General Data Protection Regulation Research Articles

Design, cohort profile and comparison of the KTD-Innov study: a prospective multidimensional biomarker validation study in kidney allograft rejection.

There is an unmet need for robust and clinically validated biomarkers of kidney allograft rejection. Here we present the KTD-Innov study(ClinicalTrials.gov, NCT03582436), an unselected deeplyphenotyped cohort of kidney transplant recipients with a holistic approach to validate the clinical utility of precision diagnostic biomarkers. In 2018-2019, we prospectively enrolled consecutive adult patients who received a kidney allograft at seven French centers and followed them for a year. We performed multimodal phenotyping at follow-up visits, by collecting clinical, biological, immunological, and histological parameters, and analyzing a panel of 147 blood, urinary and kidney tissue biomarkers. The primary outcome was allograft rejection, assessed at each visit according to the internationalBanff 2019 classification. We evaluated the representativeness of participants by comparing them with patients from French, European, and American transplant programs transplanted during the same period. A total of 733 kidney transplant recipients (64.1% male and 35.9% female) were included during the study. The median follow-up after transplantation was 12.3months (interquartile range, 11.9-13.1months). The cumulative incidence of rejection was 9.7% at one year post-transplant. We developed a distributed and secured data repository in compliance with the general data protection regulation. We established a multimodal biomarker biobank of 16,736 samples, including 9331 blood, 4425 urinary and 2980 kidney tissue samples, managed and secured in a collaborative network involving 7 clinical centers, 4 analytical platforms and 2 industrial partners. Patients' characteristics, immune profiles and treatments closely resembled those of 41,238 French, European and American kidney transplant recipients. The KTD-Innov study is a unique holistic and multidimensional biomarker validation cohort of kidney transplant recipients representative of the real-world transplant population. Future findings from this cohort are likely to be robust and generalizable.

A Third Directive on Consumer Credit

Abstract The recently adopted Consumer Credit Directive incorporates new forms of credit and uses classic consumer protection instruments as well as introducing measures that increase control over lenders with the aim of preventing over-indebtedness. In general, more burdens are imposed on lenders and certain commercial practices are banned or restricted in all Member States. Moreover, the Directive is characterised by the fact that it includes consumer data protection and specifies a consumers’ right not to be discriminated against, which may have some overlap with the General Data Protection Regulation and the on-going development of EU artificial intelligence legislation.

The Metaverse: searching for compliance with the General Data Protection Regulation

The Metaverse: searching for compliance with the General Data Protection Regulation

A comparative analysis: health data protection laws in Malaysia, Saudi Arabia and EU General Data Protection Regulation (GDPR)

Purpose General Data Protection Regulation (GDPR) of the European Union (EU) was passed to protect data privacy. Though the GDPR intended to address issues related to data privacy in the EU, it created an extra-territorial effect through Articles 3, 45 and 46. Extra-territorial effect refers to the application or the effect of local laws and regulations in another country. Lawmakers around the globe passed or intensified their efforts to pass laws to have personal data privacy covered so that they meet the adequacy requirement under Articles 45–46 of GDPR while providing comprehensive legislation locally. This study aims to analyze the Malaysian and Saudi Arabian legislation on health data privacy and their adequacy in meeting GDPR data privacy protection requirements. Design/methodology/approach The research used a systematic literature review, legal content analysis and comparative analysis to critically analyze the health data protection in Malaysia and Saudi Arabia in comparison with GDPR and to see the adequacy of health data protection that could meet the requirement of EU data transfer requirement. Findings The finding suggested that the private sector is better regulated in Malaysia than the public sector. Saudi Arabia has some general laws to cover health data privacy in both public and private sector organizations until the newly passed data protection law is implemented in 2024. The finding also suggested that the Personal Data Protection Act 2010 of Malaysia and the Personal Data Protection Law 2022 of Saudi Arabia could be considered “adequate” under GDPR. Originality/value The research would be able to identify the key principles that could identify the adequacy of the laws about health data in Malaysia and Saudi Arabia as there is a dearth of literature in this area. This will help to propose suggestions to improve the laws concerning health data protection so that various stakeholders can benefit from it.

