European Union General Data Protection Research Articles

Eye-Tracking Devices for Virtual and Augmented Reality Metaverse Environments and Their Compatibility with the European Union General Data Protection Regulation

Even though the Metaverse from science fiction is not a reality yet, it is possible to take a glimpse into how it might look like. However, the current vision of the Metaverse does not only encompass software. A great deal of companies is complementing their Metaverse projects with Virtual and Augmented Reality devices such as headsets and glasses. In this line, one of the last technological advancements in virtual and augmented reality devices included the introduction of eye-tracking technology. However, when new and additional kinds of data are processed, emerging risks for data protection might arise. This paper will, therefore, discuss the compatibility of eye-tracking devices for virtual and augmented reality environments with the European Union General Data Protection Regulation (GDPR). Being the GDPR considered a worldwide role model in terms of fundamental rights protection, the compatibility of such devices with one of the most severe data protection regimes will be put to the hardest test. The paper will do so by analyzing the state of the art of the technology, its use in headsets and glasses for virtual and augmented reality Metaverse environments, and the potential risks that such use might entail for data protection. After that, such risks will be confronted with the relevant applicable provisions of the GDPR. Finally, the paper will issue policy recommendations.

Protecting the patient’s data in the 21st century healthcare industry: Is the African continent ready for the digital space?

To ensure proper healthcare services and automation, including minimising medical errors and providing faster and more efficient healthcare, the medical field is experiencing innovative technological trends. They include automated patient records, hospital management system software, telemedicine, and the use of artificial intelligence devices. These innovations exist in more than just the global north, as they are slowly finding residence in African countries. Focusing on automated patient record, the article examines existing data protection legal frameworks in Africa to ascertain whether they provide effective remedy mechanisms patients can access should a breach occur. Taking cognisance of the current African Continental Free Trade Area Agreement (AfCFTA) aimed at creating a single market for goods and services; it is evident that healthcare services might have a continental approach. Thus, the article adopts a continental, regional, and national perspective. Using doctrinal method, the article compares the African Union Data Protection Convention with the European Union General Data Protection Regulation to draw lessons from the European Union Experience. The article finds that strengthened national mechanisms might provide the requisite remedy mechanisms patients can access to ensure enforcement of their rights to data protection.

Will the EU AI Regulations Give Rise to Another ‘Brussels Effect’? Lessons from the GDPR

The pre-eminence of the European Union (EU) General Data Protection Regulation (GDPR) in regulating the business of data collection, processing and transfer cannot be understated. It has come to serve as the model for laws in several non-EU jurisdictions who share in the EU’s concerns about citizens’ data being harnessed by Big Tech in particular. This article explores the GDPR’s outsized impact in the sphere of data regulation, the conflict between the contrasting models of regulation adopted by the EU and the United States and comments on the possibility of the AI regulations becoming what the GDPR is for data. It further delves into the possibility of this approach being followed by countries like India, where government efforts to integrate AI-based innovation and entrepreneurship have led to the possibility of newer regulatory approaches being adopted.

DATA BREACHES EXIT STRATEGY: A COMPARATIVE ANALYSIS OF DATA PRIVACY LAWS

Data has become highly valuable in the era of digitalisation and is the main target of cybercriminals. Cybercriminals steal data by exploiting system vulnerabilities. The rise of catastrophic data breach incidents affects business operations, reputation and legal standing, leading to business disruptions, financial loss and reputation damage. These incidents have raised data security concerns. The frequent incident is partly due to insufficient security measures in place. This article employs doctrinal research focusing on legal principles based on legislation to analyse Malaysia’s legal framework for protecting personal data in Malaysia and a comparison with other jurisdictions, i.e. the European Union General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act 2012 and the China Personal Information Protection Law (PIPL). The findings show that Malaysia’s data protection laws fall short of the international norm in some areas. This article suggests that Malaysian policymakers may amend the Personal Data Protection Act 2010 to align with international data protection standards to strengthen data security measures in preventive, detective and responsive data breaches. Consequently, this article provides an analysis of data protection laws in Malaysia and compares them with other advanced jurisdictions. It offers valuable insights into the challenges and opportunities involved in safeguarding personal data, the legal framework, and organisational strategies related to data privacy and security.

