Data Protection Principles Research Articles

Kewenangan Mahkamah Agung dalam Publikasi Pada Putusan Perkara Privat

This study examines the Supreme Court's authority to publish rulings on private cases and its impact on individuals' privacy rights. This authority, framed by transparency and data protection principles, is grounded in the right to public information per the Indonesian Constitution and Law No. 14 of 2008. However, publishing decisions in sensitive cases, such as divorce and domestic violence, risks violating individual privacy. This research addresses the urgent need to balance transparency and privacy by analyzing the legal basis and limitations on the Court’s authority. Through normative legal methods and legislative analysis, this study reviews key guidelines, including Supreme Court Decision No. 2-144/KMA/SK/VIII/2022, to recommend privacy protections for sensitive information in judicial rulings. Findings indicate that, despite a general obligation to disclose court decisions, exceptions must be made for sensitive data to safeguard privacy, contributing to a nuanced approach to judicial transparency.

Legal Analysis of the Notary's Role in Protecting Client Personal Data

Notaries, empowered to create authentic deeds, require client personal data to perform their duties, making this information vulnerable to misuse if not properly secured. This paper examines the obligations of notaries in protecting client data under the Personal Data Protection Act No. 27 of 2022. Using doctrinal legal research methods, it explores data protection principles, the legal framework for client rights, and how these responsibilities align with notarial duties. Findings reveal that privacy is central to data protection, with the 2022 Act providing a legal foundation for notaries to safeguard client information, emphasizing the importance of maintaining confidentiality in all deed-related activities. The Personal Data Protection Act supports notaries’ roles as data controllers and processors, linking these duties with the authority granted under the Notary Position Act. The synergy between these laws ensures that clients' data rights are upheld, and notarial responsibilities are reinforced within the legal framework.

WHO/Europe tools for strengthening health information systems

Abstract WHO/Europe offers different tools and capacity building activities to support Member States (MS) in strengthening their health information systems (HIS). These range from assessment methodologies and guidance documents to situation reports and workshops and trainings. The HIS assessment method of WHO/Europe provides an overview of the performance of the entire HIS in an MS. As such, this is often applied as a starting point for HIS strengthening activities in a country, and ideally repeated every few years to measure progress. Next to an assessment of the overall HIS, WHO/Europe also has methods for assessing specific HIS aspects, such as cybersecurity preparedness and GIS capacity. There are also several tools and capacity building activities that specifically focus on strengthening HIS digitalisation (d-HIS). For example, there is a modular d-HIS training, the programme of which can be adapted to meet specific MS needs. This also applies to the population health monitoring training that is available for interested MS. In addition, WHO/Europe has published a range of guidance documents, ranging from a comprehensive d-HIS strengthening manual to guidance on how to write an impactful health report, and guidance on how to apply data protection principles in public health. Finally, WHO/Europe supports HIS strengthening by making Regional and country-level situation reports, and by writing and contributing to scientific papers. In this presentation, first a general overview of available types of HIS strengthening tools and activities will be provided, after which the available tools and capacity building related to data protection and cybersecurity will be presented in more detail, because of the high interest WHO/Europe encounters for these topics in the Region currently.

Navigating data governance risks: Facial recognition in law enforcement under EU legislation

Facial recognition technologies (FRTs) are used by law enforcement agencies (LEAs) for various purposes, including public security, as part of their legally mandated duty to serve the public interest. While these technologies can aid LEAs in fulfilling their public security responsibilities, they pose significant risks to data protection rights. This article identifies four specific risks associated with the use of FRT by LEAs for public security within the frameworks of the General Data Protection Regulation and Artificial Intelligence Act. These risks particularly concern compliance with fundamental data protection principles, namely data minimisation, purpose limitation, data and system accuracy, and administrative challenges. These challenges arise due to legal, technical, and practical factors in developing algorithms for law enforcement. Addressing these risks and exploring practical mitigations, such as broadening the scope of data protection impact assessments, may enhance transparency and ensure that FRT is used for public security in a manner that serves the public interest.

