Data Protection Standards Research Articles

How to address data privacy concerns when using social media data in conservation science.

Social media data are being increasingly used in conservation science to study human-nature interactions. User-generated content, such as images, video, text, and audio, and the associated metadata can be used to assess such interactions. A number of social media platforms provide free access to user-generated social media content. However, similar to any research involving people, scientific investigations based on social media data require compliance with highest standards of data privacy and data protection, even when data are publicly available. Should social media data be misused, the risks to individual users' privacy and well-being can be substantial. We investigated the legal basis for using social media data while ensuring data subjects' rights through a case study based on the European Union's General Data Protection Regulation. The risks associated with using social media data in research include accidental and purposeful misidentification that has the potential to cause psychological or physical harm to an identified person. To collect, store, protect, share, and manage social media data in a way that prevents potential risks to users involved, one should minimize data, anonymize data, and follow strict data management procedure. Risk-based approaches, such as a data privacy impact assessment, can be used to identify and minimize privacy risks to social media users, to demonstrate accountability and to comply with data protection legislation. We recommend that conservation scientists carefully consider our recommendations in devising their research objectives so as to facilitate responsible use of social media data in conservation science research, for example, in conservation culturomics and investigations of illegal wildlife trade online.

FPGA Implementations for Data Encryption and Decryption via Concurrent and Parallel Computation: A Review

In recent days, increasing numbers of Internet and wireless network users have helped accelerate the need for encryption mechanisms and devices to protect user data sharing across an unsecured network. Data security, integrity, and verification may be used due to these features. In internet traffic encryption, symmetrical block chips play an essential role. Data Encryption Standard (DES) and Advanced Encryption Standard (AES) ensure privacy encryption underlying data protection standards. The DES and the AES provide information security. DES and AES have the distinction of being introduced in both hardware and applications. DES and AES hardware implementation has many advantages, such as increased performance and improved safety. This paper provides an exhaustive study of the implementation by DES and AES of field programming gate arrays (FPGAs) using both DES and AES. Since FPGAs can be defined as just one mission, computers are superior to them.

P-STORE: Extension of STORE Methodology to Elicit Privacy Requirements

Implementing security and privacy requirements at every level of the software development cycle is imperative for ensuring optimum usability as well as the users’ satisfaction. Software development must consider and comply effectively with the risks involved in the privacy and protection of confidential data. This research study endeavors to integrate the standards of data protection along with the Security Threat Oriented Requirements Engineering (STORE) methodology in order to recognize the potential threats to privacy requirements. The proposed extension of the STORE methodology, called the P-STORE, is validated by a case study of the Healthcare Management Software (HMS) system project. Furthermore, we have used the integrated fuzzy AHP with fuzzy TOPSIS technique for the usability assessment of different privacy requirements engineering approaches including the P-STORE methodology. The study demonstrates that the P-STORE approach has the capability to elicit more efficient privacy requirements and that it allows the software engineer to arrange privacy requirements efficaciously.

Protection of privacy in the period of Covid-19 pandemic

During the pandemic of COVID-19 in April 2020 the Ministry of Health in Bulgaria began the administration of the Virusafe contact tracking application. With the Law on Emergency Measures and Actions, declared by a decision of the National Assembly of 13th March 2020 amendments to the Electronic Communications Act were adopted. The purpose of the legislative amendments was to provide access of the competent authorities to the localization data from the public electronic communication networks of the individuals, who have refused or do not fulfill the obligatory isolation or treatment under art. 61 of the Health Act. This publication aims to analyze the main features of mobile applications for tracking the contacts of infected persons, as well as the adopted legislative changes, comparing them with the standards of personal data protection provided in the EU General Data Protection Regulation 2016/679 and Directive 2002/58/EC on the right to privacy and electronic communications.

The corona crisis, data protection and tracking apps in the EU

The sudden outbreak of COVID-19 put governments under pressure toswiftly introduce measures to protect citizens and react appropriately to theemerging threat. This paper focuses on geo-location tracking mobile phoneapplications developed in the Czech Republic and Austria to monitorpersonal movement of those positively tested for COVID-19 to prevent thefurther spread of the disease. The aim of the analysis is to answer thequestion of whether the appsʼ functionalities complied with the EU dataprotection standards and to what extent the citizensʼ right to control thecollection, evaluation and preservation of their personal data has beenviolated. Both countries belonged to the pioneers in COVID-19 apps. Whilethey differed in several areas such as the legal and political circumstancesunder which the apps were developed and public communication,similarities between them were identified in the area of public trust in theapps and their utilisation. In both countries, certain illiberal issues wererecognised as well.

