Data Protection Impact Assessment Research Articles

Data Protection Impact Assessment under the EU General Data Protection Regulation: A feminist reflection

Can the Data Protection Impact Assessment (DPIA) under Article 35 General Data Protection Regulation (GDPR) address the power imbalances between those in control of information and the most vulnerable and marginalised persons to whom this information refers? Put another way, can DPIA be considered a feminist tool?Whilst data protection scholars and regulators consider DPIA a promising instrument for the protection of the fundamental rights threatened by personal data processing, particularly when performed by automated systems, a feminist critique thereof, essential to comprehensively evaluate whether such optimism is justified, is still missing. This contribution addresses this knowledge gap using a combination of doctrinal and non-doctrinal analysis, feminist legal methods and intersectionality.Building on the state of the art about DPIA, I revisit its advantages and drawbacks through feminist lenses, concluding that DPIA cannot be considered a feminist tool as such. Yet, it could still serve feminist goals and become an empowering instrument for data subjects. For that, my proposals are to incorporate feminist legal methods and intersectionality principles in the process and to conceptualise a “right to DPIA”.

Visual digital data, ethical challenges, and psychological science.

Digital visual data afford psychologists with exciting research possibilities. It becomes possible to see real-life interactions in real time and to be able to analyze this behavior in a fine-grained and systematic manner. However, the fact that faces (and other personally identifying physical characteristics) are captured as part of these data sets means that this kind of data is at the highest level of sensitivity by default. When this is combined with the possibility of automatic collection and processing, then the sensitivity risks are compounded. Here we explore the ethical challenges that face psychologists wishing to take advantage of digital visual data. Specifically, we discuss ethical considerations around data acquisition, data analysis, data storage, and data sharing. We begin by considering the challenges of securing visual data from both public space security systems and social media sources. We then explore the dangers of bias and discrimination in automatic data processing, as well as the dangers to human analysts. We set out the ethical requirements for secure data storage, the dangers of "function creep," and the challenges of the right of the individual to withdraw from databases. Finally, we consider the tensions that exist between sensitive visual data that require extra protections and the recent open science movement, which advocates data transparency and sharing. We conclude by offering a practical route map for tackling these complex ethical issues in the form of a Privacy and Data Protection Impact Assessment template for researchers. (PsycInfo Database Record (c) 2024 APA, all rights reserved).

Automated threat modelling and risk analysis in e-Government using BPMN

Recent progress integrates security requirements into BPMN, enhancing its framework. Extensions aim to seamlessly embed security concepts, yet the inherent ambiguity of security terms may lead to misinterpretations and vulnerabilities. Unfortunately, many business process experts lack the expertise to accurately interpret and integrate vital security concepts. In this study, we present an innovative automated methodology tailored to assist business process experts in identifying security threats and conducting risk assessments, particularly in the context of e-Government processes. Our approach streamlines the process, requiring only a business specialist to annotate BPMN entities with high-level, non-security-related information. Based on these annotations, potential threats to the system can be automatically identified. To develop our methodology, we leverage the standard BPMN annotation mechanism. From the annotated BPMN, the methodology utilises the ENISA Threat Landscape knowledge base for threat identification and employs the OWASP Risk Rating Methodology for risk assessment. To demonstrate the effectiveness of our approach, we applied it to a straightforward case study within the e-Government domain. Through this example, we illustrate how our methodology can be employed to ensure compliance with the General Data Protection Regulation and meet the mandatory Data Protection Impact Assessment requirements.

Research development needs of pharmacists in the North of England: a cross-sectional survey