The Privacy/Antitrust Curse: Insights from GDPR Application in Competition Law Proceedings

In response to the emergence of large online platforms whose business model revolves around the collection and processing of personal data, it is usually suggested that competition and data protection are synergistic, hence requiring an integrated approach. In this respect, Europe represents the testing ground for evaluating how privacy breaches may inform antitrust investigations. Indeed, the General Data Protection Regulation (GDPR) on the one side and the German Facebook antitrust decision on the other side are considered the benchmarks of this new stance aimed at linking market power and data power. This paper tests the concrete viability of such an approach, analyzing how data protection rules and principles have been applied in antitrust proceedings by the European Commission and national competition authorities. Notably, the paper aims at demonstrating the fallacy of the narrative which describes the relationship between privacy and antitrust in terms of synergy and complementarity. Furthermore, the paper maintains that the principles recently affirmed by the European Court of Justice in Meta do not appear conclusive in addressing the issue. The strategic use of privacy as a business justification to pursue anticompetitive advantages currently addressed in the numerous Apple ATT investigations indeed shows the tension between these areas of law. Therefore, rather than strengthening the antitrust enforcement against gatekeepers and their data strategies, the inclusion of privacy harms in antitrust proceedings turns out to be a potential curse for competition authorities, providing players with an opportunity for regulatory gaming to undermine the antitrust enforcement. JEL Codes: D83, K21, L12, L4

Keeping medical information safe and confidential: a qualitative study on perceptions of Israeli physicians

BackgroundPatients expect their information to remain confidential, and physicians have a legal and ethical obligation to keep it this way. Confidentiality is not just a legal requirement but a crucial element in establishing trust between patients and healthcare providers. Patients must feel confident that their personal and medical information is kept confidential and shared only with those who need to know. Previous studies have primarily concentrated on patients’ perceptions of medical confidentiality, data privacy, and data protection issues. However, research on the practical practices and perceptions of medical confidentiality among hospital physicians is scant, underscoring the need for a deeper understanding of this critical issue.MethodsThrough qualitative methods and as part of a large-scale study on aspects of patient dignity and responsiveness in Israel, physicians shared their views and practices on managing medical information.ResultsThe study revealed the practical challenges physicians face in upholding various aspects of data protection within hospital settings. These challenges, strategies, and deviations from data protection principles that physicians discussed are of significant practical relevance. The importance of patient consent and the practical measures for safeguarding patient information were also highlighted. While physicians acknowledged the importance of protecting patient information, they also grappled with the realities of doing so in a complex healthcare environment. In future healthcare policies, it is critical to ensure robust measures are in place to safeguard and uphold medical confidentiality. These can include specific measures to increase compliance, such as regularly monitoring compliance with confidentiality policies, producing safe and anonymous channels to voice concerns, and enforcing consequences for any breaches to ensure accountability.ConclusionsWhile protecting medical information has emerged as an important goal, it is equally crucial to strike a balance between the need to share information to advance and provide quality medical care. Physicians and policymakers must navigate this delicate balance. Additionally, organizations should strengthen compliance to enhance their monitoring and enforcement of confidentiality policies. Ineffective implementation of medical confidentiality leads to theoretical guidelines that do not translate effectively into practice.

