Data Protection Compliance Research Articles

Investigating Data Protection Compliance Challenges

In today's landscape, safeguarding sensitive data is crucial for Organizations, but navigating data protection regulations and ensuring compliance is increasingly challenging. This research project explores Organizations' hurdles in achieving data protection compliance, offering insights to develop more effective strategies. A survey via Google Forms gathered insights from data protection experts and professionals, revealing key challenges such as difficulty understanding complex regulations, limited resources, and obstacles in implementing compliance measures. The study also reviewed the existing data protection regulatory framework and relevant literature, uncovering a common theme of confusion and a gap between regulatory requirements and practical application across Organizations. The research recognises that data protection extends beyond regulatory compliance, reflecting the evolving expectations of individuals and customers regarding the ethical handling of their data. This underscores the importance of data protection as both a legal and ethical responsibility closely tied to organisational reputation and public trust. The findings highlight the need for more precise, accessible guidelines and support mechanisms to bridge the gap between regulatory demands and organisational implementation. By addressing these challenges, Organizations can strengthen their data protection measures, foster trust, and ensure the security of sensitive information.

A Balancing Act: Data Protection Compliance of Artificial Intelligence

Abstract Neural network based generative artificial intelligence (GenAI) systems, in particular large language models (LLMs), hold huge potential for economic, scientific, and artistic progress. However, they are also the subject of ongoing fierce data protection debates. Some even doubt whether GenAI systems can, at least in principle, comply with the General Data Protection Regulation (EU) 2016/679 (GDPR). This issue was highlighted by a temporary ban of ChatGPT by the Italian data protection authority in March 2023. To answer the question of possible compliance with the GDPR, this paper will first illustrate relevant technical aspects and then examine the extent to which GenAI systems process personal data. A distinction will be made between training, use, and the system itself as stored on a hard drive. On this basis, this paper addresses the key question of the lawfulness of the respective processing activities, bearing in mind that each specific use case of any GenAI system requires a specific data protection assessment. While the issues discussed in this paper are relevant to GenAI systems in general, they are particularly relevant to LLMs trained on large amounts of text-based personal data. As one result, the analysis identifies serious challenges in the application of the GDPR to LLMs. However, with no significant updates to the relevant GDPR provisions in sight, this paper aims to show how pragmatic solutions are both necessary and largely possible even under the current legal framework. This includes practical guidance for developers and users on how to ensure compliance.

Hunter: Tracing anycast communications to uncover cross-border personal data transfers

Cross-border personal data transfers are heavily regulated worldwide, with data protection authorities imposing huge fines on organizations that fail to meet their strict compliance requirements. However, network-level optimizations such as anycast addresses were not designed with personal data in mind, and their use may unwittingly divert personal data out of a legal boundary. This paper describes Hunter, an automated method to trace anycast communications and identify those threatening data protection compliance. We have applied Hunter in the wild to a set of Android apps to discover that all apps observed sending personal data to anycast addresses eventually carry out international transfers but fail to disclose them in their privacy policies. Our findings suggest that using anycast addresses to transmit personal data generally results in data protection compliance issues.

A sociotechnical framework to assess patient-facing eHealth tools: results of a modified Delphi process

Among the thousands of eHealth tools available, the vast majority do not get past pilot phases because they cannot prove value, and only a few have been systematically assessed. Although multiple eHealth assessment frameworks have been developed, these efforts face multiple challenges. This study aimed to address some of these challenges by validating and refining an initial list of 55 assessment criteria based on previous frameworks through a two-round modified Delphi process with in-between rounds of interviews. The expert panel (n = 57) included participants from 18 countries and 9 concerned parties. A consensus was reached on 46 criteria that were classified into foundational and contextual criteria. The 36 foundational criteria focus on evaluating the eHealth tool itself and were grouped into nine clusters: technical aspects, clinical utility and safety, usability and human centricity, functionality, content, data management, endorsement, maintenance, and developer. The 10 contextual criteria focus on evaluating the factors that vary depending on the context the tool is being evaluated for and were grouped into seven clusters: data-protection compliance, safety regulatory compliance, interoperability and data integration, cultural requirements, affordability, cost-benefit, and implementability. The classification of criteria into foundational and contextual helps us assess not only the quality of an isolated tool, but also its potential fit in a specific setting. Criteria subscales may be particularly relevant when determining the strengths and weaknesses of the tool being evaluated. This granularity enables different concerned parties to make informed decisions about which tools to consider according to their specific needs and priorities.

