European Data Protection Law Research Articles

Privacy, health insurance, and medical research: tensions raised by European data protection law

Medical research, particularly using biobanking and genetic information, relies upon a full disclosure of medical information from as wide a group as possible. This reveals individuals' vulnerabilities that could lead to disease, but also to early diagnosis and treatment where it is available. In health insurance, this same information is used to inform decisions about the availability (including cost) of cover for the individual. In individual risk-based insurance this creates a tension with the social purposes of medical research. Within the regulatory framework, one of the most important legal instruments in Europe is the Data Protection Directive (95/46/EC). It operates within a context of the right to a private life in the European Convention on Human Rights. This paper asks how this central piece of legislation, within a discussion of the conceptualization of privacy, addresses the tension between medical research and health insurance.

New Challenges to Data Protection Study - Working Paper No. 2: Data Protection Laws in the EU: The Difficulties in Meeting the Challenges Posed by Global Social and Technical Developments

This the second of two working papers produced for the Challenges to Data study, commissioned by the European Commission. This paper discusses the difficulties that arise if one tries to apply the main EC Directive on data protection (Directive 95/46/EC) and the data protection laws in the EU Member States that implement it, as currently drafted, to the new global social and technical context described in Working Paper No. 1, by Dr. Ian Brown. It does this by means of a comparative-legal analysis, taking into account the six European and five non-European countries studied: Czech Republic, Denmark, France, Germany, Greece, United Kingdom, USA (Federal, California and New Jersey), Australia, Hong Kong, India and Japan. NB: Working Paper No. 1, on Challenges to European Data Protection Laws and Principles, can be found on Ian Brown's ssrn webpage: http://ssrn.com/author=892424. The findings of the paper presented here are summarised in another document: Comparative Chart: Divergencies Between Data Protection Laws in the EU, which can be separately downloaded from the present ssrn page, as can the country reports on France, Germany and the UK, also written by Douwe Korff.

The ‘Internal Morality’ of European Data Protection Law

The ideas of scholars such as HLA Hart and Lon Fuller raise fundamental issues about the nature of law, the characteristics of a successful and efficient legal order, and the role of enforcement in ensuring that the law functions correctly. These are precisely the types of questions that need to be raised about European data protection law, which even European government ministries and data protection authorities (DPAs) have described as complicated, increasingly out-dated, and out of step with good regulatory practice.

Privacy law and technology in Nigeria: The legal framework will not meet the test of adequacy as mandated by article 25 of European union directive 95/46

Nigeria is one of the biggest and fastest telecommunications markets in Africa and has huge potential for information technology (IT) market growth. With nearly 70 million Muslims (roughly half the population), it is also the country with the largest number of members of the Islamic faith in sub-Saharan Africa. While government policies and public-private initiatives such as ‘Computers for all Nigerians’ may have a significant impact in the mid-term, a relatively low percentage of IT penetration and an unreliable power infrastructure has not fuelled concern about European Union-style data protection laws. Value-added systems in Nigeria's fast-developing information and communication technology (ICT) sector may, however, lead to the possibility of export of personal data from the EU to Nigeria. This article considers the test of adequacy and its requirements as laid down in EU Directive 95/46. It then evaluates the Nigerian privacy provisions, keeping in view of the test laid down by the Directive, to come to the conclusion that the legal framework will fail to meet the test of adequacy, but that other remedies may be available. The author takes the view that the current situation is the not the result of influence by any religious faith, but is simply brought about by economic circumstances and the rate of infrastructural growth.

Risk, responsibility and compliance in ‘Circles of Trust’ – Part I

Today, we are expected to remember a different user name and password for almost every organisation or domain we want to access on the Internet. Identity management seeks to solve this problem by making digital identities transferable across organisational boundaries. The basic idea is that the participating organisations will set up a collaboration (or circle of trust), which involves both identity providers and other service providers. However, there is a risk that identity management may reduce the users' level of privacy: can the collaborating organisations collect personal information and create a profile which includes the user's interaction with all collaborators? Who is responsible for the processing of personal data if many organisations collaborate? How can the user make informed decisions and consent to the processing of his data? This article seeks to address these issues from the perspective of European data protection law. The paper is split into two parts. This is part I, which introduces and analyses identity management with a focus on technical issues and risks to privacy. Part II will concentrate on data protection law, addressing the roles and responsibilities of collaborators and will analyse how to ensure a compliant interaction with the end-user.

