Informational Self-determination Research Articles

In the name of protection—A critical analysis of China's legal framework of children's personal information protection in the digital era

This article provides a critical analysis of the China's legal framework of children's personal information protection in the digital era. It demonstrates that Chinese lawmakers adopt a dual-protection paradigm consisting of data privacy law and family law to protect children's personal information. In the field of data privacy law, China's Personal Information Protection Law regards children's personal information as sensitive information, and provides all contexts-based protection through the parental consent system, resulting in severe restrictions on children's freedom of access to information and their evolving capacities. In the field of family law, the Minors Protection Law fragments the right to informational self-determination of children while applying hard legal paternalism with respect to the online live-broadcast for children, limiting children's fundamental right to freedom of expression and depriving parents of the right to the custody of their children. Based on research in developmental psychology, this article argues that different legal frameworks should be adopted according to different age groups of children to protect the best interest of the child. In this way, the balance between the protection and informational self-determination of children in the digital era can be achieved.

Strategic Indeterminacy and Online Privacy Policies: (Un)informed Consent and the General Data Protection Regulation

AbstractArticle 12 of the General Data Protection Regulation (GDPR) requires data controllers to provide data subjects with any information relating to data processing operations “in a concise, transparent, intelligible and easily accessible form, using clear and plain language.” Linguistic inclusivity of privacy policies is no longer a matter of style, but has been a binding legal requirement under the new data protection framework. Article 5 GDPR sets forth the requirements of lawfulness, fairness and transparency and prohibits any data processing operations which do not meet the standards of specification, explicitness and legitimacy of processing purposes [29]. In this study, a quantitative and qualitative analysis of linguistic indeterminacy in a corpus of 350 online privacy policies is presented and it is argued that a considerable number of data controllers continue to make use of strategic vagueness in the context of purpose limitation, therefore potentially prejudicing compliance with the GDPR. A legal-linguistic perspective on the current challenges of informed consent in European data protection law is provided. Finally, it is concluded that while the GDPR has contributed significantly to the linguistic empowerment of the data subject, the framework fails to satisfy the expectation of creating a participatory culture (see [36]) with a high degree of informational self-determination.

안면인식기술과 개인정보보호

Face recognition technology is a method that utilizes thermal infrared photography, three-dimensional measurement, and skeletal analysis to scan, store, and recognize facial shapes or thermal images. It verifies identity by comparing facial images captured by cameras with those in a stored photo database. This technology is extensively applied in various sectors, such as identity verification and access control, due to its high accuracy and quick identification capabilities. The advancement of facial recognition technology, coupled with CCTV, the Internet of Things (IoT), and widespread network connections, is materializing dystopian fears concerning omnipresent surveillance and the ensuing erosion of privacy. Additionally, biased facial recognition technology may serve as a tool for discrimination, infringing upon the rights and freedoms of minorities and other marginalized groups. In 2023, the National Human Rights Commission of The Republic of Korea issued a statement regarding human rights violations facilitated by facial recognition technology and urged the Speaker of the National Assembly and the Prime Minister to actively respond. The statement highlighted that direct observation of individuals' faces in public spaces by the state could limit citizens' freedom of movement and lead to unwarranted surveillance. Given the unique nature of biometric information, such as facial recognition technology, the repercussions of data breaches and misuse are more severe compared to other types of personal information. Specifically, real-time facial recognition technology that targets an unspecified number of individuals in public spaces without their consent may infringe upon the right to privacy and informational self-determination, as well as other fundamental rights including privacy, freedom of assembly, and freedom of association. Furthermore, real-time facial recognition security systems pose challenges in terms of privacy protection and invasion. Hence, the security of collected facial data, defenses against hacking threats, and the secure management of facial databases require thorough examination. This study explores the legal framework and international legislative trends related to biometric information, including facial recognition technology, to identify measures for protecting personal information and ensuring the safe use of this technology.