Abstract Introduction Research drives safe and cost-effective practice, innovation and quality care. The national workforce directive calls for integration of research into healthcare roles1; however, pharmacist research is typically undertaken by a minority of highly motivated individuals2. Inclusion of research learning outcomes in all three Royal Pharmaceutical Society (RPS) curricula make it an essential component of pharmacist practice throughout career development; however, prospective consultant pharmacists may lack confidence in demonstrating capability3. Aim To describe research experience, perceptions of barriers and enablers, and confidence with meeting RPS research learning outcomes in pharmacists across all sectors and stages of career development in the North of England. Methods A cross-sectional survey, designed and piloted using Jisc Online Surveys, was circulated by email to Health Education England (HEE) North School of Pharmacy and Medicines Optimisation (SoPMO)* mailing list subscribers and posted on social media for completion during March 2023. Data were collected on demographics, research qualifications and research experience. Respondents were asked to prioritise barriers and enablers from existing literature according to personal experience. Confidence with meeting research learning outcomes in the Post-registration Foundation, Core Advanced and Consultant Pharmacist curricula was self-assessed using a 5-point Likert scale. Descriptive statistics were performed using Microsoft Excel®. The NHS Health Research Authority tool confirmed ethical approval was not required for this service evaluation. A Data Protection Impact Assessment was completed. *now North West SoPMO and North East and Yorkshire SoPMO, NHS England Workforce Training and Education Results There were 250 responses from pharmacists in all seven North of England Integrated Care Systems. Respondents had been practising for a median of 14 years. 54 (22%) had a postgraduate qualification with a research component and 162 (65%) had experience of research and/or quality improvement. 164 (67%) had no protected time for research and 200 (80%) did not routinely discuss research during annual appraisal. Lack of time within working hours was the most frequently reported ‘top three’ barrier (171, 68%), followed by prioritisation of clinical duties (128, 51%) and lack of knowledge (79, 32%). Key enablers were protected time (158, 63%) and access to mentorship (154, 62%). The proportion who self-assessed as ‘confident’ or ‘really confident’ that they could provide evidence to demonstrate all research learning outcome(s) in each curriculum was 106 (42%) for Post-registration Foundation; 52 (21%) for Core Advanced and 22 (9%) for Consultant Pharmacist. Discussion/Conclusion Despite 85% of respondents practising for 5 years or more, confidence in meeting the most fundamental research learning outcome in the Post-registration Foundation curriculum was low and decreased across the continuum of practice. Barriers and enablers were perceived around capability (knowledge and skills), opportunity (protected time; prioritisation of clinical duties) and motivation (access to mentorship). Limitations include a potential over-estimation of confidence, due to pharmacists with research experience being more likely to complete the survey, and the use of self-reporting, which relies on respondent introspection. Initial Education and Training (IET) reforms will better equip future pharmacists for research; however, coordinated strategies, simultaneously addressing identified barriers, are required to bridge the skill gap for much of the existing workforce.

An Open-Source Software Tool to Facilitate Data Protection Impact Assessments

In the realm of medical research, preserving patient privacy while facilitating effective research and collaborations poses a significant challenge. Data protection impact assessments (DPIAs) and associated methodologies have emerged as a response to this dual imperative. DPIAs necessitate expertise across diverse domains, resulting in a complex procedural landscape. To address this, we present “DPIA click&go”, a user-friendly tool designed to streamline the DPIA process in a plug-and-play manner. This tool enables users to semi-automatically select risks from predefined categories, construct evaluation matrices, access risk-mitigating measures, and re-evaluate risks after the application of mitigation strategies. Tailoring risks and measures to each institute’s needs is essential, facilitated by the provided data model, considerably simplifying DPIA creation at an institutional level. The efficacy of the DPIA click&go tool was validated with a real-world project, comparing its performance with a manually created DPIA in terms of risk coverage and mitigation strategies. The promising outcomes of this tool underscore its potential within the national data protection landscape, suggesting its possible foundational role in harmonizing data protection practices at a larger, potentially, European or global, scale.

