Data Protection Legal Framework Research Articles

The Legal Framework for Personal Data Protection in the Digital Era as Fulfillment of Privacy Rights in Indonesia

In this digital era, several aspects of our lives are made easier because of the presence and development of technology. One of the examples of it is the creation of various kinds of electronic systems, whether in the form of applications, websites, or portals. In using the systems, the personal data of users is usually required for each of these electronic systems. Personal data is usually used as an identity which is needed to identify a person in the process of the electronic system. Moreover, personal data is considered a sensitive matter since it concludes the information related to a person’s identity, while this information is part of the right to privacy. It is undeniable that a person’s data can be used by irresponsible parties who can harm the owner’s data, especially regarding their privacy rights. Therefore, legal protection is needed for this data, especially in the digital era in which personal data is widely used for various purposes such as electronic systems need or purposes. This study aims to find out and analyze the ideal protection and regulation of legal concepts related to personal data as the fulfillment of privacy rights in the digital era in Indonesia.
 Keywords: legal framework, personal data, privacy rights

GDPR COMPLIANCE CHALLENGES IN CROATIAN MICRO, SMALL AND MEDIUM SIZED ENTERPRISES

The General Data Protection Regulation (EU) 2016/679 which applies uniformly since 25th May 2018 in the European Economic Area (EEA) requires small and medium enterprises (SMEs) to respect the right to personal data protection of their clients, customers, and employees. The GDPR is designed to strengthen the data protection rights of all individuals within the EEA ensuring more effective protection for consumers and increased privacy considerations for businesses. However, even after more than four years of its entry into full application, the implementation of the GDPR is still an issue for Croatian SMEs, who, unlike the larger companies, very often lack the human and financial resources to comply with the data protection legal framework. This paper covers theoretical considerations and results of an online survey conducted with 345 SMEs in the Republic of Croatia with the aim to gain insights into their GDPR compliance hurdles. The results of the study have shown that the level of understanding of obligations arising from the GDPR among Croatian SMEs is rather low and that compliance with the data protection legal framework is not at a satisfactory level.

Can legitimate interest be an appropriate lawful basis for processing Artificial Intelligence training datasets?

Precision and effectiveness of Artificial Intelligence (AI) models are highly dependent on the availability of genuine, relevant, and representative training data. AI systems tested and validated on poor-quality datasets can produce inaccurate, erroneous, skewed, or harmful outcomes (actions, behaviors, or decisions), with far-reaching effects on individuals' rights and freedoms.Appropriate data governance for AI development poses manifold regulatory challenges, especially regarding personal data protection. An area of concern is compliance with rules for lawful collection and processing of personal data, which implies, inter alia, that using databases for AI design and development should be based on a clear and precise legal ground: the prior consent of the data subject or another specific valid legal basis.Faced with this challenge, the European Union's personal data protection legal framework does not provide a preferred, one-size-fits-all answer, and the best option will depend on the circumstances of each case. Although there is no hierarchy among the different legal bases for data processing, in doubtful cases, consent is generally understood by data controllers as a preferred or default choice for lawful data processing. Notwithstanding this perception, obtaining data subjects' consent is not without drawbacks for AI developers or AI-data controllers, as they must meet (and demonstrate) various requirements for the validity of consent. As a result, data subjects' consent could not be a suitable and realistic option to serve AI development purposes. In view of this, it is necessary to explore the possibility of basing this type of personal data processing on lawful grounds other than the data subject's consent, specifically, the legitimate interest of the data controller or third parties. Given its features, legitimate interests could help to meet the challenge of quality, quantity, and relevance of data curation for AI training.The aim of this article is to provide an initial conceptual approach to support the debate about data governance for AI development in the European Union (EU), as well as in non-EU jurisdictions with European-like data protection laws. Based on the rules set by the EU General Data Protection Regulation (GDPR), this paper starts by referring to the relevance of adequate data curation and processing for designing trustworthy AI systems, followed by a legal analysis and conceptualization of some difficulties data controllers face for lawful processing of personal data. After reflecting on the legal standards for obtaining data subject's valid consent, the paper argues that legitimate interests (if certain criteria are met) may better match the purpose of building AI training datasets.

Strengthening the Legal Framework for Personal Data Protection in Nigeria

Advancement in Information Communication Technology (ICT) has brought to the fore the need for the protection of individuals’ personal data. In today’s digital age, the personal data of individuals are routinely collected and stored in databases of both private and public establishments. Such personally identifiable information can easily be analyzed with fascinating accuracy, rapidly transmitted, and put to unimaginable uses. This situation has placed the regulation of personal data collection and uses on the front burner in many nations. The weak or total absence of regulation of personal data poses serious challenges to the security of lives and property of individuals and can constitute a serious disincentive for the adoption of beneficial technology. Employing the doctrinal methodology, this article examines the legal framework for personal data protection in Nigeria with the aim of assessing the adequacy or otherwise of relevant extant regulations in protecting the personal data of Nigerians and other people doing business in Nigeria. Looking at the state of the law in some developed and developing countries, the paper notes that the current state of regulation in Nigeria is still a far cry from what obtains in most countries of the global North and some sister African countries. It, therefore, concludes that there is a compelling need for a stronger regulatory framework for data privacy in Nigeria.

