European Union General Data Protection Regulation Research Articles

Utilization of registers to create an evidence-based approach in catastrophes and civil defence

Medical data registers are a key instrument of medical care research and a valuable tool for medical quality assurance. The structured plausibility tested documentation of large case numbers on a longitudinally oriented time axis with different points in time of data acquisition enables statements to be made on numerous relevant outcomes, not only the mortality of patients. For incidents outside the daily routine care in trauma surgery, such as natural disasters, accidents with multiple casualties and nonmilitary treatment of the domestic population in defence situations, such registers can provide data-based recommendations for action. These data, mainly obtained from routine traumatological treatment, enable a targeted resource management in the abovenamed incidents, which are associated with mass casualties. Due to the utilization of registers from the military field or from international registers, the perspective is additionally extended with respect to treatment strategies and injury patterns. Whether data can also be generated in a suitable manner for the abovenamed registers in specific disaster situations and can provide a direct gain of knowledge from the incident, must be critically discussed. The maintenance of the register datasets is time-consuming and has been subjected to a more stringent regulation at least since May 2018, when the European Union General Data Protection Regulation (EU-GDPR) came into force. The future Register Act in Germany will hopefully achieve greater simplification in the documentation of routine data.

A comparative analysis: health data protection laws in Malaysia, Saudi Arabia and EU General Data Protection Regulation (GDPR)

Purpose General Data Protection Regulation (GDPR) of the European Union (EU) was passed to protect data privacy. Though the GDPR intended to address issues related to data privacy in the EU, it created an extra-territorial effect through Articles 3, 45 and 46. Extra-territorial effect refers to the application or the effect of local laws and regulations in another country. Lawmakers around the globe passed or intensified their efforts to pass laws to have personal data privacy covered so that they meet the adequacy requirement under Articles 45–46 of GDPR while providing comprehensive legislation locally. This study aims to analyze the Malaysian and Saudi Arabian legislation on health data privacy and their adequacy in meeting GDPR data privacy protection requirements. Design/methodology/approach The research used a systematic literature review, legal content analysis and comparative analysis to critically analyze the health data protection in Malaysia and Saudi Arabia in comparison with GDPR and to see the adequacy of health data protection that could meet the requirement of EU data transfer requirement. Findings The finding suggested that the private sector is better regulated in Malaysia than the public sector. Saudi Arabia has some general laws to cover health data privacy in both public and private sector organizations until the newly passed data protection law is implemented in 2024. The finding also suggested that the Personal Data Protection Act 2010 of Malaysia and the Personal Data Protection Law 2022 of Saudi Arabia could be considered “adequate” under GDPR. Originality/value The research would be able to identify the key principles that could identify the adequacy of the laws about health data in Malaysia and Saudi Arabia as there is a dearth of literature in this area. This will help to propose suggestions to improve the laws concerning health data protection so that various stakeholders can benefit from it.

WhatsApp Data Policy, Data Security and Users’ Vulnerability

Several regulatory agencies regulate companies that deal with users' data, but specifically in the UK, they are regulated by the European Union General Data Protection Regulation (GDPR). The techniques of handling and processing data, rights of users, sanctions for defaulters, and other regulating clauses are formulated and implemented by these agencies to minimize the exploitation of the masses. Data regulation and management are essential because companies managing users' data are expected to handle data with care, caution, and due diligence. However, WhatsApp (arguably the most powerful instant messaging application in use) has been involved repeatedly in several cases that compromised the security of its users’ data over the years. The platform has become a prime target and medium for predators (con artists, fraudsters) with intentions to access users' data (phone numbers, last seen, live location, and others) for vile purposes. These cases include leaked data that could be used for marketing purposes, phishing, impersonation, and fraud. This paper highlights recent cases of data security (data leakages) and privacy policies involving WhatsApp, examining the various issues that threaten WhatsApp users and make them vulnerable to exploiters, cybercrime, and con artists. It also considers how WhatsApp can protect its users against vulnerabilities. Also, the European Union GDPR was examined in line with WhatsApp's privacy policy to measure compliance with the regulation in light of recent data breaches. 

Can legitimate interest be an appropriate lawful basis for processing Artificial Intelligence training datasets?

