Data Privacy Law Research Articles

The diffusion of data privacy laws in Southeast Asia: learning and the extraterritorial reach of the EU’s GDPR

ABSTRACT The European Union’s General Data Protection Regulation (GDPR) of 2016 is widely recognised as the benchmark global standard for data-privacy law. In recent years, countries across Southeast Asia have enacted or updated data-privacy laws with provisions that align with the GDPR. This paper explores the balance of internal and external forces driving these regulatory changes. It argues that a nuanced understanding of diffusion in the policymaking process allows us to see beyond the ‘Brussels Effect’ and how the increasing digitalistion of Southeast Asian societies has created increasing local demand for regulatory change. While an analytical focus on scripting in the drafting of GDPR-like laws focuses attention on the extraterritorial reach of the EU’s regulatory power, an analytical focus on problematisation points to different pathways of domestic learning regarding data privacy, especially in response to rising data-security threats.

European health regulations reduce registry-based research

BackgroundThe European Health Data Space (EHDS) regulation has been proposed to harmonize health data processing. Given its parallels with the Act on Secondary Use of Health and Social Data (Secondary Use Act) implemented in Finland in 2020, this study examines the consequences of heightened privacy constraints on registry-based medical research.MethodsWe collected study permit counts approved by university hospitals in Finland in 2014–2023 and the data authority Findata in 2020‒2023. The changes in the study permit counts were analysed before and after the implementation of the General Data Protection Regulation (GDPR) and the Secondary Use Act. By fitting a linear regression model, we estimated the deficit in study counts following the Secondary Use Act.ResultsBetween 2020 and 2023, a median of 5.5% fewer data permits were approved annually by Finnish university hospitals. On the basis of linear regression modelling, we estimated a reduction of 46.9% in new data permits nationally in 2023 compared with the expected count. Similar changes were neither observed after the implementation of the GDPR nor in permit counts of other medical research types, confirming that the deficit was caused by the Secondary Use Act.ConclusionsThis study highlights concerns related to data privacy laws for registry-based medical research and future patient care.

The Impact of Data Privacy Laws on Digital Marketing Practices

Purpose: The general study focused on investigating the impact of data privacy laws on digital marketing practices. Methodology: The study adopted a desktop research methodology. Desk research refers to secondary data or that which can be collected without fieldwork. Desk research is basically involved in collecting data from existing resources hence it is often considered a low cost technique as compared to field research, as the main cost is involved in executive’s time, telephone charges and directories. Thus, the study relied on already published studies, reports and statistics. This secondary data was easily accessed through the online journals and library. Findings: The findings reveal that there exists a contextual and methodological gap relating to the impact of data privacy laws on digital marketing practices. Preliminary empirical review revealed that privacy laws such as GDPR, CCPA, APPI, and LGPD significantly transformed digital marketing practices, necessitating a shift towards more ethical and transparent data handling. These regulations increased compliance costs and administrative burdens but also improved data security and consumer trust. Companies that proactively adapted to these regulations by investing in robust data protection measures experienced enhanced consumer engagement and brand loyalty. The study highlighted the critical role of privacy-enhancing technologies in facilitating compliance and maintaining effective marketing strategies. Overall, the impact of data privacy laws was profound, requiring ongoing adaptation and innovation in digital marketing practices to balance regulatory compliance with consumer trust. Unique Contribution to Theory, Practice and Policy: The Theory of Planned Behaviour (TPB), Institutional Theory and Technology Acceptance Model (ATM) may be used to anchor future studies on data privacy laws. The study recommended several strategies for advancing the understanding and implementation of data privacy laws in digital marketing. It suggested that future research should explore the relationship between data privacy regulations and consumer behavior to develop effective marketing strategies. Businesses were advised to adopt proactive compliance measures, invest in data protection technologies, and educate consumers about their privacy rights. Policymakers were encouraged to develop balanced regulations through stakeholder collaboration and to harmonize international data privacy standards. The study also emphasized the importance of promoting privacy-enhancing technologies through public-private partnerships and government incentives to safeguard consumer data while supporting marketing innovation.