The Passport to Regulate Foreign Jurisdiction: The Personal Data Protection Bill, 2019 on its Extraterritorial Application

The Indian Personal Data Protection Bill, 2019 (PDP Bill) was formulated from the Recommendations of the Justice Srikrishna Report. This Bill was the first portkey for India’s exclusive data protection regime. Notably, there is an urgent need to establish a strong legal framework for data protection in India as this would be the only safehouse for protecting every individual’s personal data, including sensitive and critical data. The EU’s General Data Protection Regulation (GDPR) serves as a yardstick for global data protection regulation due to its architecture that places a great onus of compliance on foreign entities. This resolute extraterritorial nature that GDPR thatches on itself has inspired several upcoming worldwide data protection regimes. Consequently, the Joint Parliamentary Committee, which is tasked with reviewing India’s PDP Bill, has the responsibility to upgrade its stance to be tenacious and more obstinate, as well as ensure that the Bill has a strong extraterritorial foundation. This requirement comes with a plethora of challenges under international law as questions on cross-border jurisdictions are inevitable. This paper compares the PDP Bill with the GDPR and Brasil’s Lei Geral de Proteção de Dados (LGPD) and analyzes the key challenges emerging from the extraterritorial scope of these legislations through the lens of international law. Its main objective is to identify the possible and plausible solutions to these extraterritorial jurisdictional issues and highlight how the fundamental construction of India’s PDP Bill can be improved to effectively address the extraterritorial concerns.

The Legal Framework for Data Protection in Nigeria

The Legal Framework for Data Protection in Nigeria

Financial Intelligence Units: Reflections on the applicable data protection legal framework

Financial Intelligence Units (FIUs) are key players in the current Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) legal system. FIUs are specialised bodies positioned between private financial institutions and states’ law enforcement authorities, what renders them a crucial middle link in the chain of information exchange between the private and public sectors. Considering that a large share of this information is personal data, its processing must meet the minimum data protection standards. Yet, the EU data protection legal framework is composed of two main instruments, i.e. the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED), which provide different thresholds for the protection of personal data. The aim of this paper is to clarify the applicable data protection legal regime for the processing of personal data by FIUs for AML/CFT purposes. To that end, the paper provides an overview of the nature and goals of AML/CFT policy and discusses the problem of the diversity of existing FIU models. Further, it proposes a number of arguments in favour of and against the possibility of applying either the GDPR or LED to the processing of personal data by the FIUs and reflects on how convincingly these arguments can be used depending on the specificities of a given FIU model.

The challenges and opportunities of mental health data sharing in the UK

The challenges and opportunities of mental health data sharing in the UK

The Economic Implication of the EU-UA Data Privacy Relationship on its Bilateral Digital Trade Activities

It is no longer news that the COVID-19 pandemic has had a negative impact on global economic activities. While countries continue to grapple with the seeming unending destruction of human lives caused by the pandemic, global economy continue to suffer due to the slow or lack of economic activities across the world. With restrictions imposed by countries across the globe, the pandemic has crippled traditional infrastructures deployed by countries in executing traditional cross-border bilateral trades. With the palpable fear of recession looming across the globe, coupled with the uncertainties around resumption of normal economic activities, economies of the world are learning to adapt to a “new normal” as economic activities and business relationships have transitioned online. This has contributed to the astronomical increase in internet activities by users; turning the world into a global marketplace. According to reports, worldwide digital population as of last quarter 2020 stood at 4.66 billion users . This represents almost more than half of the world’s population and a sharp increase from previous figure of 3.97 billion users. The increase in internet users has been attributed to the transition of most business activities, whether domestic or foreign, to the internet, as companies leveraged on technology and internet to provides goods and services across the globe. While the increase in internet users stimulated the global digital economy during the pandemic, it resulted to an increase the exposure of personal or business data of its users online. A situation which has exposed the inefficiencies in the data protection legal framework of some countries and, reinforced the advantage other countries have during bilateral digital trade as result of having a more robust data protection framework. This article examines the European Union (EU) and United States of America (US) data privacy relationship and the possible impact it may have on the bilateral digital trade relationship between both countries as global economy transition into digital economy. To unravel this issue, the author would examine the existing digital trade relationship between the EU and the USA and potential impact the provisions of the General Data Protection Regulation (“GDPR”) may have on same even as global economies transition to digital trade as a tool to stimulate economic activities while avoiding the spread of COVID-19.

