Data Protection Authorities Research Articles

Regulating police use of facial recognition technology in the Netherlands: The complex interplay between criminal procedural law and data protection law

In this contribution, we provide insight into the complex interplay between criminal procedure law and data protection law when it comes to regulating police use of facial recognition technology. By analysing the Dutch ‘Police Deployment Framework for Facial Recognition Technology’, we show that data protection law and criminal procedure do not interact with each other to a sufficient degree in relation to facial recognition technology. We identify several barriers standing in the way of their cooperation, resulting in notable gaps in the system of checks and balances: (1) a different underlying mindset (maximum versus minimum use of data); (2) a different assessment of the required legal basis (proportionality versus strict necessity); and (3) an ineffective web of supervision. We suggest several ideas for filling these gaps and bridging the disconnection: following the approach in existing Dutch law used for the processing of ANPR and DNA data, encoding the less ‘muddy’ rules of data protection law into digital technology itself, and further research on the feasibility of effective supervision by the Dutch Data Protection Authority. Our contribution shows that in order to properly regulate facial recognition technology, scholars need to look beyond the edges of their own fields of law.

The LED’s right of access to one’s data: Loopholes on proper access, legality review and data protection authority Accountability

Directive 2016/680 (the Law Enforcement Directive (LED)) provides two procedures for the exercise of the rights of access to one’s data: a direct one under Article 14 LED (directly addressed to the law enforcement authority) and an ‘indirect’ one under Article 17 (3) LED, i.e., via the intermediary of the data protection authority (DPA). In the present paper we will argue that the latter procedure should be the exception and the Article 14 LED procedure should be seen as the default. We will analyse the weaknesses of the Article 17 (3) LED provision and then criticize its, in our opinion, flawed implementation into the national laws of Belgium, France and Germany. We will demonstrate that Article 17 (3) LED, as read in light of Article 15 LED on the restrictions to the right of access, might be interpreted incorrectly to allow for the ‘indirect’ access procedure to be evoked abusively. We will argue that it lacks the explicit language to guarantee the decision-making powers of DPAs when deciding what information to communicate to the concerned data subjects when answering their request. We will demonstrate how the examined Member State laws further restrict the powers of their DPAs, which endangers the effectiveness of the ‘indirect’ access procedure because they do not guarantee the accountability, transparency, and proper legality check by the DPAs which are called on to exercise the right of access indirectly.

Assessment of Independence of Regulatory Structures Governing Data Protection and Privacy in East Africa: A Case Study of Kenya and Tanzania

In an era of widespread digital information exchange, protecting personal data and privacy has become crucial. East African countries such as Kenya and Tanzania have implemented regulatory structures to address these concerns. However, the effectiveness and independence of these structures raise questions, necessitating a comprehensive assessment. Therefore, this study investigates the question of the independence of data protection authorities in East Africa with a particular focus on Kenya and Tanzania. This study was guided by three questions, namely, do the structures of data protection authorities in Kenya and Tanzania affect their independence? Are the data protection authorities in Kenya and Tanzania sufficiently funded to run their duties? And are the tenures of Commissioners of data protection authorities in Kenya and Tanzania secured? The study engaged two approaches: doctrinal legal research methodology, which analyses law in the form of legislation, case law, and international instruments, as well as comparative legal research methodology, which involves comparative analysis of identified criteria from Kenya and Tanzania. It was observed that the Kenyan data protection authority is more independent than the Tanzanian data protection authority.

Using the blockchain to enable transparent and auditable processing of personal data in cloud- based services: Lessons from the Privacy-Aware Cloud Ecosystems (PACE) project

The architecture of cloud-based services is typically opaque and intricate. As a result, data subjects cannot exercise adequate control over their personal data, and overwhelmed data protection authorities must spend their limited resources in costly forensic efforts to ascertain instances of non-compliance. To address these data protection challenges, a group of computer scientists and socio-legal scholars joined forces in the Privacy-Aware Cloud Ecosystems (PACE) project to design a blockchain-based privacy-enhancing technology (PET). This article presents the fruits of this collaboration, highlighting the capabilities and limits of our PET, as well as the challenges we encountered during our interdisciplinary endeavour. In particular, we explore the barriers to interdisciplinary collaboration between law and computer science that we faced, and how these two fields’ different expectations as to what technology can do for data protection law compliance had an impact on the project's development and outcome. We also explore the overstated promises of techno-regulation, and the practical and legal challenges that militate against the implementation of our PET: most industry players have no incentive to deploy it, the transaction costs of running it make it prohibitively expensive, and there are significant clashes between the blockchain's decentralised architecture and GDPR's requirements that hinder its deployability. We share the insights and lessons we learned from our efforts to overcome these challenges, hoping to inform other interdisciplinary projects that are increasingly important to shape a data ecosystem that promotes the protection of our personal data.

