National Data Protection Authorities Research Articles

Od zasady do praktyki. Wyzwania dotyczące ogólnounijnej realizacji „prawa do bycia zapomnianym” po sprawie Google przeciwko CNIL

While scholarly attention largely gravitates towards the debate on regional versus global delisting under EU law, this paper scrutinizes the Google v CNIL ruling concerning the conditions and methods of EU-wide delisting in light of the preliminary reference questions posed. The focus lies in the intricate analysis absent from the dispositif, which leaves many complexities to the evaluation of the national data protection authorities and the courts, and, concerningly, to the solely discretion of the search engine operators. Nuanced analyses absent from the dispositif address the crucial aspects in defining the territorial scope such as the role of geo-blocking, the possible public interest variations within the EU and the regulatory cooperation frameworks, particularly in light of Google’s standard delisting procedure. Furthermore, the research highlights the concerns about the varying levels of protection for EU citizens, contrasting the delisting procedure before the search engine operator and the formal proceedings involving the data protection authorities and the courts. By exploring a significant decision by the Belgian data protection authority, the author illustrates the possibilities for regulatory cooperation to achieve a cohesive and comprehensive approach to EU-wide delisting. The author advocates for regulatory transparency in this legal area and explicit guidance from the European Data Protection Board toward ensuring that the “right to be forgotten” is applied consistently and in a manner that genuinely protects individuals’ rights across the EU.

Inter-agency coordination and digital platform regulation: lessons from the Whatsapp case in Brazil

ABSTRACT This article examines the drivers and obstacles behind the first large-scale cross-agency coordination in digital platform regulation in Brazil. Drawing on elite semi-structured interviews and document analysis, it investigates how the Brazilian National Data Protection Authority (ANPD) and other federal agencies worked together to scrutinize the legal implications of WhatsApp’s privacy policy and terms of service changes announced in January 2021, including concerns regarding transparency, legitimate interest, and consent. The study reveals that while formal institutional arrangements such as cooperation agreements existed, informal factors like personal relationships played a significant role in facilitating coordination. However, capacity and autonomy issues within the involved bodies hindered more substantive coordination and may explain divergences in the interpretation of data protection legislation. The findings emphasize the importance of enhancing mechanisms for inter-agency coordination in digital platform regulation, especially considering capacity and autonomy issues within and across regulatory ecosystems, offering insights to other jurisdictions, particularly for developing countries facing public governance constraints similar to those experienced in Brazil.

Know their Customers: An Empirical Study of Online Account Enumeration Attacks

Internet users possess accounts on dozens of online services where they are often identified by one of their e-mail addresses. They often use the same address on multiple services and for communicating with their contacts. In this paper, we investigate attacks that enable an adversary (e.g., company, friend) to determine (stealthily or not) whether an individual, identified by their e-mail address, has an account on certain services (i.e., an account enumeration attack ). Such attacks on account privacy have serious implications as information about one’s accounts can be used to (1) profile them and (2) improve the effectiveness of phishing. We take a multifaceted approach and study these attacks through a combination of experiments (63 services), surveys (318 respondents), and focus groups (13 participants). We demonstrate the high vulnerability of popular services (93.7%) and the concerns of users about their account privacy, as well as their increased susceptibility to phishing e-mails that impersonate services on which they have an account. We also provide findings on the challenges in implementing countermeasures for service providers and on users’ ideas for enhancing their account privacy. Finally, our interaction with national data protection authorities led to the inclusion of recommendations in their developers’ guide.

CONSENT IN THE DECISION-MAKING PRACTICE OF THE SLOVAK DPA

Consent in personal data regulation presents one of the legal bases that legitimizes personal data processing realised by the controller. Despite the controller’s frequent referral to consent as a legal basis for such processing, the fulfilment of legal conditions for valid consent provision can prove challenging to many controllers. In this regard, the paper examines the existing decision-making practice of the national data protection authority – the Office for Personal Data Protection of the Slovak Republic – concerning the deficiencies regarding data subject’s consent provision that resulted in the initiation of administrative proceedings before this office and in the issuance of sanctions for the infringement of the applicable regulation on consent provision.