An Examination of the Legal Framework for Data Privacy and Protection in Nigeria

An Examination of the Legal Framework for Data Privacy and Protection in Nigeria

A divided European data protection framework: a critical reflection on the choices of the European legislator post-Lisbon

The Lisbon Treaty introduced Article 16 in the Treaty on the Functioning of the European Union (TFEU), which establishes the right to data protection. Article 16 TFEU offers the legal basis for the adoption of a framework that ensures the uniform application of data protection rules in all areas of EU law. During the major reform of the secondary European data protection legal framework, the European legislator chose to adopt the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) as the main legal instruments regulating data protection, instead of opting for one single legal instrument. The GDPR and the LED are complemented with a number of provisions and acts that draw a patchwork of data protection rules depriving the European Union from a harmonised framework. This chapter explores the complex web of provisions in the EU legal framework, focusing on the EU primary law, presents the options that existed in the hands of the European legislator and makes reflections on the favouring of a divided system in European data protection regulation.

Who is responsible for data processing in smart homes? Reconsidering joint controllership and the household exemption

The growing industrial and research interest in protecting privacy and fighting cyberattacks for smart homes has sparked various innovations in security- and privacy-enhancing technologies (S/PETs) powered by edge computing. The complex technical set-up has however raised a whole series of legal issues surrounding the regulation of smart home with data protection law. To determine how responsibility and accountability should be fairly assumed by stakeholders, there is a pressing need to first clarify the roles of these parties within the existing data protection data protection legal framework. This article focuses on two legal concepts under the GDPR as the mechanisms to (dis)assign responsibilities to various categories of entities in a domestic IoT context: joint controllership and the household exemption. A close examination of the relevant provisions and case-law shows a widening notion of joint controllership and a narrowing scope for the household exemption. While this interpretative approach may prevent evasion of accountability in specific cases, it may lead to the unintended consequence of imposing disproportionate compliance burdens on developers, contributors, and users of smart home safety technologies. By discouraging users to adopt S/PETs, data protection law may likely lead to a lower level of privacy and security protection. The differential responsibilities among joint controllers as envisaged in case-law may reconcile the tensions to some degree, but certain limitations remain. The regulatory dilemma in this regard highlights some underlying assumptions of data protection law that are no longer valid with regard to a smart home, and thus calls for further conceptual and empirical studies on fair reassignment of responsibility and accountability in a domestic IoT setting.

Aarogya Setu- Carrying Your Privacy in Your Hands?

There are numerous benefits of having a data protection legislation in place to guide a nation in how to protect the personal data of individuals. These guiding factors maybe transparency, accountability, ensuring rights of the individuals, listing out organizational measures and the compliance to be undertaken, to name a few. In the current context of having contact tracing apps, it becomes all the more important to have a data protection legal framework. The article seeks to understand the privacy concerns spelled out by the Aarogya Setu App, briefly compare the same with practices across different countries and understanding the need for legislative action concerning the privacy issues. In absence of a legislation, compliance with the privacy principles is not enough. The absence of a national or applicable law that posits data protection principles, provisions and organizational measures, should not permit denial of the basic tenets and continued provision of basic minimum rights of personal data protection and privacy, which must be ensured to all individuals at all times. Finally, it must be borne in mind that the adoption of contact tracing apps will put to test the balance between state surveillance and user privacy. The need of a data protection legislation is very telling in the current times and speaks for itself.

Interoperability Between EU Policing and Migration Databases: Risks for Privacy

The interoperability initiative passed in May 2019 as Regulations (EU) 2019/817 and 818 seeks new strategies for identifying dangerous individuals who use false or multiple identities. The EU’s databases in the Area of Freedom Security and Justice (AFSJ) for policing and migration purposes will be interconnected. This constitutes a paradigm shift for purpose limitation as a core element of data protection. This article identifies regulatory patterns and shortcomings in the technical and legal data protection arrangements of the interoperability regulations. The legal framework for data protection in the EU has developed considerably with the General Data Protection Regulation (GDPR) 2016/679 and with Directive 2016/680 for policing and criminal justice. The European Data Protection Board, a multilevel accountability forum in which European and national data protection authorities cooperate has been established. From a trans-disciplinary legal, public administration, and public policy perspective, this article analyses the regulatory patterns and institutional settings established for the upcoming interoperability of databases for policing and migration. EU migration and policing databases, police information sharing, interoperability, data protection, privacy, accountability, eu-LISA, Europol, Schengen Information System, Visa Information System, EU external borders

The Personal Data Protection Bill, 2018: India’s regulatory journey towards a comprehensive data protection law

Abstract This article analyses the relevance of Personal Data Protection Bill, 2018 for developing a data protection legal framework in India. In this regard, the article attempts to analyse the evolution process of comprehensive personal data protection law in the Indian context. The manner in which the Personal Data Protection Bill, 2018 will revamp and strengthen the existing data protection regulatory framework forms the major edifice of this article. The article also dwells on the significant role played by the fundamental right to privacy judgment (Justice K.S. Puttaswamy v Union of India) of Supreme Court of India, thus preparing the regulatory ground for the evolution of the Personal Data Protection Bill, 2018. The influence of the European Union General Data Protection Regulation in shaping the Indian legal framework is highlighted. The article also discusses pertinent legal concerns that could question the effectiveness of the proposed data protection legal framework in the Indian context.

