GDPR Requirements Research Articles

Implications of GDPR and NIS2 for Cyber Threat Intelligence Exchange in Hospitals

The DYNAMO Horizon Europe Project aims to support critical sector (healthcare, energy production, marine transport) stakeholders in enhancing resilience and minimizing the effects of cyber-attacks. DYNAMO's objective is to use artificial intelligence to integrate cyber threat intelligence (CTI) and business continuity management (BCM) to support decision-making. The goal is joint preparation for EU cyber threats, necessitating timely global situational awareness and effective communication to address threats before they escalate. This paper focuses on the intelligence sharing and trust needs of the DYNAMO use cases while also meeting regulatory requirements. Analyzing DYNAMO’s internal materials and aligning them with authorities' requirements, particularly NIS2 and GDPR, reveals that healthcare organizations need to prepare for more effective data protection, incident response, and cyber-attack mitigation. While NIS2 doesn't specify technical requirements for healthcare, it offers a broader framework for organizations to make informed decisions about equipment suppliers and security applications. After the general review, this study examines a specific healthcare use case: a hospital infected by phishing, emphasizing that CTI exchanges may contain sensitive data falling under GDPR and NIS2 regulations. This includes technical details, health-related information, patient data, insurance details, and employee information. Concerning the AI-based approaches used, DYNAMO must handle this CTI exchange in compliance with the law. The case study compares the DYNAMO project's CTI exchange use case with GDPR and NIS2 requirements, highlighting challenges such as the difficulty in separating sensitive data under GDPR and differences in language and terms between the two regulations. Despite these challenges, the study discusses the impact of GDPR and NIS2 on CTI exchange in the healthcare sector, providing key implementation points and guidelines.

Using the blockchain to enable transparent and auditable processing of personal data in cloud- based services: Lessons from the Privacy-Aware Cloud Ecosystems (PACE) project

The architecture of cloud-based services is typically opaque and intricate. As a result, data subjects cannot exercise adequate control over their personal data, and overwhelmed data protection authorities must spend their limited resources in costly forensic efforts to ascertain instances of non-compliance. To address these data protection challenges, a group of computer scientists and socio-legal scholars joined forces in the Privacy-Aware Cloud Ecosystems (PACE) project to design a blockchain-based privacy-enhancing technology (PET). This article presents the fruits of this collaboration, highlighting the capabilities and limits of our PET, as well as the challenges we encountered during our interdisciplinary endeavour. In particular, we explore the barriers to interdisciplinary collaboration between law and computer science that we faced, and how these two fields’ different expectations as to what technology can do for data protection law compliance had an impact on the project's development and outcome. We also explore the overstated promises of techno-regulation, and the practical and legal challenges that militate against the implementation of our PET: most industry players have no incentive to deploy it, the transaction costs of running it make it prohibitively expensive, and there are significant clashes between the blockchain's decentralised architecture and GDPR's requirements that hinder its deployability. We share the insights and lessons we learned from our efforts to overcome these challenges, hoping to inform other interdisciplinary projects that are increasingly important to shape a data ecosystem that promotes the protection of our personal data.

Legal concerns regarding the protection of minors’ personal data in compliance with national legislation and GDPR requirements