Psychosocial determinants of healthcare personnel's willingness to carry real-time locating system tags during daily inpatient care in hospital managing COVID-19 patients: insights from a mixed-methods analysis.

ObjectiveReal-time locating systems (RTLS) enable contact tracing and hand hygiene reminders, to improve hospital safety. Successful implementation requires healthcare personnel (HCP) to carry RTLS tags continuously. We assessed for determinants of HCP’s willingness to use RTLS tags during routine inpatient care, and evaluated concerns using mixed-methods analysis.Materials and MethodsWe conducted a cross-sectional study in the 330-bed purpose-built National Centre for Infectious Diseases in Singapore, from January 15 through February 4, 2020. The anonymous survey comprised 24 questions based on constructs from behavioral models and an open-ended question. Principal component analysis was performed to derive the latent factor structure applied in the multivariable logistic regression analysis. Concerns were analyzed using thematic analysis.ResultsOf 260 HCP (nurses [40.8%], ancillary and administrative staff [23.1%], allied health professionals [18.5%], and physicians [17.7%]), 75% were willing to use the RTLS tag. After adjusting for age, gender, healthcare professional group, and duration of practice, the acceptance of the use of the RTLS tag (adjusted OR 11.28 [95% CI 4.39–29.00], P < .001) was highly associated with the willingness to use the RTLS tag. HCP who perceived the tag to be easy to use (adjusted OR 2.80 [95% CI 1.37–5.72], P = .005), were also more willing to use the tag. HCP were willing to carry the RTLS tag for the purpose of contact tracing despite privacy concerns.ConclusionMore communications on the intentions and data protection standards of the RTLS, and accessory enhancements for HCP’s convenient and sustained use of the RTLS tag are crucial, to optimize RTLS’s usefulness during the COVID-19 pandemic.

EU Personal Data Protection Standards and Regulatory Framework

The purpose of the study is to identify the prospects and challenges that arise in the application of the current EU legislation in field of personal data protection. Legal historical method and method of legal forecasting used in work made it possible to analyze advantages of modern instruments of legal regulation. The advantages and disadvantages of the Regulation were analyzed. The analysis indicated a lack of legal certainty of the conceptual apparatus and procedural mechanism of the Regulation, different visions of legislator and representatives of the scientific community regarding the conclusions made by artificial intelligence systems using personal data.

The global flood of COVID-19 contact tracing apps: sailing with human rights and data protection standards against the wind of mass surveillance

Research background: Countries all around the world are rapidly introducing contact tracing apps and other surveillance technologies to tackle the spread of COVID-19 raising serious concerns about human rights and democratic principles. Purpose of the article: The article aims to analyse how human rights and data protection law regulate the COVID-19 contact tracing apps and reveal the biggest challenges that countries face in applying the essential requirements. Methods: The article will analyse the legal framework and compare many guidance documents issued by the international organisations, including the Council of Europe, the OECD and many EU institutions on the data protection requirements for contact tracing tools and the main challenges the governments face in different countries. Findings &amp; Value added: The article will reveal that the existing human rights and data protection standards already impose significant requirements for contact tracing apps requiring to comply with such principles as legality, necessity, proportionality, transparency, purpose limitation, temporariness. Although countries tend to deviate from some of these standards a choice between effective response to crises and fundamental rights should not be made. The article argues that the global flood of digital surveillance technologies requires new regulatory framework and governance mechanisms to enable impact assessment, oversight and monitoring of these technologies both during and after the crises not only to ensure that they are lawful and ethical, but also to limit the dependency of governments on large technology companies as well as to prevent mass surveillance becoming the new normal on a global scale.

Schrems II: Will It Really Increase the Level of Privacy Protection against Mass Surveillance?