Precision and effectiveness of Artificial Intelligence (AI) models are highly dependent on the availability of genuine, relevant, and representative training data. AI systems tested and validated on poor-quality datasets can produce inaccurate, erroneous, skewed, or harmful outcomes (actions, behaviors, or decisions), with far-reaching effects on individuals' rights and freedoms.Appropriate data governance for AI development poses manifold regulatory challenges, especially regarding personal data protection. An area of concern is compliance with rules for lawful collection and processing of personal data, which implies, inter alia, that using databases for AI design and development should be based on a clear and precise legal ground: the prior consent of the data subject or another specific valid legal basis.Faced with this challenge, the European Union's personal data protection legal framework does not provide a preferred, one-size-fits-all answer, and the best option will depend on the circumstances of each case. Although there is no hierarchy among the different legal bases for data processing, in doubtful cases, consent is generally understood by data controllers as a preferred or default choice for lawful data processing. Notwithstanding this perception, obtaining data subjects' consent is not without drawbacks for AI developers or AI-data controllers, as they must meet (and demonstrate) various requirements for the validity of consent. As a result, data subjects' consent could not be a suitable and realistic option to serve AI development purposes. In view of this, it is necessary to explore the possibility of basing this type of personal data processing on lawful grounds other than the data subject's consent, specifically, the legitimate interest of the data controller or third parties. Given its features, legitimate interests could help to meet the challenge of quality, quantity, and relevance of data curation for AI training.The aim of this article is to provide an initial conceptual approach to support the debate about data governance for AI development in the European Union (EU), as well as in non-EU jurisdictions with European-like data protection laws. Based on the rules set by the EU General Data Protection Regulation (GDPR), this paper starts by referring to the relevance of adequate data curation and processing for designing trustworthy AI systems, followed by a legal analysis and conceptualization of some difficulties data controllers face for lawful processing of personal data. After reflecting on the legal standards for obtaining data subject's valid consent, the paper argues that legitimate interests (if certain criteria are met) may better match the purpose of building AI training datasets.

Bridging the European Data Sharing Divide in Genomic Science.

In this viewpoint, we argue for the importance of creating data spaces for genomic research that are detached from contexts in which fundamental rights concerns related to surveillance measures override a purpose-specific balancing of fundamental rights. Genomic research relies on molecular and phenotypic data, on comparing findings within large data sets, on searchable metadata, and on translating research results into a clinical setting. These methods require sensitive genetic and health data to be shared across borders. International data sharing between the European Union (EU) or the European Economic Area and third countries has accordingly become a cornerstone of genomics. The EU General Data Protection Regulation contains rules that accord privileged status to data processing for research purposes to ensure that strict data protection requirements do not impede biomedical research. However, the General Data Protection Regulation rules applicable to international transfers of data accord no such preferential treatment to international data transfers made in the research context. The rules that govern the international transfer of data create considerable barriers to international data sharing because of the cost-intensive procedural and substantive compliance burdens that they impose. For certain jurisdictions and select use cases, there exist practically no lawful mechanisms to enable the international transfer of data because of concerns about the protection of fundamental rights. The proposed solutions further fail to address the need to share large data sets of local and regional cohorts across national borders to enable joint analyses. The European Health Data Space is an emerging federated, EU-wide data infrastructure that is intended to function as an infrastructure bringing together EU health data to improve patient care and enable the secondary use of health-related data for research purposes. Such infrastructure is implementing new institutions to support its functioning and is being implemented in reliance on a new enabling law, the regulation on the European Health Data Space. This innovation provides the opportunity to facilitate EU contribution to international genomic research efforts. The draft regulation for this data space provides for a concept of data infrastructure intended to enable cross-border data exchange and access, including access to genetic and health data for scientific analysis purposes. The draft regulation also provides for obligations of national actors aimed at making data widely available. This effort is laudable. However, in the absence of further, more fundamental changes to the manner in which the EU regulates the secondary use of health data, it is reasonable to believe that EU participation in international genomic research efforts will remain impeded.