Transparency and consent as the main principles of personal data protection in Ukraine

The rapid digitization of the modern world has led to an increase in the collection and processing of personal data. The principles of transparency and consent have become crucial for citizens to understand how their data is being used and to be able to give their voluntary consent to its processing. Ukraine is actively adapting its legislation to EU standards in the field of personal data protection. In particular, the General Data Protection Regulation (GDPR) affects approaches to data collection and processing. Examining transparency and consent in the context of these changes can help identify which aspects of the law need special attention. Citizens are becoming increasingly cautious about who they trust with their data. This article analyzes and evaluates the role and impact of the principles of transparency and consent on the effective mechanism of personal data protection in Ukraine, taking into account modern technological and legislative challenges. Studying these principles demonstrates their importance and relevance in today’s digital society. The principle of transparency determines the need for accessible and understandable information for data subjects regarding the processing of their data. Openness is a fundamental requirement for maintaining trust between organizations and citizens. Providing the ability to control and regulate their data allows data subjects to play a more active role in the processing and use of their personal data. The principle of consent, in turn, emphasizes the voluntary and informed nature of consent to data processing. The consent of the data subject determines the basis for the legal processing of personal data, ensuring harmony between the rights of citizens and the interests of organizations. As technology advances and legislation changes, transparency and consent become even more important aspects. They help build trust between organizations and citizens, ensure responsible use of personal data, and empower individuals to control their own information.

Legal Horizons of the New Artificial Intelligence Paradigm

Modern society is undergoing a structural transformation of the world economy. This is as a result of the transition to a new technological base through the introduction of artificial intelligence, cutting-edge information and communication technology, energy technology, biotechnology and nanotechnology. Artificial intelligence has the ability to significantly change the economy and social relations in society, and its newly discovered capabilities are transformational and global in nature. At the same time, the extraordinary capabilities of artificial intelligence technologies involve risks that can threaten stability and undermine human values. In order to eliminate possible threats and risks and mitigate potential dangers, it is crucial to develop systemic legal measures and ways to regulate AI technologies and models on a national and international scale and to define the legal status of AI, which must include protection of humans from the uncontrolled influence of AI and the inviolability of guarantees of human rights and freedoms. With this in mind, and in order to mitigate potential dangers and ensure the controllability and sustainability of AI technologies based on the concept of trusted (responsible) AI, it is necessary to agree on universal international guidelines for the development and application of AI technologies and models. Furthermore, it is necessary to create a universal code of conduct for AI developers, who together can create a basis for a uniform framework of legal regulation within the national legislation of each country on the principles of human rights protection, privacy and data protection, transparency and explainability, fairness, accountability and safety of artificial intelligence, adequate human oversight and ethical standards for the creation and application of AI models.

GDPR compliance via software evolution: Weaving security controls in software design

Software should comply with international privacy laws, like the General Data Protection Regulation (GDPR). However, implementing appropriate technical controls is often an error-prone and time-consuming process. This is partly due to the limited knowledge of software engineers about privacy and security. This paper proposes SoCo, a semi-automated approach to support organizations in achieving software compliance with the GDPR data protection principles. To do so, SoCo supports engineers in identifying and integrating appropriate technical controls in sequence diagrams during the design phase. SoCo includes a technique to assist engineers to identify data processing activities in software applications modeled as sequence diagrams that may need to comply with the GDPR, a catalog of privacy and security controls that engineers can use to fix non-compliant activities, and a technique to implement such controls in the non-compliant sequence diagrams. Our evaluation results show that SoCo can help software engineers identify and design appropriate security controls to address GDPR violations and required moderate manual effort when applied to a substantive open-source application.Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

DS-PACK: Tool assembly for the end-to-end support of controlled access human data sharing

The EU General Data Protection Regulation (GDPR) requirements have prompted a shift from centralised controlled access genome-phenome archives to federated models for sharing sensitive human data. In a data-sharing federation, a central node facilitates data discovery; meanwhile, distributed nodes are responsible for handling data access requests, concluding agreements with data users and providing secure access to the data. Research institutions that want to become part of such federations often lack the resources to set up the required controlled access processes. The DS-PACK tool assembly is a reusable, open-source middleware solution that semi-automates controlled access processes end-to-end, from data submission to access. Data protection principles are engraved into all components of the DS-PACK assembly. DS-PACK centralises access control management and distributes access control enforcement with support for data access via cloud-based applications. DS-PACK is in production use at the ELIXIR Luxembourg data hosting platform, combined with an operational model including legal facilitation and data stewardship.

