Data Protection Reform Research Articles

Data Protection Reform via the Retained EU Law (Revocation and Repeal) Act and the Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023/1417: Arguably Partially Unlawful and Liable to Undercut the UK’s Council of Europe Commitments

Data Protection Reform via the Retained EU Law (Revocation and Repeal) Act and the Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023/1417: Arguably Partially Unlawful and Liable to Undercut the UK’s Council of Europe Commitments

“Data, data, data” – post-Brexit data governance and its relation to the UK’s economic model

ABSTRACT This paper studies the UK’s post-Brexit turn toward softening data protection standards. It uses this case to develop a perspective on data governance that is rooted in the growth model framework. With this approach, it illustrates how incentives to ease data-based value creation can be tied to certain macroeconomic conditions. The studied data protection reform serves as a crucial event at which links between macroeconomic conditions and policy action promise to become particularly visible. As the analysis shows, the UK government’s policy discourse and actions reflect various facets of the country’s data economy that have special weight in the UK’s growth model: the importance of data markets and advertising, the role of tech and data in attracting foreign investments, and the general importance of tech and data-intense service industries. The case study therefore points to important analytical dimensions that are relevant more generally for the study of evolving growth regimes.

Naruszenie obowiązku współpracy z organem nadzorczym w sprawach z zakresu ochrony danych osobowych jako podstawa do nałożenia administracyjnej kary pieniężnej

Przedmiot badań: Niniejsze opracowanie poświęcone zostało analizie obowiązku prawnego współpracy podmiotów zobowiązanych do stosowania tzw. ogólnego rozporządzenia o ochronie danych osobowych (znanego szerzej jako RODO) z organem nadzorczym, którym w Polsce jest Prezes Urzędu Ochrony Danych Osobowych, oraz konsekwencjom jego naruszenia. Przedmio­tem swoich dociekań autorka artykułu uczyniła normy prawa ochrony danych osobowych oraz praktykę ich stosowania.
 Cel badawczy: Podstawowym celem niniejszego artykułu jest ustalenie i ocena czy rozwiązania prawne przyjęte w art. 31 RODO są właściwe i wystarczające z punktu widzenia zapewnienia sprawnej realizacji zadań powierzonych organom nadzorczym odpowiedzialnym za monitorowa­nie stosowania przepisów o ochronie danych osobowych. 1
 Metoda badawcza: Podstawową, zastosowaną w przypadku niniejszego opracowania metodą badawczą jest analiza materiału normatywnego i poglądów piśmiennictwa. Ponadto, w oparciu o rozstrzygnięcia Prezesa Urzędu Ochrony Danych Osobowych analizie poddano stosowanie pra­wa ochrony danych osobowych we wskazanym powyżej zakresie.
 Wyniki: Obowiązek współpracy z organem nadzorczym, wyrażony wprost po raz pierwszy na gruncie przepisów tzw. ogólnego rozporządzenia o ochronie danych, jest ważnym instrumen­tem zapewniającym niezakłóconą realizację kompetencji przyznanych organowi nadzorczemu. W tym kontekście jest on jednym z elementów składających się na fundament europejskiej re­formy prawa ochrony danych osobowych, jakim jest wzmocnienie pozycji organu nadzorczego w relacji z administratorami, podmiotami przetwarzającymi – oraz gdy ma to zastosowanie – ich przedstawicielami. Wprowadzenie możliwości zastosowania sankcji finansowej jako konsekwen­cji naruszenia art. 31 RODO zapewnia możliwość urzeczywistnienia tego celu i pozwala na realne dyscyplinowanie podmiotów zobowiązanych do stosowania przepisów ogólnego rozporządzenia – zarówno w wymiarze indywidualno-, jak i ogólnoprewencyjnym, tj. zarówno w stosunku do samego podmiotu ukaranego, jak i do przyszłych adresatów żądań kierowanych przez organ. Jak pokazuje ponad 3-letnia praktyka stosowania przepisów ogólnego rozporządzenia, przyjęcie przez prawodawcę europejskiego takiego rozwiązania okazało się konieczne. Możliwość nałoże­nia administracyjnej kary pieniężnej, w przypadku naruszenia obowiązku współpracy z organem nadzorczym, może się okazać jednym z niewielu, a czasem wręcz jedynym narzędziem, po który organ będzie mógł sięgnąć, dążąc do niezakłóconej i terminowej realizacji powierzonych mu za­dań, w tym przede wszystkim monitorowania i egzekwowania stosowania ogólnego rozporządze­nia. Tym samym norma ta w sposób pośredni wpływa również na realizację praw osób, których dane dotyczą. Z drugiej strony, zastosowana na gruncie art. 31 RODO konstrukcja prawna, z którą wiąże się konieczność odwołania do innych przepisów ogólnego rozporządzenia określających kompetencje organu, chroni te podmioty przed jej ewentualnym nadużywaniem i ma istotny wy­miar gwarancyjny.