The right to privacy and an implication of the EU General Data Protection Regulation (GDPR) in Europe: challenges to the companies

ABSTRACT The article traces the European Union (EU)’s General Data Protection Regulation (GDPR) and implication in the Europe. In the era of global digitalisation, the right to respect private life, communication and the home has become a matter of protection. Protecting the right to privacy is a responsibility of a state which includes privacy of personal information, e.g. birth, messages, phone call and number and emails. Likewise, this study explains EU concern’s about its citizens’ privacy and the recent inclusion of the GDPR for the protection of natural persons. The article aims to explore individual fundamental rights and implications in the digital age, as well as cooperation data rules between companies and public bodies. At the same time, questions arise about the rightful implication of GDPR and the right to privacy of the public through protection, especially from tech companies. For validating the argument, various qualitative research methods were applied. The COVID-19 pandemic has raised a serious question over privacy rights protection by the government, which supports our findings that EU GDPR has a long road to go and have challenges. Its credibility of lawful data activities is also a matter of concern and a reliable promise by the member states and the EU.

The future regulation of artificial intelligence systems in healthcare services and medical research in the European Union.

Despite its promising future, the application of artificial intelligence (AI) and automated decision-making in healthcare services and medical research faces several legal and ethical hurdles. The European Union (EU) is tackling these issues with the existing legal framework and drafting new regulations, such as the proposed AI Act. The EU General Data Protection Regulation (GDPR) partly regulates AI systems, with rules on processing personal data and protecting data subjects against solely automated decision-making. In healthcare services, (automated) decisions are made more frequently and rapidly. However, medical research focuses on innovation and efficacy, with less direct decisions on individuals. Therefore, the GDPR’s restrictions on solely automated decision-making apply mainly to healthcare services, and the rights of patients and research participants may significantly differ. The proposed AI Act introduced a risk-based approach to AI systems based on the principles of ethical AI. We analysed the complex connection between the GDPR and AI Act, highlighting the main issues and finding ways to harmonise the principles of data protection and ethical AI. The proposed AI Act may complement the GDPR in healthcare services and medical research. Although several years may pass before the AI Act comes into force, many of its goals will be realised before that.

Digitizing the Informed Consent Process: A Review of the Regulatory Landscape in the European Union.

BackgroundRapid technological advancements are reshaping the conduct of clinical research. Electronic informed consent (eIC) is one of these novel advancements, allowing to interactively convey research-related information to participants and obtain their consent. The COVID-19 pandemic highlighted the importance of establishing a digital, long-distance relationship between research participants and researchers. However, the regulatory landscape in the European Union (EU) is diverse, posing a legal challenge to implement eIC in clinical research. Therefore, this study takes the necessary steps forward by providing an overview of the current regulatory framework in the EU, relevant to eIC.MethodsWe reviewed and analyzed the key EU regulations, such as the EU General Data Protection Regulation (GDPR) and the Clinical Trials Regulation (CTR). We investigated the legality of eIC in several EU Member States, Switzerland, and the United Kingdom. To this end, we contacted the medicines agencies of various countries to clarify the national requirements related to the implementation and use of eIC in clinical research. Our research was complemented by comparing the legal acceptance of eIC between the EU and the United States.ResultsIn the EU, a distinction must be made between eIC for participation in clinical research and eIC for processing the participants’ personal data, complying respectively with requirements laid down by the CTR and the GDPR. On a national level, countries were classified into three groups: (1) countries accepting and regulating the use of eIC, (2) countries accepting the use of eIC without explicitly regulating it, and (3) countries not accepting the use of eIC. As a result, the regulation of eIC through laws and guidelines shows a large variety among EU Member States, while in the United States, it is harmonized through the Code of Federal Regulations.ConclusionVarious requirements must be considered when implementing eIC in clinical research. Nevertheless, requirements across the EU Member States may differ significantly, whereas, in the United States, efforts have already been made to achieve a harmonized approach.