Video surveillance legislation in the EU and Slovenia: privacy rights, security needs, and data protection challenges

This paper describes the legal framework of video surveillance in the European Union (EU), with an emphasis on the legislation of the Republic of Slovenia. We are analyzing the legal intricacies inherent in balancing privacy rights and security needs. The purpose of the paper is to examine the legislative instruments in the EU and Slovenia, especially regarding the legal basis for processing data of video surveillance. The research methodology combines qualitative analysis and legislative review and case studies from selected Slovenian Information Commissioner opinions and decisions. The findings reveal a dynamic and complex landscape, where technology often outpaces regulatory frameworks, leading to potential privacy infringements. The paper shares the idea that harmonizing legislation across the EU helps ensure the balance between security and privacy rights, with significant practical implications in the creation of standardized policies and guidelines for the operation of video surveillance systems regarding European Data Protection Board opinions. The originality of this paper lies in its selected analysis of EU legislation and its practical application in Slovenian legislation. It distinguishes itself by offering a practical view in ensuring data protection compliance and security technologies regarding video surveillance.

Citizen scientists as data controllers: Data protection and ethics challenges of distributed science

Citizen-science is a rapidly expanding approach to knowledge production that increasingly involves the collection of personal data in various forms. This processing of personal data invokes relevant data protection laws and, specifically, the designation of data controller, the person(s) or organisation(a) who determine if and how personal data is to be processed and hence are charged with the legal responsibility for compliance with the General Data Protection Regulation (GDPR). Traditionally, in the context of research, professional researchers would be designated controllers, and research participants whose data was processed would be “data subjects” and hence enjoy the GDPR's protections. Yet, citizen-scientists adopt a dual role, acting both as participants and as researchers. This paper maps the implications this dual role has from the perspective of data protection law and research ethics. We explain how the data protection concept of controller has been interpreted very broadly. As a result, in their dual role, citizen scientists can be both data subjects entitled to protection and data controllers, sometimes of their own data, tasked with data protection compliance obligations. If citizen scientists share the objectives of research projects they participate in or co-shape those objectives, it is likely that they – together with the professional researchers - will be considered controllers, and held responsible for the processing of personal data in compliance with the GDPR. The paper discusses how this can affect both the quality of protections provided to participants (including participant-researchers), thus undermining the fundamental goal of research ethics, generally, as well as the practice of citizen science itself. We analyse this question of citizen scientists as data controllers as both a matter of law and research ethics. We conclude with policy recommendations that can be applied both on the level of data protection law (to reconsider how the role of controller is assigned) and research ethics guidelines that should take a nuanced approach to the circumstances of assignment of the status of data controller in citizen science projects as an important step toward responsible and ethical participatory research.

Personal data protection compliance assessment: A privacy policy scoring approach and empirical evidence from Thailand's SMEs