Certification as guidance for data protection by design

ABSTRACT Data protection by design is an obligation for data controllers according to article 25(1) of the General Data Protection Regulation (GDPR). The present paper explores the concept of data protection by design and proposes that data protection certificates can offer guidance to data controllers, about compliance with this GDPR obligation. An exploration of officially approved certification schemes shows that the certification requirements may lay down concrete use cases which can guide data controllers about compliance with the obligation of data protection by design. Even though these policies are not a comprehensive guide for data protection by design, they lay down valuable solutions with respect to effective compliance. Moreover, the data protection measures of compliance in certification criteria have been approved by the competent Data Protection Authority and possibly the European Data Protection Board. As the present paper argues, the official approval by the competent authorities creates legitimate expectations under European Union Law. Specifically, data controllers can legitimately expect that abidance by approved safeguards meets the expectations of the authorities that are entrusted with monitoring their compliance. For these reasons, certification though an ex post mechanism, can offer valuable ex ante guidance.

Attention training technique delivered in groups as treatment for anxiety and depression in patients with coronary heart disease: study protocol for a waiting-list randomized controlled trial.

Clinically significant symptoms of depression and anxiety in coronary heart disease (CHD) patients are common and associated with adverse outcomes. Psychological treatments have shown limited effectiveness and more effective treatments have been requested. Attention training technique (ATT), a component of metacognitive therapy, can potentially be effective as a stand-alone treatment for anxiety and depression. In an open study, ATT delivered face-to-face in a group format was feasible and potentially effective for improving depression and anxiety symptoms in CHD patients. The next progressive step is to test the effectiveness of ATT in a randomized controlled trial. This paper describes the methodology of this trial. ATT-CHD is a randomized wait-list (WL) controlled study. Eligible CHD patients from two hospitals with Hospital Anxiety and Depression Scale (HADS)-Anxiety and/or HADS-Depression subscales scores ≥8 will be randomized into ATT (n = 32) or WL control (n = 32). After 6-8 weeks, WL patients will be allocated to ATT. Participants will be evaluated pre-, mid- and post-treatment, and at 6-months follow-up using changes in HADS as primary outcome. Secondary outcomes will be changes in psychiatric disorders, rumination, worry, type D-personality, metacognitions, insomnia, quality of life, and C-Reactive protein (CRP). To our knowledge, this will be the first WL-controlled randomized study testing the effectiveness of group-based ATT as treatment of symptoms of anxiety and depression in CHD patients. It will also explore correlations between changes in psychological distress and CRP. A qualitative analysis will reveal patients' experience with ATT including processes that may facilitate or serve as barriers to effectiveness. Recruitment into the study commenced in December 2022. The Regional Committees for Medical and Health Research Ethics (REK), Norway has granted approval for the study (ID 52002). The trial results will be published in peer-reviewed journals. According to Norwegian legislation, the Norwegian Data Protection Authority, and the Committee of Ethics, we are not allowed to share original study data publicly. ClinicalTrials.gov, identifier NCT05621408 pre-inclusion. There were no significant changes of methods or outcomes after study start.

The GDPR’s Rules on Data Breaches: Analysing Their Rationales and Effects

The General Data Protection Regulation (GDPR) requires an organisation that suffers a data breach to notify the competent Data Protection Authority. The organisation must also inform the relevant individuals, when a data breach threatens their rights and freedoms. This paper focuses on the following question: given the goals of the GDPR’s data breach notification obligation, what are its strengths and weaknesses? We identify six goals of, or rationales for, the GDPR`s data breach notification obligation, and we assess the obligation in the light of those goals. We refer to insights from information security and economics, and present them in a reader-friendly way for lawyers. Our main conclusion is that the GDPR’s data breach rules are likely to contribute to the goals. For instance, the data breach notification obligation can nudge organisations towards better security; such an obligation enables regulators to perform their duties; and such an obligation improves transparency and accountability. However, the paper also warns that we should not have unrealistic expectations of the possibilities for people to protect their interests after a data breach notice. Likewise, we should not have high expectations of people switching to other service providers after receiving a data breach notification. Lastly, the paper calls for Data Protection Authorities to publish more information about reported data breaches. Such information can help to analyse security threats.