DPA powers toward effective and transparent GDPR enforcement: the case of Croatia

The paper identifies and explores the solutions to certain underdeveloped and lacking legislative solutions and issues in the practice of the national data protection authority (CPDPA), which affect the aims of effective GDPR enforcement and transparency. On a broader level it contributes to the EDPB initiatives toward the harmonization of certain procedural provisions and overcoming the differences in the conduct of cross-border proceedings. Most of the research considerations are supported by a study of the case that received much public attention and involves the first administrative fine in Croatia. Arguments are provided toward prescribing time limits for the resolution of data protection administrative disputes and toward appropriate addressal of the closely related issues of publishing CPDPA rulings, with the concerns of their accessibility worked out through a comprehensive policy. This includes also the particular considerations on the corrective measures issued to public authorities, which cannot be fined, and on the underdeveloped fine-limitation rule for certain other public sector bodies. Public interest concerns should be closely examined in the assessment of communicating information on relevant data protection cases and CPDPA decisions, as well as the interrelation with the freedom of information requests. The publishing of non-anonymous final rulings should be recognized as a form of additional sanction and power of the data protection authority and as such further explored also at the EU level. In terms of more efficient CPDPA functioning it is argued that the prescribed time limits for issuing expert opinions are extended. At the same time resources should be utilized toward better inclusivity and accessibility of relevant information, primarily rulings, on its website.

Alternatives for an adequate structuring of the national data protection authority (ANPD) in its independent profile: proposals to overcome the technological challenges in the age of digital governance.

This article aims to identify the necessary elements for the independent and democratic structuring of the National Data Protection Authority (ANPD) in its definitive legal profile, as an autarchy under aspecial regime, so that it can achieve the technical and decision-making autonomy that it was granted by the Brazilian Data Protection Law (LGPD). Drawing on documentary research and findings on similar foreign authorities, it is possible to point out, as apartial result of this analysis, the insufficiency of entrusting such amission to its recent formal separation from the Direct Administration, being also possible to conclude that the success of the state modernization in the Digital Age will depend, to alarge extent, on intertemporal choices able to direct the ANPD towards astructure attentive to technological innovations. To this end, the training and continuing education of the institution's staff, as well as possible agreements to be signed by the entity, such as the alternatives sought by the Courts of Accounts in the field of information and communications technology (ICT), emerge as adetermining factor.

Data Protection in Healthcare-Integrated Biobanking

ABSTRACTIntroductionDevelopment of personalized medicine depends on research using clinical biospecimens and data. This interface between clinical care and translational research is increasingly served by hospital-integrated biobanks; yet their implementation is hampered by complex data regulations.MethodsA generic data protection concept with a decision and application matrix was developed addressing five criteria: (1) organizational integration into university medicine, (2) biobank governance, (3) ethical and legal aspects, (4) specifications of the BSI (Bundesamt für Sicherheit in der Informationstechnik [Federal Office for Information Security]), and (5) FAIR (findable, accessible, interoperable, and reusable) principles for research data. Applicability was tested for the highest complexity level at Campus Lübeck.ResultsThe data protection concept was approved by the local ethics committee as well as local and national data protection authorities. The concept allows an automated research-guided patient recruitment and data protection-compliant information technology (IT) in connection to national and international research networks. It ensures university and hospital conformity with the EU Data Protection Regulation. Consent behavior of 277,766 patients over five years proved routine practicability (error rate 0.0013%; withdrawals 0.09%). Clinical staff obtained higher consent rates (85.6%) compared with consent rates for use of data only at central patient admission (56.1%); even though consents in central patient admission increased constantly during observation time.ConclusionThe generic data protection concept can legitimately enable personalized medicine through biobanking in the clinical context.

Politika prava na privatnost i zaštita podataka o ličnosti na internetu - studija slučaja Turske

The right to privacy and the personal data protection are two highly intertwined rights. In the era of globalization, the ever more extensive and widespread use of communication technologies, the challenge of protecting these rights from abuse in non-democratic states arises. The analysis of the legislation of the Republic of Turkey shows that Turkish state has formally regulated the area of protection of the right to privacy and protection of personal data on the Internet, while practice shows many abuses and violations. The development of the Internet and other instruments of communication has enabled the authoritarian and undemocratic regime to collect personal data, use it for the purpose of dealing with political dissidents and consequently violate the general principles of the rule of law. The political changes that followed the referendum held in 2017. meaningfully contributed to the growth of the president's power. These constitutional changes resulted in a change in the share of power in the decision-making process regarding the selection of members of the National Data Protection Authority. In this sense, the Council of Ministers was completely squeezed out of the membership selection process, and the influence of the president was doubled. Referring to the existing legislation, the state, under the guise of protecting national interests and national security, violated discussed rights. The same excuse was used for the purpose of arresting political dissidents and unfit journalists, which generally led to a large reduction of the rule of law in this country. The main results and conclusions arising from this article refer to the recognition of the trend of general reduction and violation of mentioned rights, which is connected and explained by constitutional changes and implementation of the adopted legislation.