Assessing UK Data Protection Reform in Transnational Context: What New Direction?

This paper analyses the post-Brexit reforms to UK data protection put forward in Data: A New Direction. It is found that they are wide-ranging and significant but generally not radical. The great bulk of the proposed substantive changes to data protection (although not the most far-reaching suggestions concerning either e-privacy or automated decision-making) could be plausibly justified under the restrictions regime set out in the General Data Protection Regulation (GDPR). The reforms to the integrity duties would be deeper and pose some risk of reducing ʻaccountabilityʼ to formalistic theatre even when high risk processing is underway. Nevertheless, in principle their basic structure remains compatible with Data Protection Convention 108+ (DPC+). Proposals to shift the ICO away from a de jure focus on upholding data protection rights are difficult to square even with the DPC+. De facto the ICO is not acting as an effective enforcer of data subject rights even today, but these proposals would entrench and further this troubling reality. This points to a critical problem with the initiative, namely, its lack of balance vis-a-vis the interests of the data subject. A reform package which sought to marry more robust and accountable enforcement for individuals with some liberalisation of the substance and process of data protection would offer a better way forward.

Getting Rid of Data

We are experiencing an amazing data-centered revolution. Incredible amounts of data are collected, integrated, and analyzed, leading to key breakthroughs in science and society. This well of knowledge, however, is at a great risk if we do not dispense with some of the data flood. First, the amount of generated data grows exponentially and already at 2020 is expected to be more than twice the available storage. Second, even disregarding storage constraints, uncontrolled data retention risks privacy and security, as recognized, e.g., by the recent EU Data Protection reform. Data disposal policies must be developed to benefit and protect organizations and individuals. Retaining the knowledge hidden in the data while respecting storage, processing, and regulatory constraints is a great challenge. The difficulty stems from the distinct, intricate requirements entailed by each type of constraint, the scale and velocity of data, and the constantly evolving needs. While multiple data sketching, summarization, and deletion techniques were developed to address specific aspects of the problem, we are still very far from a comprehensive solution. Every organization has to battle the same tough challenges with ad hoc solutions that are application-specific and rarely sharable. In this article, we will discuss the logical, algorithmic, and methodological foundations required for the systematic disposal of large-scale data, for constraints enforcement and for the development of applications over the retained information. In particular, we will overview relevant related work, highlighting new research challenges and potential reuse of existing techniques.

The anatomy of plausible futures in policy processes: Comparing the cases of data protection and comprehensive security

Due to rapid change and wicked policy problems, anticipatory policymaking is increasingly important. In addition to methods for producing foresight knowledge, tools are needed to make sense of the increasing amounts of future-oriented argumentation. This article presents a comparative analysis of anticipatory argumentation in two fields: the EU data protection reform and the Finnish concept for comprehensive security. A three-layer heuristic framework is presented for qualitative analysis of statements on plausible futures. The first layer consists of specific expectations regarding the future. The second layer is the generic anticipatory storyline. The third layer consists of the underlying futures consciousness. The data protection case presents an institutional reform narrative with short time perspective and relatively high agency, while the comprehensive security case presents a crisis narrative based on a contingency planning orientation with long time perspective, relatively developed systems perception and relatively low agency. In policy foresight with high uncertainty and high aspirations of agency, reflexivity and ethical responsibility are crucial components of foresight. This article promotes these by providing a tool for structuring anticipatory assumptions. The tool can be used for studying policy documents or during the policy process to craft more rigorous future-oriented policies.