Mandating interoperability of interpersonal communications services in an ecosystems competition context

With the adoption of Article 7 of the Digital Markets Act, the EU has taken a progressive approach to mandating horizontal interoperability of number-independent interpersonal communications services. This legislative measure addresses the structural competition challenge posed by direct network effects, which tend to lock users into established messaging platforms. However, it is not entirely clear how, if at all, the Commission should implement this interoperability mandate. To shed light on this matter, we present an ecosystems competition context where these messaging services transition into digital ecosystems to create value from user-generated data and attention. Within this context, we find interoperability mandates like Article 7 a plausible solution to the structural competition problem, although much is yet to be done to sharpen these mandates against the intricate inter-ecosystem dynamics and to empower multi-homing users in a post-interoperability world. Achieving this goal requires collaborative efforts not only from sector regulators responsible for overseeing these mandates but also from antitrust and data protection authorities.

Our health, our research. Identifying public health research priorities among children and youth in a multiethnic population: protocol for a community-based participatory health research priority survey

IntroductionEmphasis on public involvement (PI) in health research has increased in the last 20 years. However, there is limited literature on PI in planning and conducting population-based health research. This...

The European Court of Justice in Meta Platforms leaves competition and data protection authorities with an assignment

The European Court of Justice in Meta Platforms leaves competition and data protection authorities with an assignment

The concept of personal data protection culture from European Union documents: a “Brussels effect” in Latin America?

This article aims to analyse, based on documentary sources and data collected through extensive field research, the potential cultural influence of EU (European Union) standards for protecting personal data in Latin American countries, which have data protection authorities and specific laws on the subject. The text has two sections, with an introduction and a conclusion. The introduction presents the subject, indicating the sources that lead up to the text analysis and conclusions. In the first section, the article deals with the EU’s data protection model from its fundamentalist legal perspective. The second section deals with constructing the personal data protection culture concept and how extensive EU documents research can help infer it. The conclusion indicates that the EU’s data protection perspective – as a fundamental right and public policy – can potentially influence several Latin American countries. Also, it concludes that there is an evident difficulty in culturally measuring greater or lesser effectiveness in protecting personal data based on the documents. Despite this dilemma, the EU documentation points to some qualitative suggestions that deserve to be incorporated into the analysis of cultures of personal data protection, focusing on Latin American countries.

DPA powers toward effective and transparent GDPR enforcement: the case of Croatia

The paper identifies and explores the solutions to certain underdeveloped and lacking legislative solutions and issues in the practice of the national data protection authority (CPDPA), which affect the aims of effective GDPR enforcement and transparency. On a broader level it contributes to the EDPB initiatives toward the harmonization of certain procedural provisions and overcoming the differences in the conduct of cross-border proceedings. Most of the research considerations are supported by a study of the case that received much public attention and involves the first administrative fine in Croatia. Arguments are provided toward prescribing time limits for the resolution of data protection administrative disputes and toward appropriate addressal of the closely related issues of publishing CPDPA rulings, with the concerns of their accessibility worked out through a comprehensive policy. This includes also the particular considerations on the corrective measures issued to public authorities, which cannot be fined, and on the underdeveloped fine-limitation rule for certain other public sector bodies. Public interest concerns should be closely examined in the assessment of communicating information on relevant data protection cases and CPDPA decisions, as well as the interrelation with the freedom of information requests. The publishing of non-anonymous final rulings should be recognized as a form of additional sanction and power of the data protection authority and as such further explored also at the EU level. In terms of more efficient CPDPA functioning it is argued that the prescribed time limits for issuing expert opinions are extended. At the same time resources should be utilized toward better inclusivity and accessibility of relevant information, primarily rulings, on its website.