Privacy policies, intended to provide information to individuals regarding how their personal data is processed, are often complex and challenging for users to understand. Businesses often demonstrate non-compliance with personal data protection laws, ranging from the absence of privacy policies to the existence of policies that do not adhere to legal requirements. This paper aims to (1) develop a quantitative and systematic tool for evaluating privacy policies' compliance with the Personal Data Protection Act (PDPA), (2) assess compliance among Small and Medium Enterprises (SMEs) in Thailand, and (3) provide recommendations for enhancing compliance practices. To achieve this, we proposed a multi-criteria privacy policy scoring model integrated with comprehensive statistical data analyses. The privacy policy scoring model consists of ten privacy principles and 31 privacy criteria, providing a structured framework for evaluating privacy policies. During a two-year postponement period for enforcing the PDPA law, we conducted a stratified random-sampling survey of 384 SMEs to evaluate their privacy policies using the proposed scoring model. The accomplished results revealed significantly lower scores than anticipated, with the nationwide average score of SMEs reaching only 6.1909 out of 100 points. More than half of the SMEs collected personal data without announcing privacy policies, and those with privacy policies adhered to an average of only 12.15 out of 31 privacy criteria. These findings highlight the pressing need to improve compliance practices among SMEs in Thailand. The proposed methodology can be customized and applied to align with the requirements of personal data protection laws in other countries. Additionally, our findings indicate that compliance with the PDPA is influenced by the Thailand Standard Industrial Classification (TSIC) sections, suggesting the adoption of tailored approaches by policymakers to address the specific needs of different TSIC sections.

A multicriteria model to support decisions regarding data protection compliance

ABSTRACT With the advent of the General Personal Data Protection Law (LGPD) in Brazil, companies need to adapt to the law and, therefore, must identify weaknesses in relation to the protection of personal data. Next, actions are defined that include investments in technology, infrastructure and training. These actions require resources, either for the implementation of some technology or readjustment of the system, time for implementation, restructuring of processes, and involvement of key people. Considering these actions can also impact the organizational strategy, this work proposes a model to support the prioritization of actions necessary to comply with the LGPD. The model is based on the FITradeoff (Flexible and Interactive Tradeoff) multicriteria method. The proposed model was applied in a Brazilian organization that is adapting to the LGPD and needed formal support in relation to decisions. The recommendations obtained demonstrated alignment with the company's needs and strategies.

Balancing privacy at the time of pandemic: global observation

The rapid outbreak of COVID-19 has initiated the development of mobile applications aiming at helping public health authorities to slow down viral diffusion. The proliferation of these applications engenders challenges to forge a balance between ‘public health utility’ and ‘personal privacy’. This paper scrutinizes various applications that collect personal data according to their functions and data protection compliance. These applications are mostly of three broader categories- contact tracing, self-assessment, and quarantine enforcement. We conduct systematic categorization based on five parameters-type of owner or provider, host platform, functionalities, the existence of privacy policy, and state of the source code. A total of 122 apps encompassing 83 countries were assessed during a research period of 20 days (June 1 to 20, 2020). Findings suggest that although the majority of the applications publish a privacy policy, many applications do not give information in detail, making the issue of privacy obscure. The majority of the applications collect various sensitive personal data irrespective of their functionalities, provider, and platform. Most applications are not open source raising concerns over trust and transparency. The findings are valuable to policymakers who are formulating short, mid, and long-term technology policies to strike a balance between functionality and personal privacy.

Minimizing the Risk of Wrong-site Dermatologic Surgery: The Five "I"s Process.