Data Autonomy: Recalibrating Strategic Autonomy and Digital Sovereignty

The datafication of society comes with a recalibration of power structures. European states can no longer depend on territorial control to govern (cyber)space, powerful corporations own essential cloud infrastructure, state actors denying the importance of democracy and human rights have crucial roles in supply chains, and users are left without choice when using digital services. This article proposes data autonomy as a value-based framework, in response to this ongoing powershift undermining the European Union’s strategic autonomy. In contrast to debates around digital sovereignty and international data flows in data protection law, data autonomy aspires to establish a framework that puts human dignity at its core. Essentially, data autonomy is based on informational self-determination, yet expands it in three dimensions: First, informational selfdetermination remains limited to the citizen-state relationship. The scope of data autonomy expands to private actors, in cases where those are particularly powerful. Secondly, data autonomy expands beyond individual rights and duties, including organizational autonomy as an enabler for individual autonomy. Thirdly, data autonomy addresses harmful inferences resulting from the use of systems based on machine learning or artificial intelligence. Therefore, it is not limited to risks stemming from statically labelled data (e.g., data stored in databases). Strategic Autonomy, Human Dignity, Digital Sovereignty, Governance, Datafication, Data Ownership, Data Governance, Data Protection, Privacy, Informational Self-Determination

Challenge to general law of data protection (GLDP) enforcement of informative self-determination

The present article approaches the paradigm of valuing consent to treat personal data as provided on the General Law of data Protection (GLDP), due to confrontation with its effectiveness, based on informative self-determination. At this point, some insufficiencies of the model to the adequate adjustment in fundamental rights and in alternatives feasible to implement the idea of informative self-determination will be assessed based on the deductive methodology of literature review. It is pointed out that the merely formal consent cannot be enough to free consent protection due to cognitive limitations, asymmetry among powers, need of service usufruct, use of technical terms, time shortage and difficulty to manage future risks. On the other hand, some trends are highlighted to mitigate this insufficiency, be it through information systems such as privacy by design, accountability, offer of paid premium services without counterpart of the indiscriminate assignment of data and other contextual analyses.

Persuasive Technology and computational manipulation: hypernudging out of mental self-determination.

Artificial Intelligence, unperceived, can acquire the user's data, find connections not visible by a human being, profile the users, and aim at persuading them, resulting in Persuasive Technology (PT). During the persuasive process, PT can use manipulation, finding and using routes to affect System 1, the primordial brain of individuals, in the absence of their awareness, undermining their decision-making processes. Multiple international and European bodies recognized that AI systems could use manipulation at an unprecedented degree via second-generation dark patterns such as the hypernudge and that computational manipulation constitutes a risk for autonomy and different, overlapping, fundamental rights such as privacy, informational self-determination and freedom of thought. However, there is a lack of shared ideas regarding which fundamental rights are violated by computational manipulation and which fundamental rights can protect individuals against it. The right to be let alone and the right to hold and express a thought differ from the right to create a thought, being in control of the decision-making process and free from cognitive interferences operated by computational manipulation. Therefore, this paper argues in favor of recognizing a newly emerged fundamental right, the right to mental self-determination, tailored to the unprecedented abilities of AI-driven manipulative technologies.

The right to free personal development as a manifestation of the connection between human dignity and freedom

Constitutional recognition of the worth of a human as the dominant value in the hierarchy of social ones activates the full potential of positive law to the maximum to secure it, in particular the mechanism of a general permissive type of legal regulation, which essentially presupposes freedom, and therefore the embodiment of the ideal of a free human person. The specificity of such regulation is expressed in the process of its social and contextual characteristics, namely, in the description of the scope and boundaries. Accordingly, it has been established that the development of the general permissive idea in the twentieth century shifted to the plane of “recognition of the worth of human dignity”, so the study of freedom within its interrelationship with human dignity forms the first approximate idea of the subject coverage of the general permission (as the basis of appropriate regulation). It has been established that such an interrelation is justified in the regulatory (international, national) and doctrinal context at the level of values and individual rights. It has also been proved that this interrelation is most clearly visible in the right to the free development of a person, which becomes a kind of “intersection”, the main point where dignity and freedom “are connected”.The national recognition of this right in the constitutions of different states has been investigated, in particular as the goals of the state; the highest values; the foundations of the political system and social peace; the personal independency right, including in the system of other personal rights. The peculiarities of its interpretation in German jurisprudence as an “unnamed”, “independent fundamental right to freedom”, which has been developed in two aspects: a) the general right of a person – its “comprehensive protection” from public and private interference, “strengthening” (additional) guarantee of human dignity (which promoted the formation of a kind of human rights methodology – “theory of spheres”). Its nature is analyzed from the point of view of the “human person essence (core)” and its components: human dignity, the fundamental right to informational self-determination, the right to life and limb; b) general freedom of action, which extends the sphere of defending freedom that is not covered by special constitutional rights.It has been found that this right was secured internationally with the expansion of its scope at the expense of the subject matter – the right of the people to self-determination. The constitutional practice of recognition of the right to free personal development in Ukraine has been analyzed and it is presumed to project the basic sphere of the generally permissive type of legal regulation