Governing work through personal data: The case of Uber drivers in Geneva

This article presents an ethnographic account of the advocacy initiative, conducted by NGO PersonalData.IO and the company Hestia.ai, that seeks to empower gig workers by helping them regain access to their personal data through data access rights, using the European Union General Data Protection Regulation. It is based on a case study of Uber drivers in Geneva that has a worldwide relevance for the gig economy. Previously self-employed, drivers are now classified as employees and their working time and earnings must be calculated according to local labour laws. We contribute to debates on algorithmic management in ride-hailing platforms by focusing on participatory methods of accountability through personal data, from an infrastructural perspective. First, we focus on the nexus between personal data protection and algorithmic management to understand the domination of ride-hailing platforms over the workers’ means of production, i.e., their personal data. We provide empirical transparency on the data structures of Uber for the sake of algorithmic accountability. These structures are utilised for their surge pricing algorithms and ultimately govern the workforce. Second, within a collective process of governance, we built participatory tools and methods for empowering gig workers and data scientists. These are means for calculating earnings and working that made explicit a new social meaning of work, i.e., “lost time between rides”.

A Comparison Between Enforcement of the European Union General Data Protection Regulation (GDPR) and the United States Privacy Regulations

A Comparison Between Enforcement of the European Union General Data Protection Regulation (GDPR) and the United States Privacy Regulations

Data protection in Mercosur: current situation, perspectives and project

The purpose of this paper is to present the "state of the art" of data protection in MERCOSUR and indicate the possibilities for a future draft Decision that harmonizes the region protection level. To achieve this objective, we will proceed to: (i) Indicate the relevance of the subject related to data protection, (ii) Mention the main characteristics of the European Union General Data Protection Regulation (since it is the most advanced in the matter and because UE is, like MERCOSUR, an integration process, although in a more advanced level), (iii) Analyze the initiatives that were created from MERCOSUR to create a decision that regulates data protection in the block. To this end, the minutes of Sub-Working Group No. 13 will be analyzed, (iv) Carry out a brief comparative analysis of the various levels of protection existing among the 4 MERCOSUR States parties (Argentina, Brazil, Paraguay, Uruguay), (vi) Indicate the importance of regulation at the regional level (equal degree of protection for the member States of MERCOSUR). Based on these points, it is concluded that, given the importance of the topic related to data protection, a new MERCOSUR regulations draft is necessary and, in this sense, the present paper gives some proposals that could be incorporated into this eventual project. The methodology used in this work is essentially exploratory and qualitative. However, it also uses aspects of the descriptive methodology, for which an analysis of previous works that addressed the issue is made, as well as an analysis of regulations related to the subject.

DATA SUBJECT ACCESS REQUEST: WHAT INDONESIA CAN LEARN AND OPERATIONALISE IN 2024?

The enactment of the Indonesian Personal Data Protection (PDP) Law is in line with the nation’s position as the most promising digital economy in Southeast Asia. The PDP Law, amongst others, introduces Data Subject Access Request (DSAR), a cornerstone mechanism to exercise data subject rights mirroring the European Union General Data Protection Regulation (GDPR). However, major causes of DSAR failure are predominantly triggered by resource constraint, lack of fundamental understanding, and technical gap when responding to such requests. In practice, DSAR management is time consuming and taxing since organisations shall manage numerous and complex requests within a tight timeline. By way of comparative analysis, we explore the concept of data subject rights, specifically the Rights to Access. Through observations and constructive responses by global data protection professionals, academics and non-lawyers, this paper alluded that similar failure scenario might occur in Indonesia when PDP Law grace period ended in 2024 – if the causes are not addressed and mitigated. Apropos, in safeguarding data subjects’ right, we assert that DSAR under the PDP law might bring disproportionate impracticality, hence there is demand for a robust consultation and holistic regulatory implementation. We also propose to consider a harmonized DSAR ASEAN framework for future proofing cross-border payment, in 2024 and beyond.

