Free Movement Of Such Data Research Articles

Plugins and POPI: A Critical Discussion into the Legal Implications of Social Plugins and the Protection of Personal Information

Social plugins are one of the many trackers used by companies with an online presence. However, under the Protection of Personal Information Act 4 of 2013 (POPI), these trackers have certain legal consequences for internet users. The main reason for this is that trackers tend to process personal information without informing internet users that their data are being collected, the reason for the collection or processing thereof, or who the responsible parties are that are collecting and processing the personal information. The article looks at these issues, amongst others, in the light of a 2019 judgment from the Court of Justice of the European Union or CJEU, namely, Case C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW e.V. EU:C:2019:629. Due to the fact that it has had data protection legislation for much longer than other countries or legal jurisdictions, including South Africa, the European Union (the EU) has a substantial body of case law interpreting the data protection legislation of the EU itself as well as that of the individual member states. One of the main instruments used as guidance by the drafters of POPI was Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (hereafter Directive 95/46). Directive 95/46 was previously considered the gold standard, before Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation) (hereafter the GDPR) was enacted and Directive 95/46/EC was finally repealed. Since Directive 95/46 was one of the main guiding documents used in drafting POPI, one may expect that the South African courts may turn to the EU and consider how the CJEU has interpreted the similar provisions contained in Directive 95/46, especially since there is very little South African jurisprudence available on POPI. The four main issues under discussion are: who, other than the internet users, has the locus standi to bring an application in terms of POPI? Second, what are the responsibilities of joint responsible parties towards internet users? Third, where there are joint responsible parties, do both need a legitimate interest to process personal information? Lastly, who will be responsible for obtaining the necessary consent to process the personal data?

Patients' knowledge, preferences, and perspectives about data protection and data control: an exploratory survey.

Background: In the European Union, the General Data Protection Regulation (GDPR) plays a central role in the complex health research legal framework. It aims to protect the fundamental right to the protection of individuals' personal data, while allowing the free movement of such data. However, it has been criticized for challenging the conduct of research. Existing scholarship has paid little attention to the experiences and views of the patient community. The aim of the study was to investigate 1) the awareness and knowledge of patients, carers, and members of patient organizations about the General Data Protection Regulation, 2) their experience with exercising data subject rights, and 3) their understanding of the notion of "data control" and preferences towards various data control tools. Methods: An online survey was disseminated between December 2022 and March 2023. Quantitative data was analyzed descriptively and inferentially. Answers to open-ended questions were analyzed using the thematic analysis method. Results: In total, 220 individuals from 28 European countries participated. The majority were patients (77%). Most participants had previously heard about the GDPR (90%) but had not exercised any of their data subject rights. Individual data control tools appeared to be marginally more important than collective tools. The willingness of participants to share personal data with data altruism organizations increased if patient representatives would be involved in the decision-making processes of such organizations. Conclusion: The results highlighted the importance of providing in-depth education about data protection. Although participants showed a slight preference towards individual control tools, the reflection based on existing scholarship identified that individual control holds risks that could be mitigated through carefully operationalized collective tools. The discussion of results was used to provide a critical view into the proposed European Health Data Space, which has yet to find a productive balance between individual control and allowing the reuse of personal data for research.

New technologies, children and the General Data Protection Regulation (GDPR): The gap between communication, infrastructure and the application of an European Regulation!

One of the central concepts of the General Data Protection Regulation (GDPR) is the “data subject”. This notion in relation to the establishment of rights and obligations for controllers and processors becomes a common denominator in the implementation of this Regulation at the level of all Member States of the European Union. The Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) was adopted, in order to protect the privacy of data subject, whether a parent, an young person or a child. However, starting with the title we can identify two different actions: to assure the protection of personal data and the free movement of this data within and outside the Union borders. In this context we must take the following into account: the reality of conceptual gaps in interpretation of this document; old or non-existent infrastructure; legislative bottlenecks and the risks involved in the protection of children’s data. Are parents, young people or children properly informed about their rights and the risks to which they are exposed in an era of digitalization? Can online school ensure the protection of children? Does the current infrastructure allow the optimal implementation of the General Data Protection Regulation? My research, in this context, has the aim of identifying gaps between information, infrastructure and the application of the GDPR, using the content analysis method and the questionnaire as a qualitative method of research. The expected results of this research are awareness by state institutions about the risks to which children are exposed in an era of digitalization and the awareness of the controllers about the obligation to ensure the protection of children’s data in the processing process.