Personal data protection and State surveillance: the risks of digital discrimination and Federal Supreme Court’s vision

This article proposes an examination of the changes that have taken place in the organization of society in the face of the advancement of new mechanisms of monitoring and state surveillance, with the objective of identifying the dangers arising from them and the risks that a new digital discrimination entails for fundamental rights. Based on a dialectical analysis, we move on to the study of the necessary transformations of consent, revisiting the classic civil law institute, now in the wake of the new General Law for the Protection of Personal Data (Law nº. 13.709/2018). Subsequently, we move on to the study of the impact brought about by the decision rendered by the Federal Supreme Court in the legal analysis of ADI (Direct Action of Unconstitutionality) nº. 6.389/DF, which deemed the provisions contained in Provisional Measure nº 954/2020 and recognized the existence, in our national legal system, of the fundamental right to informative self-determination that, with the approval of EC (Constitutional Amendment) 115/22, was inserted in art. 5, LXXIX as a fundamental right to personal data protection. Finally, it concludes by the necessary structuring of the National Data Protection Authority (ANPD), provided for in article 55-A of the LGPD (General Law for the Protection of Personal Data), representing its creation as an instrument that materializes the objective dimension of this fundamental right.

Validity of algorithms for identifying mild traumatic brain injury in the French national emergency department database OSCOUR: a retrospective multicentre validation study protocol

IntroductionThe French emergency department (ED) surveillance network OSCOUR transmits data on ED visits to Santé publique France (the national public health agency). As these data are collected daily and are...

The Fundraiser's Transfer of Personal Data from the European Union to the United States in Context of Crowdfunding Activities

European start-up companies must overcome more ‘transfer hurdles’ when personal data is transferred from the European Union to the US (United States of America) as part of crowdfunding campaign activities. Transfer of personal data is commonly not associated with (small scale) crowdfunding activities. However, the strict rules of the EU GDPR (European General Data Protection Regulation) on safeguarding personal data apply to all companies when data is transferred from the EU to the US - regardless the size of the business.
 This article identifies exchange of personal data that takes place between primarily fundraiser and crowdfunding service provider in different steps of fundraising campaigns. The framework for rewardbased crowdfunding for goods production that is provided by the US based Indiegogo platform is used as example and context. The article highlights by way of example the obligations that must be met by European fundraisers as "data controllers" when personal data is transferred to Indiegogo. No easy solutions are provided by either European Union or national data protection authorities on how to establish an adequate level of personal data protection. Paradigms on how to secure transfer of personal data to third countries are available in form of so-called standard contractual clauses, but still conditions for transfer of personal data from Europe to the US are hard to comply with. Apart from entering into an inter partes agreement on use of standard contractual clauses with the crowdfunding platform provider, a European fundraiser must furthermore make a so-called "transfer impact assessment" to ensure that third party access to personal data is avoided. In the case of transfer of personal data from the EU to the US the fundraiser must consider using encryption of data as a "supplementary measure" to block third party access. Encryption of data is however not suitable for exchange of data in a dynamic crowdfunding campaign so other means for protection of data must be found and applied.
 The reason and explanation for making data transfers from the EU to the US that hard for e.g., fundraisers are thus to be found at interstate level in the relation between the EU and the US. According to EU law, more specifically the GDPR and several of the provision of the Charter of Fundamental Rights of the European Union, US security legislation authorises a disproportionate access for US intelligence services to citizens' personal data. A solution on manageable transfer of personal data from the EU to the US may be found before the end of 2022, since a new TADP (Trans-Atlantic Data Privacy Framework) is currently being negotiated between EU and US at top politician level. However, the implementation of the TADP may take som time since the EU legislative framework needs adjustments to make the new transfer possibilities operational.

Cross-sectional nationwide mixed-methods population-based study of living conditions, and identification of sexual and fertility profiles among young women after breast cancer in France: the Candy study protocol

IntroductionAt the end of the treatment, many young breast cancer (BC) survivors face difficulties related to fertility and sexuality, mainly due to the side effects of treatment. Integrating patient needs...