Fraud detection in motor insurance: privacy and data protection concerns under EU Law

Abstract This article focuses on the privacy and data protection concerns under European Union (EU) law with respect to the detection of insurance fraud in motor insurance. Insurance fraud—in the context of this article—encompasses all claims where an insured intends to deceive an insurer, aiming to direct payment towards a person who is not the intended recipient, or to procure payment to which the insured is not entitled. More and more frequently, insurers rely on advanced technologies (such as network analysis) to detect fraudulent claims. Evidently, these techniques need to operate within the boundaries of the law governing the protection of personal data and the right to privacy. The EU General Data Protection Regulation imposes certain restrictions on the processing of personal data. This article analyses the legal restrictions Articles 6 and 22 General Data Protection Regulation impose on insurers with respect to the processing of personal data for the purpose of fraud detection. Moreover, insurers work together to identify known fraudsters by sharing access to a database that contains registered cases of fraud (blacklists). This article analyses the legality of such blacklists in light of the EU law on data protection.

'If relevant, yes; if not, no': General practitioner (GP) users and GP perceptions about asking ethnicity questions in Irish general practice: A qualitative analysis using Normalization Process Theory.

The use of ethnic identifiers in health systems is recommended in several European countries as a means to identify and address heath inequities. There are barriers to implementation that have not been researched. This study examines whether and how ethnicity data can be collected in Irish general practices in a meaningful and acceptable way. Qualitative case study data generation was informed by Normalization Process Theory (NPT) constructs about 'sense' making and 'engagement'. It consisted of individual interviews and focus group discussions based on visual participatory techniques. There were 70 informants, including 62 general practitioner (GP) users of diverse ethnic backgrounds recruited through community organisations and eight GPs identified through an inter-agency steering group. Data were analysed according to principles of thematic analysis using NPT. The link between ethnicity and health was often considered relevant because GP users grasped connections with genetic (skin colour, lactose intolerance), geographic (prevalence of disease, early years exposure), behavioural (culture/food) and social determinant (housing) factors. The link was less clear with religion. There was some scepticism and questions about how the collection of data would benefit GP consultations and concerns regarding confidentiality and the actual uses of these data (e.g. risk of discrimination, social control). For GPs, the main theme discussed was relevance: what added value would it bring to their consultations and was it was their role to collect these data? Their biggest concern was about data protection issues in light of the European Union (EU) General Data Protection Regulation (GDPR). The difficulty in explaining a complex concept such as 'ethnicity' in the limited time available in consultations was also worrying. Implementation of an ethnicity identifier in Irish general practices will require a strong rationale that makes sense to GP users, and specific measures to ensure that its benefits outweigh any potential harm. This is in line with both our participants' views and the EU GDPR.

Interest group lobbying in the European Union: privacy, data protection and the right to be forgotten

The issue of trust and control of data online has become critical for many European Union (EU) citizens in an era where we are increasingly reliant on digital platforms across a plethora of everyday activities. Indeed, the future of the EU’s Digital Single Market Policy is reliant on developing trust through robust legislation that ensures explicit control of data by EU citizens. This article explores the extent to which interest groups have been able to successfully achieve their goals through actions in the European Union institutional spaces that construct privacy and data protection legislation. Specifically, it investigates the intervention of interest groups utilizing the ‘right to be forgotten’ (RTBF) in the EU General Data Protection Regulation as a case study. The article shows that issue salience and conflict as well as institutional politicization and lobbying by a union of ‘strange bedfellows’ are important factors in determining interest group preference attainment and success and ultimately who the winners and losers have been in the RTBF decision-making process.

Implementation of the ECOWAS Supplementary Act on Personal Data Protection: Lessons from the EU GDPR

The process of accessing information about any individual is fast becoming beyond the control of private individuals as long as internet technology continues to penetrate more areas of our routine lives. The question has always been how far private individuals can regulate how their private information is accessed, processed and for what purpose. The European Union (EU) has made the General Data Protection Regulation (GDPR) for the purpose of filling the regulatory gap in protecting the right to data privacy of Europeans under the Data Protection Directive (1995). For the EU as a supranational organisation, the regulatory system is designed to be protective of the privacy right of every citizen within and outside the EU because it has the institutional capacity to sanction business entities that breach the GDPR. The Economic Community of West African States (ECOWAS) has adopted the Supplementary Act on Personal Data Protection. Although the ECOWAS has the outlook of a supranational community, it lacks the institutional structure that should make its laws enforceable across the member states. With its present structure, however, the ECOWAS Act is still a model instrument for data protection in the African region and can be improved upon. This paper examines the ECOWAS Act and studies the structure and implementation of the GDPR to understand why the act may not effectively be enforced across the member states without the reform of the ECOWAS.