INTRODUCTION Wrong-site surgery remains a problem in surgery despite the WHO surgical checklist,1 reported as one per 100,000.2 The current process is nonspecific and does not form part of the process management.2 NHS England reports that 27.4% of general surgical never events were related to wrong skin condition surgery.3 Within dermatologic surgery, this impacts skin lesions, assessed by one practitioner and excised by another, and is accentuated by the high-volume nature of these clinics. Anatomic risk factors include misperception of patient orientation or poorly visualized areas, for example, back, head, and neck. Patient risk factors include multiple lesions at a similar site or communication issues, for example, mental capacity or mental/ physical disabilities. Therefore, there is a need to refine the process. TECHNIQUE Here, we propose a simple five-step process, deemed the five I’s process, for all skin lesions: Ink—mark the patient preoperatively with the intended incision Image—use secure photography or the patient’s smartphone4 Inject local anesthetic along the markings Incise along the markings Illustrate the surgery graphically These principles also draw relevance to other surgical domains, for example, illustrating procedures with limited visualization, such as complex head and neck reconstruction, or marking a donor site for tendon reconstruction. Ink When consenting a patient, the incision should be marked. In skin cancer excision, marking an adequate margin of uninvolved skin often leaves a bigger defect than the patient anticipates. This also helps the surgeon plan a suitable reconstructive method. Image A photograph with a hospital-approved device or medical photography is helpful, enabling the patient to understand the surgical plan and help to provide informed consent. For reconstruction of a scalp defect, a local flap requires more extensive incisions resulting in a larger postoperative wound but is likely to be more aesthetic in the long term. However, a patient may prefer coverage with a skin graft despite a contour defect and no hair growth from the grafted area for a simpler wound. Consent must be taken beforehand to ensure patient privacy and data protection compliance. Photographs should be securely stored and accessed via a centralized system, which most centers have. The UK has no restrictions for photography using a patient’s phone; however, this practice varies from country to country. Inject The first pause in the WHO checklist is to avoid wrong-site injections. Local anesthetic should be infiltrated along the inked lines. Preoperative markings of local flaps/sites for skin grafts help anticipate the type and volume of local anesthetic required. Incise The second surgical pause of the WHO checklist is incise. Then, the skin should be cut along the marked lines. Illustrate An illustration drawn on the operation note clarifies the exact surgical site and reconstruction method. This documentation should be uploaded to a centralized system or be available during follow-up to aid continuity of care, particularly if done by another physician or by virtual means. CONCLUSION The five I’s process is a memorable method to supplement the WHO checklist and minimizes miscommunication between patients and surgeons, and therefore, wrong-site surgery (Fig. 1). (See Video [online], which displays the five I’s process in the preoperative management of a patient.)Fig. 1.: This figure details the five I’s process. {"href":"Single Video Player","role":"media-player-id","content-type":"play-in-place","position":"float","orientation":"portrait","label":"Video 1.","caption":"This video displays the Five I’s in the preoperative management of a patient.","object-id":[{"pub-id-type":"doi","id":""},{"pub-id-type":"other","content-type":"media-stream-id","id":"1_4thb82k2"},{"pub-id-type":"other","content-type":"media-source","id":"Kaltura"}]}

Accounting for Indeterminacy: The Trouble with Transparency(ies) in Data Protection Compliance Work

Accounting for Indeterminacy: The Trouble with Transparency(ies) in Data Protection Compliance Work

Data cart – designing a tool for the GDPR-compliant handling of personal data by employees

ABSTRACT Employees who process personal data as part of their job play a critical role in protecting privacy. They are expected to follow strict data protection guidelines and protect personal data adequately. However, few studies have addressed the needs of these employees in terms of appropriate tools to assist them in complying with privacy laws. To develop a suitable tool, we used a human-centred design approach and held a series of eight workshops with 19 employees from two German public institutions. Based on the metaphor of a data cart, we developed a concept for a tool that supports employees in data management and data protection compliance. Qualitative usability testing revealed that participants expected the tool to raise their data protection awareness, reduce errors, and increase work efficiency. Our findings also suggest that if Privacy by Design becomes an integral part of digitalisation, employee perceptions of data protection may be positively altered. Employers, IT engineers, and researchers benefit from gaining insights into ways to improve the usability of data protection compliant personal data management tools. Simultaneously, we highlight how they can improve and promote compliance.

Data Protection Compliance Organizations (DPCO) Under the NDPR, and Monitoring Bodies Under the GDPR: Two Sides of the Same Compliance Coin?