The article highlights the legal concerns surrounding the protection of minors' personal data. The writers have conducted an original study of the sources regulating civil and labor relations in the field of acquiring and using personal data. The expansion and use of information technology and online communications can potentially lead to the violation of personal rights by the owners of personal data, both in workplace settings and in the daily lives of ordinary residents. The purpose of this article is to highlight issues concerning the collection, storage, use, and dissemination of the personal data of a minor, as well as to develop methods to protect the personal data of a child based on a comprehensive analysis of international acts, Ukrainian legislation, unique literature, and case law materials pertaining to the protection of personal data of a minor.
 Based on the analysis of national legislation and case law of the European Union, the author concludes that the right to personal data protection is one of the forms of realization of the right to respect for private and family life. The obligation to protect person's rights to processing and storage of his or her private information is a negative obligation on the part of both the State and the owners of personal data.
 The article addresses current difficulties concerning the security of children' personal data under current civil and medical legislation in Ukraine and other countries. The provisions of the General Data Protection Regulation, the California Consumer Privacy Act, and Ukraine's "On Personal Data Protection" Law are compared. Possible steps to establish further protection of children's personal data during collection and processing, whether utilizing websites, video games, online purchases, and so on, are proposed.
 The paper concludes that state functions should be executed without necessitating individuals' consent for the collection of personal data. Personal data processing should be carried out within the framework and on the basis of Ukrainian laws and regulations, taking into account international conventions in this area. The analysis of methods for safeguarding children's personal data enabled the identification of supplementary avenues for data protection. These include acquiring copies of personal data by both children and their parents, rectifying inaccuracies, completing incomplete data, exercising the 'right to be forgotten' and the 'right to erasure' of personal data, invalidating transactions, and seeking compensation for material and moral damages arising from the unlawful use of personal data

Sustained agreement rates in the longitudinal assessment of lupus patients to a Broad Consent for personal data and specimen usage in the RHINEVIT biobank.

Biobanks are essential structures for scientific research. The RHINEVIT biobank is used to recruit biomaterials from rheumatology patients in outpatient care and to conduct clinical research studies (e.g., cohort studies) and basic research. RHINEVIT established Broad Consents (BC) to allow extensive and relevant usage of data and biospecimens without the need for specific project restrictions. For quality assurance, we compared the consent rate of individual items of the BC versions in patients with systemic lupus erythematosus (SLE) in the longitudinal study. BCs were used for biomaterial donation. Informed consent data from RHINEVIT were analyzed. Due to the content restructuring of the BC items due to changes from the templates of the working group of the Medical Ethics Commissions in the Federal Republic of Germany and GDPR requirements, content mapping of the items was performed for the analysis. From September 2015 to March 2022, 291 SLE outpatients donated biomaterials. In 119 patients, the BC was renewed at least once in a subsequent biomaterial donation. Three biomaterial donations were obtained from 21 patients and four from six patients using the respective BC. However, one consent was later revoked. Consent to the BC topics showed consistently high rates of agreement (range 97.5%-100%), with only some patients disagreeing with individual topics. This remained stable over time (median 526 days [Q1 400, Q3 844]). None of the patients disagreed with a certain topic in two consecutive visits. Modifications to the BC did not result in any relevant changes in the approval rates for SLE patients. RHINEVIT's BC is successfully used for the quality-assured handling of excellently annotated biomaterial. The long-term use of these highly valuable biospecimens for unrestricted research, also in an international context, remains assured.

Building Situational Awareness of GDPR

Because previous academic research does not comment sufficiently on how the relevant content of the European Union (EU) General Data Protection Regulation (GDPR has been properly communicated to the organisations, or how the situational awareness (SA) of GDPR has been built in the organisations, this qualitative empirical research was regarded as a valuable approach for gathering authentic research material on the practical bases of this phenomena. The aim of this empirical case study (CS) is to develop a picture of what processes organisations use to build SA of the GDPR requirements. To guide the CS, we asked how the SA for decision-making was constructed and how it was perceived in organisations. The experiences of eight Finnish organisations showed that the organisations’ practices of building SA and their experiences with the quality and adequacy of SA differed. However, building SA proved to be a critical step for organisations in the overall process of meeting GDPR requirements. Especially the data coming from inside the organisation became very relevant in the SA process, because it supported decision makers to determine how the GDPR requirements should be implemented in the organisation. As a main contribution of this article, based on best practices shared by organisations a model of building SA was built. The proposed model is threefold and was constructed by combining the findings of an empirical CS analysis, the steps of the intelligence process, and the essential elements of the model of creating information security SA. The result is potentially beneficial for building situational understanding of any complex or ambiguous issue, especially in complex and digitalised technological areas, where combining information management with accurate and efficient decision-making is a common challenge. The results can be used by any party who is looking to build SA of an abstract issue in a complex environment.