Taxonomy of the GDPR-based Privacy Research by Scientometric Analysis

Will General Data Protection Regulation (GDPR) be adopted globally in business? The GDPR was approved in the European Union (EU) in April 2016 and officially put into effect in May 2018, thus the research in this field has an obvious upward trend. The development of GDPR is aimed at adapting to new trends, conducting scientific econometric analysis in the fields of privacy and GDPR, and analyzing and visualizing emerging trends. First, summarizing the privacy and GDPR studies publicly published between 1995 and 2023 through statistical analysis of terminology categories and high-yield journals. Then, understand the overall research status of privacy rights and GDPR from the perspectives of author, journal, literature co citation analysis, and collaborative networks. Finally, based on keyword analysis and literature co citation cluster analysis, a knowledge graph was constructed that includes knowledge domains, evolutionary trends, and future research directions. As a globally influential regulation, GDPR emphasizes the protection and lawful processing of personal data, which is of great significance for protecting personal data privacy and enhancing data security.

Preserving the Past, Enabling the Future: Assessing the European Policy on Access to Archives in the Digital Age

Abstract In this study we investigate the implementation and challenges of accessing archives in the digital age. Through an online survey and expert interviews, data were collected from archival institutions, professional users, and civil society organizations in all Council of Europe member states. The findings reveal that digitization has had a positive impact on document accessibility, providing convenience, reducing workload, and improving user access. However, only a small portion of archival holdings have been digitized, highlighting the need for further efforts in this area. Data protection and copyright present significant obstacles, with the European General Data Protection Regulation leading to access restrictions and legal uncertainties. Preservation, interoperability, and organization of records pose challenges in the digital realm, and while artificial intelligence shows promise in automating metadata creation and identifying sensitive materials, concerns about algorithmic biases and the need for additional checks are highlighted. To enhance accessibility, user-friendly interfaces, cooperation among memory preserving institution, and outreach to new user groups are crucial, which can ensure the effective preservation and accessibility of digital collections in the digital age. We provide insights for policy-making and archival institutions in navigating the evolving landscape of accessibility.

When Is a Decision Automated? A Taxonomy for a Fundamental Rights Analysis

Abstract This Article addresses the pressing issues surrounding the use of automated systems in public decision-making, specifically focusing on migration, asylum, and mobility. Drawing on empirical data, this Article examines the potential and limitations of the General Data Protection Regulation and the Artificial Intelligence Act in effectively addressing the challenges posed by automated decision-making (ADM). The Article argues that the current legal definitions and categorizations of ADM fail to capture the complexity and diversity of real-life applications where automated systems assist human decision-makers rather than replace them entirely. To bridge the gap between ADM in law and practice, this Article proposes to move beyond the concept of “automated decisions” and complement the legal protection in the GDPR and AI Act with a taxonomy that can inform a fundamental rights analysis. This taxonomy enhances our understanding of ADM and allows to identify the fundamental rights at stake and the sector-specific legislation applicable to ADM. The Article calls for empirical observations and input from experts in other areas of public law to enrich and refine the proposed taxonomy, thus ensuring clearer conceptual frameworks to safeguard individuals in our increasingly algorithmic society.

Experiences of GDPR in Norway: Politics of autonomy and control

This article explores the challenges Norwegian anthropologists face owing to the implementation of the General Data Protection Regulation (GDPR). The authors’ analysis reveals a tension between the need to comply with data protection regulations and preserve research autonomy and methodological integrity. The authors document how GDPR's bureaucratic control mechanisms have influenced researchers’ conceptualization of ethics, leading to a split between legalistic adherence and critical responses within the anthropological community. This situation has necessitated negotiations with various stakeholders and re‐evaluating participatory observational methods, particularly in health research, where access has become increasingly difficult. The article highlights the anthropological community's efforts to navigate these regulations through national debates, establishing forums for ethics in ethnographic research and developing strategies to maintain methodological standards while ensuring GDPR compliance. The authors advocate vigilance against the colonization of bureaucratic logic and seek to secure anthropological representation in regulatory bodies to safeguard the discipline's interests.