An Overview of Privacy-Enhancing Technologies in Biometric Recognition

Privacy-enhancing technologies are technologies that implement fundamental data protection principles. With respect to biometric recognition, different types of privacy-enhancing technologies have been introduced for protecting stored biometric data which are generally classified as sensitive. In this regard, various taxonomies and conceptual categorizations have been proposed and standardisation activities have been carried out. However, these efforts have mainly been devoted to certain sub-categories of privacy-enhancing technologies and therefore lack generalization. This work provides an overview of concepts of privacy-enhancing technologies for biometric recognition in a unified framework. Key properties and differences between existing concepts are highlighted in detail at each processing step. Fundamental characteristics and limitations of existing technologies are discussed and related to data protection techniques and principles. Moreover, scenarios and methods for the assessment of privacy-enhancing technologies for biometric recognition are presented. This paper is meant as a point of entry to the field of data protection for biometric recognition applications and is directed towards experienced researchers as well as non-experts.

Beyond compliance: The impact of data protection on statistical excellence – A view from the 2021 Population-Housing Census in Greece

In this paper we propose the idea that compliance of a producer of official statistics to the basic principles of data protection in the preparation of a survey, while imposing additional burden, complexity or even restrictions to the process, can actually prove to be an effective tool to ensure and demonstrate compliance with the Fundamental Principles of Official Statistics and the European Statistics Code of Practice. To show the validity of this idea we utilize the Greek Population and Housing Census of 2021, conducted in 2021 by the Hellenic Statistical Authority (ELSTAT), as a representative example of statistical survey, which was built from the beginning with a primary look to the basic data protection principles of the General Data Protection Regulation of the European Union (GDPR). While preparing the Census we came across the intrinsic interplay that exists between principles of the GDPR and the Fundamental Principles and the Code. In the paper we analyze this interplay as we came across it in the Census and show that it can be used as a tool to strengthen the implementation of basic principles of official statistics in all statistical production processes.

Introduction to Data Protection Frameworks: A Review

In the digital era, where data breaches are prevalent and harmful, "An Introduction to Data Protection Frameworks: A Review" provides a critical analysis of mechanisms aimed at safeguarding personal data. The review commences by discussing data protection, underscoring its significance as a basic right and its pivotal role in the digital realm. It then explores the historical backdrop, tracing the progression of data protection laws from their origins to the extensive frameworks in place today. The review meticulously details the fundamental principles of data protection—fairness, accuracy, minimization, and accountability—which form the bedrock of efficient data management. Additionally, it highlights the rights of data subjects, such as access, rectification, and erasure, empowering individuals amidst the rise of data-driven practices. It further delves into the obligations of data controllers and processors, stressing the importance of adherence and integrity in data management. The paper also conducted a comparative examination of global frameworks such as the GDPR, which is critical for international data regulation. Lastly, the review explores the obstacles and future prospects of data protection, recognizing the challenges posed by technological progress and the global exchange of information.

Abstract PO3-19-11: CINDERELLA Clinical Trial (NCT05196269): using artificial intelligence-driven healthcare to enhance breast cancer locoregional treatment decisions