An important event that once again brought to the forefront issues related to mass surveillance was the judgment of the Court of Justice of the European Union (hereafter referred as CJEU) delivered on July 16, 2020 in the case of Data Protection Commissioner v. Facebook Ireland Ltd. and Maximilian Schrems (Schrems II). It can be considered as the first serious precedent in the field of surveillance, which is aimed at ensuring privacy in the field of national security. Therefore, it becomes an important issue to assess its impact on the legal framework of international transfers of personal data and on the level of privacy protection. The impact of the judgment on the level of privacy protection and mass surveillance is particularly important now that CОVID-19 contact tracing programs are being widely used. In this research we try to trace the formation of the approach to mass surveillance in the case-law of CJEU before and after the Schrems II. We also try to point out some of the difficulties that the process of cross-border data transfer will face after the Schrems II. The main question of the study is whether the approach of the CJEU developed in the Schrems II will actually increase the privacy protection against mass surveillance. We conclude that the Schrems II is an important decision with serious consequences that go beyond the direct impact on data transfer between the EU and the US. It can have controversial influence of the level of privacy protection. Together with the positive trend of formation of more harmonized global data protection standards it can create many unresolved problems in the field of international data transfer and in economic dimension.

Ensure the Inviolability of Personal Life in the Conduct of Police Preventive Activities

The paper addresses the basic rights and freedoms guaranteed by the Constitution of Georgia, in particular, issues related to personal data. The development of information technology has had a significant impact on the dangers of illegal processing of personal data. The European Court of Human Rights considers the inviolability of private life as a precondition for human autonomy, independent development and protection of human dignity. According to the norms of international law, the right to respect for private life is recognized as one of the most important and fundamental rights, the protection of which is indicated by the legislation of Georgia. The aim of the paper is to analyze the legislation and practice of police law in the field of protection of the right to privacy and to offer relevant recommendations, taking into account the standards set by European and national courts. Human rights legislation must ensure the protection of all human beings against the abuse of state power. Interference with rights must be based on the principle of proportionality. The use of policing should not pose an excessive threat of fundamental human rights violations. Interference with a particular right must be done under principle of proportionality to achieve a certain public good. In clarifying the issue of alleged violation of the right, special attention should be paid to the severity and probability of the expected threat to legal good. The Constitution of Georgia, EU and Council of Europe data protection standards, national legislation, as well as the case law of the European Court of Human Rights and the National Constitutional Court are analyzed around the topic. In addition, the reports of the State Inspector, the Public Defender and the relevant scientific literature are used to study the above issues.

Healthcare needs among unaccompanied minor refugees: a study protocol of a qualitative study explaining access and utilisation across place and gender

IntroductionSeveral studies have identified that unaccompanied minor refugees (UMRs) are allegedly ‘vulnerable’ and belong to a high-risk group in terms of psychological distress and post-traumatic stress disorder due to their preflight, periflight and postflight experiences. Psychosocial care (PSC) is of high importance for UMRs, but little is known about barriers to access and utilisation of PSC across place and gender. The aims of this gender-sensitive qualitative study will be to build on the existing body of literature and to provide qualitative evidence on the contexts and mechanisms of PSC for male and female UMRs in Germany by comparing two German regions.Methods and analysisFollowing the study preparing realist review, a qualitative study will be undertaken in Berlin and Central German cities. Approximately 24 experts from the field of PSC and 12 lay UMRs will participate in face-to-face, semistructured interviews. Data will be transcribed and analysed based on the grounded theory research paradigm.Ethics and disseminationOnly participants who have been informed in both German and their native tongue and who have signed a declaration of consent will be included in the study. The study will comply rigorously with German data protection standards. Approval from the Ethical Review Committee at Martin Luther University Halle-Wittenberg, Germany has been obtained and granted. The results of the study will be presented at several conferences and will be published in high-quality, peer-reviewed international journals. The results will display a differentiated picture of the PSC of UMRs in Germany. Such knowledge is a precondition for a ‘science of change’ that translates explanations into practical recommendations on how to improve healthcare policies.Trial registration numberDRKS00018080.