A Bilingual Longitudinal Analysis of Privacy Policies Measuring the Impacts of the GDPR and the CCPA/CPRA

Privacy policies are the main mechanism for websites to describe their practices in collecting and processing visitors' personal data. Their format and content are subject to legal requirements that have changed due to recent new privacy regulations including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA). Studying how privacy policies are adapted to such regulatory change can help identify shortcomings in implementing the law and inform future legislatory initiatives. Existing work in this area mostly studied effects of the GDPR on privacy policies or the "Do Not Sell My Personal Information" link mandated by the CCPA. Methodologically, insights were mainly drawn from English-language privacy policies using keyword-based analyses or machine learning classifiers. In this work, we address this research gap and conduct a bilingual study of privacy policies in English and German that investigates the effects of the GDPR and CCPA/CPRA on privacy policy content, using established methods from corpus linguistics that are language-independent and do not rely on keyword lists or classifiers that may date quickly. We find that, unlike for the GDPR, the CCPA's requirements were not yet widely implemented when it first became enforceable but only with its amendment, the CPRA. Before that, websites used more than 60 variants of the "Do Not Sell" link instead of the mandated wording and did not prominently reference individual rights granted by the CCPA/CPRA. While companies outside California and the US did adapt their disclosures to the CCPA/CPRA, this was limited to English-language policies and did not spill over to policies in German. For GDPR enforcement, we find websites to increasingly rely on legitimate interests to justify data collection, raising concerns whether individuals' interests in the privacy of their personal information are still sufficiently considered.

Data mining, research ethics and practice: A view from Italy

This article explores the intersection of ethics and methodology in anthropological research, focusing on squats in Rome. It juxtaposes traditional ethnographic practices with contemporary ethical regulations, such as the General Data Protection Regulation (GDPR), to examine the nuanced relationship between researchers and their subjects in socially vulnerable and legally sensitive environments. The article critiques the reductionist view of ethnographic data as mere information to be extracted, arguing for a more engaged and reciprocal approach to anthropology that respects the agency of research subjects and emphasizes the co‐production of knowledge. The document challenges conventional ethical frameworks and advocates for anthropology's commitment to listening and giving voice to marginalized communities through examining interactions with squatters and the Roma population. This enquiry scrutinizes the bureaucratic imposition on ethnographic research and reaffirms the discipline's role in contributing to a broader understanding of ethics in anthropological practice.

Why data about people are so hard to govern

AbstractHow data on individuals are gathered, analyzed, and stored remains largely ungoverned at both domestic and global levels. We address the unique governance problem posed by digital data to provide a framework for understanding why data governance remains elusive. Data are easily transferable and replicable, making them a useful tool. But this characteristic creates massive governance problems for all of us who want to have some agency and choice over how (or if) our data are collected and used. Moreover, data are co‐created: individuals are the object from which data are culled by an interested party. Yet, any data point has a marginal value of close to zero and thus individuals have little bargaining power when it comes to negotiating with data collectors. Relatedly, data follow the rule of winner take all—the parties that have the most can leverage that data for greater accuracy and utility, leading to natural oligopolies. Finally, data's value lies in combination with proprietary algorithms that analyze and predict the patterns. Given these characteristics, private governance solutions are ineffective. Public solutions will also likely be insufficient. The imbalance in market power between platforms that collect data and individuals will be reproduced in the political sphere. We conclude that some form of collective data governance is required. We examine the challenges to the data governance by looking a public effort, the EU's General Data Protection Regulation, a private effort, Apple's “privacy nutrition labels” in their App Store, and a collective effort, the First Nations Information Governance Centre in Canada.