AFEI: adaptive optimized vertical federated learning for heterogeneous multi-omics data integration.

Vertical federated learning has gained popularity as a means of enabling collaboration and information sharing between different entities while maintaining data privacy and security. This approach has potential applications in disease healthcare, cancer prognosis prediction, and other industries where data privacy is a major concern. Although using multi-omics data for cancer prognosis prediction provides more information for treatment selection, collecting different types of omics data can be challenging due to their production in various medical institutions. Data owners must comply with strict data protection regulations such as European Union (EU) General Data Protection Regulation. To share patient data across multiple institutions, privacy and security issues must be addressed. Therefore, we propose an adaptive optimized vertical federated-learning-based framework adaptive optimized vertical federated learning for heterogeneous multi-omics data integration (AFEI) to integrate multi-omics data collected from multiple institutions for cancer prognosis prediction. AFEI enables participating parties to build an accurate joint evaluation model for learning more information related to cancer patients from different perspectives, based on the distributed and encrypted multi-omics features shared by multiple institutions. The experimental results demonstrate that AFEI achieves higher prediction accuracy (6.5% on average) than using single omics data by utilizing the encrypted multi-omics data from different institutions, and it performs almost as well as prognosis prediction by directly integrating multi-omics data. Overall, AFEI can be seen as an efficient solution for breaking down barriers to multi-institutional collaboration and promoting the development of cancer prognosis prediction.

Building Situational Awareness of GDPR

Because previous academic research does not comment sufficiently on how the relevant content of the European Union (EU) General Data Protection Regulation (GDPR has been properly communicated to the organisations, or how the situational awareness (SA) of GDPR has been built in the organisations, this qualitative empirical research was regarded as a valuable approach for gathering authentic research material on the practical bases of this phenomena. The aim of this empirical case study (CS) is to develop a picture of what processes organisations use to build SA of the GDPR requirements. To guide the CS, we asked how the SA for decision-making was constructed and how it was perceived in organisations. The experiences of eight Finnish organisations showed that the organisations’ practices of building SA and their experiences with the quality and adequacy of SA differed. However, building SA proved to be a critical step for organisations in the overall process of meeting GDPR requirements. Especially the data coming from inside the organisation became very relevant in the SA process, because it supported decision makers to determine how the GDPR requirements should be implemented in the organisation. As a main contribution of this article, based on best practices shared by organisations a model of building SA was built. The proposed model is threefold and was constructed by combining the findings of an empirical CS analysis, the steps of the intelligence process, and the essential elements of the model of creating information security SA. The result is potentially beneficial for building situational understanding of any complex or ambiguous issue, especially in complex and digitalised technological areas, where combining information management with accurate and efficient decision-making is a common challenge. The results can be used by any party who is looking to build SA of an abstract issue in a complex environment.

Using Video Cameras as a Research Tool in Public Spaces: Addressing Ethical and Information Governance Challenges Under Data Protection Legislation

Systematic observation is a promising unobtrusive method of assessing human behavior in urban environments without many issues typically associated with self-report measures (e.g., recall bias, low response rates). Improvements in video camera technologies make it more feasible for researchers to conduct systematic observation, which could reduce the time, labor, and cost to facilitate high-quality observational research in urban environments at scale. However, there are important ethical and information governance challenges driven by data protection laws, which discourage many researchers from using camera-based observation methods. The European Union General Data Protection Regulation is a leading global standard for data protection. Drawing on our experiences of conducting three studies using video cameras in public spaces, we discuss how to conduct this kind of research in line with General Data Protection Regulation requirements. The paper outlines issues concerning data protection, privacy, informed consent, and confidentiality, and how we addressed them. In doing this, the paper provides support for responsible use of camera-based observation methods, which will be of value to researchers, ethics committees, and funders. Outlining how to use video cameras responsibly will enable more research to be conducted that, in turn, will build the case for its benefits to researchers and society.