Abstract Background. Breast cancer treatment has improved overall survival rates, with different locoregional approaches offering patients similar locoregional control but variable aesthetic outcomes that may lead to disappointment and poor quality of life (QoL). There are no standardized methods for informing patients of the different therapies prior to intervention, nor validated tools for evaluation of aesthetics and patients' expectations. The CINDERELLA Project is based on years of research and developments of new healthcare technologies by various partners, aimed to provide an artificial intelligence (AI) tool to aid shared decision-making by showing breast cancer patients the predicted aesthetic outcomes of their locoregional treatment. The clinical trial will evaluate the use of this tool within an AI cloud-based platform approach (CINDERELLA App) versus a standard approach. We anticipate that the CINDERELLA App will lead to improved satisfaction, psychosocial well-being and health-related QoL while maintaining the quality of care and providing environmental and economic benefits. Trial design. CINDERELLA is an international multicentric interventional randomized controlled open-label clinical trial. Using the CINDERELLA App, the AI and Digital Health arm will provide patients with complete information about the proposed types of locoregional treatments and photographs of similar patients previously treated with the same techniques. The Control arm will follow the standard approach of each clinical site. Randomization will be conducted online using the digital health platform CANKADO, ensuring a balanced distribution of participants between the two groups. CANKADO is the underlying platform through which physicians control the patients' app content and conduct all data collection. Privacy, data protection and ethical principles in AI usage were taken into account. Eligibility criteria. Patients diagnosed with primary breast cancer without evidence of systemic disease. All patients must sign an informed consent and be able to use a web-based app autonomously or with home-based support. Specific aims. Primary objective: to assess the levels of agreement among patients' expectations regarding the aesthetic outcome before and 12 months after locoregional treatment. The trial will also evaluate the aesthetic outcome level of agreement between the AI evaluation tool and self-evaluation. Secondary objectives: health-related QoL (EQ-5D-5L and BREAST-Q ICHOM questionnaires) and resource consumption (e.g., time spent in the hospital, out-of-pocket expenses). The questionnaires and photographs will be applied prior to any treatment, at wound healing, at 6 and 12 months following the completion of locoregional therapy. Statistical methods. Wilcoxon signed rank test will be used to assess the intervention's impact on the agreement level between expectations and obtained results. Weighted Cohen's kappa will be calculated to measure the improvement in classifying aesthetic results with intervention. Statistical tests and/or bootstrap techniques will compare results between arms. A similarity measure will be calculated between self-evaluation and outcome obtained with the AI tool for each participant, and a beta regression model will be used to analyze the intervention's effect. Secondary objectives will be evaluated by scoring questionnaires based on provided guidelines. Target accrual. The clinical trial, led by Champalimaud Clinical Centre, will enroll a minimum of 515 patients in each arm between July 2023 and January 2025. Recruitment is currently open at five study sites in Germany, Israel, Italy, Poland and Portugal. The clinical trial is still open for further international study sites. Funding. European Union grant HORIZON-HLTH-2021-DISEASE-04-04 Agreement No. 101057389. Citation Format: Eduard-Alexandru Bonci, Orit Kaidar-Person, Marília Antunes, Oriana Ciani, Helena Cruz, Rosa Di Micco, Oreste Davide Gentilini, Nicole Rotmensz, Pedro Gouveia, Jörg Heil, Pawel Kabata, Nuno Freitas, Tiago Gonçalves, Miguel Romariz, Helena Montenegro, Hélder P. Oliveira, Jaime S. Cardoso, Henrique Martins, Daniela Lopes, Marta Martinho, Ludovica Borsoi, Elisabetta Listorti, Carlos Mavioso, Martin Mika, André Pfob, Timo Schinköthe, Giovani Silva, Maria-Joao Cardoso. CINDERELLA Clinical Trial (NCT05196269): using artificial intelligence-driven healthcare to enhance breast cancer locoregional treatment decisions [abstract]. In: Proceedings of the 2023 San Antonio Breast Cancer Symposium; 2023 Dec 5-9; San Antonio, TX. Philadelphia (PA): AACR; Cancer Res 2024;84(9 Suppl):Abstract nr PO3-19-11.