Organisational GDPR Investments and Impacts

The aim of this empirical multi-case study is to understand the GDPR investments and impacts of the organisations. Among these, the measuring experiences related to GDPR and information security (Isec), and the future expectations are examined. Several interesting findings were recognised, which also enabled further suggestions. First, an understanding of the organisations’ investments and their impact is built by gathering information about the actions that organisations made to fulfil the GDPR requirements. In the second phase, it is deemed necessary to examine how organisations experience the measures and evaluation of GDPR development and progress, in order to understand how respondents, end up evaluating the impact of their investments. In the third phase it is considered necessary to consider the future development of GDPR and the challenges and opportunities it brings to organisations, in order to understand how the experiences so far affect preparations for the future. The final phase of evaluation focuses on finding out what impact the GDPR has had on organisations. On the one hand, it is possible that the total investment in the GDPR may also correlate with the development of the organisational Isec maturity, because GDPR has brought more resources and visibility to the organisation’s Isec, and operations have become more systematic. On the other hand, organisations with an already high level of Isec maturity and organisations operating in a regulatory-focused industry may accept the GDPR-based Isec investments more easily. If GDPR is tightly integrated with both the organisation’s information security and the business functions under the responsibility of executive management, it may support the organisation’s business and information security development. This research serves GDPR authorities, organisational executives, persons in charge of GDPR/information security/cybersecurity, service providers and academia.

An AI framework to support decisions on GDPR compliance

The Italian Public Administration (PA) relies on costly manual analyses to ensure the GDPR compliance of public documents and secure personal data. Despite recent advances in Artificial Intelligence (AI) have benefited many legal fields, the automation of workflows for data protection of public documents is still only marginally affected. The main aim of this work is to design a framework that can be effectively adopted to check whether PA documents written in Italian meet the GDPR requirements. The main outcome of our interdisciplinary research is INTREPID (artI ficial iNT elligence for gdpR compliancE of P ublic admI nistration D ocuments), an AI-based framework that can help the Italian PA to ensure GDPR compliance of public documents. INTREPID is realized by tuning some linguistic resources for Italian language processing (i.e. SpaCy and Tint) to the GDPR intelligence. In addition, we set the foundations for a text classification methodology to recognise the public documents published by the Italian PA, which perform data breaches. We show the effectiveness of the framework over a text corpus of public documents that were published online by the Italian PA. We also perform an inter-annotator study and analyse the agreement of the annotation predictions of the proposed methodology with the annotations by domain experts. Finally, we evaluate the accuracy of the proposed text classification model in detecting breaches of security.

The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis

The fast evolution and prevalence of driverless technologies has facilitated the testing and deployment of automated city shuttles (ACSs) as a means of public transportation in smart cities. For their efficient functioning, ACSs require a real-time data compilation and exchange of information with their internal components and external environment. However, that nexus of data exchange comes with privacy concerns and data protection challenges. In particular, the technical realization of stringent data protection laws on data collection and processing are key issues to be tackled within the ACSs ecosystem. Our work provides an in-depth analysis of the GDPR requirements that should be considered by the ACSs’ stakeholders during the collection, storage, use, and transmission of data to and from the vehicles. First, an analysis is performed on the data processing principles, the rights of data subjects, and the subsequent obligations for the data controllers where we highlight the mixed roles that can be assigned to the ACSs stakeholders. Secondly, the compatibility of privacy laws with security technologies focusing on the gap between the legal definitions and the technological implementation of privacy-preserving techniques are discussed. In face of the GDPR pitfalls, our work recommends a further strengthening of the data protection law. The interdisciplinary approach will ensure that the overlapping stakeholder roles and the blurring implementation of data privacy-preserving techniques within the ACSs landscape are efficiently addressed.