The European Union (EU) Data Protection Directive (DPD) was repealed for its failure to achieve the anticipated level of regulatory compliance thereby paving the way for General Data Protection Regulation (GDPR) which came with a number of novelties including the introduction of monitoring bodies (MBs) as another layer of compliance enforcement with provisions of the GDPR through sector-specific codes of conduct (CoC). While the DPD also had a provision on CoC, it was bereft of its enforcement mechanism, success indicators and workability, hence the introduction of MBs as an additional player in the GDPR-enforcement ecosystem to ensure compliance with the CoC on the one hand and sanction violations on the other. Conversely, on the other side of the Mediterranean Sea, Nigeria issued its own version of the GDPR as ‘Nigeria Data Protection Regulation’ (NDPR) and introduced its own peculiar MB styled ‘Data Protection Compliance Organization’ (DPCO) to, interestingly, on behalf of the National Information Technology Development Agency (NITDA) ensure and monitor compliance with the NDPR and at the same time forge a fiduciary relationship with the controllers as their paid auditors. This article places the European concept of MBs and Nigerian novelty of DPCOs side by side while examining the relationship between the two similar yet asymmetric concepts. The article analyses the varying issues surrounding the nature, appointment or creation, powers, and functionalities of MBs and DPCOs under the European and Nigerian regulations. Nigeria, Nigeria Data Protection Regulation, NDPR, National Information Technology Development Agency, NITDA, Data Protection Compliance Organization, DPCO

Balancing Competing Interests in the Reidentification of AI-Generated Data

AI systems generate valuable analytical information from (apparently) non-personal data with vast economic consequences. This information generated from non-personal data provides a competitive edge which serves as a key rationale for its appropriation to the exclusion of others. The proliferation of AI has made it possible for non-personal data (including anonymised data) to result in the reidentification of natural persons. There have been propositions from various quarters for the protection of non-personal data by Intellectual Property Rights (IPR). Should AI-generated data be protected by IPR, this can potentially result in data protection concerns in the event of data reidentification that singles out natural persons. This might particularly occur where reidentified data leads to the identification of natural persons in circumstances where the applicability of data protection law had neither been contemplated nor anticipated. This article highlights the concerns that might arise in the event of data reidentification and how this might raise interesting challenges for data protection compliance. Keywords: AI | AI-Generated Data | Reidentification | Intellectual Property Rights

Short-term oestrogen as a strategy to prevent postpartum depression in high-risk women: protocol for the double-blind, randomised, placebo-controlled MAMA clinical trial

IntroductionPostpartum depression affects 10%–15% of women and has a recurrence rate of 40% in subsequent pregnancies. Women who develop postpartum depression are suspected to be more sensitive to the rapid...

AI Training Datasets & Article 14 GDPR

[Purpose] At the earliest stages in AI lifecycle, training, verification and validation of machine learning and deep learning algorithm require vast datasets that usually contain personal data, which however is not obtained directly from the data subject, while very often the controller is not in a position to identify the data subjects or such identification may result to disproportionate effort. This situation raises the question on how the controller can comply with its obligation to provide information for the processing to the data subjects, especially when proving the information notice is impossible or requires a disproportionate effort. There is little to no guidance on the matter. The purpose of this paper is to address this gap by designing a clear risk-assessment methodology that can be followed by controllers when providing information to the data subjects is impossible or requires a disproportionate effort. [Methodology] After examining the scope of the transparency principle, Article 14 and its proportionality exemption in the training and verification stage of machine learning and deep learning algorithms following a doctrinal analysis, we assess whether already existing tools and methodologies can be adapted to accommodate the GDPR requirement of carrying a balancing test, in conjunction with, or independently of a DPIA. [Findings] Based on an interdisciplinary analysis, comprising theoretical and descriptive material from a legal and technological point of view, we propose a risk-assessment methodology as well as a series of risk-mitigating measures to ensure the protection of the data subject's rights and legitimate interests while fostering the uptake of the technology. [Practical Implications] The proposed balancing exercise and additional measures are designed to facilitate entities training or developing AI, especially SMEs, within and outside of the EEA, that wish to ensure and showcase the data protection compliance of their AI-based solutions.

Sociodemographic characteristics determine download and use of a Corona contact tracing app in Germany-Results of the COSMO surveys.