Identity management and data protection law: Risk, responsibility and compliance in ‘Circles of Trust’ – Part II

Today, we are expected to remember a different user name and password for almost every organisation or domain we want to access on the Internet. Identity management seeks to solve this problem by making digital identities transferable across organisational boundaries. The basic idea is that the participating organisations will set up a collaboration (or circle of trust) which involves both identity providers and other service providers. However, there is a risk that identity management may reduce the users' level of privacy: Can the collaborating organisations collect personal information and create a profile which includes the user's interaction with all collaborators? Who is responsible for the processing of personal data if many organisations collaborate? How can the user make informed decisions and consent to the processing of his data? This article seeks to address these issues from the perspective of European data protection law. The paper is split into two parts. Part I [Olsen T, Mahler, T, Identity management and data protection law: Risk, responsibility and compliance in `Circles of Trust' – Part I, Comput Law Secur Rep 2007;23(4):342–351. doi:10.1016/j.clsr.2007.05.009] introduced and analysed identity management with a focus on technical issues and risks to privacy. This is part II, which concentrates on data protection law, addressing the roles and responsibilities of collaborators and analysing how to ensure a compliant interaction with the end-user.

Bluetooth

Many of the applications of Bluetooth will have important legal ramifications. Most importantly, the use of Bluetooth is an anathema to the UK and European data protection laws. When a visitor enters an office building, does he consent to his personal information (in particular his whereabouts) being transmitted throughout the building to all the companies that have offices there? Bluetooth enables this to be easily done.

NEWS AND COMMENT ON RECENT DEVELOPMENTS FROM AROUND THE WORLD : Commission calls for comment on the legal status of ‘voice on the Internet’

Against the common perception of data protection as a road-block, we demonstrate that the GDPR can work as a research enabler. This study demonstrates that European data protection law's regulatory pillars, the first related to the protection of the fundamental right to data protection and the second regarding the promotion of the free flow of personal data, result into an architecture of layered data protection regimes, which come to tighten or relax data subjects’ rights and data protection safeguards vis à vis processing activities differently grounded in public or merely economic interests. Each of the identified data protection regimes shape different “enabling regulatory spots” for the processing of sensitive personal data for research purposes.

The Adequacy of Privacy: The European Union Data Protection Directive and the North American Response

The recently passed European Directive on the Protection of Personal Data aims to harmonize European data protection law at a higher level of protection than exists now. It represents a European consensus on a standard for personal privacy and a model for countries without data protection laws. The protracted process for agreement and ratification, however, has produced a document with many derogations and ambiguities, reflecting the wider moves towards ''subsidiarity'' within the European Union. Of concern to North America is the stipulation that transborder data flow may not be permitted unless the receiving country can demonstrate an ''adequate'' level of protection. While the process through which this provision will be interpreted and applied is so far found to be complicated and unclear, nevertheless European authorities will be reluctant to tolerate ''data havens,'' a fact that should concern North American business that relies on the unimpeded flows of personal data from and to Europe. Neither Canada nor the United States can claim ''adequate'' data protection according to the European standard. However, Canadian efforts through the Canadian Standards Association and the Federal Information Highway Advisory Council signal an attempt to fashion a more comprehensive policy framework for privacy than the more incremental and reactive approach of the United States. This divergence is explained by key cultural, economic, and political factors within Canada, which have caused a different reaction to the extraterritorial effects of the European Union's Data Protection Directive.

European Data Protection Law

Journal Article European Data Protection Law Get access A.C. Evans A.C. Evans 1A.C. Evans is Lecturer in Public Law, University of Dundee Search for other works by this author on: Oxford Academic Google Scholar The American Journal of Comparative Law, Volume 29, Issue 4, Autumn 1981, Pages 571–582, https://doi.org/10.2307/839754 Published: 01 October 1981