The Philosophical Background and the Adventures of Religious Studies:

The teaching of Religious Studies in Greece has always been the subject of intense debate and controversy. The case law of the Council of State mandates a denominational course, allowing exemption only on the grounds of religious conscience. The Supreme Administrative Court even considered the introduction of a compulsory Religious Studies course for all students to be unconstitutional. In this sense, the Religious Studies course in Greece is seen as outdated, and an increasing number of students are seeking to be exempt from it. In a recent case, the Council of State, in an attempt to depart from its previous case law on the exemption, essentially referred the decision on the matter in question to the Greek Data Protection Authority, which was requested to give its opinion on the status of the currently applicable exemption. In the context of this contribution, we argue that: a) The Council of State erred in its approach of shifting the burden of this decision to the Data Protection Authority. b) These issues should not be decided by the courts or independent authorities but by the democratically legitimized legislature. c) Religious knowledge is an indispensable element of education and, as such, the Religious Studies course should have an encyclopedic, rather than a narrowly developed denominational character and remain compulsory for all pupils.

Meta platforms: How the CJEU leaves competition and data protection authorities with an assignment

Competition authorities can identify a violation of the data protection rules when such a finding is necessary to establish an abuse of dominance under the competition rules. This is the main outcome of the judgment that the Court of Justice of the European Union (CJEU) delivered in Meta Platforms on 4 July 2023. The judgment is the next step in the saga that started with the 2019 competition decision of the Bundeskartellamt (the German Federal Cartel Office) requiring Facebook (now Meta) to refrain from combining user data from different sources beyond its social network. The judgment provides a welcome confirmation that data protection standards can also matter for the interpretation of the competition rules. However, what is more remarkable and less expected is the general framework the CJEU sets out for coordination between competition and data protection authorities building on the duty of sincere cooperation and the clarity with which it evaluates the different legal bases Meta invoked for processing user data. The judgment can become a reference point for assessing the legality of personal data processing by powerful firms, but also leaves competition and data protection authorities with an assignment to explore how to coordinate their work in the future.

New Data Protection Regime in Vietnam — Overview of emerging parallels to GDPR

New Data Protection Regime in Vietnam — Overview of emerging parallels to GDPR

Privacy and epidemiology: let's find a shared solution.

During the pandemic period, Italian epidemiologists managed to monitor the situation despite fragmented and often low-quality data flows, comparing themselves to other countries (such as England and Israel) that were able to provide valuable indications in very short times thanks to the availability of a large amount of interconnected data at the national level. In the same months, the Italian Data Protection Authority launched several investigations that triggered an immediate stiffening of the mechanisms for accessing data by epidemiological structures at both regional and company levels, leading to a significant limitation in the conduct of epidemiological investigations, and in some cases the complete suspension of important projects. The interpretation of the General data protection regulation (Gdpr) was found to be subjective and heterogeneous among different institutions. The path to legitimizing data processing appears obscure and subject to the sensitivity of the different actors involved in the process within companies and regions. Apparently, only economic reporting is unanimously considered the primary and legitimate use of data. The work of Italian epidemiologists has been called into question to the point of making it practically impossible to carry out their institutional duties, even though they are an integral part of the National health service's (Nhs) function to promote and ensure health and well-being for the population. Today, it is necessary to immediately initiate a path to identify shared solutions among the various actors at both the central and local levels, which allow epidemiological structures and professionals to carry out their tasks with serenity, while ensuring data protection. The obstacles to conducting epidemiological studies are not a problem of individual operators or individual epidemiology structures, but a block to the production of knowledge and, ultimately, to the processes of improving the Nhs.

The thin red line: Refocusing data protection law on ADM, a global perspective with lessons from case-law