Legal Aspects of Artificial Intelligence on Automated Decision-Making in Indonesia

This paper analyzes the importance of Indonesia's comprehensive legal framework on automated decision-making empowered by Artificial Intelligence, comparing it to the European Union, the United States, and China. Specifically, this paper inquires about the status quo of the legal protection of automated decision-making In Indonesia. The analysis highlights profiling in an automated decision-making system with the following discussion about personal data protection. In this context, the European Union's member states set out the General Data Protection Regulation (GDPR) that prohibits automated decision-making to a certain extent. In the United States, the practice of automated decision-making is rather usual. Simultaneously, China takes an exceptional measure instead and develops this automation through a social credit system. The analysis concludes that Indonesia has weak legal protection towards personal data and profiling, which later becomes the basis in facilitating automated decision-making. The provision of automated decision-making and profiling is the absolute bare minimum to Indonesia's Personal Data Protection Bill due to insufficient legal certainty. In the end, it is paramount for lawmakers to consider a comprehensive regulation on automated decision-making by adopting the European Union's GDPR framework.
 KEYWORDS: Artificial Intelligence, Automated Decision-Making, Personal Data Protection.

EU GDPR or APEC CBPR? A comparative analysis of the approach of the EU and APEC to cross border data transfers and protection of personal data in the IoT era

This article examines the two major international data transfer schemes in existence today – the European Union (EU) model which at present is effectively the General Data Protection Regulation (GDPR), and the Asia-Pacific Economic Cooperation (APEC) Cross Border Privacy Rules system (CBPR), in the context of the Internet of Things (IoT).While IoT data ostensibly relates to things i.e. products and services, it impacts individuals and their data protection and privacy rights, and raises compliance issues for corporations especially in relation to international data flows. The GDPR regulates the processing of personal data of individuals who are EU data subjects including cross border data transfers. As an EU Regulation, the GDPR applies directly as law to EU member nations. The GDPR also has extensive extraterritorial provisions that apply to processing of personal data outside the EU regardless of place of incorporation and geographical area of operation of the data controller/ processor. There are a number of ways that the GDPR enables lawful international transfer of personal data including schemes that are broadly similar to APEC CBPR.APEC CBPR is the other major regional framework regulating transfer of personal data between APEC member nations. It is essentially a voluntary accountability scheme that initially requires acceptance at country level, followed by independent certification by an accountability agent of the organization wishing to join the scheme. APEC CBPR is viewed by many in the United States of America (US) as preferable to the EU approach because CBPR is considered more conducive to business than its counterpart schemes under the GDPR, and therefore is regarded as the scheme most likely to prevail.While there are broad areas of similarity between the EU and APEC approaches to data protection in the context of cross border data transfer, there are also substantial differences. This paper considers the similarities and major differences, and the overall suitability of the two models for the era of the Internet of Things (IoT) in which large amounts of personal data are processed on an on-going basis from connected devices around the world. This is the first time the APEC and GDPR cross-border data schemes have been compared in this way. The paper concludes with the author expressing a view as to which scheme is likely to set the global standard.

Liable, but Not in Control? Ensuring Meaningful Human Agency in Automated Decision‐Making Systems

Automated decision making is becoming the norm across large parts of society, which raises interesting liability challenges when human control over technical systems becomes increasingly limited. This article defines “quasi‐automation” as inclusion of humans as a basic rubber‐stamping mechanism in an otherwise completely automated decision‐making system. Three cases of quasi‐automation are examined, where human agency in decision making is currently debatable: self‐driving cars, border searches based on passenger name records, and content moderation on social media. While there are specific regulatory mechanisms for purely automated decision making, these regulatory mechanisms do not apply if human beings are (rubber‐stamping) automated decisions. More broadly, most regulatory mechanisms follow a pattern of binary liability in attempting to regulate human or machine agency, rather than looking to regulate both. This results in regulatory gray areas where the regulatory mechanisms do not apply, harming human rights by preventing meaningful liability for socio‐technical decision making. The article concludes by proposing criteria to ensure meaningful agency when humans are included in automated decision‐making systems, and relates this to the ongoing debate on enabling human rights in Internet infrastructure.