The Legal Challenges of Data Privacy Laws, Cybersecurity Regulations, and AI Accountability in the Digital Era

The Legal Challenges of Data Privacy Laws, Cybersecurity Regulations, and AI Accountability in the Digital Era

IMPLEMENTASI DESAIN PRIVASI SEBAGAI PELINDUNGAN PRIVASI ATAS DATA BIOMETRIK

Attention to biometric data security has become urgent for protecting user privacy. In the context of the Protection of Data Privacy (PDP) Law, biometric data are classified as specific data, requiring extra protection due to their unique, non-exchangeable characteristics. This study uses a normative approach, analyzing legislation and legal comparisons through regional and international regulations, to examine two issues: the position of biometric data as specific data under the Electronic Information and Transactions Law and PDP Law, and the technical solutions through privacy by design to protect biometric data. The research findings are: (1) Biometric data are correlated with privacy and personal rights, classifying them as specific data. Their use for public and private interests raises the potential for privacy violations. (2) Technical solutions through privacy by design can begin with implementing consent at the registration stage by personal data controllers, ensuring the processing of biometric data achieves specific purposes.

Cross-jurisdictional Data Transfer in Health Research: Stakeholder Perceptions on the Role of Law

Large data-intensive health research programmes benefit from collaboration amongst researchers who may be located in different institutions and international contexts. However, complexities in navigating privacy frameworks and data protection laws across various jurisdictions pose significant challenges to researchers seeking to share or transfer data outside of institutional boundaries. Research on the awareness of data protection and privacy laws amongst stakeholders is limited. Our qualitative study, drawn from a larger project in Singapore, revealed insights into stakeholders’ perceptions of the role of law in cross-national health data research. Stakeholders in our study demonstrated a range of perceptions regarding the role of data protection law in governing the collection and transfer of health data for research. The main criticisms included inadequate legal protection to data and lack of uniformed data protection standards. Despite these criticisms, participants recognised the importance of data protection law in supporting cross-border data transfers and proposed measures to improve perceived limitations of existing laws. These measures include strengthening existing legal framework, establishing contractual agreements and imposing severe punishments for data misuse.

Review on Data Privacy, Protection, and Security Challenges in Blockchain Adoption Across Diverse Domains

The paper explores how blockchain technology can transform data management, especially when it comes to handling privacy and security issues. Blockchain's immutability, transparency, and decentralization make it a potentially useful tool for addressing the expanding problems associated with data security and integrity. However, the slow adoption of blockchain technology is influenced by a complex interplay of developing privacy concerns, legislative uncertainty, and technological subtleties. The current study aims to identify key data privacy, protection, and security challenges associated with blockchain adoption in various domains, assess the adequacy of the current data privacy, protection, and security laws to address these challenges, and propose potential solutions and areas for further research to mitigate data privacy, protection, and security risks in blockchain applications. Additionally, the research has examined the adaptability and dependability of the two main kinds of blockchain—public and private—as well as the variations in their reach and visibility.

DATA PRIVACY LAWS AND THEIR IMPACT ON FINANCIAL TECHNOLOGY COMPANIES: A REVIEW

In an era where the digital transformation of financial services is both a boon and a battleground, this paper meticulously navigates the intricate relationship between Financial Technology (FinTech) and the evolving landscape of data privacy laws. With the digital economy's expansion, FinTech companies stand at the forefront of innovation, offering unprecedented financial inclusion and efficiency opportunities. However, this rapid advancement also raises significant concerns regarding data privacy and consumer protection, necessitating a delicate balance between innovation and compliance. This study aims to dissect the complexities inherent in this relationship, exploring the impact of data privacy laws on FinTech, regulatory compliance challenges, and opportunities for fostering trust and innovation within the digital financial ecosystem.
 Employing a qualitative research design, the paper delves into a comprehensive review of scholarly literature, legal documents, and regulatory frameworks to illuminate the multifaceted dynamics at play. The findings reveal a nuanced "Innovation Trilemma," where FinTech's drive for innovation often collides with the imperative for market integrity and regulatory clarity. The study underscores the critical role of ethical considerations in FinTech adoption, highlighting the importance of integrating ethical practices to safeguard consumer rights and data protection.
 Conclusively, the paper advocates for regulatory adaptability, ethical innovation, and collaborative engagement among stakeholders as essential strategies for navigating the complexities of the digital financial landscape. It calls for a concerted effort to foster an ecosystem where innovation thrives alongside robust consumer protection and market integrity, paving the way for a sustainable, inclusive and ethically grounded FinTech future.
 Keywords: Financial Technology, Data Privacy Laws, Regulatory Compliance, Innovation Trilemma, Ethical FinTech, Digital Financial Ecosystem.