Reinforcement learning for addressing the cold-user problem in recommender systems

Recommender systems are widely used in webshops because of their ability to provide users with personalized recommendations. However, the cold-user problem (i.e., recommending items to new users) is an important issue many webshops face. With the recent General Data Protection Regulation in Europe, the use of additional user information such as demographics is not possible without the user’s explicit consent. Several techniques have been proposed to solve the cold-user problem. Many of these techniques utilize Active Learning (AL) methods, which let cold users rate items to provide better recommendations for them. In this research, we propose two novel approaches that combine reinforcement learning with AL to elicit the users’ preferences and provide them with personalized recommendations. We compare reinforcement learning approaches that are either AL-based or item-based, where the latter predicts users’ ratings of an item by using their ratings of similar items. Differently than many of the existing approaches, this comparison is made based on implicit user information. Using a large real-world dataset, we show that the item-based strategy is more accurate than the AL-based strategy as well as several existing AL strategies.

Unlocking personal data from online services: user studies on data export experiences and data transfer scenarios

ABSTRACT In recent years, online services have started to make personal data of users more accessible by offering dedicated ways of exporting data. The introduction of download portals is associated with increasing demands by privacy regulations regarding the rights of users, such as the Right of Access (Art. 15) and the Right to Data Portability (Art. 20) of the European Union’s General Data Protection Regulation (GDPR). These rights aim to empower users by increasing their control over the personal data that online services hold about them. They allow users to export their personal data and thereby gain insights on the scope of personal data held by the services and to transfer this data to other services. However, until now, little is known about how users experience and evaluate the process of accessing and exporting their data and how it impacts individual-level factors such as privacy-related attitudes (i.e. attitudes regarding sharing personal data, perceived control over data, and using privacy-protective strategies). In this paper, we report the results of an online survey with an experimental condition (N = 728) and a second online survey (N = 817) where participants from two university courses were asked to request real data exports from online services and inspect the exported data afterward. We find that inspecting exported personal data has a statistically significant positive effect on users’ privacy-related attitudes. However, users perceive limited usefulness in switching scenarios where personal data is transferred to a new substitutional service and rather prefer to use the data at multiple complementary services.

Enhancing the Responsibilities of Data Controllers in Vietnam: Insights from the European General Data Protection Regulation

 
 This article explores the evolving landscape of data protection law in Vietnam, focusing specifically on the responsibilities of data controllers under Vietnam's new Personal Data Protection Decree (Decree No. 13/2023/ND-CP - hereinafter referred to as Decree 13) and compares it with the European Union's General Data Protection Regulation (GDPR). The main objective is to assess how the provisions regarding data controllers’ responsibilities under Decree 13 align with international data protection standards, identifying its progress and challenges. The analysis uncovers both convergence and divergence points between the related provisions under Decree 13 and the GDPR, particularly in terms of clarity, scope, and enforcement mechanisms. A significant challenge identified is the ambiguity in Decree 13’s provisions on data controllers’ responsibilities and the absence of several essential elements, which could undermine the effectiveness of Vietnam's data protection framework. To address these issues, the article offers strategic recommendations for legislative improvements and practical adjustments for data controllers in Vietnam. In conclusion, while navigating the path to a comprehensive data protection framework poses challenges for Vietnam, this journey offers an opportunity to align with regional and global developments in data protection laws. By learning from the GDPR and adapting to its specific features, Vietnam can develop a robust, effective, and trustworthy data protection environment, safeguarding its citizens' privacy rights and facilitating a favorable international business climate.