Minding the Machine v2.0: The EU General Data Protection Regulation and Automated Decision Making

This chapter examines how parts of the newly revamped legal framework for data protection in the European Union (EU) are likely to impact on automated decisional systems. In particular, it casts a critical light on two sets of provisions of the EU’s General Data Protection Regulation (Regulation 2016/679): Articles 22 and 25. Article 22 gives a person a qualified right ‘not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’. Article 25 imposes a duty on controllers of personal data to implement technical and organisational measures so that the processing of the data will meet the Regulation’s requirements and otherwise ensure protection of the data subject’s rights. Both sets of rules are aimed squarely at subjecting automated decisional systems to greater accountability. The basic argument advanced in the chapter is that the rules unfortunately suffer from significant weaknesses that are likely to hamper their ability to meet this aim.

A Study on the Information Security Management Index through Analysis of EU-GDPR(European Union-General Data Protection Regulation)

A Study on the Information Security Management Index through Analysis of EU-GDPR(European Union-General Data Protection Regulation)

EU General Data Protection Regulation: Changes and implications for personal data collecting companies

The General Data Protection Regulation (GDPR) will come into force in the European Union (EU) in May 2018 to meet current challenges related to personal data protection and to harmonise data protection across the EU. Although the GDPR is anticipated to benefit companies by offering consistency in data protection activities and liabilities across the EU countries and by enabling more integrated EU-wide data protection policies, it poses new challenges to companies. They are not necessarily prepared for the changes and may lack awareness of the upcoming requirements and the GDPR's coercive measures. The implementation of the GDPR requirements demands substantial financial and human resources, as well as training of employees; hence, companies need guidance to support them in this transition. The purposes of this study were to compare the current Data Protection Directive 95/46/EC with the GDPR by systematically analysing their differences and to identify the GDPR's practical implications, specifically for companies that provide services based on personal data. This study aimed to identify and discuss the changes introduced by the GDPR that would have the most practical relevance to these companies and possibly affect their data management and usage practices. Therefore, a review and a thematic analysis and synthesis of the article-level changes were carried out. Through the analysis, the key practical implications of the changes were identified and classified. As a synthesis of the results, a framework was developed, presenting 12 aspects of these implications and the corresponding guidance on how to prepare for the new requirements. These aspects cover business strategies and practices, as well as organisational and technical measures.

From universal towards child-specific protection of the right to privacy online: Dilemmas in the EU General Data Protection Regulation

The new European Union (EU) General Data Protection Regulation aims to adapt children’s right to privacy to the ‘digital age’. It explicitly recognizes that children deserve specific protection of their personal data, and introduces additional rights and safeguards for children. This article explores the dilemmas that the introduction of the child-tailored online privacy protection regime creates – the ‘empowerment versus protection’ and the ‘individualized versus average child’ dilemmas. It concludes that by favouring protection over the empowerment of children, the Regulation risks limiting children in their online opportunities, and by relying on the average child criteria, it fails to consider the evolving capacities and best interests of the child.

The impact of the EU general data protection regulation on scientific research.

The use of personal data is critical to ensure quality and reliability in scientific research. The new Regulation [European Union (EU)] 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [general data protection regulation (GDPR)], repealing Directive 95/46/EC, strengthens and harmonises the rules for protecting individuals’ privacy rights and freedoms within and, under certain conditions, outside the EU territory. This new and historic legal milestone both prolongs and updates the EU acquis of the previous Data Protection Directive 95/46/EC. The GDPR fixes both general rules applying to any kind of personal data processing and specific rules applying to the processing of special categories of personal data such as health data taking place in the context of scientific research, this including clinical and translational research areas. This article aims to provide an overview of the new rules to consider where scientific projects include the processing of personal health data, genetic data or biometric data and other kinds of sensitive information whose use is strictly regulated by the GDPR in order to give the main key facts to researchers to adapt their practices and ensure compliance to the EU law to be enforced in May 2018.