Cross-Border Data Flows and International Law: Navigating Jurisdictional Complexities in the Digital Age

This paper delves into the intricate realm of "Cross-Border Data Flows and International Law: Navigating Jurisdictional Complexities in the Digital Age." In an era dominated by global connectivity and digital interdependence, the paper scrutinizes the challenges posed by jurisdictional complexities in regulating the exchange of data across borders. The investigation encompasses a comprehensive analysis of existing international legal frameworks, jurisdictional challenges arising from varying national regulations, the impact of data protection and privacy laws, and technological solutions. Through case studies and a forward-looking lens, the paper offers insights into the evolving landscape of cross-border data governance. The recommendations put forth aim to foster a harmonized approach to international law, ensuring a delicate balance between facilitating data flows and safeguarding individual privacy rights.

Recent Developments in Data Privacy Laws in India

Recent Developments in Data Privacy Laws in India

Africa's Data Privacy Puzzle: Data Privacy Laws and Compliance in Selected African Countries

This study sought to give a thorough analysis of data privacy legislation, compliance rates, enforcement strategies, and related issues in seventeen (17) African countries that were chosen for the study. The study's objectives were to assess the state of data privacy laws in selected African countries, analyse levels of compliance among entities operating within these countries, assess the effectiveness of enforcement mechanisms, and identify and analyse the common challenges African countries face in complying with and enforcing data privacy laws. Researchers conducted a systematic review of 48 data privacy publications to gain a deep understanding of the complex data privacy landscape. This involved rigorous criteria for inclusion/exclusion, comprehensive search strategies, quality assessment, and data extraction/synthesis. While 15 African countries have implemented comprehensive data privacy legislation, two (Ethiopia and Burundi) rely on general regulations. The analysis found that regulatory bodies significantly enhance compliance, and highlighted recurring challenges such as insufficient public awareness, resource limitations, and complex governance structures. The research underscores the crucial role of dedicated legislation, public education, empowered regulatory authorities, and regional collaboration in guaranteeing data privacy rights in the digital age across Africa.

Shedding Light on the Inadequate Protection of Internet Users’ Right to Privacy under Kuwaiti Law

Abstract Digital technology such as AI has enabled private companies to collect and analyse people’s personal information, which may infer hidden private data about the individual, such as medical data or psychological state. The inferred private information can be sold to third parties or used to target advertisements without the individual’s knowledge and explicit consent. Private companies, therefore, pose a risk to internet users’ right to privacy in the digital world. As such, the legal system should have a comprehensive Data Privacy law that provides internet users with adequate legal protection for preserving their right to privacy against private companies. Still, Kuwait lacks comprehensive Data Privacy. The only two data privacy mechanisms are embodied in chapter 7 under the Electronic Transaction Act (ETA) No. 20 of 2014 and the Regulation of User Protection and Privacy issued by the Communication and Information Technology Regulatory Authority (CITRA). This paper finds that the fragmented Kuwaiti laws concerning the individual’s right to privacy inadequately protect internet users’ right to privacy against the risk posed by private companies, and therefore, legislative interventions are needed. This paper concludes with proposing essential recommendations for the Kuwaiti Legislative Authority to issue a comprehensive data privacy law, using European Union’s General Data Protection Regulation as a guidance framework (GDPR), to strengthen internet users’ right to privacy (as control over their personal information) against the risk private companies pose.

The Corporate Challenges of Conforming to Data Privacy Laws: Balancing User Data Rights and Corporate Innovation

The Corporate Challenges of Conforming to Data Privacy Laws: Balancing User Data Rights and Corporate Innovation

From Menstruation to Regulation: Understanding Data Privacy Laws and Period Tracker Apps

From Menstruation to Regulation: Understanding Data Privacy Laws and Period Tracker Apps

The EU–US data privacy framework and the impact on companies in the EEA and USA compared to other international data transfer mechanisms

Third time's a charm? Companies in the European Economic Area, Switzerland and the UK (EEA+) are considering the pros and cons of the third attempt of the EU Commission and US government to establish interoperability between their data protection and privacy law systems, after the demise of the US Safe Harbor Program and the EU–US Privacy Shield. Should US companies register? Are the efforts worth the potential benefits, given that the new programme has already been challenged and may be invalidated like previous programmes for reasons that businesses cannot control? Should companies that were already enrolled in the previous programmes accept automatic enrolment or leave the programme? Can and should companies in the EEA+ rely on EU–US Data Privacy Framework (DPF) registration for international transfers? Or insist on registration in addition to standard contractual clauses (EU SCC 2021) or other compliance mechanisms? Are data transfer impact assessments (DTIAs) still required for transfers to the US? Should they be updated? This paper seeks to help companies find answers to these questions and (I) outlines the background and context of the Adequacy Decision, (II) explains how US companies can join the DPF, (III) discusses the impact of the Adequacy Decision, (IV) summarises requirements for other compliance mechanisms for international data transfers under the GDPR, (V) compares the DPF to other transfer compliance mechanisms and (VI) provides practical considerations and a summary.