지능정보사회에서 사회보장 영역의 정보화와 기본권 보호

In the field of social security, the transition to the ‘Digital Welfare States’ is accelerating as we detect fraud, and discover welfare blind spots using intelligent information technology. However, this can increase concerns about privacy protection and the advent of a surveillance society, and fixation of prejudice. The balance between innovation using new technologies and protection of fundamental rights is raised as an important task. In relation to these issues, this paper analyzes the Hague District Court’s case on the System Risk Indication (SyRI) to examine the impact of informatization in the social security area on the guarantee of basic rights and the implications to South Korea related to the direction of normative response to it.
 SyRI is a legal instrument used by the Dutch government to detect various forms of fraud, including social benefits, allowances, and taxes fraud. The court has ruled that the legislation regulating the use of SyRI does not comply with Article 8 of the European Convention on Human Rights (ECHR), which protects the right to respect for private and family life, home and correspondence. The court has decided that the legislation does not strike a fair balance, as required under the ECHR, which would warrant a sufficiently justified violation of private life. In that respect, the application of SyRI is insufficiently transparent and verifiable.
 The SyRI case has an important meaning for many countries pursuing a digital welfare state in that it warned of such dangers regarding the digitalization of welfare, which has been promoted with only the convenience and efficiency of social security administration. Even if it is need to use intelligent information technology for a legitimate purpose, it can cause various risks and side effects, so we must first establish a legal basis through sufficient social discussion and agreement. In addition, rather than obsessing over efficiency and administrative convenience, it is necessary to think about fundamental measures to solve the problems of fraud and blind spots in the social security field, and focus on using technology for this purpose. Also, the legislation should accommodate enhanced transparency regarding risk models and algorithms, provision of information to the data subjects, objective evaluation procedures for the need for data processing and the adequacy of the process, and data protection impact assessment. Through this, it will be possible to prevent damage to constitutional values such as human autonomy, the right to self-determination of personal information, the privacy or the right to respect for private life, and equality, and to minimize restrictions on fundamental rights.

Data Privacy Regulations in Ghana: A Guide to GDPR Compliance for Businesses

The protection of personal data is a top priority for both individuals and organizations in the modern digital world. In the Ghanaian context, strict data privacy laws are essential to protecting citizens' rights and privacy. The legal foundation for these restrictions is the 1992 constitution of Ghana and Data Protection Act, specifically the Data Protection Act, 2012 (Act 843), which establishes the guidelines for legitimate data processing, the responsibilities of data controllers and processors, and the rights of data subjects. Compliance with local laws, however, may not be sufficient for enterprises operating on a worldwide scale or in international marketplaces as a result of the fact that globalization and digitalization cut across national boundaries. This article delves into Ghana's complex data privacy landscape, illuminating key points and providing suggestions for how businesses can improve their data protection practices by adhering to internationally recognized data protection standards like the General Data Protection Regulation (GDPR) of the European Union. Understanding the fundamental principles of Ghana's Data Protection Act, the scope and applicability of GDPR in Ghana, the importance of data mapping and inventory, the function of Data Protection Impact Assessments (DPIAs), consent and the rights of data subjects, data security and breach notification, and the potential sanctions for non-compliance are some of the key areas of focus. Readers can obtain a profound awareness of Ghana's data privacy landscape and the procedures necessary to successfully align with national and international data protection regulations by navigating this in-depth exploration. Businesses that prioritize compliance with data protection regulations in Ghana are better positioned not only to meet legal requirements but also to foster trust, drive innovation, and contribute to the nation's digital advancement on the global stage. In an ever-evolving digital world where data privacy is paramount.

On defense of “ethification” of law: How ethics may improve compliance with the EU digital laws

In recent years, academics and professionals witness the rise of the “ethification” of law, specifically in the area of ICT law. Ethification shall be understood as a proliferation of moral principles and moral values in the legal discourse within the areas of research, innovation governance, or directly enforceable rules in the industry. Although the ethical considerations may seem distant from mere regulatory compliance, the opposite is true. The article focuses on the positive side of the “ethification” of digital laws through the lens of legal requirements for impact assessments pursuant to General Data Protection Regulation and conformity assessments in the proposal for the Artificial Intelligence Act. Authors argue that ethical considerations are often absent in the context of using new technologies including artificial intelligence, yet they may provide additional value for organizations and society as a whole. Additionally, carrying out ethics-based assessments is already in line with existing regulatory requirements in the fields of data protection law and proposed EU AI regulation. These arguments are reflected in the context of facial recognition technology, where both data protection impact assessment under the EU General Data Protection Regulation and conformity assessment under the proposal of the EU Artificial Intelligence Act will be mandatory. Facial recognition technology is analyzed through the ethics-based assessment involving stakeholder analysis, data flows map, and identification of risks and respective countermeasures to show additional insights that ethics provides beyond regulatory requirements.