Reconciling the biomedical data commons and the GDPR: three lessons from the EUCAN ELSI collaboratory

The coming-into-force of the EU General Data Protection Regulation (GDPR) is a watershed moment in the legal recognition of enforceable rights to informational self-determination. The rapid evolution of legal requirements applicable to data use, however, has the potential to outstrip the capabilities of networks of biomedical data users to respond to the shifting norms. It can also delegitimate established institutional bodies that are responsible for assessing and authorising the downstream use of data, including research ethics committees and institutional data custodians. These burdens are especially pronounced for clinical and research networks that are of transnational scale, because the legal compliance burden for outbound international data transfers from the EEA is especially high. Legislatures, courts, and regulators in the EU should therefore implement the following three legal changes. First, the responsibilities of particular actors in a data sharing network should be delimited through the contractual allocation of responsibilities between collaborators. Second, the use of data through secure data processing environments should not trigger the international transfer provisions of the GDPR. Third, the use of federated data analysis methodologies that do not provide analysis nodes or downstream users access to identifiable personal data as part of the outputs of those analyses should not be considered circumstances of joint controllership, nor lead to the users of non-identifiable data to be considered controllers or processors. These small clarifications of, or modifications to, the GDPR would facilitate the exchange of biomedical data amongst clinicians and researchers.

Definition of “Personal Information” in the Crime of Infringing on Citizens’ Personal Information—From the Perspective of Personal Information Protection Law

The concept of “personal information” in the crime of infringing on citizens’ personal information has always been controversial in the criminal law circle. With the promulgation of the personal information protection law, it is necessary to further analyze the definition of “personal information” in the crime of infringing on citizens’ personal information. The legal interest of the crime of infringing on citizens’ personal information is not the suprapersonal legal interest, but the personal information right in the personal legal interest. As the core content of personal information right, the essence of information self-determination right is to emphasize citizens’ personal control over information, which is in line with the legislative orientation of the new law. Around the right of information self-determination, personal information without identifiability should not belong to personal information, and the identification object of personal information should also be limited to “natural persons” to prevent the biased application of law in judicial practice.

THE PRINCIPLE OF TRANSPARENCY OF PUBLIC ADMINISTRATION AS AN ELEMENT OF THE RIGHT TO GOOD GOVERNENCE

Article 18 of the Constitution of Georgia defines good governance as the right to fair administrative proceedings, the right to access public information, the right to informational self-determination, and compensation for damages caused by public authorities. The right to “Good Governance” means an impartial, fair, and timely decision-making process. Also, it implies transparency and full involvement of the interested party in the decision-making process. In 2011 Georgia joined the Open Government Partnership’s (OGP) initiative. The Government of Georgia undertook to ensure the openness of governance, transparency, and accountability to the public, as fundamental values for a democratic society, as well as to continue establishing the founding principles of open governance partnership in public administration. This article presents the whole range of issues of public administration transparency, considering the forms of its implementation

The Crisis of Right to Informational Self-Determination versus the Crisis of Social Safety

The control of information about oneself has emerged as the most sensitive issue both personally and nationally in a digital information society. In the digital information society, the right to informational self-determination is very likely to emerge as a fundamental constitutional right to be the cornerstone of maintaining a free democratic system. As a guardian of constitutional rights, the Korean Constitutional Court has maintained an appropriate balance between guaranteeing the right to informational self-determination and social safety. This paper examines how the Constitutional Court allows restrictions on the right to informational self-determination by analyzing the details of the four-step review of the principle of prohibition of excessive restriction on cases of violation of the right to informational self-determination. Even if some flaws are often found in the process of the argumentation, the Constitutional Court's credit for properly balancing the right to informational self-determination and social safety as public interest should not be underestimated.

The Estonian Electronic Health Record – a Prototype for Data governance in the European Health Data Space?

The Estonian Electronic Health Record (‘EEHR’) enables patients and healthcare professionals to share and use health data for treatment and health administration, but also caters to so-called secondary uses such as scientific research and development of health products – an approach in line with the EU draft regulation for a European Health Data Space of May 2022 (‘EHDS’). However, neither in the Estonian record nor in the EHDS patients have a say in the collection or storage of their data in electronic patient registers; the same is true for data retrieval for secondary use. This is in obvious contradiction to informational self-determination, which is exacerbated by indeterminate permissions and prohibitions.