A Quick Guide on the Data Protection Regime in Nigeria

As data becomes a highly-sought commodity, more and more people are concerned about how their data is stored, processed, and transmitted. The advent of Big Data, availability of advanced data analytics tools, and surge in surveillance activities have transformed into a mass resuscitation of the desire to have data collected and processed only on legal bases and for specified purposes. Although significant progress has been made in recent time, there is currently no dedicated, principal legislation on data protection in Nigeria. In fact, until early 2019 when the National Information Technology Development Agency (NITDA) issued its Data Protection Regulation, provisions on data protection were few, incomprehensive, and dispersed in general and sector-specific legislation. This essay examines the legal framework for data protection in Nigeria and justifies the importance of an adequate data protection regime, security- and economy-wise.

GDPR Interference With Next Generation 5G and IoT Networks

This article examines the specific data protection framework with regards to 5G networks, which is the current high-end evolution of the previous four generations of cellular technology networks. Taking into consideration practical issues, that have emerged from 5G (Fifth Generation) technology, the scope is the presentation of legal solutions. As this digital mobile transformation will begin from 2020, affecting applications of a wide range of services in energy sector, transport services, banking sector, health field, as well as in industrial control systems, and progressively in everyday life through all smart devices. It is crucial to specialize and sum up the interference between European data protection legal framework and 5G networks, in order to provide a new path to the addressing issues.

An Introduction into the New Chinese Data Protection Legal Framework

Coming into effect on 1 June 2017, the Cyber Security Law of the People’s Republic of China (the ‘‘CSL’’) established the legal foundation of cybersecurity and data protection. The purpose of the law is to protect network security, maintain cyberspace and national security, safeguard public interests, and protect the legitimate rights and interests of citizens, legal persons and other organizations.

Right to Privacy, Data Protection and IOTs: An Appraisal of Legal Issues Covering Cross Border Data Transfer

This research examines the extent to which the fundamental right to privacy covers the right to data protection alongside a cursory look at the adequacy of the legal framework for cross border data transfer and its effect in Nigeria. The right to privacy is an innate fundamental human right which is globally recognized and must be protected by all states. Over the years, States have been reluctant to pay maximum attention to the threat posed by the acquisition of citizens’ personal data until recent times, especially with growing threat posed by IOTs to the privacy of users. This research will employ the doctrinal research approach with an in-depth analysis of privacy laws of the EU, US, UK and Iceland with regards to the extent to which data privacy is protected as a fundamental right to privacy. The GDPR although European has a strong legal framework for data protection and its effect on giving it as a right similar to that of privacy. Nigeria has the NITDA regulation, nonetheless, the cross-border transfer of data is important to really lock down the restriction of data, thus it should adopt the structure. In summary, the right to data protection is to be considered a fully-fledged right just as it i s in the EU d data protection are not lost to . Technological advancement occurs daily and it is the duty of the law as a normative structure to make sure that the rules of privacy an the binaries and codes of IOTs.

La revisión del régimen jurídico de la privacidad en la Unión Europea

Es conocido el momento de madurez que atraviesa el instituto de protección de datos personales en la Unión Europea, con una ambiciosa renovación de su régimen común, que obligará a revisar la regulación interna de los Estados miembros. La Directiva 95/46/ CE, del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos, tiene los días contados merced a la aprobación del Reglamento (UE) 2016/679, del Parlamento Europeo y del Consejo, de 27 de abril de 2016. El cual obedece a los nuevos retos tecnológicos y de globalización, unidos a la necesidad de una regulación homogénea directamente aplicable que evite las divergencias en la ejecución y aplicación de la Directiva, aunque no será aplicable hasta el 25 de mayo de 2018. Renovación que, también en forma de Reglamento europeo de directa aplicación, se hace extensiva a los particulares riesgos que las comunicaciones electrónicas, y, sobre todo, Internet, representan para la información personal. A la vez que se hace más exigente desde esta perspectiva la lucha común contra la delincuencia organizada y el terrorismo, según evidencian la Directiva (UE) 2016/680 de policía y la Directiva (UE) 2016/681 de transferencia de datos PNR.