Enabling Integrity and Compliance Auditing in Blockchain-Based GDPR-Compliant Data Management

The General Data Protection Regulation (GDPR) is a European Union (EU) data protection and privacy law. According to the GDPR, the data on a hosting platform must meet semantic consistency and data integrity requirements. Semantic consistency means that the data operation should comply with the GDPR, while data integrity is meant to ensure that the outsourcing data should be intact. The two terms are not interchangeable. For example, if a cloud service provider migrates data to foreign storage nodes without authorization of the data owner, the data integrity requirement of the GDPR is met but the semantic consistency requirement is not. How to ensure data integrity and compliance is the main challenge for a GDPR-compliant data supervision platform. To achieve this aim, we leverage a blockchain based data management framework to check the data compliance, which can break the black box of the data hosting platform and demonstrate its logic to data owners, allowing for inspection. We propose a new provable data possession (PDP) scheme for the aforementioned framework that can check for semantic consistency and data integrity simultaneously. The verifier does not need to hold any audited data, which can reduce bandwidth usage. The verification result can be regarded as the proof for subsequent data recovery and accountability. Experimental results show higher efficiency of the PDP scheme.

A Comprehensive Analysis on Right to Privacy in the Digital Age under the Ambit of Data Privacy Laws in India

A Comprehensive Analysis on Right to Privacy in the Digital Age under the Ambit of Data Privacy Laws in India

Contractual Mechanisms for Securing the Public Interest in Data Sharing in Public-Private Health Research Partnerships

Public private partnerships (PPPs) are increasingly common in health research, with large European investment over the last 20 years and renewed focus in the wake of the global health crisis COVID-19. PPPs have been used for health research that seeks to collect, analyse and share personal data from research participants, often on the basis of informed or broad consent. PPPs are underpinned by contracts, both to govern the use of data and samples necessary for health research, and to govern the agreement between the public and private contracting parties of a project. This raises the question of how far contracts adequately protect public interests, for example in privacy and data protection when patient data are exposed to a broader range of potential uses from the private sector. A core principle of contract law is that you cannot contract for unlawful activity. As such, contracts could be void if their design or performance entails a breach of statute or common law, for example data protection and privacy laws or the common law duty of confidentiality. This paper analyses the implications of this general principle of illegality for contracts underpinning PPPs in health research, particularly to understand the extent to which it could operate to protect the public interest as conceived by privacy and data protection law. The paper will show how this heavily policy-driven doctrine has scope to ensure that contracts and contract terms that are contrary to public policy are void or unenforceable which, in the context of PPPs using personal information for health innovation and research, is a welcome, though limited, accountability mechanism in private law that could operate to serve the public interest.

Has the GDPR killed e-government? The “once-only” principle vs the principle of purpose limitation

Journal Article Has the GDPR killed e-government? The “once-only” principle vs the principle of purpose limitation Get access Monika Mikiver, Monika Mikiver Guest Lecturer in Administrative Law, University of Tartu, School of Law, 10142 Tallinn, Estonia Search for other works by this author on: Oxford Academic Google Scholar Paloma Krõõt Tupay Paloma Krõõt Tupay Paloma Krõõt Tupay, Associate Professor in Constitutional Law, University of Tartu, School of Law, 10142 Tallinn, Estonia Email: palomakreet.tupay@ut.ee Search for other works by this author on: Oxford Academic Google Scholar International Data Privacy Law, ipad010, https://doi.org/10.1093/idpl/ipad010 Published: 23 June 2023

Smart robots and AI: Strategic approaches to data privacy and security law for digital marketers

Smart robots are expected to increasingly be employed by consumers to improve their everyday lives in ways not seen before. Artificial intelligence (AI) applications in smart robots are changing the way smart robots are used and the way related services are consumed. Privacy and security concerns arise, however, with the implementation of innovative technologies for consumers as these collect and use personal data. While the law has not caught up with the technology, this is further complicated by the fact that there are no clear rules in some cases. European Union (EU), UK and US law require ‘appropriate’ or ‘reasonable’ measures to be taken and require the protection of personal data of consumers generally, including marketers of smart robots using AI. This is complicated by the complex nature of AI and the need to track consumers and collect data in order to provide personalised and effective smart robot services. Marketers should employ an interdisciplinary strategy to address these concerns and requirements including employing marketing, technical and legal strategies. This has wider implications for the marketing community as it becomes very difficult to not consider or build in technical and legal considerations.