Neo-Liberal Business-As-Usual or Post-Surveillance Capitalism With European Characteristics? The EU’s General Data Protection Regulation in a Multi-Polar Internet

Since the Global Financial Crisis from 2008/2009 and the decade which followed it, the tenets of neoclassical economic theory and its application through neo-liberalism have been questioned in western economies including the European Union (EU). The Snowden revelations of US-driven global digital surveillance prompted law and policy changes in various jurisdictions including the EU to counter privacy infringements by both state and corporate actors. This all takes place against a backdrop of an increasingly multi-polar world, including in matters of Internet governance, where the US’s hegemony is weakened and the EU and BRICS emerge as powerful actors, including in the Internet sphere. One highly prominent event in the last ten years thrusting the EU into global prominence is its data protection legislation update, with the introduction of the General Data Protection Regulation (GDPR), widely believed to be the international ‘gold standard’ in privacy and data protection standards, holding actors in the digital economy to account for their (ab)use of personal data and empowering users thereby seemingly placing some limitations on unfettered digital capitalism and surveillance. Can the GDPR developments be understood as an attempt by the EU to forge a different political economy of digital technology to neo-liberal capitalism whereby large companies are constrained in their actions and EU citizens’ rights upheld? Or can these developments be seen through another lens, that of varieties of capitalism, whereby the European Union, in the context of growing geopolitical multi-polarity, is leveraging its large and attractive market and the ‘Brussels Effect’ to become a ‘regulatory superpower’ after having lost the tech superpower battle to the US and China? The GDPR exposes the nature of contemporary EU internet regulation as a contested and hybrid site, containing both capitalist impulses and overtures to protect aspects of individuals’ privacy and data protection. This latter aspect of protecting privacy and data protection is diminished to the extent that the GDPR facilitates much data gathering and use, and seems to have the effect in practice of consolidating US tech giant Google’s corporate power. Thus, the GDPR seems more an example of EU regulatory capitalism, ‘constraining and encouraging the spread of neo-liberal norms’, rather than an attempt to move to digital post-capitalism. Nevertheless, the external-reaching aspects of the GDPR make it an example of the ‘Brussels effect’ and contribute to shoring up the EU’s regulatory power in a multi-polar Internet by proactively setting de facto standards. In this way, the EU ‘remains relevant as a global economic power’ through its regulation, rather than through its technological innovation like the US and China. The GDPR’s aspects which promote human rights and social goals may also give rise to more privacy protective innovation, albeit innovation which may come from non-EU Big Tech companies.

Disclosure, Exposure and the ʻRight to be Forgottenʼ after Google Spain: Interrogating Google Search's webmaster, end user and Lumen notification practices

This article argues that Google's essentially blanket and unsafeguarded dissemination to webmasters of URLs delisted under the Google Spain judgment disclosures claimants’ personal data, cannot be justified either on the purported basis of their consent or a legal requirement but instead seriously infringes European data protection standards. Such disclosure would only be compatible with the initially contextually sensitive context of collection where it was (i) reasonably necessary and explicitly limited to the purposes of checking the legality of the initial decision and/or bona fide research and (ii) prevented unauthorised repurposing or other misuse through robust safeguards. Strict necessity thresholds would need to apply where disclosure involved special categories of data or was subject to reasoned objection by a data subject and international transfers would require further controls, ideally as provided by the European Commission's standard contractual clauses. Disclosing identifiable data on removals to end users would directly and fundamentally undermine a data subject's rights and, therefore, ipso facto violate purpose limitation and legality, irrespective of whether rights are claimed in data protection, defamation or civil privacy. The public's legitimate interests in receiving information on personal data removals are best secured through safeguarded scientific research, which search engines should facilitate.

The Right to Be Forgotten in the Digital Age: The Challenges of Data Protection Beyond Borders

AbstractThis article explores the challenges of the extraterritorial application of the right to be forgotten and, more broadly, of EU data protection law in light of the recent case law of the ECJ. The paper explains that there are good arguments for the EU to apply its high data protection standards outside its borders, but that such an extraterritorial application faces challenges, as it may clash with duties of international comity, legal diversity, or contrasting rulings delivered by courts in other jurisdictions. As the article points out from a comparative perspective, the protection of privacy in the digital age increasingly exposes a tension between efforts by legal systems to impose their high standards of data protection outside their borders – a dynamic which could be regarded as ‘imperialist’ – and claims by other legal systems to assert their own power over data – a dynamic which one could name ‘sovereigntist’. As the article suggests, navigating between the Scylla of imperialism and the Charybdis of sovereigntism will not be an easy task. In this context, greater convergence in the data protection framework of liberal democratic systems worldwide appears as the preferable path to secure privacy in the digital age.