WhatsApp Data Policy, Data Security and Users’ Vulnerability

Several regulatory agencies regulate companies that deal with users' data, but specifically in the UK, they are regulated by the European Union General Data Protection Regulation (GDPR). The techniques of handling and processing data, rights of users, sanctions for defaulters, and other regulating clauses are formulated and implemented by these agencies to minimize the exploitation of the masses. Data regulation and management are essential because companies managing users' data are expected to handle data with care, caution, and due diligence. However, WhatsApp (arguably the most powerful instant messaging application in use) has been involved repeatedly in several cases that compromised the security of its users’ data over the years. The platform has become a prime target and medium for predators (con artists, fraudsters) with intentions to access users' data (phone numbers, last seen, live location, and others) for vile purposes. These cases include leaked data that could be used for marketing purposes, phishing, impersonation, and fraud. This paper highlights recent cases of data security (data leakages) and privacy policies involving WhatsApp, examining the various issues that threaten WhatsApp users and make them vulnerable to exploiters, cybercrime, and con artists. It also considers how WhatsApp can protect its users against vulnerabilities. Also, the European Union GDPR was examined in line with WhatsApp's privacy policy to measure compliance with the regulation in light of recent data breaches. 

A survey‐based study on diagnosis and management of vernal keratoconjunctivitis

A survey‐based study on diagnosis and management of vernal keratoconjunctivitis

Open Data in the Era of the GDPR: Lessons from the Human Cell Atlas.

The Human Cell Atlas (HCA) is striving to build an open community that is inclusive of all researchers adhering to its principles and as open as possible with respect to data access and use. However, open data sharing can pose certain challenges. For instance, being a global initiative, the HCA must contend with a patchwork of local and regional privacy rules. A notable example is the implementation of the European Union General Data Protection Regulation (GDPR), which caused some concern in the biomedical and genomic data-sharing community. We examine how the HCA's large, international group of researchers is investing tremendous efforts into ensuring appropriate sharing of data. We describe the HCA's objectives and governance, how it defines open data sharing, and ethico-legal challenges encountered early in its development; in particular, we describe the challenges prompted by the GDPR. Finally, we broaden the discussion to address tools and strategies that can be used to address ethical data governance. Expected final online publication date for the Annual Review of Genomics and Human Genetics, Volume 24 is August 2023. Please see http://www.annualreviews.org/page/journal/pubdates for revised estimates.

Streaming Platforms and Profiling

This contribution aims to address risks and opportunities for cultural diversity resulting from ‎platforms’ personalisation tools based on a legal analysis of the main provisions of the European Union‎ General Data Protection Regulation (GDPR) on consumer profiling and automated decisions, as well as ‎a sample of data protection policies of selected streaming platforms. It examines how the latter may in‎ practice affect the protection of consumers’ personal data for the purpose of recommending personalised ‎audio-visual and music content online and how such provisions relate to the discoverability of a‎ diversified cultural offer online and, at the European level, the obligation for platforms to give prominence‎ to European works in their catalogues. The paper shows that a lot may still be done to improve the‎ transparency of algorithms used for personalisation purposes and to provide users with greater control of‎ their data, as required by the GDPR.‎

Securing Fine-Grained Data Sharing and Erasure in Outsourced Storage Systems

The wide use of internet-connected services makes massive personal data collected by service providers without the need of our consent. Although the archived data may enable them to provide better service experiences for users, it also presents serious risks to individual privacy, especially when active or unexpected data breaches have become commonplace. To mitigate this issue, several acts and regulations (e.g., the European Union general data protection regulation) have been issued and specified a lot of security requirements for personal data management. Among these various requirements, we mainly focus on the requirement of giving back the access control of personal data to data owners themselves and the right to be forgotten for data erasure. In this article, we provide a cryptographic solution of achieving these two requirements in the setting of outsourced storage. Specifically, we introduce a personal data management framework built upon a novel cryptographic primitive dubbed as forward-secure attribute-based puncturable encryption (FS-DABPE). This primitive simultaneously features of system-wide forward secrecy and practical key management as well as fine-grained access control of the encrypted personal data. Consequently, by locally puncturing, updating and erasing system-wide secret keys, it securely realizes fine-grained personal data sharing and data erasure without interactions. Furthermore, to instantiate the proposed framework, we present a concrete FS-DABPE construction, and prove its security under a well-studied complexity assumption. In addition, we provide a prototype implementation of the concrete construction, and present extensive experimental results that illustrate its feasibility and practicability.