Cookies Implementation Analysis and the Impact on User Privacy Regarding GDPR and CCPA Regulations

This paper will mostly focus on the analysis of the implementation of cookies and their impact on the data collected from users. The first part of the paper will describe the basic characteristics and concepts of cookies. Their functionalities, categories and possibilities for creation will be presented, as well as the role of the privacy management software and its importance in cookie processing. The last part of the paper will deal with the impact of cookies on user privacy, with reference to two important regulations related to the protection of user privacy (GDPR and CCPA). The processing refers to the technological goals and challenges that arise from the introduction of data protection principles as well as the possibility of overcoming the gap between GDPR and CCPA requirements and technical capabilities. Finally, a description of the general concept of cookies is provided, with the advantages and disadvantages of their introduction. Comparing the approaches of working with cookies contributes users’ insight into their specifications in order to correctly draw conclusions about the implementation of cookies. The authors give proposals and critical opinions on safety and potential directions for future development.

Media users’ and professionals’ responses to personal data receipts: A mixed methods study

European General Data Protection Regulation requires organisations to request the data subject’s consent for personal data processing. Data controllers must be able to demonstrate valid consent was obtained (‘transparency’). Media often struggle to meet GDPR requirements in practice. We identified several issues with existing consent procedures amongst which a need for trustworthy approaches to record and track consent. In this article, we evaluate a specific transparency initiative: a Personal Data Receipt (PDR) for news personalisation. We investigated how European media users and media professionals evaluated the PDR. We conducted qualitative surveys and interviews to explore and describe individuals’ viewpoints on/responses to the PDR. The main strengths highlighted in this study are: GDPR compliance and improved data processing transparency which leads to more control and user trust. PDR weaknesses are mainly related to users not reading the receipt, lack/overload of information, and design issues. Based on our findings, we identified missing elements and formulated recommendations for PDR improvement to optimise consent strategies. By examining how individuals responded to this specific transparency tool, and rhetorical tactics connected to it (placation, diversion, jargon, and misnaming), our study provides informed suggestions for ways out of digital resignation (Draper & Turow, 2019).

Advanced Electronic Signatures and eIDAS – Analysis of the Concept

We discuss the model of electronic signatures as described by the European eIDAS Regulation from the perspective of common understanding of electronic signatures in the cryptographic community. We show that these two perspectives do not present the same picture. The discrepancies between them may become opportunities as well as barriers for rapid deployment of electronic signatures and seals in business and administration.We focus particularly on validation of advanced electronic signatures and its interplay with the data protection requirements of GDPR. We show that by tweaking the existing technical standards one can reduce the number of problems and achieve compliance with both GDPR and eIDAS.Among others, we wish to bring attention to the evolving regulatory framework that without any doubt will have a substantial impact on the ecosystem of electronic signatures.

Know Your Customer: Balancing innovation and regulation for financial inclusion

AbstractFinancial inclusion depends on providing adjusted services for citizens with disclosed vulnerabilities. At the same time, the financial industry needs to adhere to a strict regulatory framework, which is often in conflict with the desire for inclusive, adaptive, and privacy-preserving services. In this article we study how this tension impacts the deployment of privacy-sensitive technologies aimed at financial inclusion. We conduct a qualitative study with banking experts to understand their perspectives on service development for financial inclusion. We build and demonstrate a prototype solution based on open source decentralized identifiers and verifiable credentials software and report on feedback from the banking experts on this system. The technology is promising thanks to its selective disclosure of vulnerabilities to the full control of the individual. This supports GDPR requirements, but at the same time, there is a clear tension between introducing these technologies and fulfilling other regulatory requirements, particularly with respect to “Know Your Customer.” We consider the policy implications stemming from these tensions and provide guidelines for the further design of related technologies.

The Alignment Problem: Machine Learning and Human Values

The Alignment Problem: Machine Learning and Human Values

Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)?