DPIA for Cloud-based Health Organizations in the context of GDPR

The General Data Protection Regulation is the core instrument of the reformed legal framework for personal data protection in the European Union. The GDPR was put into effect on May 25, 2018, and requires assessing and conducting a Data Protection Impact Assessment for processing operations that are likely to result in a high risk to the rights and freedoms of natural persons, specifically using new technologies and considering the nature, scope, context, and purposes of the processing. Although GDPR does not precisely specify the types of processing activities for which a DPIA would be necessary, through the guidelines that it provides, the organization should conduct a DPIA, if there is large scale processing of health data. An example of this, is a Cloud-based Health Organization. Taking into account this parameter, that Cloud-based Health Organization processes personal data that could impact the freedoms and rights of a data subject under the GDPR and that the GDPR does not specify a DPIA process to follow, instead it allows organizations to use a framework that complements their existing processes, this paper presents the last two steps of a DPIA study for a Cloud-based Health Organization and provides guidelines on how to carry them out effectively. This study is part of a project for the compliance of Cloud-based Health Organizations with the General Data Protection Regulation 2016/679. For fulfilling the objectives of this study, the PIA-CNIL methodology is applied, which is in accordance with the data privacy impact assessment that has been described in ISO/IEC 29134. The main contribution of this work is the development of a guide that is designed to help Cloud-based Health organizations identify, analyze and reduce data protection risks in relation to their processing activities. More analytically, this research presents the risks that could be materialized by the data processing activities carried out by a Cloud-based Health Organization regarding its Processing Activities and could have an impact on the fundamental rights and freedoms of natural persons.

Algorithmic management: Assessing the impacts of AI at work

Algorithmic outputs are increasingly shaping the employee experience, presenting a host of risks and impacts with far-reaching consequences. This contribution considers how algorithmic impact assessments should complement, as well as inform, an overarching ‘top-down’ framework for the governance of algorithmic management systems. While generalised obligations are crucial, identifying risk mitigations on a case-by-case basis can provide significant added value by (i) identifying and evaluating risks and impacts, and facilitating context-specific responses; (ii) striking a balance between generalised requirements and complete self-regulation; and (iii) ensuring that due regard to anticipated impacts and risk mitigation is built in from the design and development stages, through to deployment in the workplace. The criteria for an effective impact assessment obligation in the algorithmic management context are identified, including the appropriate stages, actors, and procedure. The Good Work Charter, which operates as a synthesis of legal principles, rights, and obligations, as well as ethical principles as they apply to the workplace, is proposed as an assessment framework. Finally, the article compares the proposed model with the existing obligation to carry out data protection impact assessments for high-risk data processing. The shortcomings of the latter obligation are explored, and a legislative approach to avoid duplication is proposed.

Identifying and quantifying trade-offs in multi-stakeholder risk evaluation with applications to the data protection impact assessment of the GDPR

Cybersecurity risk management consists of several steps including the selection of appropriate controls to minimize risks. This is a difficult task that requires to search through all possible subsets of a set of available controls and identify those that minimize the risks of all stakeholders. Since stakeholders may have different perceptions of the risks (especially when considering the impact of threats), conflicting goals may arise that require to find the best possible trade-offs among the various needs. In this work, we propose a quantitative and (semi-)automated approach to solve this problem based on the well-known notion of Pareto optimality. For validation, we show how a prototype tool based on our approach can assist in the Data Protection Impact Assessment mandated by the General Data Protection Regulation on a simplified—but realistic—use case scenario. We also evaluate the scalability of the approach by conducting an experimental evaluation with the prototype with encouraging results.

Conducting a Data Protection Impact Assessment in Health Science: A Comprehensive Guide

Conducting a Data Protection Impact Assessment in Health Science: A Comprehensive Guide

Conducting a Data Protection Impact Assessment in Health Science: A Comprehensive Guide

Conducting a Data Protection Impact Assessment in Health Science: A Comprehensive Guide

Prioritising Command-and-Control Over Collaborative Governance: The Role of the Information Regulator Under the Protection of Personal Information Act

Although the Protection of Personal Information Act 4 of 2013 (POPIA) wholeheartedly adopts the command-and-control features of the EU General Data Protection Regulation (GDPR), POPIA does not include many of the collaborative governance mechanisms in the GDPR. POPIA dilutes the accountability requirements in the GDPR. It rarely requires responsible parties to generate or keep documentation and there is no equivalent of European Data Protection Impact Assessments in the South African Act. This affects the regulation of automated processing that involves profiling. The European system of certifications is also not included in POPIA. POPIA includes a system of codes of conduct but even they have a more peremptory nature. The absence of collaborative governance mechanisms in POPIA constitutes a missed opportunity to build a culture of enhanced data protection in South Africa. The Information Regulator has the task of giving many exemptions and prior-approvals under the Act. The newly constituted Information Regulator will find itself exposed as it faces a particularly difficult mandate.