Current challenges and the future of legal protection of personal data: under the influence of digitalization development

Current challenges and the future of legal protection of personal data: under the influence of digitalization development

Profilowanie i analiza predykcyjna z wykorzystaniem zbiorów big data z perspektywy RODO

The text analyses the normative regulations adopted by the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) in order to answer the question whether the said regulations properly balance the interests of both entities that use predictive analytics and profiling in their economic activity, and of persons whose data they process. As this type of processing is based on big data, the proper analysis of this issue had to begin with determining which types of data processed in such sets can be considered personal information and in what conditions they can be treated as such. Based on these findings, the study analyzed the duties imposed by the GDPR on entities processing personal data in situations when such information has been obtained from big data. This in turn made it possible to assess the adopted normative regulations as well as point to the possible solutions and development paths.

Protection of Health Data in Accordance with the GDPR: Selected Issues

Patients’ rights are widely commented issue in the medical and legal press. Attempts are being made to analyse issues relating to patient consent, the right to information about the medical procedures performed and the state of health, or the authority of medical personnel to make decisions about the patient’s person and the related procedures or treatments. This results in an increase in the importance of information, which has become one of the most important values in today’s world. Access to information, especially about oneself, means a certain social and legal awareness. Restrictions on access to information deprive people of the right to selfdetermination and, at the same time, the right to satisfy one of their needs, which is particularly important in today's world. Nowadays, it is unavoidable to process the data of any person, which is essential for the proper functioning of society, but above all for the benefit of each individual. This testifies that an individual is present in social, economic or political life. For over a year now, institutions providing medical services have been obliged to implement a number of regulations contained in the Regulation of the Parliament and Council 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC. Personal data relating to health are defined in the preamble of the Act. This Regulation does not indicate the organisational or technical measures to be taken by the data administrator to ensure data protection. These measures should be appropriate to the scope, purpose and risks of the data being processed. Sensitive data shall fall within the category of data for which processing involves the adoption of enhanced security measures. The task of the 99 data administrator is to introduce appropriate guarantees to ensure the implementation of appropriate technical and organizational measures so that the data processing meets the requirements of the GDPR and protects the rights of data subjects. Their task is also to adapt their forms, statements, e-mails or other queries so that they are clear, understandable and readable for the average recipient. For it is the quality that is the essence of information provided in the inquiry, not its number. The EU legislator has introduced several new developments to identify patterns of conduct and interpretations that are new concerning previous regulations. With the introduction of the GDPR, new procedures have been developed in order to exercise the rights of data subjects. However, the existing acquis of literature and judicature, as well as experience in the application of provisions ensuring the full entitlement of the data subjects, is not underestimated. More and more frequent analysis of the consequences of breaching the right to the protection of medical data and of the issue of giving and withdrawing consent to the processing of data may increase the importance of this right for society and thus ensure full protection of privacy and the information autonomy of the patient.

Brak kodeksu branżowego w systemie ochrony zdrowia a ochrona danych osobowych pacjenta

The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) shall concern all those who process personal data of natural persons with regard to their professional, commercial and statutory activities. It was addressed to many industries, and as it is well known each industry is different, running an online store cannot be compared with the provision of health care or treatment. The Member States, the supervisory authorities, the European Data Protection Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation. The code of conduct is to provide the minimum requirements related to the protection of personal data in health care facilities that must be met in order to demonstrate compliance with the GDPR. The purpose of the code is, inter alia, the collection of the personal data, fulfilling the obligation to inform and the use of technical means to prevent personal data breach. Almost four years have passed since the application of the GDPR regulations and no code of conduct has been adopted for application, including the health protection. The GDPR applied without proper interpretation would make it impossible to conduct medical treatment which involve sensitive data processing. In the current legal situation is a patient provided with adequate protection?