Technology Innovation System Analysis of Electricity Smart Metering in the European Union

Between 2018 and 2023 the penetration rate of electricity smart meters in the European Union (EU) is expected to grow from approximately 44% to 71%. The unprecedently rapid development of smart metering (SM) as an ICT-enabled technological novelty is progressing in a complex, multi-actor innovation system, which is strongly driven by EU-level institutions and policies. This paper presents the comprehensive Technology Innovation System (TIS) analysis of electricity SM development in the EU, with a focus placed on regulatory aspects. The article identifies the key elements of the SM innovation system (technologies and infrastructures; actors and networks; institutions and policies) and characterises their interaction based on an in-depth desk research and a critical assessment of regulations, statistics and primary and grey literature sources (e.g., market reports). The main enablers and barriers for EU-level SM TIS development are studied. The major driving force for EU-level SM TIS is the clear, yet evolving vision of EU-level actors for the SM deployment, founded on the grounds of energy conservation and empowerment of customers. On the other hand, the major inhibitor is the insufficient regulatory framework for roll-outs at the level of a Member State, which does not fully ensure interoperability, data protection and security standards or organisational effectiveness.

Personal Data Processing by and for Political Campaigns: The Application of the Council of Europe's Modernised Convention 108

At the center of efforts to combat electoral manipulation and propaganda lies the question of how personal data on individual voters is being processed in political campaigns, and whether or not it is done so legally and ethically. Familiar data protection questions are now at the center of a heated international debate about democratic integrity, and about the rights to free elections enshrined in the European Convention on Human Rights. International instruments for the protection of data, such as the modernized Council of Europe’s Convention 108, assume increasing importance in the regulation of data-driven elections, and in the support of broad democratic principles of pluralism and individual autonomy. The main body of the paper analyzes the different, but related, data protection standards that apply directly to the processing of personal data in election campaigns: identifiability and re-identifiability; the definition of sensitive political opinions; political communications; legitimate interests and proportionality; the processing of public data on social media; the obligation of transparency; and automated processing and profiling. Throughout, comparisons are made with parallel provisions within the EU General Data Protection Regulation (GDPR) and to recent investigations into political campaign practices by data protection authorities in the UK, France, and Canada. Convention 108+ has a unique role to play in the promulgation of good data protection practices for political campaigns and thereby enhancing democratic rights. The modernized Convention 108+ of 2018 is explicitly rooted in a broad aim “to secure the human dignity and protection of the human rights and fundamental freedoms of every individual.” It recognizes that the “right to protection of personal data is to be considered in respect of its role in society and that it has to be reconciled with other human rights and fundamental freedoms, including freedom of expression.” The processing of personal data in political campaigns requires exactly this kind of reconciliation. The history of the Council of Europe and its experience in promoting democratic rights make the organization ideally suited to addressing these critical issues in both advanced industrialized societies, as well as within the more fragile democratic cultures of the Global South.

The GDPR as Global Data Protection Regulation?

The deterritorialization of the Internet and international communications technology has given rise to acute jurisdictional questions regarding who may regulate online activities. In the absence of a global regulator, states act unilaterally, applying their own laws to transborder activities. The EU's “extraterritorial” application of its data protection legislation—initially the Data Protection Directive (DPD) and, since 2018, the General Data Protection Regulation (GDPR)—is a case in point. The GDPR applies to “the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services . . . to such data subjects in the Union; or (b) the monitoring of their behaviour . . . within the Union.” It also conditions data transfers outside the EU on third states having adequate (meaning essentially equivalent) data protection standards. This essay outlines forms of extraterritoriality evident in EU data protection law, which could be legitimized by certain fundamental rights obligations. It then looks at how the EU balances data protection with third states’ countervailing interests. This approach can involve burdens not only for third states or corporations, but also for the EU political branches themselves. EU law viewed through the lens of public international law shows how local regulation is going global, despite its goal of protecting only EU data subjects.