Recent global trends are producing powerful growth in the digital environment, and its spread is prompting adoption of strict and comprehensive regulation to ensure data protection. This results in a number of difficulties, one of which is lack of consistency between data protection regulation and the regulatory regimes applicable to specific industries and institutions. That inconsistency is particularly evident in the field of international arbitration — one of the most widely used and convenient methods for resolving international disputes. The principles and fundamental concepts that largely define international arbitration, such as autonomy of the parties and confidentiality, have made its use very well accepted and widespread. However, data protection requirements often force the parties that are subject to them to make a difficult choice between the basic principles of international arbitration and the requirements of data protection regulation. This bind has come about because data protection regulation, which generally imposes comprehensive compliance obligations, rarely takes into account the specifics of the industries in which it will be applied. In this article it is analyzing application of the GDPR requirements that pertain to cross-border data transfer from the perspective of international arbitration in order to illustrate difficulties and regulatory gaps that may be encountered by the entities interested in thorough compliance with the applicable regulations.

GDPR - General Data Protection Regulation on Sites Requiring Accessibility

The paper describes what GDPR - General Data Protection Regulation is and why it matters for business, institutions and other legal entities, who need to collect personal data in order to provide and deliver services or products. They have to apply and describe to consumers’ principles and general rules to protect their data. Rules include reasons why personal data collection is necessary, transparency how and by who it will be used and stored and for how long, as well as safety measures to not be used by other third parties or for other purposes unless the consumer clearly agreed. The paper explores the necessity and awareness to provide personal data to sites, how people provide it, what rights and options there are to protect it and why. Online users and clients are now more aware and receiving information on how their personal data is used by sites and service providers online. Research results on how much people want and fear to share their personal data are also presented. The paper presents in detail GDPR rules, requirements and rights and practiced, as well as what is personal data and sensitive personal data and the different ways to process and protect it. The research also focuses on special personal data provided by people with disabilities in order to have accessibility on sites and use certain services. In the end, recommendations for sites with accessibility are presented, following GDPR protection requirements.

NovidChain: Blockchain-based privacy-preserving platform for COVID-19 test/vaccine certificates.

The COVID‐19 pandemic has emerged as a highly transmissible disease which has caused a disastrous impact worldwide by adversely affecting the global economy, health, and human lives. This sudden explosion and uncontrolled worldwide spread of COVID‐19 has revealed the limitations of existing healthcare systems regarding handling public health emergencies. As governments seek to effectively re‐establish their economies, open workplaces, ensure safe travels and progressively return to normal life, there is an urgent need for technologies that may alleviate the severity of the losses. This article explores a promising solution for secure Digital Health Certificate, called NovidChain, a Blockchain‐based privacy‐preserving platform for COVID‐19 test/vaccine certificates issuing and verifying. More precisely, NovidChain incorporates several emergent concepts: (i) Blockchain technology to ensure data integrity and immutability, (ii) self‐sovereign identity to allow users to have complete control over their data, (iii) encryption of Personally Identifiable Information to enhance privacy, (iv) W3C verifiable credentials standard to facilitate instant verification of COVID‐19 proof, and (v) selective disclosure concept to permit user to share selected pieces of information with trusted parties. Therefore, NovidChain is designed to meet a high level of protection of personal data, in compliant with the GDPR and KYC requirements, and guarantees the user's self‐sovereignty, while ensuring both the safety of populations and the user's right to privacy. To prove the security and efficiency of the proposed NovidChain platform, this article also provides a detailed technical description, a proof‐of‐concept implementation, different experiments, and a comparative evaluation. The evaluation shows that NovidChain provides better financial cost and scalability results compared to other solutions. More precisely, we note a high difference in time between operations (i.e., between 46% and 56%). Furthermore, the evaluation confirms that NovidChain ensures security properties, particularly data integrity, forge, binding, uniqueness, peer‐indistinguishability, and revocation.

Incorporating privacy by design in body sensor networks for medical applications: A privacy and data protection framework

Privacy and Data protection are highly complex issues within eHealth/M-Health systems. These systems should meet specific requirements deriving from the organizations and users, as well as from the variety of legal obligations deriving from GDPR that dictate protection rights of data subjects and responsibilities of data controllers. To address that, this paper proposes a Privacy and Data Protection Framework that provides the appropriate steps so as the proper technical, organizational and procedural measures to be undertaken. The framework, beyond previous literature, supports the combination of privacy by design principles with the newly introduced GDPR requirements in order to create a strong elicitation process for deriving the set of the technical security and privacy requirements that should be addressed. It also proposes a process for validating that the elicited requirements are indeed fulfilling the objectives addressed during the Data Protection Impact Assessment (DPIA), carried out according to the GDPR.