The impact of the EU General Data Protection Regulation on childhood cancer research in Europe.

The EU General Data Protection Regulation (GDPR) 1 EURegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/ojDate: May 4, 2016 Date accessed: February 25, 2022 Google Scholar was implemented on May 25, 2018, stipulating rules on the protection of individuals regarding the processing and free movement of personal data. 3 years later, the European Society for Paediatric Oncology (SIOP Europe) conducted a survey among clinicians and academics from across Europe to investigate the impact of the GDPR on childhood cancer research, and to identify the challenges and opportunities in this field.

ПЕРСПЕКТИВНІ НАПРЯМИ УДОСКОНАЛЕННЯ РЕГУЛЮВАННЯ СФЕРИ ЗАХИСТУ ПЕРСОНАЛЬНИХ ДАНИХ В УКРАЇНІ

The process of legislative settlement of issues related to the protection of personal data began in the European Union (EU) with the entry into force of Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals regarding the processing of personal data and on the free movement of such data (Directive). After adoption the Charter of Fundamental Rights of the European Union (2000), which Article 8 defined the protection of personal data as a human right, establishment of the sufficient principles in the Lisbon Treaty (2009), there were amended two key EU acts: the Treaty on EU and the Treaty establishing the European Community. As a result, everyone in the EU was guaranteed the right to protect their personal data. In 2016 the EU adopted Regulation 2016/679/EC of the European Parliament and of the Council on the protection of natural persons regarding the processing of personal data and on the free movement of such data (Regulation), which radically updated the methods of collecting and processing personal data, and not only in the EU. As a result, to comply with its requirements, both EU-based companies and those operating in the EU or working with consumers from the EU market were forced to update their privacy/personal data policies. In turn, in Ukraine, significant progress in the development of legal regulation of personal data protection occurred later. As of 2010, public relations regarding collection, storage, use and dissemination of information about a person were regulated by more than two dozen uncoordinated laws and secondary legislation. To specify and define the mechanisms for implementing the provisions of Article 32, Constitution of Ukraine, which proclaimed the right of a person to non–interference in its personal life and established a ban on the collection, storage, use and dissemination of confidential information about a person without its consent, the Verkhovna Rada of Ukraine in 2010 adopted the law of Ukraine “On Personal Data Protection”. Having played a vital role in the legislative codification of the rules for processing personal data, the law, like the Directive, failed to respond to technological changes and the processes caused by this in society, despite numerous amendments made by MPs. Since the Association Agreement between EU and Ukraine came into power, there is noticeable arising necessity to harmonize the Ukrainian legislative framework with EU, as though contexts of adoption of the Regulation and the Law are different, so are the ways of resolving personal protection issues in Ukraine and the EU. Therefore, it is necessary to establish the new legislative amendments, the degree of compliance of personal data protection standards in Ukraine with the relevant standards in the EU. In this paper, as an outcome of estimations of relevant international research, further analytical and comparative analyses, there are some proposals to future institutional features of such modernization, affecting such issues as: clarification regarding material effects in order to limit legal regulation and avoid excessive legal burden on individuals, as well as in some cases on state authorities; providing new definitions of concepts that are not yet available in domestic regulation; establishment of fundamental guidelines for the processing of personal data in accordance with international standards; fostering more sustainable standards for the processing of sensitive personal data; in-depth structuring the issue of processing personal data for a different purpose than the one for which they were collected; regulating the implementation of the rights of personal data subjects, in particular, the right to information, the right to access, the right to correct personal data, the right to be forgotten, the right to personal data mobility, the right to restrict the processing of personal data, the right to protection from automated decision-making, the right of the data subject to protection of their rights and compensation for damage; clarifications regarding the definitions of the duties and responsibilities of the personal data controllers and operator; sustainable regulations concerning the issue of cross-border transfer of personal data.

