Data Privacy Law Research Articles

Raising the Stakes: Creating an International Sanction to Generate Corporate Compliance with Data Privacy Laws

In the current framework of human rights, data privacy is finding its home as an independent human right, separate from its historical home under the umbrella of general privacy. However, there is no consistent system or standard for defining this right, and different regions require substantially different levels of protection. This inconsistency has allowed for corporations, by way of their executive officers, to avoid or completely ignore the requirements imposed by many countries. Moreover, the penalties in many regions are not severe enough to incentivize corporations to change their behavior. The lack of a truly global system and standard for enforcing this right, and the specific lack of pressure on the officers that direct corporate policy, has allowed data privacy violations to go severely under-checked. This Note seeks to provide a novel solution for tackling corporate holdup in complying with data privacy laws. This Note examines the historical roots of data privacy as a human right, discusses its similarity to resources that have been considered public utilities, and provides examples of instances where the right to data privacy has been ignored by corporate officers. By modifying the United Nations’ existing sanction procedure and jurisdiction, this Note proposes that the United Nations would be able to target corporate officers individually for their roles in data privacy violations. By leveraging personal liability for noncompliance, the United Nations could generate a global sense of accountability to the modern, human right to privacy in one’s personal data.

Healthy Data Protection

Healthy Data Protection

Privacy and Data Protection

Introduction. This article provides an overview regarding privacy and data protection laws and principles around the world. It is based on lectures by the author on May 17, 2018 at Moscow State Institute of International Relations (MGIMO) and Lomonosov Moscow State University (MSU) on the occasion of the publication of a Russian version of the 3 rd edition of Determann's Field Guide to Data Privacy Law. Materials and methods. Materials include national and international laws and scholarly articles and books relating to privacy and data protection. Methods follow general principles of German and United States legal commentary. Research results. People, societies and governments value and protect privacy quite differently around the world. Consequently, data privacy, data security and data protection laws and policies vary significantly. Particularly pronounced are differences in the approach to the protection of privacy and information freedom and data processing regulation in the United States and the European Union. Discussion and conclusions. Law and policy makers around the world must analyze and balance their people's specific needs for privacy, security, freedom of information, technical progress, economic development and other values and objectives as they decide whether to adopt European Unionstyle data processing regulation, enact specific individual privacy laws as the United States, or pursue alternative approaches. They need to consider the different meanings of individual privacy, data security, information self-determination and data protection, as well as the different functions of data privacy laws, data processing regulation, record retention statutes and data residency requirements.

New European data privacy and cyber security laws

New European data privacy and cyber security laws

The Right to be Forgotten—The EU and Asia Pacific Experience (Australia, Indonesia, Japan and Singapore)

This article explores the right to be forgotten or otherwise known as the right to erasure in the EU and Asia Pacific. The right to be forgotten has quickly become an important concept of data protection law. It allows a person to request that their personal data and information be deleted or removed from an internet website. Subsequently, from the application of this right, a person has a level of their personal privacy protected over the internet. However, the acceptance and implementation of this right by Australia, Indonesia, Japan, Singapore and the EU varies. With the implementation of the EU General Regulation on Data Protection in May 2018, the right to be forgotten is well entrenched in the EU. This article investigates an issue of growing significance because of Australia’s engagement with these countries, accentuated by the use of the internet. First, one of Australia’s closest neighbours, Indonesia, has the largest Islamic population. Secondly, Singapore being a Commonwealth country along with Australia, has also adopted the common law, and has strong trade and other bilateral partnerships. Thirdly, of all the Asian nations, Japan, that recently obtained equivalency from the EU in data protection law, has seen the right emerge in that state. The right, in many respects is also in conflict with other rights and freedoms (right to expression) and other areas of the law. It is an area of law that may never be settled, as technology continues to evolve. This article will highlight the current status of the right to be forgotten across these jurisdictions, with what can be considered three models of data protection and privacy law. These laws have been developing separately throughout the EU, South East Asia and the Pacific.

Shore to Shore: How Europe’s New Data Privacy Laws Help Global Libraries and Patrons

As the European Union’s General Data Protection Regulation (GDPR) comes into effect to ensure the data protection and privacy of the personal information of its citizens, positive benefits will also befall users around the world. By using GDPR-compliant technology systems and underlying operating processes, global users of many technology systems, including library systems, will notice improved transparency on data collection, its use and sharing, greater access and control over their own personal information, and reduced notification time when a data breach does occur involving their information. Libraries can use these changes as an opportunity to educate patrons and users on privacy topics.