Making the future by using the future: A study on influencing privacy protection rules through anticipatory storylines

This article investigates how futures of privacy protection are made in Europe. The public consultation phase of the European Union’s data protection reform is analysed as a case of making the future by using the future, that is, influencing institutional change through anticipatory storylines. A qualitative analysis of consultation responses is conducted, and two discourse coalitions are identified. The industry coalition promotes market liberalisation to allow the digital future to emerge. The civil society coalition, in turn, argues for rescuing privacy with strict rules. The article suggests that plausibility in relation to the discursive and extra-discursive environment is crucial for the success of storylines. The second storyline was relatively successful because it was more plausible in light of the trend of legalism and the predominant future-oriented narrative of privacy in danger. The ‘anticipatory institutionalism’ approach opens novel perspectives concerning actors’ future-oriented projects in relation to historical processes.

Certification of Data Protection Officers Should Be Regulated

The Data Protection Officer (hereinafter “DPO”) is a key figure person of the general data protection reform. The profile required in the General Data Protection Regulation (hereinafter “GDPR”) to hold this position is demanding and people having the required competencies and experience are limited. Many companies, especially SMEs, required or simply planning to hire a DPO before May 2018 are a little lost and, sometimes, misled by opportunists leveraging the shortage of suitable candidates. A strong demand for guaranteeing a minimum level of competences to the candidate DPOs is being observed. Many schemes offering to certify a minimum level of knowledge have popped up in the Member States. However, the DPO certification market remains very fragmented and presents many inconsistencies regarding the content and process offered. The experience of certification in other activities has demonstrated that the proliferation of unregulated certification schemes creates inconsistencies in the schemes’ content. It also encourages competition between them and raises a risk of a race to the bottom that could undermine trust in this procedure. The GDPR does not provide for any restrictions preventing of regulating the schemes established outside Article 42 even though they are not recognized as possible means to instill accountability. The authorities could mandate the European standardization bodies to design a harmonized DPO standard within the implementation acts and include the accreditation of private certification bodies in the process specified in Article 43.1 of the GDPR. The solution envisioned could offer the opportunity to set up a twofold regulation process for data protection certification, one dedicated to the schemes falling within the scope of Article 42.1 scope and another one for those not falling within this scope.

General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?

This Article concerns the EU data protection reform which will come into effect from 25th of May 2018 and will be directly applicable in all Member States. The EU data protection reform aims to build a modern and comprehensive data protection framework for the European Union. The GDPR makes a number of changes in data protection laws, e.g. it introduces new obligations for data controllers and processors, brings new status and new tasks for Data Protection Officers (DPOs), gives more rights to data subjects and most importantly completely changes the perception of data protection law by introducing rules such as privacy by design, privacy by default. The Author describes selected changes, in general, from the viewpoint of an ordinary citizen.

Компаративный анализ стратегических аспектовразвития цифровой экономики

Strategic aspects of development of digital economy of the countries of OECD, the EU and Russia are considered in the article. As this type of economy becomes significant driving force of global economic growth and plays an important role in acceleration of rates of economic development, in productivity increase, in the creation of new branches and markets, in the effective use of natural resources, in the development of citizens' initiatives and democratic values. The distinguished processes are based on the level of society and business informatization at the current stage of the world economy development. The purpose of the work is to define the trends of digital economy development in Russia on the basis of its functioning features using a comparative analysis of strategic directions of digitization of the economy of the EU and OECD countries. Methodologically the research is based on the study and generalization, analysis and synthesis, as well as a comparative analysis that allow us to define fundamental trends of the development of digital economy in the EU and OECD countries. Among these trends are the establishment of innovations in the field of digital economy; the development of information infrastructure; the formation of favorable institutional environment for the improvement of interaction of all subjects of a digital economy; extensive use of digital technologies by business, population and state institutions and the increase of the national economy security in the global digital environment. The authors have revealed general characteristics and distinctive features of the implementation of strategic documents that provide the development of digital economy in different countries. It has been done on the basis of analysis of particular management decisions that suggest the implementation of the above mentioned trends. The revealed patterns allow us to confirm that in general the strategy of the development of digital economy in Russia corresponds to the world trends. Further the authors will develop particular measures of the digitization of the Russian economy taking into account the international experience. Keywords risks, digitization, digital technologies, digital infrastructure, efficiency, resource saving, eco-friendly technologies.