Avoiding Liability and Other Legal Land Mines in the Evolving Genomics Landscape.

This article reviews evolving legal implications for clinicians and researchers as genomics is used more widely in both the clinic and in translational research, reflecting rapid changes in scientific knowledge as well as the surrounding cultural and political environment. Professionals will face new and changing duties to make or act upon a genetic diagnosis, address direct-to-consumer genetic testing in patient care, consider the health implications of results for patients' family members, and recontact patients when test results change over time. Professional duties in reproductive genetic testing will need to be recalibrated in response to disruptive changes to reproductive rights in the United States. We also review the debate over who controls the flow of genetic information and who is responsible for its protection, considering the globally influential European Union General Data Protection Regulation and the rapidly evolving data privacy law landscape of the United States.

Koncept privatnosti podataka u elektronskom zdravstvenom sistemu zasnovan na blokčejn tehnologiji

Introduction/purpose: Advances in information and communication technologies have enabled the creation of a symbiotic environment of humans and machines in which humans interact with machines to get better quality of everyday life. In that interaction, environment problems of information security and in particular data privacy are at the forefront. In many countries, there is legal regulation that regulates this problem in terms of securing the goals that must be realized when manipulating private data, and the technology itself is the choice of the creators of information systems. Blockchain technology is one of the methods of choice to ensure the integrity of data and undeniable transactions while digital certificates in conjunction with it enable the realization of data privacy of patients. Methods: The cryptographic methods of asymmetric cryptography apply blockchain technology and reliable methods of identification in cyberspace, which enables the preservation of data privacy at a high level. Results: This paper describes the method of patient health data privacy protection in a healthcare system based on digital certificates as an identification method in cyberspace and Blockchain technology as a method for preserving the integrity of transactions and a healthcare information system. The proposed concept enables the separation of private and medical data in such a way that with the accepted principle of patient ownership of medical data, it is possible to achieve primary and secondary use of healthcare data without compromising the patient's privacy. Conclusions: The concept of identity assignment to every element in the healthcare information system and the organization/storage of data in accordance with the principles of Blockchain technology proposed in this paper enable the realization of a high level of data privacy in accordance with the European Union General Data Protection Regulation at the international level. In addition, the proposed concept enables the detection of unregistered devices or entities in the system and thus preserves the integrity of the system and increases its overall information security.

Eye-tracking Devices for Virtual and Augmented Reality Metaverse Environments and Their Compatibility With the European Union General Data Protection Regulation

Eye-tracking Devices for Virtual and Augmented Reality Metaverse Environments and Their Compatibility With the European Union General Data Protection Regulation

Comparative Review of Personal Data Protection Policy in Indonesia and The European Union General Data Protection Regulation

Data leakage is one of the high potentials for criminal acts in cyberspace. The Indonesian government passed the Personal Data Protection Act (UU PDP) to ensure the security of every citizen's personal data. This study aims to compare the policies of the Personal Data Protection Act with the European Union General Data Protection Regulations (EU-GDPR). This study uses a qualitative descriptive analysis method with data from previous studies and official releases from the Indonesian government and the European Union. The results of this study illustrate that the PDP Law and the EU-GDPR have the same arrangements regarding the rights of personal data subjects. In the data processing aspect, the principle of processing personal data in the PDP Law is not mandatory. In contrast, in the EU-GDPR, the principle of processing personal data is mandatory. In the aspect of controlling and processing personal data, both rights and responsibilities are almost the same, both for the PDP Law and the EU-GDPR. In the aspect of imposing sanctions, EU-GDPR is more apparent in the mechanism of imposing sanctions in the form of fines. While in the PDP Law, sanctions consist of administrative sanctions, criminal sanctions, and criminal fines, the mechanism of imposing sanctions is not yet clear.