7-Steps medication reviews: analysis of medicine changes in acute medical wards

Abstract Introduction In Northern Ireland, medication errors cause 20 patient deaths, lead to around 800 non-elective hospital admissions and cost £1.9 million annually.1 The iSIMPATHY (implementing Stimulating Innovation in the Management of Polypharmacy and Adherence Through the Years) project is an EU-funded partnership between Scotland, Ireland and Northern Ireland delivering medication reviews using the 7-Steps medication review tool and asking ‘what matters to you?’ 2 The iSIMPATHY 7-Steps review is a new research study in Northern Ireland. Aim To identify medicine changes made by an independent prescribing pharmacist during 7-Steps medication reviews. Method Medication reviews were delivered on acute medical wards in the Northern Health and Social Care Trust. No patients were excluded from reviews, however reviews were targeted at patients aged 50 years and older and resident in a care home, approaching the end of their lives, prescribed 10 or more medicines or on high-risk medication. Data on medication changes made during 192 medication reviews was collected and analysed to identify the numbers and types of medicines stopped, started and doses altered. Ethical approval was not required, an approved Data Protection Impact Assessment was in place. Results Mean number of medicines per patient pre- and post-review were 12.2 and 12.3 respectively. Medicines were stopped in 49% of patients, dose decreased in 36%, changed to a more appropriate medicine in 15%, dose increased in 15% and new medicines started in 55%. Medicines stopped included opioids and gabapentenoids (18%), nutritional and electrolyte supplements (15%), items for comfort (9%), antidepressants (including amitriptyline for pain) (10%), antihypertensives and diuretics (8%), bladder anticholinergics and mirabegron (5%), laxatives (4%), betahistine (3%), quinine (2%). Dose decreases were made for analgesics including opioids (28%), PPI/H2RA (23%), anticoagulants (13%), statins and fibrates (6%), antihypertensives (6%), benzodiazepines and z-drugs (5%), antidiabetics (3%). Dose increases were made for anticoagulants and items for comfort (both 26%), laxatives (24%), pancreatin (15%), nutritional and electrolyte supplements (9%). Medicines started included nutritional and electrolyte supplements (45%), medicines for comfort (19%), laxatives (15%), nicotine replacement (7%), PPI/H2RA (2%), bisphosphonates (2%). Discussion/Conclusion The 7-STEPS medicine reviews led to important medicine changes while the number of medicines following review remained the same. The person-centred, holistic approach facilitated identification and actioning of the medicine changes that mattered to individual patients. Stopped and decreased dose medicines included high risk medicines, those likely to cause adverse effects or high anticholinergic burden and medicines no longer needed or effective for the individual. Medicine doses were increased for high risk medicines, to ensure sufficient nutritional, electrolyte and enzyme replacement and items for comfort for example constipation. Importantly, unmet therapeutic needs were identified and new medicines were prescribed to address these needs, for example, acid suppressants, bisphosphonates, anticoagulants, statins, antidiabetics, nicotine replacement therapy and for patient’s comfort including pain relief. Limitations include results may not be reflective of all hospital patients as set in an acute setting and through the iSIMPATHY project.

Practical fundamental rights impact assessments

Abstract The European Union’s General Data Protection Regulation tasks organizations to perform a Data Protection Impact Assessment (DPIA) to consider fundamental rights risks of their artificial intelligence (AI) system. However, assessing risks can be challenging, as fundamental rights are often considered abstract in nature. So far, guidance regarding DPIAs has largely focussed on data protection, leaving broader fundamental rights aspects less elaborated. This is problematic because potential negative societal consequences of AI systems may remain unaddressed and damage public trust in organizations using AI. Towards this, we introduce a practical, four-Phased framework, assisting organizations with performing fundamental rights impact assessments. This involves organizations (i) defining the system’s purposes and tasks, and the responsibilities of parties involved in the AI system; (ii) assessing the risks regarding the system’s development; (iii) justifying why the risks of potential infringements on rights are proportionate; and (iv) adopt organizational and/or technical measures mitigating risks identified. We further indicate how regulators might support these processes with practical guidance.