Generative AI and deepfakes: a human rights approach to tackling harmful content

ABSTRACT The EU's Artificial Intelligence Act (AIA) introduces necessary deepfake regulations. However, these could infringe on the rights of AI providers and deployers or users, potentially conflicting with privacy and free expression under Articles 8 and 10 of the European Convention on Human Rights, and the General Data Protection Regulation (EU) 2016/679 (GDPR). This paper critically examines how an unmodified AIA could enable voter manipulation, blackmail, and the generation of sexual abusive content, facilitating misinformation and potentially harming millions, both emotionally and financially. Through analysis of the AIA's provisions, GDPR's regulations, relevant case law, and academic literature, the paper identifies risks for both AI providers and users. While the AIA's yearly review cycle is important, the immediacy of these threats demands swifter action. This paper proposes two key amendments: 1) mandate structured synthetic data for deepfake detection, and 2) classify AI intended for malicious deepfakes as ‘high-risk’. These amendments, alongside clear definitions and robust safeguards would ensure effective deepfake regulation while protecting fundamental rights. The paper urges policymakers to adopt these amendments during the next review cycle to protect democracy, individual safety, and children. Only then will the AIA fully achieve its aims while safeguarding the freedoms it seeks to uphold.

Data Protection and Privacy as a Fundamental Right - An In-depth Analysis of the European Union and India's Data Protection Legislation

In the digital age, the protection of personal data and the right to privacy have emerged as paramount concerns, necessitating robust legal frameworks to safeguard these fundamental human rights. This paper embarks on a comprehensive study of data protection laws in two distinct jurisdictions, the European Union (EU) and India. By examining the EU’s General Data Protection Regulation (GDPR), renowned for its stringent data protection standards, and juxtaposing it with India’s evolving legal framework, particularly in light of the Supreme Court’s landmark recognition of privacy as a fundamental right and the ongoing deliberations on the Digital Personal Data Protection Act (DPDPA), 2023, this research aims to unravel the complexities of legislating privacy in the digital era. Through a comparative analysis, the article highlights the similarities and divergences between the GDPR and the DPDP Act, evaluates the effectiveness of these frameworks in safeguarding privacy, and explores the challenges posed by technological advancements. Furthermore, it delves into the future of data protection laws. By integrating legal analysis with the theoretical underpinnings of privacy as a fundamental right, this research contributes to the global discourse on data protection, advocating for a dynamic legal landscape that aligns with the evolving nature of privacy threats in the digital world.

Basic principles of personal data processing and protection

The development of an information society that prefers quick and remote resolution of issues, including on the Internet, raises the issue of protecting information and data disseminated and provided by personal data subjects. People do not want to transmit personal information without a clear understanding that it will be protected and not used, or to transfer it unnecessarily to third parties, because most of this information is identifying and personal, and in some cases even «sensitive». In this case, persons who transfer, process, or store personal data must be guided by legal grounds that determine the course of such actions. The fundamental concepts that must be followed in any operations with personal data are the principles. Principles are the basic framework that everyone in this process must adhere to, and failure to do so entails legal liability.
 The institute of personal data protection is relatively new, therefore, with the development of this institute, legislation at various levels develops and improves the basic provisions and general principles of personal data protection. At present, the general principles of personal data processing and protection can be summarised as: transparency, fairness, lawfulness, purpose limitation, data minimisation, data accuracy, data retention period limitation, data security and the principle of accountability.
 Such principles are enshrined in the General Data Protection Regulation and meet the main goal, namely to define the standards on the basis of which personal data should be collected, processed, transferred, stored, and destroyed. The existence of such principles and, most importantly, their consolidation in regulatory legal acts that are binding for all and are primarily necessary to preserve and not restrict the right to privacy and the right to protection of personal data, the right to privacy. The general principles of legitimate operations with personal information provide for notification of the person who provides his/her personal data about the purpose of processing and all the details concerning future actions with the provided information and regulation, limitation and determination of liability for violation of the principles of processing and protection of personal data for the person who further carries out the specified operations.