Basic principles of personal data processing and protection

The development of an information society that prefers quick and remote resolution of issues, including on the Internet, raises the issue of protecting information and data disseminated and provided by personal data subjects. People do not want to transmit personal information without a clear understanding that it will be protected and not used, or to transfer it unnecessarily to third parties, because most of this information is identifying and personal, and in some cases even «sensitive». In this case, persons who transfer, process, or store personal data must be guided by legal grounds that determine the course of such actions. The fundamental concepts that must be followed in any operations with personal data are the principles. Principles are the basic framework that everyone in this process must adhere to, and failure to do so entails legal liability.
 The institute of personal data protection is relatively new, therefore, with the development of this institute, legislation at various levels develops and improves the basic provisions and general principles of personal data protection. At present, the general principles of personal data processing and protection can be summarised as: transparency, fairness, lawfulness, purpose limitation, data minimisation, data accuracy, data retention period limitation, data security and the principle of accountability.
 Such principles are enshrined in the General Data Protection Regulation and meet the main goal, namely to define the standards on the basis of which personal data should be collected, processed, transferred, stored, and destroyed. The existence of such principles and, most importantly, their consolidation in regulatory legal acts that are binding for all and are primarily necessary to preserve and not restrict the right to privacy and the right to protection of personal data, the right to privacy. The general principles of legitimate operations with personal information provide for notification of the person who provides his/her personal data about the purpose of processing and all the details concerning future actions with the provided information and regulation, limitation and determination of liability for violation of the principles of processing and protection of personal data for the person who further carries out the specified operations.

Enforcement of data breaches in the Dutch and British healthcare sector: a contribution to clarifying requirements of data protection by design?

ABSTRACT Within the healthcare sector, highly sensitive personal data, including data concerning health, is processed. The careless handling of such data can have a significant impact on the fundamental rights and freedoms of natural persons. It is central that data protection principles, including data protection by design, are followed by the healthcare sector. When these requirements are not met, it is crucial that enforcement action is taken to prevent personal data breaches. This article compares the enforcement carried out in the Netherlands and in the UK for breaches in the healthcare sector of the General Data Protection Regulation and the UK Data Protection Act 2018. The author reflects on whether more effective enforcement measures would lead to healthcare developments that are compliant with the data protection by design obligation (Article 25 of the GDPR). It is argued that in turn,compliance with this obligation can prevent personal data breaches and data protection complaints, rendering enforcement, and consequently recovery, superfluous.

PERSONAL DATA PROTECTION POLICY: ENSURING EFFECTIVE IMPLEMENTATION OF DATA PRIVACY POLICIES IN PRIVATE HIGHER INSTITUTIONS

Faculty of Business and Management Sciences, Kolej Universiti Islam Perlis, Malaysia As digital technology develops globally, the protection of personal data in the commercial sector becomes extremely important. Cases of selling data to third parties are increasing, and the government is required to tighten provisions in personal protection laws. Therefore, the Personal Data Protection Act 2010 (Act 709) was passed by the Parliament of Malaysia for the purpose of regulating the processing of personal data and to prevent the misuse of the personal data in commercial transactions. The Act confers rights on Data Subjects in relation to the collection, use and or retention (processing) of their Personal Data, and places obligations on Data Users. The Personal Data Protection Order (Group Data Users) 2013 lists the categories of data users who need to register with Personal Data Protection Department. One of group data users is the education sector including educational institutions and private higher education registered under the Private Higher Education Institutions Act 1996 (Act 555). As data users, private higher education institutions are responsible for protecting Personal Data of two categories of data subjects, namely students and employees in the institution. The obligation including to exercise an appropriate policies and procedures to safeguard the Personal Data collected, to maintain data accuracy, and to prevent unauthorized disclosure. This paper aims to measure the implementation of personal data protection laws including the formulation of operational policies and procedures in private higher education institutions. This will be done by looking at the provisions from the Act regarding the principles of data protection as well as the duties for compliance to the legislation. Furthermore, non-compliance of the Act commits an offence and on conviction, be liable to a fine not exceeding RM500,000 or to imprisonment for a term not exceeding 3 years or both. The study also seeks to determine what are the challenges in implementing the Act successfully.