Personal data protection and State surveillance: the risks of digital discrimination and Federal Supreme Court’s vision

This article proposes an examination of the changes that have taken place in the organization of society in the face of the advancement of new mechanisms of monitoring and state surveillance, with the objective of identifying the dangers arising from them and the risks that a new digital discrimination entails for fundamental rights. Based on a dialectical analysis, we move on to the study of the necessary transformations of consent, revisiting the classic civil law institute, now in the wake of the new General Law for the Protection of Personal Data (Law nº. 13.709/2018). Subsequently, we move on to the study of the impact brought about by the decision rendered by the Federal Supreme Court in the legal analysis of ADI (Direct Action of Unconstitutionality) nº. 6.389/DF, which deemed the provisions contained in Provisional Measure nº 954/2020 and recognized the existence, in our national legal system, of the fundamental right to informative self-determination that, with the approval of EC (Constitutional Amendment) 115/22, was inserted in art. 5, LXXIX as a fundamental right to personal data protection. Finally, it concludes by the necessary structuring of the National Data Protection Authority (ANPD), provided for in article 55-A of the LGPD (General Law for the Protection of Personal Data), representing its creation as an instrument that materializes the objective dimension of this fundamental right.

Relevant interprofessional knowledge of the (general/abdominal) surgeon-Information security and data protection in everyday clinical practice

Short narrative overview based on regulations by law, individual experiences from daily practice and selected references from current literature. Information security and data protection are mandatory and indispensable elements by law of general, professional and social actions, which can be also considered substantial parts of quality management. Therefore, (general/abdominal) surgeon underlies it too. It comprises the protection of information of each type and origin - it serves the warranty of the basic aims such as confidentiality, integrity, availability and authenticity of information, which supports both aims of aclinician, patient safety and treatment effectiveness. It is considered abasic right to protect personal data against abusive processing - however, data security is not the primary aim, but rather the right for informational self-determination. It implies that in case of an IT emergency (released by apersisting system failure or cyberattack), logistic operations are transferred into previously defined emergency procedures well organized and possibly with no interruption - digital logistic operations become suddenly complete analogous processes, with exclusive responsibility of the single institutes and departments. Both sides benefit equally from aregular bilateral exchange between the surgeon and the information security and data protection officer and are able to ensure the common goals of patient safety and treatment effectiveness through aproportionate integration of information security and data protection into everyday clinical practice.

공공영역에서의 개인정보 수집과 활용을 위한 제도적 개선방안

In recent years, artificial intelligence technology, which enables new technologies to be deployed, has expanded the scope and methods of data collection and utilization of government agencies. Data analysis and AI technology are deployed to enhance the intelligent and accurate use of Closed-circuit television (CCTV) surveillance cameras for crime prevention, security, and public safety purposes. The use of facial recognition technology enables an individual to be identified by processing images captured on CCTV, the suspects to be tracked on the CCTV footage, and crime scenes to be monitored in real time. Amidst this expansion, there is an increasing need for discussions to protect privacy. The need for privacy control is emphasized as data collection, retention, and utilization capabilities resulting in losing control over individual’s own information. The value and importance of personal data have been changed from the previous, and government surveillance issues arises as vast quantities of personal data being stored and easily shared. The need for government data access for various purposes and storage of data on a large scale may lead to the privacy right and the infringement of informational self-determination. In a situation where the use of CCTV information is allowed and gradually expanding, it is difficult to evaluate that legal grounds for controlling the actions of government agencies or guaranteeing the rights of individual subjects are sufficient. This paper aims to examine the current status of data collection by government institutions, especially the institutional basis for the use of CCTV and video information collection by government agencies, and problems with the system regarding personal data protection.

The Ethics of the Right to Informational Self-Determination in the context of Algorithmic Decision-Making (ADM) – A holistic assessment

The Ethics of the Right to Informational Self-Determination in the context of Algorithmic Decision-Making (ADM) – A holistic assessment

Study of the factors influencing the use of MyData platform based on personal health record data sharing system