Legal incentives for innovations in the emotional AI domain: a carrot and stick approach?

Abstract Emotions strongly influence the human way of living and life experiences. In this context, Artificial Intelligence (AI) technologies are crucial to pushing developments further. Although emotional AI-driven innovations are welcome in our society, they might also have negative effects on the interdependence and autonomy of natural persons. Thus, they might be challenged by several legal provisions in the EU such as the General Data Protection Regulation (GDPR) and the draft AI Act. Yet these inventions require considerable investment, where legal incentives such as intellectual property rights (IPR) are crucial. Indeed, it is also important to secure certainty as to the legal and ethical acceptability of such innovations. This article looks at emotional AI to investigate the interlinkage between technological innovations, legal incentives and ethics, through the lenses of patent law and fundamental rights, in order to shed light over the challenges, limitations, but also opportunities for the protection, commercialization and exploitation of emotional AI-related inventions. Our research offers new scientific knowledge on the largely under-explored issue of legal incentives for emotional AI-related inventions in the European framework. It also provides companies and inventors with key points to consider in decision-making related to investments in and incentives for emotional AI-related innovations, also elaborating on suggestions for the European legislator and policymakers to better stimulate and promote emotional AI technology through regulation.

Protection of children’s personal data in social networks in the context of the right to be forgotten

The article is devoted to a legal analysis of the protection of the confidentiality of children’s personal data on social networks in the context of the right to be forgotten and the General Data Protection Regulation. It is established that most social networks have their own usage rules, but their priority is to attract more users and company profit rather than the security of users’ personal data. Legal mechanisms for the implementation and protection of human rights in the digital environment are in the process of formation and improvement. It is proven that the application of the right to be forgotten has become one of the forms of personal data protection in social networks and on the Internet in general. Although initially the right to erasure emerged only at the level of the judicial practice of the Court of Justice of the EU, an effective mechanism has now been created to protect the individual’s right to delete outdated information about themselves, taking into account the balance between the right to privacy and the right to freedom of expression. Due to psychological immaturity and limited life experience, children and adolescents may casually disclose sensitive personal information, increasing the likelihood of abuse by both social networks and third parties. Therefore, minors receive special protection as vulnerable user categories according to the General Data Protection Regulation. It is argued that the incorporation of the right to be forgotten into EU legislation helps eliminate undesirable consequences of oversharing and restores minors’ ability to control their digital footprint. The terms of service of most social networks ensure additional protection of minors’ data and provide several options for deleting already disseminated information. Obstacles to the application of the right to be forgotten in social networks are identified, such as the lack of a developed mechanism for deleting photos or videos with minors published without the consent of the child or their parents by another user, the limited ability of users under 13 years old to request deletion without intermediaries, and the limited liability of social networks for the loss of information, data, and direct or indirect damages from such actions.

Redact4Trace: A solution for auditing the data and tracing the users in the redactable blockchain

With the introduction of the General Data Protection Regulation and the advent of the Blockchain 3.0 era, redactable blockchain have become a popular area of research. However, auditing harmful data on redactable blockchain has become an urgent problem to be solved to promote redactable blockchain. Moreover, tracing the identity of users who submit harmful data is a concerning problem that urgently needs to be solved. To address these issues, we propose Redact4Trace, a solution for tracing and auditing data in redactable blockchains. In Redact4Trace, transactions are the unit for minor data editing and redaction, ensuring fine-grained data editing and access. We have designed a data auditing scheme based on the unique characteristics of redactable blockchains. This scheme, which uses a chameleon hash, depends only on the transaction’s hash and effectively protects user privacy. We have also designed an identity tracing scheme based on bilinear maps. Users must use the bilinear mapping to compute address information and store it in the transaction for identity tracing. If the identity information in the transaction is altered, our backup scheme based on the discrete logarithm problem can still trace the user’s identity effectively. Security analyses and experimental results confirm that Redact4Trace is both secure and efficient.