Modeling ecosystems of reference frameworks for assurance: a case on privacy impact assessment regulation and guidelines

To assure certain critical quality properties (e.g., safety, security, or privacy), supervisory authorities and industrial associations provide reference frameworks such as standards or guidelines that in some cases are enforced (e.g., regulations). Given the pace at which both technical advancements and risks appear, there is an increase in the number of reference frameworks. As several frameworks might apply for same systems, certain overlaps appear (e.g., regulations for different countries where the system will operate, or generic standards in conjunction with more concrete standards for a given industrial sector or system type). We propose the use of modelling for alleviating the complexity of these reference frameworks ecosystems, and we provide a tool-supported method to create them for the benefit of different stakeholders. The case study is based on privacy data protection, and more concretely on privacy impact assessment processes. The European GDPR regulates the movement and processing of personal data, and, contrary to available software engineering privacy guidelines, articles in legal texts are usually difficult to translate to the underlying processes, artefacts and roles that they refer to. To facilitate the mutual comprehension of legal experts and engineers, in this work we investigate how mappings can be created between these two domains of expertise. Notably, we rely on modelling as a central point. We modelled the legal requirements of the GDPR on data protection impact assessments, and then, we selected the ISO/IEC 29134, a mainstream engineering guideline for privacy impact assessment, and, taking a concrete sector as example, the EU Smart Grid Data Protection Impact Assessment template. The OpenCert tool was used for providing technical support to both the modelling and the creation of the mapping models in a systematic way. We provide a qualitative evaluation from legal experts and privacy engineering practitioners to report on the benefits and limitations of this approach.

Article: Data Protection Impact Assessment for Unmanned Aircraft Systems Operations in Kenya: Past, Present and Future Perspectives

Data Protection is concerned with the processing of personal information of individuals within a regulated sphere, taking into account protected rights. It principally underscores that the operations of unmanned aircraft systems (UAS) should be in an environment that appreciates the established canons of data protection. UAS operations pose a potential threat to an individual’s privacy, the human right that anchors the protection of personal data. This article examines what the present and future hold for data protection impact assessment (DPIA) in regulation of UAS. The article discusses the impact that the history of UAS Regulation has had on the regulation on data protection challenges. It then proceeds to highlight how the data protection agenda took a significant place in the UAS regulation in other areas and in Kenya. Towards this end, an assessment of the legal development is made. Even then, it does appear that, despite this milestone in UAS technology and law, regulators still have to contend with many issues on how to approach the sacrosanct element of privacy in UAS operations. Against this backdrop, this article sees into the future and suggests how the emerging practice and policy on DPIA as a risk-based strategy can be harnessed and streamlined to minimize the exposure related to processing of personal data by the UAS operators or in the course of UAS operations. Among many others, this article finds that UAS operators, who can be categorized as either data controllers or data processors, are, therefore, required to interrogate their mandate in ensuring that they are in full compliance with the law. Data protection, UAS, DPIA, Kenya, Privacy, Law, Regulation, KCAA, Risk, DPIA, ODPC

The who, what, why and when of data protection impact assessments

Despite their importance, misunderstandings about Data Protection Impact Assessments (DPIAs) are a common stumbling block for many businesses. So what do you need to know about them?

Artificial intelligence in health care: data protection concerns in Malaysia

Abstract • The application of artificial intelligence (AI) has transformed the existing notion of the health care system. The concept of AI is not new, but increasing computational power and big data, the Internet of Things, and advanced analytical power ushers in new opportunities to realize the full potential of AI. Recently, there has been an increased application of AI in the health care system, potentially raising questions about patient safety, privacy, security, and confidentiality, specifically data protection. • The present study focuses on the effectiveness of the Malaysian data protection law in addressing the issue of health data protection in the wake of proliferated use of AI in the health care system. The Malaysian Personal Data Protection Act (PDPA) has to face challenges in applying AI because the data processing mechanism of AI has fundamentally challenged the adequacy and sustainability of present data protection principles and associated rights of individuals. • However, as nearly a decade-old law, the current PDPA requires some amendments to its provisions, for instance, the introduction of the mandatory requirement of data protection impact assessment and privacy by design for high-risk data (ie health data) processing and human involvement in automated decision-making process among others. Besides, ensuring more accountability and transparency on the part of the data users by introducing a comprehensive code of practice about the processing of health data would help data users comply with data protection legislation.