Stosunek kościelnej ochrony danych osobowych do RODO – uwagi na marginesie postanowienia Krajowego Sądu Pracy w Norymberdze z dnia 29 maja 2020 roku, 8 Ta 36/20

Przedmiotem opracowania jest prezentacja postanowienia Krajowego Sądu Pracy w Norymberdze z dnia 29 maja 2020 roku, 8 Ta 36/20 i rozważenie skutków z tego orzeczenia płynących dla ochrony praw jednostki. Analizowane rozstrzygnięcie jest jednym z pierwszych orzeczeń sądowych odnoszących się do art. 91 ust. 1 RODO i kościelnego aktu prawnego (Kościoła Katolickiego w Niemczech) regulującego ochronę danych osobowych. Przedmiotem opracowania jest nie tylko ocena spełnienia przez ustawę o kościelnej ochronie danych osobowych Kościoła Katolickiego w Niemczech (kirchliches Datenschutzgesetz – KDG) wymogów RODO, ale przede wszystkim kwestia właściwości sądu państwowego (sądu pracy) lub kościelnego (Międzydiecezjalnego Sądu Ochrony Danych Osobowych z siedzibą w Kolonii działającego w oparciu o Regulamin Kościelnego Sądownictwa Ochrony Danych Osobowych – niem. Kirchliche Datenschutzgerichtsordnung – KDSGO) do badania roszczenia odszkodowawczego pracownika zatrudnionego przez Kościół Katolicki, wskazującego jako podstawę roszczenia udostępnienie jego danych osobowych osobom nieuprawnionym. Opracowanie zawiera także analizę wniosków płynących z postanowienia w szerszym, prawnoporównawczym kontekście polskiego konstytucyjnego modelu stosunków państwa oraz kościołów i innych związków wyznaniowych.

Анализ влияния регламента General Data Protection Regulation на деятельность предприятий топливно-энергетического комплекса

General Data Protection Regulation has been adopted in 2018 and establishes privacy and security protection for data gathered on anyone in the European Union. Russian power engineering companies have to potentially comply with GDPR in regards of processing and storing customer data. This paper contains an analysis of certain GDPR requirements and their meaning for power engineering companies and their departments for the purpose of compliance risk assessment. The results can help make decisions on compliance risk assessment initiatives to diminish data protection risks for international businesses, including power engineering companies.

Data sharing, international property practices and the GDPR: communicating with your consumers

PurposeThe purpose of this paper is to examine the requirements of the General Data Protection Regulation (“GDPR”) in order to: identify its requirements for the Australian and New Zealand based members of multi-national property firms (“MNPF”); and understand how those firms are currently engaging with customers regarding the obligations the GDPR imposes.Design/methodology/approachThe research was undertaken by means of doctrinal legal research that engaged with statutory law, related policy documents, accessible private firm documents and website materials, and academic and other related writings. The authors considered these in the context of the GDPR's requirements, and how relevant obligations were communicated to the public on the MNPF Australian and New Zealand members' websites.FindingsThe research confirms the available literature's observations of the GDPR's broad reach and the firms to which it applies. The difficulties experienced in locating relevant information highlights the need for a change to firm processes to ensure that any communication obligations are met. The cases engaged with also serve to highlight the need to ensure that the actual practice is consistent with required GDPR processes.Research limitations/implicationsThe research faced three limitations. First: there was a limited number of relevant Australian and New Zealand based property related firms available to consider: not all property related firms were members of a MNPF or had business partners or customers/clients in the European Union or European Economic Area. Second: one of the relevant firms had already identified it was withdrawing from the Australian market. Third: there was a lack of public access to all materials as, while privacy policies as required by domestic laws were readily accessible, access was not readily available to GDPR related or required information or documents.Originality/valueThe research adds to the academic literature in this emerging area of international legal obligation.