combination with primary law.Thus, in the next European legislature, a general reform of the data protection framework is envisaged to account for the challenges posed by new technologies of information, globalisation and the increasingly common practice of using personal data to prevent criminal and terrorist actions. The legislative package for the protection of personal data concerns two proposals: a Regulation that generally covers the treatment of personal data within the EU, both in the private and public sectors, and a Directive on Data Retention that aims to prevent, detect or to pursue criminal acts. This contribution not only clarifies the specific content of companies' obligations to respect the European standard for the protection of personal data but also discusses the proposal to revise the general framework to respect the Charter's acknowledgment of the fundamental right of personal data protection. The forthcoming legislative reform will represent an important reference point for countries - such as Switzerland - that are not members of the European Union. This paper assesses whether the European legislative reform on the protection of personal data, in conjunction with national law, responds in a satisfactory manner to the challenges posed by technological evolution and widespread use of the Internet. In recent years, the question of State regulation of the processing of personal data by private companies has become urgent as allegations of unauthorized access to personal data have been hotly debated in the European press. Thus, the paper shall first analyse, the appropriateness of European and States' legislation to properly regulate the effective protection of personal data, in particular of obligations applicable to companies storing and processing personal data on European soil. Does the proposed European legislation in the context of the EU's international agreements with the US provide sufficient legal safeguards to ensure the effective protection of personal data in the post-Snowden era? Specific subparts are devoted to the European reform of companies' criminal liability in cases of cyber-attack (a) and of specific obligations imposed on providers of cloud computing services (b). In the second part, I comment on the interpretation of the European data-protection legislation, provided by the Court of Justice, regarding the obligations imposed upon 'intermediaries' that process personal data, such as the Internet service providers (a) and Internet search engines (b). The Court of Justice has interpreted the European legislation in a manner that allows courts and national authorities to impose on companies a set of safeguards to protect individuals against the infringement of copyright and privacy rights.

The work of revision of the Council of Europe Convention 108 for the protection of individuals as regards the automatic processing of personal data

Thirty years after the Convention 108 for the protection of individuals as regards the automatic processing of personal data was adopted, the Council of Europe launched a process of modernising this text in order to adapt it to the substantive technological revolutions that have occurred since its birth in 1981. After two years of work, the Committee of the Convention 108 (T-PD Committee) has adopted the proposal of a revised version of both the Convention 108 and its additional Protocol. This paper presents the main propositions of changes brought by the modernisation work. Major changes have been brought to certain definitions and to the scope of the Convention as well as to the basic principles and to the special regime for sensitive data. Important new rights have been added to the list of guarantees offered to data subjects. New duties appear now in the text. And the transborder data flow regime has been entirely rewritten.

The Right to the Protection of Personal Data (Dreptul la Protecţia Datelor cu Caracter Personal)

(The article is written in Romanian)This article aims to analyze, from two perspectives, the right to the protection of personal data, a right which had maybe the most dynamic evolution in the last three decades on a very narrow niche. Firstly, we will focus on the right’s content by analyzing thoroughly the provisions which enshrine it. Secondly, we are interested to reason whether it is a new fundamental right, distinct from the right to the protection of private life or not. The right to the protection of personal data was born out of the necessity to protect the individual from the avalanche-like development of a computerized human society. Personal data have been legally defined as,any information relating to an identified or identifiable natural person,” covering, therefore, a generous sphere of protection.Because it is a relatively new and less known right, we are interested in describing this generous sphere of protection. We will look upon the first important legal act which regulated distinctly and in detail the right to the protection of personal data – the 108 Convention of the Council of Europe from 1981 for the protection of individuals with regard to automatic processing of personal Data. Further, we will analyze Article 16 of the Treaty of Lisbon which enshrines the right to the protection of personal data. This provision was introduced for the first time in an EU treaty in Article 16, which became the central piece in the protection of personal data in the Member States of the EU. We will analyze the extent in which Article 16 may enjoy direct effect. Further we will concentrate on Article 8 of the Charter of Fundamental Rights of the European Union, which is exclusively dedicated to data protection.In the next section we will analyze the content of this right from the perspective of the provisions of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. We will look upon the criteria for making data processing legitimate, the special categories for processing and the scope of the independent supervisory authorities created in all EU Member States.In the last section we will analyze the possibility that the right to the protection of personal data is a new fundamental right from both a formal and a substantial point of view.

Are the OECD guidelines at 30 showing their age?

Three decades have passed since the Organisation for Economic Co-operation and Development (OECD) promulgated Guidelines on the Transborder Flows of Personal Data, and still the issue of transborde...

A Comparative Study of the APEC Privacy Framework- A New Voice in the Data Protection Dialogue?

The dialogue on data protection has so far been dominated by European and American voices. There are currently a few international conventions in place such as the Council of Europe's 1981 Convention for the Protection of Individuals with regard to the Automatic processing of personal data, the 1980 OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data , which apply to 30 OECD countries, and the EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data, which binds EU member states but has had some impact on non-European countries due to the restriction on cross border flow of information.This has changed with the emergence of the APEC Privacy Framework in 2004 which focuses on the importance of the free flow of information in the digital age. Does the APEC Privacy Framework have anything of value to add or does it dilute the standards already in place? This article will examine these questions and argue that perhaps the APEC Privacy Framework is the first step towards a truly global standard for data protection.

A Comparative Study of the APEC Privacy Framework- A New Voice in the Data Protection Dialogue?

AbstractThe dialogue on data protection has so far been dominated by European and American voices. There are currently a few international conventions in place such as the Council of Europe's 1981 Convention for the Protection of Individuals with regard to the Automatic processing of personal data, the 1980 OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data , which apply to 30 OECD countries, and the EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data, which binds EU member states but has had some impact on non-European countries due to the restriction on cross border flow of information.This has changed with the emergence of the APEC Privacy Framework in 2004 which focuses on the importance of the free flow of information in the digital age. Does the APEC Privacy Framework have anything of value to add or does it dilute the standards already in place? This article will examine these questions and argue that perhaps the APEC Privacy Framework is the first step towards a truly global standard for data protection.

The Right to Know and the Right to Keep Secret in the Russian Federation

Victor Monakhov and Anita Soboleva analyse the current development of legal standards in the area of access to information and protection of personal data in the Russian Federation. At the end of 2005 Russia ratified the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. At the same time several new laws, intended to harmonize national privacy legislation with this Convention and to define the legal status of different databases, which are being created by the state for the purposes of registration of population and identification of persons, passed the first reading in the State Duma. The article reflects the ongoing debates on the scope of the right to know and the right to keep secret in the Russian context.