BackgroundThe application of telemedicine and electronic health (eHealth) technology has grown in importance during the COVID-19 pandemic, and a new approach in personal data management and processing MyData, has emerged. Data portability and informational self-determination are fundamental concepts of MyData. This study analysed the factors that influence acceptance of the MyData platform, which, reflects the right to self-determine personal data.MethodsThe study involved participants having experience using the MyData platform, and the key factors of the unified theory of acceptance and use of technology were used in the research model (performance expectancy, effort expectancy, social influence, facilitation condition and behavioural intention to use). The questionnaire comprided 27 items, and system usage log data were used to confirm that behavioural intention to use affected actual use behaviour through structural equation modeling.ResultsIn total, 1153 participants completed the survey. The goodness of fit in the structural equation model indices indicates that the data fit the research model well. Performance expectancy, social influence, and facilitating conditions had direct effects on behavioural intention to use. We used system usage log data to confirm that behavioural intention to use positively affected actual use behaviour. The impact of the main factors in the unified theory of acceptance and use of technology was not moderated by age or gender, except for performance expectancy.ConclusionsThis study is the first to examine the factors influencing the use of the MyData platform based on the personal health record data sharing system in Korea. In addition, the study confirmed the use behaviour of the MyData platform utilising the system’s actual usage log for each function and analysing the effect of the intention of use on actual use. Our study serves as a significant foundation for the acceptance of data portability and sharing concepts. It also lays the foundation for expanding the data economy and ecosystem in the pandemic era.

Toward an architecture to improve privacy and informational self-determination through informed consent

PurposeMost developed countries have enacted privacy laws to govern the collection and use of personal information (PI) as a response to the increased misuse of PI. Yet, these laws rely heavily on the concept of informational self-determination through the “notice” and “consent” models, which is deeply flawed. This study aims at tackling these flaws achieve the full potential of these privacy laws.Design/methodology/approachThe author critically reviews the concept of informational self-determination through the “notice” and “consent” model identifying its main flaws and how they can be tackled.FindingsExisting approaches present interesting ideas and useful techniques that focus on tackling some specific problems of informational self-determination but fail short in proposing a comprehensive solution that tackles the essence of the overall problem.Originality/valueThis study introduces a model for informed consent, a proposed architecture that aims at empowering individuals (data subjects) to take an active role in the protection of their PI by simplifying the informed consent transaction without reducing its effectiveness, and an ontology that can partially realize the proposed architecture.

How to protect privacy in a datafied society? A presentation of multiple legal and conceptual approaches

The United Nations confirmed that privacy remains a human right in the digital age, but our daily digital experiences and seemingly ever-increasing amounts of data suggest that privacy is a mundane, distributed and technologically mediated concept. This article explores privacy by mapping out different legal and conceptual approaches to privacy protection in the context of datafication. It provides an essential starting point to explore the entwinement of technological, ethical and regulatory dynamics. It clarifies why each of the presented approaches emphasises particular aspects and analyses the tensions that arise. The resulting overview provides insight into the main strengths and limitations of the different approaches arising from specific traditions. This analytic overview therefore serves as a key resource to analyse the usefulness of the approaches in the context of the increasing datafication of both private and public spheres.Specifically, we contrast the approach focusing on data subjects whose data are being ‘protected’ with others, including Fair Information Practice Principles, the German right to ‘informational self-determination’, and the South American ‘habeas data’ doctrine. We also present and contrast emerging approaches to privacy (differential privacy, contextual integrity, group privacy) and discuss their intersection with datafication. In conclusion, we put forth that rather than aiming for one single solution that works worldwide and across all situations, it is essential to identify synergies and stumbling blocks between the various regulatory settings and newly emerging approaches.

Closing the Gaps in Patients’ Data Protection Rights: A Glance Into the Future with a Dutch Case Study

This article discusses the legislative framework of data protection and health law in today’s world where the individual has become an active player in governing his health. The individual’s protection within the traditional treatment relationship between the care provider and the care receiver is subject to substantial changes amidst technological and health innovations. The traditional, clinical health setting is complemented with actors from a non-clinical background, such as commercial companies that provide healthcare deliverables. New mechanisms for data protection and safeguarding data subject’s rights are required. The European Health Data Space Regulation is a good starting point, since it enables individuals to obtain a copy of their health data, to share and rectify these. However, we observe three gaps in the individual’s data protection and his position vis-à-vis commercial companies, i.e. in the domain of legislation, governance and in the interaction between the care provider and care receiver. The individual plays a role as a patient, but also as an individual with a particular lifestyle who uses wearables and buys commercial DNA tests. The individual’s monitoring of his own health with devices does not necessarily fall within the scope of existing European and national legislation on data protection and health. Keywords: European Health Data Space | fundamental rights | individual and informational self-determination | technological innovations