The new European regulation on personal data protection: significant aspects for data processing for scientific research purposes


 On 27 April 2016, after a troubled gestation,, Regulation 2016/6791 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data was finally published.
 The Regulation is to have a two-year transitional period, meaning it will actually enter into force in the first half of 2018.

PROCESSING OF EMPLOYEES’ PERSONAL DATA AND COLLECTIVE REDINDANCIES

This article is devoted to the issues of personal data processing in the event of collective dismissals. The author identifies situations in which personal data may be processed in the course of collective dismissals, the compliance of the processing of such data with Regulation No. 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and the repeal of Directive 95/46 / EC and analyzes the consequences of unlawful processing of employees’ personal data during collective redundancies.

Protection of Personal Data in the Catholic Church in the Light of the EU Regulation No. 2016/67

The article deals with the issues of personal data protection in the Catholic Church in Poland. It presents to what extent the Catholic Church is obliged to apply Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of personal data and on the free movement of such data, and repealing Directive 95/46/EC and what are its requirements to its internal regulations. Reference was also made to the content of the Decree of the Polish Episcopate on the protection of personal data of March 13, 2018.

APPROVING COMMENTARY ON THE JUDGMENT OF THE VOIVODSHIP ADMINISTRATIVE COURT IN WARSAW OF 13 APRIL 2021, REF. II SA/WA 1898/20

Information relating solely to a telephone number does not qualify as personal data under Article 4(1) of Regulation (UE) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of naratural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. The court assessed that in a situation where entity has a set of data containing only telephone numbers, the telephone number alone is not sufficient to identify a specific person. The judgment of the WSA should be approached with approval.

Data Protection in Law Enforcement and Judicial Cooperation in Criminal Matters

Abstract The redesign of data protection in the police and judicial area is intended to create uniformity at the European level for the citizens of EU Member States. This scientific article analyses the subject of data protection in law enforcement and judicial cooperation in criminal matters. The focus is primarily on the existing provisions and the latest developments of the EU with regard to Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. The international level with regard to data protection in the police and judicial area and possible changes due to the developments in data protection under European law are also examined in more detail.

The Impact of the GDPR on the Unmanned Aircraft Sector

Video recording in real time or taking photographs while flying over private property pose a serious threat to privacy. Additionally, drones are capable of collecting personal data such as video and audio content, as well as location information. This article analyses the scope of application of Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (the General Data Protection Regulation, GDPR) in light of drone operations. Moreover, the paper aims to show the impact of the GDPR on the drone sector. GDPR, Regulation 2016/679, drones, UAS, RPAS, Drone Operator as a Data Controller or a Data Processor

CRIMINAL LIABILITY FOR BREACH OF PERSONAL DATA PROTECTION

The article contains an analysis of the issue of criminal liability for breach of personal data protection in the Personal Data Protection Acts of 1997 and 2018, as well as in the Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The author has compared the most important issues related to criminal liability for violation of personal data protection on the basis of the above regulations, because data protection is nowadays a necessary element for us, and violations related to the extortion of personal data should be quickly and effectively enforced by judicial authorities.

Scope of the eu general personal data regulation

The purpose of this article is to clarify the scope of the Regulation (eu) 2016/679 of the European parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (here in after — Regulation). The author makes a comparative legal analysis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (here in after — the Directive) and Regulations. As a result of the study, the author distinguishes between the territorial and extraterritorial scope of the Regulation. The author clarifies the content of the concepts of “equipment” and “the establishment” of the controller and the person processing personal data in the context of the application of the Regulations. The article concludes that since no changes were made to the concept of “the establishment” when the Directive was repealed, a broad interpretation of this concept in judicial practice can also be applied to the territorial scope of the Regulation. The continuity of the wording of the Directive and the Regulation allowed the author to conclude that the extraterritorial scope of the Regulation can be seen not only in Part 2 of Article 3 of the Regulation, which provides for its direct extraterritorial effect, but also in Part 1 of Article 3, which specifies the territorial scope of its action, on the basis of criteria that are based solely on the territory of the EU member States, such as the “place of establishment” of the controller or the person processing personal data.