When is Personal Data 'About' or 'Relating To' an Individual? A Comparison of Australian, Canadian and EU Data Protection and Privacy Laws

The definition of “personal information” or “personal data” is foundational to the application of data protection laws. One aspect of these definitions is that the information must be linked to an identifiable individual, which is incorporated in the requirement that the information must be “about” or “relating to” an individual. This article examines this requirement in light of recent judicial and legislative developments in Australia, Canada and the European Union. In particular, it contrasts the decisions rendered by the Federal Court of Australia in Privacy Commissioner v Telstra Corporation Ltd and by the European Court of Justice decisions in Scarlet Extended and Patrick Breyer v Bundesrepublik Deutschland as well as the new General Data Protection Regulation with Canadian law. This article also compares how the three jurisdictions deal with the vexed issue of IP addresses as personal information where the connection between the IP address and a particular individual often raises particular problems.

Global Convergence of Data Privacy Standards and Laws: Speaking Notes for the European Commission Events on the Launch of the General Data Protection Regulation (GDPR) in Brussels & New Delhi, 25 May 2018

The presentation covered the following six aspects of the relationship between new data protection standards such as the General Data Protection Regulation (GDPR) and what is being enacted in the rest of the world. (1) The global diffusion of data privacy laws since 1970, seen through five key facts: (i) 126 countries (as at June 2018) now have data privacy laws which at least meet the ten minimum standards set by international agreements as early as 1980: (ii) 60% of these laws (75) are from outside Europe; (iii) 45 of the 126 laws have been enacted this decade, an average of 5 new laws per annum; (iv) At least 34 further countries have official Bills in the legislative process; and (v) Many countries (not only in the EU) are now enacting, or have already enacted, new laws to strengthen their original DP laws. Maps of the 126 laws and 34 Bills are included. (2) Global convergence on higher standards is occurring, not chaotic development. My estimate is that the average enactment of the distinctive new principles in the 1995 EU general data protection Directive, across all 75 non-European data privacy laws is at least 7/10 of those principles. Within European jurisdictions it is closer to 10/10. Data protection laws outside Europe already converge on more than ½ of the higher standards that have been required in Europe since the 1990s. (3) The GDPR is already influencing a higher level of legislative convergence. An incomplete study of over 30 countries outside Europe (in Africa, Asia and elsewhere), shows that six new ‘GDPR principles’ have been enacted by at least 10 countries, and all new GDPR principles by at least one. (4) ‘GDPR creep’, voluntary convergence by businesses where there is no legal obligation, is a new global phenomenon. (5) There is convergence on a global treaty, (Global) Data Protection Convention 108, which originated with the Council of Europe, but is being acceded to by non-European countries since 2011. It has also last week (18 May) been ‘modernised’ with new standards including many but not all of the GDPR’s new elements. ‘GDPR Lite’ may be the new global standard. (6) There are potential impediments to adoption of high global standards, First, countries may make commitments to regional agreements requiring lower standards, including to allow data exports, and then legislate to implement them. Second, Free Trade Agreements may place stronger prohibitions on personal data export restrictions than does the global GATS agreement, creating clashing standards.

Chapter 8 – Media reporting of migrants and migration

Chapter 8 – Media reporting of migrants and migration

The Quest for Information Privacy in Africa

The Quest for Information Privacy in Africa

Proof of Zero: Revisiting Aadhaar's Fundamentals

This short law and public policy note examines some of the newer challenges posed by centralisation of biometric information under India’s Aadhaar ecosystem, together with legal and regulatory challenges arising in view of evidentiary law of fingerprinting in India an elsewhere. It them makes a case for both technological and legal structure reforms, drawing inspiration from the 2012 report and the recently released 2017 white paper on data protection and privacy law in India.

Acquisitions in the Third Party Tracking Industry: Competition and Data Protection Aspects

Amid growing concern about the use and abuse of personal data over the last decade, there is an emerging suggestion that regulators may need to turn their attention towards the concentrations of power deriving from large-scale data accumulation. No longer the preserve of data protection or privacy law, personal data is receiving attention within competition and antitrust law. Recent mergers and acquisitions between large digital technology platforms have raised important questions about how these different areas intersect and how they can complement one another in order to protect consumer welfare while ensuring competitive markets. This paper draws attention to one particularly complicated kind of digital data-intensive industry: that of third party tracking, in which a firm does not (only or primarily) collect and process personal data of its own customers or users, but rather data from the users of other ‘first party’ services. Mergers and acquisitions between firms active in the third party tracking industry raise unique challenges for privacy and fundamental rights which are often missed in regulatory decisions and academic discussions of data and market concentration. In this paper, we combine empirical and normative insights to shed light on the role of competition regulators in addressing the specific challenges of mergers and acquisitions in the third party tracking industry. After critically assessing some of the US and EU case law in this area, we argue that a bolder approach is needed; one that engages in a pluralist analysis of economic and noneconomic concerns about concentrations of power and control over data.