Balancing National Security and Data Protection: The Role of EU and US Policy‐Makers and Courts before and after the NSA Affair

AbstractBased on the unparalleled number of recent data protection reforms triggered by Snowden's revelations on both sides of the Atlantic, this article aims to examine the interplay between the two main transatlantic actors striking the balance between national security and privacy, namely EU and US policy‐makers and courts. We argue, on the one hand, that the NSA affair has opened a window to policy‐makers to pursue reforms in order to attain a level of adequacy of their respective data protection legal regimes. On the other hand, although some data protection reforms have been adopted by legislators in response to courts acting as reformers in the post‐Snowden context, the EU and US courts' approaches to balancing national security and data protection remain diametrically opposite. Drawing upon recent case law, we demonstrate that US courts continue to tilt the balance in favour of national security while EU courts retain their pro‐privacy stance.

The data protection reform and its impact on the Italian legal system: Between hopes and expectations

The General Data Protection Regulation (GDPR) will be subject to national-level implementation over the next two years, but are we sure this will help pave the way for the creation of a real European digital single market and strengthen individuals’ rights to privacy and data protection? This paper will analyse those aspects of the data protection reform enshrined in the GDPR that can be considered the most important for European businesses, public institutions and national data protection authorities alike. In particular, the focus will be on: (1) the one-stop-shop mechanism; (2) the new rules of consent in the marketing domain; and (3) the role of data protection officers according to the new regulation. Furthermore, considering the need to contextualise such a change in the law of the EU with a more country-specific analysis, the author will also provide a general overview of the possible impact of the reform on the Italian legal system, according to its current laws and regulations and the jurisprudence of the Italian Data Protection Authority.

The EU data protection reform and the challenges of big data: remaining uncertainties and ways forward

ABSTRACTAs the first broad reform of the EU data protection legislation is being achieved, and notwithstanding EU institutions’ confident discourse, scepticism remains about the reform’s ability to safeguard the fundamental right to data protection in the face of evolving data processing techniques underlying so-called big data. Yet, one might wonder whether the cause for this difficulty should be ascribed mainly to technological progresses that the law finds it hard to deal with or rather to the policy choices embedded in the legal reform itself. Indeed, a new data protection enforcement model is being adopted, which relies heavily on risk assessment and management by the data controllers themselves. Likewise, data protection authorities see their supervisory role significantly weakened. These developments and the underlying rationality are discussed. Given the limitations of the risk-based approach as currently devised, we suggest that it be reappraised in consideration of risk regulatory experiences in other domains.

Data Protection Directive (EU) 2016/680 for Police and Criminal Justice Authorities

In May 2018, the EU Data Protection Reform became applicable. In particular the General Data Protection Regulation (EU) 2016/679 (GDPR), which repealed Directive 95/46/EC on 25 May 2018 attracted much attention, albeit resembling its predecessor. Alongside the GDPR, the Reform encompassed a Directive (EU) 2016/680 establishing rules for the protection of individuals with regard to the processing of personal data by competent authorities for purposes of law enforcement (LED). The LED put forth great achievements in areas that had previously not been regulated by EU law. Therefore, the LED constitutes a major step forward in establishing a comprehensive EU data protection regime, as the first horizontal and legally binding instrument laying down the rules for national and cross-border processing of personal data in the area of law enforcement. Although the LED received way less attention than the GDPR, two main objectives of the Directive are too important to be neglected: the increased level of fundamental rights protection in the area of police and criminal justice, and the improved sharing of personal data between the Member States, as they will be able to rely on uniform data protection rules. The LED is a modern instrument, designed for the processing of personal data by Law Enforcement Authorities (LEAs) in the Digital Age, which is why there is no doubt that instruments such as the Directive are rapidly gaining in importance and visibility: firstly, an increased number of criminal acts is being committed online or with the help of online tools. Perpetrators of crime leave digital traces that may support LEAs in their tasks of crime prevention, detection, investigation and prosecution. Secondly, as perpetrators are becoming more tech-savvy, LEAs turned to new investigative techniques, including big data analytics. The term big data police technologies may include predictive systems that identify people or places suspected of crime, surveillance systems to monitor at-risk areas and search systems to mine data for investigative clues or to develop intelligence nets of helpful data for groups or across communities. Thirdly, EU rules on the processing of personal data by LEAs are undergoing consolidation, with the LED acting as a locomotive. The rules of the LED, which had to be transposed into the national laws of all 28 Member States and the four Schengen Area States (Norway, Iceland, Switzerland and Lichtenstein) by 6 May 2018, benefited from the attention given to the GDPR, as some of the Regulation’s solutions could simply be taken over. However, a number of provisions were developed specifically for the LED. This Article will give a general overview of the LED structure, its scope and briefly present the ten chapters. The second part of the Article will address four distinct features enshrined in the LED, focussing on automated individual decision-making (Article 11), the indirect exercise of data subject rights (Article 17), the obligation for competent authorities to keep logs (Article 25) and the provisions on international transfers (Articles 35-39). It will thereby critically assess the articles and point to both similarities and differences with regard to the GDPR.