Transfer of Personal Data by E-Commerce Companies: A Study From The Perspective of Indonesian Personal Data Protection Laws

In the era of globalization, the protection of personal data has become a critical issue in Indonesia, especially within the e-commerce sector. Cases of this nature underscore the significance of safeguarding personal data and enforcing stringent legal measures. This research employs a normative juridical legal study that integrates two primary approaches: the legislative approach and the comparative approach. The research data sources comprise primary, secondary, and tertiary legal materials obtained through a comprehensive literature review. The data analysis process is conducted using a descriptive method and applying deductive logic. The growth of e-commerce users in Indonesia has witnessed a significant increase. Law Number 27 of 2022 regulates the principles of personal data protection, encompassing the rights of data owners, transparency, and meticulous data management. While considered positive, a comparison with Malaysian regulations, such as the Personal Data Protection Act 2010, reveals fundamental differences that warrant attention. The implications of the regulation on the transfer of personal data in Law Number 27 of 2022 play a crucial role for e-commerce companies. They must ensure the security of consumers' personal data and adhere to legal principles to maintain consumer trust in an increasingly competitive market.

Регулирование “облачных сервисов” как инструмент международной конкуренции: опыт США и Китая

The international cloud services industry represents an arena of global economic competition and has the potential to become a field for political rivalry among various actors. States remain the primary actors in this competitive landscape, with the U.S. and China actively enhancing their positions through various regulatory measures. The article examines government regulation strategies, categorising them into ‘positive’ and ‘negative’ as well as ‘defensive’ and ‘offensive’, with examples provided for each. A thorough analysis of national strategies from official U.S. and Chinese documents reveals their conceptual approaches to cloud services regulation. The documents of international intergovernmental organisations and global governance institutions through which countries implement (both individually and in their collaborative participation) their strategies for regulating cloud services were examined in detail. Commonalities and differences in the regulatory policies of the U.S. and China are highlighted, both in their national strategies and in principles articulated at the international level. The study confirms the hypothesis that cloud services regulation serves as a tool for international political influence. Key factors in the evolution of the international regulatory system for cloud services are identified, including their further technological development and shifts in the global order. The primary scenario axis is identified as the U.S.–China competition for dominance in the Global South. Based on these findings, the author presents a scenario forecast for the future of international cloud services regulation. Two potential outcomes are considered: the confrontational one leading to increased political competition, bearing risks of Internet fragmentation, divergence in technical standards, and a higher likelihood of destructive actions, including military use of cloud services; and the consensual one, resulting in international convergence on all aspects of cloud services regulation, including technical standardisation, legal norms, economic rules, fundamental principles of personal data protection and respect for national interests of all states.

Implementing the human right to science in the context of health-related data processing.

This paper contributes to the exploration of the potential application of duties related to the diligent anticipation of the (imminent) harms and (potential) benefits to humans that scientific innovation engenders to health-related contexts. In particular, it addresses the intersection between the human right to science and health-related data processing, which plays a key role in the production, translation and implementation of biomedical knowledge. The first part of the paper provides a brief recap of the interpretation of the right to science based on Art. 15 (1) (b) of the United Nations International Covenant on Economic, Social and Cultural Rights (hereafter ICESCR or Covenant) and the resulting obligations for States in the context of health and related data processing. The second part of the paper defines the relevance of the ICESCR for EU Member States and the European Union. In the third part, theses are put forward on how the human right to science and the obligations under Art. 15 (1) (b) ICESCR influence the interpretation and application of the General Data Protection Regulation as secondary EU law. By examining the justifications for using the right to science to interpret EU data protection law and by providing interpretation and application guidance on the main data protection principles in the area of health-related data processing, taking this right into account, the aim is to shape the EU data governance framework to meet the requirements of this human right. In doing so, the paper aims to close the gaps in the interpretation and application of the main rules of EU data protection law. Such standardization in the health-related context can contribute to a coherent interpretation and application of existing rules by referring to this emerging human right. Against this background, the paper identifies governance measures that the EU legislator could take to guide the processing of health-related data in line with the requirements of the right to science.