During the SARS-CoV-2 pandemic mobile health applications indicating risks emerging from close contacts to infected persons have a large potential to interrupt transmission chains by automating contact tracing. Since its dispatch in Germany in June 2020 the Corona Warn App has been downloaded on 25.7 Mio smartphones by February 2021. To understand barriers to download and user fidelity in different sociodemographic groups we analysed data from five consecutive cross-sectional waves of the COVID-19 Snapshot Monitoring survey from June to August 2020. Questions on the Corona Warn App included information on download, use, functionality, usability, and consequences of the app. Of the 4,960 participants (mean age 45.9 years, standard deviation 16.0, 50.4% female), 36.5% had downloaded the Corona Warn App. Adjusted analysis found that those who had downloaded the app were less likely to be female (Adjusted Odds Ratio for men 1.16 95% Confidence Interval [1.02;1.33]), less likely to be younger (Adjusted Odds Ratio for age 18 to 39 0.47 [0.32;0.59] Adjusted Odds Ratio for age 40 to 64 0.57 [0.46;0.69]), less likely to have a lower household income (AOR 0.55 [0.43;0.69]), and more likely to live in one of the Western federal states including Berlin (AOR 2.31 [1.90;2.82]). Willingness to disclose a positive test result and trust in data protection compliance of the Corona Warn App was significantly higher in older adults. Willingness to disclose also increased with higher educational degrees and income. This study supports the hypothesis of a digital divide that separates users and non-users of the Corona Warn App along a well-known health gap of education, income, and region.

EU Data Protection Regulation and How It Affects Arbitration and ADR-ODR

On May 2018 a European Regulation, with direct force to all European Members, was in action. The General Data Protection Regulation, EU2016/679. A severe Regulation that was published in 2016 and set a 2-year period of time for all the Member States to be adjusted. This text, that implies huge fines for noncompliance, also affects the ADR mechanisms, like Arbitration, Mediation, etc. There is a paramount importance Principle of accountability, that GDPR implies, which requires data controllers to take personal responsibility for data protection compliance and record the measures they take to comply with their data protection obligations. Even almost 3 years have passed, the issues still remain: How is the interaction between ADR and GDPR? Which are the roles of the actors of alternative dispute resolution methods, and due to these roles which are the responsibilities? What is considered a lawful process, in accordance with GDPR, during the procedure of an ADR mechanism? It is also paramount to take into consideration, that the scope of that European Regulation affects directly even actors of non-EU territory, according to article 3.2 & 3 GDPR: 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: - the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or – the monitoring of their behavior as far as their behavior takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

The landscape from above: Continuous cloud monitoring for continuous assurance

The concept of monitoring information system security has long been recognised as sound and valuable management practice. For additional consideration, a large portion of compliance requirements for information security and privacy are supported by such monitoring. Security programmes must be aligned with privacy and compliance programmes to ensure those areas of data protection compliance are appropriately met and monitored, and then actions based on maturity levels must be aligned with information assurance programmes. Some key areas to consider in information security programmes include: 1) Continuous assurance (full data life cycle, continuous monitoring, continuous awareness, continuous compliance, challenges, benefits); 2) continuous supply chain management (continuous vendor management and oversight, benefits, challenges); 3) continuous cloud assurance (private cloud, community cloud, public cloud, hybrid cloud); and 4) continuous improvement (what is involved and necessary, including actions, monitoring and metrics). This paper posits that organisations, building out their digital transformation strategies, must think strategically about the way in which they manage privacy compliance in the cloud, committing to a data-driven continuous assurance privacy programme which would provide a more robust compliance posture.

Blockchain and the GDPR: Coexisting in contradiction?

The recent adoption of the General Data Protection Regulation (GDPR) has fundamentally altered the legal landscape in the European Union and beyond with respect to data protection. Organisations that process personal data must ensure their data-processing practices are compliant with the requirements of the GDPR, irrespective of the technology used. The use of new technologies to process personal data can lead to additional complexities from a compliance perspective, particularly where the technology has intrinsic features that appear to be at odds with certain fundamental requirements of data protection law. This is an issue that applies to the use of blockchain technology as key features of the technology do not, at first glance, appear to be consistent with the requirements of the GDPR. While it is accurate to state that the GDPR has created some challenges regarding the adoption of blockchain technology to process personal data, these challenges are not necessarily insurmountable. This paper discusses the most pertinent challenges to the adoption of blockchain technology from a data protection compliance perspective.