2017-2018 Further Update to Graham Greenleaf’s Asian Data Privacy Laws – Trade and Human Rights Perspectives

2017-2018 Further Update to Graham Greenleaf’s Asian Data Privacy Laws – Trade and Human Rights Perspectives

The Role of Data Protection and Privacy Law in Personally Identifiable Information Driven Mergers from the EU Merger Perspective

An accepted master thesis on Reconciliation of Competition Law and The General Data Protection Regulation in the Context of Personally Identifiable Information - Driven Mergers

Erratum to: Online Price Discrimination and EU Data Privacy Law

Erratum to: Online Price Discrimination and EU Data Privacy Law

2014-2017 Update to Graham Greenleaf's Asian Data Privacy Laws - Trade and Human Rights Perspectives

In July 2017 I published on SSRN an update from mid-2014 to mid-2017 of my Asian Data Privacy Laws – Trade and Human Rights Perspectives (Oxford University Press, 2014), to accompany the publication of the paperback edition in July 2017. This further update aims to cover developments to 31 October 2018. The content of this update first covers International Agreements affecting privacy which are of relevance to Asia. Summaries follow of developments in the fifteen months prior to November 2018 from any of the 26 jurisdictions in Asia, considered region-by-region (North-East Asia; South-East Asia; and South Asia). This period has been a very significant one for Asian data privacy laws, with the most important developments being: * The anti-privacy provisions in the 'new TPP', the Comprehensive and Progressive Trans-Pacific Partnership (CPTPP) free trade agreement; * The initial impact of the EU's General Data Protection Regulation (GDPR) on Asian jurisdictions; * The draft adequacy decision concerning japan, by the European Commission; * Amendments to Korea's 'Network Act', and their significance for Korea's adequacy applicaition to the EU; * Strongly GDPR-influenced draft Bills in both Thailand and Indonesia; * Vietnam's Cybersecurity Law and its strong data localisation provisions; * The Indian Supreme Court's unanimous decision in Puttaswamy v Union of India that India has a fundamental constitutional right of privacy, and its decision by majority a year later that India's biometric ID system, the Aadhaar, while constitutionally capable of validity, was implemented by legislation which is in part invalid; * The Report by the India's Srikrishna Committee, and its GDPR and Chinese influenced draft data protection Bill.

The Quest for Information Privacy in Africa: A Review Essay

The Quest for Information Privacy in Africa: A Review Essay

Graham Greenleaf, Asian Data Privacy Laws: Trade and Human Rights Perspectives

Graham Greenleaf, Asian Data Privacy Laws: Trade and Human Rights Perspectives

Structure and Enforcement of Data Privacy Law in South Korea

South Korea’s data privacy law has evolved rapidly despite a short history of relevant legislation and enforcement. South Korea’s data privacy law has exceedingly stringent consent requirements. In addition to consent, there are many other statutory provisions with onerous requirements, arguably making the overall data privacy law regime one of the strictest in the world. South Korea’s data privacy law, in particular the Personal Information Protection Act, has a similar structure to the EU’s data privacy law. However, the overall legal regime and enforcement mechanisms for data privacy reveal South Korea’s unique characteristics and the weaknesses of its data privacy law. Both the governance regime and the enforcement powers are too fragmented to achieve consistent policy outcomes. Data privacy has gained greater public attention in recent years in South Korea and, perhaps reflecting this phenomenon, relevant laws and regulations have been amended frequently. A notable trend is to strengthen penalty provisions such as the maximum amount of administrative fine, now set at 3% of relevant sales revenue. It remains to be seen if heightened penalty provisions will meaningfully help to address data privacy concerns.

Bibliography of Materials Relevant to the Interaction of Competition Policy, Big Data and Personal Data

This is a bibliography of more than 250 references to articles, papers, presentations, books and speeches relevant to the interaction of antitrust/competition law, big data, personal data, data protection law, privacy law, and consumer protection law.