Search engine imaginary: Visions and values in the co-production of search technology and Europe

This article discusses the co-production of search technology and a European identity in the context of the EU data protection reform. The negotiations of the EU data protection legislation ran from 2012 until 2015 and resulted in a unified data protection legislation directly binding for all European member states. I employ a discourse analysis to examine EU policy documents and Austrian media materials related to the reform process. Using the concept 'sociotechnical imaginary', I show how a European imaginary of search engines is forming in the EU policy domain, how a European identity is constructed in the envisioned politics of control, and how national specificities contribute to the making and unmaking of a European identity. I discuss the roles that national technopolitical identities play in shaping both search technology and Europe, taking as an example Austria, a small country with a long history in data protection and a tradition of restrained technology politics.

The Forthcoming General Data Protection Regulation in the EU: Higher Compliance Costs Might Slow Down Small and Medium-sized Enterprises’ Adoption of Infrastructure as a Service

Cloud-based services (especially IaaS) are widely used by businesses, including small and medium-sized enterprises. The recently adopted General Data Protection Regulation is going to influence the EU cloud computing market significantly, and SMEs using IaaS to process personal data of their clients face a need to adapt to those changes if they are to remain compliant with the data protection rules. The objective with the paper was to look into the regulation adopted and identify the aspects that significantly influence the relations between a cloud provider and a client, especially if seen from the perspective of SMEs. Further, the paper discusses whether IaaS will be an obvious choice for SMEs seeking to hire computer infrastructure resources for the purpose of processing personal data when the compliance efforts necessary after the General Data Protection Regulation comes into force are taken into account. The findings suggest that forthcoming changes could significantly affect the industry and, in light of the likely increase in transaction costs, that SMEs may want to consider traditional outsourcing services instead. Consequently, the results of the data protection reform would be contradictory to other objectives of the European Commission, especially that of wider adoption of cloud services by SMEs.

The Reform of the EU Data Protection Framework: Outlining Key Changes and Assessing Their Fitness for a Data-Driven Economy

The article analyzes the recent data protection reform of the European Union (EU). It introduces the drivers of the reform, in particular by looking at a few seminal judgments of the Court of Justice of the EU. Against this backdrop, the article highlights the key changes that the new General Data Protection Regulation brings about, assesses their implications and seeks to situate them in the wider context of the digital economy and its governance, in particular with regard to cross-border data flows.

Data protection authority perspectives on the impact of data protection reform on cooperation in the EU

This article presents the findings of interviews with representatives from the majority of EU data protection authorities in the context of the ongoing data protection reform process. It not only identifies commonalities between the authorities to the extent it is possible to speak about an EU DPA perspective, but also identifies areas of tension and disagreement as well as future intentions. The focus of the article is upon the impact of the data protection reform process on the way that these independent bodies, located in EU Member States will increasingly have to cooperate at an EU-level. Capturing these perspectives at this moment in the reform process provides not only insight into the process from a group of concerned stakeholders, but also insight into how these stakeholders are (re-)positioning themselves, planning, and anticipating the impacts of the reform.

The Reform of the EU Data Protection Framework: Outlining Key Changes and Assessing Their Fitness for a Data-Driven Economy

AbstractThis article analyzes the recent data protection reform of the European Union (EU). It introduces the drivers of the reform, in particular by looking at a few seminal judgments of the Court of Justice of the EU. Against this backdrop, the article highlights the key changes that the new General Data Protection Regulation brings about, assesses their implications, and seeks to situate them in the wider context of the digital economy and its governance, in particular with regard to the free cross-border flow of data.

The Reform of the EU Data Protection Framework: Outlining Key Changes and Assessing Their Fitness for a Data-Driven Economy

AbstractThis article analyzes the recent data protection reform of the European Union (EU). It introduces the drivers of the reform, in particular by looking at a few seminal judgments of the Court of Justice of the EU. Against this backdrop, the article highlights the key changes that the new General Data Protection Regulation brings about, assesses their implications, and seeks to situate them in the wider context of the digital economy and its governance, in particular with regard to the free cross-border flow of data.