This article explores existing data protection law provisions in the EU and in six other jurisdictions from around the world - with a focus on Latin America - that apply to at least some forms of the processing of data typically part of an Artificial Intelligence (AI) system. In particular, the article analyzes how data protection law applies to “automated decision-making” (ADM), starting from the relevant provisions of EU's General Data Protection Regulation (GDPR). Rather than being a conceptual exploration of what constitutes ADM and how “AI systems” are defined by current legislative initiatives, the article proposes a targeted approach that focuses strictly on ADM and how data protection law already applies to it in real life cases. First, the article will show how GDPR provisions have been enforced in Courts and by Data Protection Authorities (DPAs) in the EU, in numerous cases where ADM is at the core of the facts of the case considered. After showing that the safeguards in the GDPR already apply to ADM in real life cases, even where ADM does not meet the high threshold in its specialized provision in Article 22 (“solely” ADM which results in “legal or similarly significant effects” on individuals), the article includes a brief comparative law analysis of six jurisdictions that have adopted general data protection laws (Brazil, Mexico, Argentina, Colombia, China and South Africa) and that are visibly inspired by GDPR provisions or its predecessor, Directive 95/46/EC, including those that are relevant for ADM. The ultimate goal of this study is to support researchers, policymakers and lawmakers to understand how existing data protection law applies to ADM and profiling.11The authors thank the reviewers of the CPDP Latin America 2022 Conference and this journal for their suggestions to improve the draft paper. We also thank our colleague Stefania Medrano for her research and translation support into Latin American jurisdictions.

AN ANALYSIS OF THE LAWS CONCERNING DIGITAL PRIVACY

Both data protection and privacy are crucial components of internet governance. The Data Protection Act is a piece of legislation designed to safeguard individuals' privacy rights. One definition of privacy is the individual's right to manage and disseminate his or her own private information and data in accordance with his or her own goals and values. Numerous judicial decisions in India have elevated the right to privacy to the status of a fundamental right, and statutes have further codified the right as a legal one. The term "internet privacy" can refer to a wide range of issues and debates. The term can refer to both the rights an individual has to control their personal information and the infringements on those rights that occur when that information is transmitted over the Internet. The ever-changing nature of the internet has resulted in a never-ending slew of new privacy-related concerns and problems. Privacy protection in the digital sphere is crucial in the modern world because of the importance of safeguarding our personal information, financial data, sensitive information, online activity, and fundamental rights. To continue reaping the benefits of technological advancements without jeopardising our safety or giving up control of our personal information, it is crucial for individuals, businesses, and governments to take action to protect digital privacy. “The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha on December 11, 2019, by Minister of Electronics and Information Technology Ravi Kumar”. In India, this occurred. The bill's stated goals include, first and foremost, the protection of personally identifiable information, and secondly, the creation of a Data Protection Authority to oversee that protection. This study aims to to examine views of Indian citizens regarding laws concerning digital privacy. For the sake of justification, total 240 respondents has taken through questionnaire by applying 5 point likert scale.

Artificial intelligence-based mining of electronic health record data to accelerate the digital transformation of the national cardiovascular ecosystem: design protocol of the CardioMining study

IntroductionMining of electronic health record (EHRs) data is increasingly being implemented all over the world but mainly focuses on structured data. The capabilities of artificial intelligence (AI) could reverse the...

Addressing the Challenges of Data Privacy Protection Law in Vietnam

The Internet has substantially changed human behaviors in the way of accessing and exchanging information – including personal data – easier and faster than ever. Frontier-less nature of the Internet not only enables the free flow of data across countries, but also brings new challenges including risks to privacy.
 Under the state surveillance, Vietnam has regulated differently privacy from the state and privacy from private actors. The utmost priority focused on regulating cyber activities that impact national security and social order and safety, which is reflected in Law on Cybersecurity No. 24/2018/QH14 on June 12, 2018.
 For personal data protection, the rules for the collection, storage, processing, use, disclosure, and publication of personal data are set out in Vietnam’s Civil Code 2015 and in multiple sectorial laws besides a general framework for data protection promulgated in Law on Network Information Security No. 86/2015/QH13 (Nov 19, 2015). However, these rules are drafted in broad language and are open to interpretation; however, there has been no repository for precedent till now.
 Recently, in order to enhance the best effort in protecting personal data, Vietnam updated its legislative agenda and planned to enact an initial decree on Personal Data Protection drafted by Vietnamese Ministry of Public Security after its first issuance in 2019. This updated draft has a more robust set of rules regulating specific rights of data subjects, cross-border transfer of data, and processing of sensitive personal data, which clarified mostly the longstanding speculation about the direction of Vietnam’s data protection regime beyond state surveillance.
 The objective of the present article is to point out the current status of the legal system in protecting personal data, its potential obstacles to effective protection of the right to data protection, and to put forward solutions for removing those obstacles with regard to data protection in Vietnam.