MEDICAL CONFIDENTIALITY DISCLOSURE IN CONDITIONS OF EPIDEMIC THREATS

The aim: To establish public opinion on the limits of medical confidentiality in an epidemic and the widespread use of applications that contain personal data, including those regarding health, to understand the possibility of changing the paradigm of public policy to protect medical confidentiality in an exacerbation of the epidemic situation. Materials and methods: This research is based on regulatory acts, scientific articles, and opinions of both medical workers and ordinary citizens of Poland, Germany, and Ukraine, judicial practice, doctrinal ideas, and views on this issue. Such methods as dialectical, comparative, analytic, synthetic, comprehensive, statistical, and generalization. Results: the results of a survey of residents of Poland, Germany, and Ukraine showed that one of the pandemic consequences was that a significant number of respondents were willing to partially renounce the right to medical confidentiality in the face of exacerbating epidemic threats to reduce the number of infected. Conclusions: In the face of the SARS-Cov-2 virus, nations worldwide have faced the challenge of respecting the right to privacy, particularly in terms of medical confidentiality. Virtual methods of patient communication with healthcare professionals use mobile electronic services (applications), and other new technologies in the context of the COVID-19 pandemic have exacerbated the issue of understanding the boundaries of medical confidentiality and personal data protection. In order to maintain an effective balance between human rights and public health, the mass collection and storage of sensitive personal data must take place following the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. At the same time, it is expedient to recommend states to specify specific provisions of this Regulation in order to avoid an expanded interpretation of certain of its provisions.

Dostavljanje kopije podataka o ličnosti

The right to submit a copy of personal data was regulated for the first time in the legal system of the Republic of Serbia by the Law on Personal Data Protection (Official Gazette of the Republic of Serbia, Nos. 87/2018 of 13/11/2018), as part of the legal institute "Right to Access Personal Data''. This legal institute was assumed from the European Union, namely from Regulation (EU) 2016/679 of the European Parliament and of the Council as of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation). From the beginning of implementation of the above law until today, the question of the form in which a copy of personal data is delivered to the data subject has been raised, i.e., whether the obligation to submit a copy of personal data necessarily means the obligation to submit a copy of documents containing personal data.

DEVELOPMENT OF THE PERSONAL DATA PROTECTION FRAMEWORK – WILL THE PANDEMIC BRING NEW CHANGES?

The General Data Protection Regulation (hereinafter – the Regulation), which entered into force on 25 May 2018 and introduced a new legal framework for the protection of personal data in the European Union, also included a number of new rights, more precise definitions and improvements in the field of personal data protection. The three‐year period has shown that the Regulation has successfully replaced Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement ofsuch data, but the Covid‐19 pandemic posed the question: does the Regulation sufficiently define and explain how controllers should deal with the processing of sensitive data, or in situations where employees of companies and institutions work remotely? Data protection is a complex concept that can be analyzed from both a legal and a social point of view. Traditionally, data protection has been referred to as the protection of personal privacy in the context of processes involving the use of personal data. Prior to the implementation of the Regulation, the existing rules on the protection of personal data in the European Union were not sufficiently uniform and were implemented differently in each Member State. It contributed to the development and implementation of the Regulation, in the hope that it would modernize and promote a common data protection regime, while maintaining all the basic principles of data protection that have been followed so far. Prior to the pandemic, the Regulation successfully achieved its original objectives, but hasthe pandemic necessitated a revision of the Regulation? This article will analyze the development of the legal framework for the protection of personal data and analyze the compliance of the Regulation with the requirements arising from the effects of the pandemic.