PROTECTION OF PERSONAL DATA IN THE EUROPEAN UNION-TURKEY RELATIONS: EFFECT OF VISA LIBERALISATION DIALOGUE

The European Union is rather successful at making regulations and law whose influence go beyond the European territory, as these acts are widely considered as common standards. One of them is about personal data protection. The European Union accepted a new regulation on the protection of personal data which was put in practice in May 2018, after a long period of discussions. The regulation was accepted for the replacement of laws about data protection in member and candidate states. As a European Union candidate country, Turkey started a visa liberation dialogue with the European Union in 2013. Personal data protection issue has been one of the most crucial subjects of the visa liberation process and considered as an important requirement which must be fulfilled by Turkey. In this respect, the study will elaborate the European Union’s regulation on new personal data protection under the case of Turkey’s visa liberalisation dialogue. In the first chapter, the historical development of personal data protection, the European Union data protection regulation and current situation will be analysed. In the second chapter, the study will elaborate the issue of data protection under the case of visa liberation dialogue between Turkey and the European Union. In the last chapter, aiming to reveal the differences between General Data Protection Regulation and Turkish data protection legislation, Turkey’s cohesion to the European Union’s data protection regulation within the frame of visa liberation dialogue will be dealt. In this context, differentiating from present studies and researches in the literature, this study asserts that visa liberalisation dialogue catalyses Turkey’s compliance with the European Union’s data protection standards.

Disclosure, Exposure and the ʻRight to be Forgottenʼ after Google Spain: Interrogating Google Search’s Webmaster, End User and Lumen Notification Practices

This paper argues that Google’s essentially blanket and unsafeguarded dissemination to webmasters of URLs deindexed under the Google Spain judgment involves the disclosure of the claimant’s personal data, cannot be justified either on the purported basis of their consent or that this is legally required but instead seriously infringes European data protection standards. Disclosure of this data would only be compatible with the initially contextually sensitive context of collection where it was (i) reasonably necessary and explicitly limited to the purposes of checking the legality of the initial decision and/or bona fide research and (ii) was subject to effective safeguards that prevented any unauthorised repurposing or other use. Strict necessity thresholds would need to apply where disclosure involved special category data or was subject to reasoned objection by a data subject and international transfers would require appropriate safeguards as provided by the European Commission’s standard contractual clauses. Disclosing identifiable data on removals to end users would directly and fundamentally undermine a data subject’s rights and, therefore, ipso facto violate purpose limitation and legality, irrespective of a data subject claims rights in data protection, defamation or civil privacy. The public’s legitimate interests in receiving information on personal data removals should be secured through safeguarded scientific research that the search engines should facilitate and promote.

Development of a knowledge management system for the NOMAD instrument onboard the ExoMars TGO spacecraft

Purpose This paper aims to describe the development of a knowledge management system (KMS) for the Nadir and Occultation for Mars Discovery (NOMAD) instrument on board the ESA/Roscosmos 2016 ExoMars Trace Gas Orbiter (TGO) spacecraft. The KMS collects knowledge acquired during the engineering process that involved over 30 project partners. In addition to the documentation and technical data (explicit knowledge), a dedicated effort was made to collect the gained experience (tacit knowledge) that is crucial for the operational phase of the TGO mission and also for future projects. The system is now in service and provides valuable information for the scientists and engineers working with NOMAD. Design/methodology/approach The NOMAD KMS was built around six areas: official documentation, technical specifications and test results, lessons learned, management data (proposals, deliverables, progress reports and minutes of meetings), picture files and movie files. Today, the KMS contains 110 GB of data spread over 11,000 documents and more than 13,000 media files. A computer-aided design (CAD) library contains a model of the full instrument as well as exported sub-parts in different formats. A context search engine for both documents and media files was implemented. Findings The conceived KMS design is basic, flexible and very robust. It can be adapted to future projects of a similar size. Practical implications The paper provides practical guidelines on how to retain the knowledge from a larger aerospace project. The KMS tool presented here works offline, requires no maintenance and conforms to data protection standards. Originality/value This paper shows how knowledge management requirements for space missions can be fulfilled. The paper demonstrates how to transform the large collection of project data into a useful tool and how to address usability aspects.