Administrative Independence in the Nordic States

EU law increasingly requires that the Member States establish independent administrative bodies in various fields. Examples include market supervision, non-discrimination, and data protection. This article addresses the realisation of such requirements in the five Nordic states. The West Nordic systems of Denmark, Iceland, and Norway feature a traditional hierarchic organisation of the administrative authorities under the relevant ministries, albeit with examples of independent administrative bodies. Contrastingly, the East Nordic systems of Finland and Sweden have a long-standing constitutional tradition of organising the entire state administration with a considerable degree of independence from the governmental level. The study of the constitutional frameworks and traditions contributes to understanding the impact of EU law requirements on independence in different national systems. The relatively uncritical reception of requirements on administrative independence in the Nordic states may be explained by both the practical orientation of Nordic legal thinking and the long-standing existence of arrangements of independent authorities in the legal systems. This attitude is contrasted with the sceptical views on administrative independence in continental Europe, especially Germany, as exemplified by Case C-518/07 Commission v Germany (on independent national data protection authorities). Also the Nordic experiences, however, highlight the tension between the ideals of total independence and the needs for the authorities to be linked to, and funded by, the public sector. The legal comparison may help to understand the impact of EU law and reveal the various ‘Europeanisations’ of general administrative law, given the national preconditions.

Trends in Interpretation of EU Data Protection Authorities of Cybersecurity Requirements Under the GDPR

One of the main legal requirements for the adopting the GDPR was the technical and organizational security requirements, alongside the transparency and purpose limitation principles. The wide wording mentioned by the GDPR in terms of state-of-the-art security measures has given rise to a series of interpretations both in literature and by the data controllers and data processors. The manner in which national data protection authorities interpret this wording on a case-by-case basis is a good indicator in terms of interpretation, as the authorities look into the specific use case requiring preventive security measures. Thus, this research paper brings additional clarity in the interpretation of this legal requirement in terms of the risks and damages considered relevant for the specific data breach or lack of proper legal requirement implementation, given publicly available information in this respect. Further, the research paper highlights the number of use cases analyzed by different national data protection authorities and the views of each national data protection authority.

Data protection-compliant broad consent for secondary use of health care data and human biosamples for (bio)medical research: Towards a new German national standard

BackgroundThe secondary use of deidentified but not anonymized patient data is a promising approach for enabling precision medicine and learning health care systems. In most national jurisdictions (e.g., in Europe), this type of secondary use requires patient consent. While various ethical, legal, and technical analyses have stressed the opportunities and challenges for different types of consent over the past decade, no country has yet established a national consent standard accepted by the relevant authorities. MethodsA working group of the national Medical Informatics Initiative in Germany conducted a requirements analysis and developed a GDPR-compliant broad consent standard. The development included consensus procedures within the Medical Informatics Initiative, a documented consultation process with all relevant stakeholder groups and authorities, and the ultimate submission for approval via the national data protection authorities. ResultsThis paper presents the broad consent text together with a guidance document on mandatory safeguards for broad consent implementation. The mandatory safeguards comprise i) independent review of individual research projects, ii) organizational measures to protect patients from involuntary disclosure of protected information, and iii) comprehensive information for patients and public transparency. This paper further describes the key issues discussed with the relevant authorities, especially the position on additional or alternative consent approaches such as dynamic consent. DiscussionBoth the resulting broad consent text and the national consensus process are relevant for similar activities internationally. A key challenge of aligning consent documents with the various stakeholders was explaining and justifying the decision to use broad consent and the decision against using alternative models such as dynamic consent. Public transparency for all secondary use projects and their results emerged as a key factor in this justification. While currently largely limited to academic medicine in Germany, the first steps for extending this broad consent approach to wider areas of application, including smaller institutions and medical practices, are currently under consideration.

The gdpr’s Application and Supervisory Authorities’ Remit on National Parliaments’ Data Processing in Parliamentary Core Activities

Abstract Since the entry into force of the gdpr, national Parliaments within the EU have adopted varying legal opinions on its material scope of application and, inter alia, (national) data protection authorities’ supervisory jurisdiction concerning data processing in parliamentary core areas. This article summarizes the findings of a European Centre for Parliamentary Research and Documentation (ecprd) network survey conducted in early 2021 – that is, after the cjeu’s decision Land Hessen of 9 July 2020, C-272/19. It shows that the judgement had an ambiguous effect on parliaments’ legal viewpoints and briefly points out key issues influencing the minority opinion – amongst them the Austrian Parliament’s position – that parliamentary core activities’ data processing is exempted from the gdpr’s scope of application.

A glass half full look at the Brazilian Data Protection Authorithy

In any data protection system, the regulatory institution – called the National Data Protection Authority – plays a substantial role. In Brazil, this institution was created in a different way from what had originally been expected. Therefore, the legal literature started to criticize it and to doubt its ability to satisfactorily exercise its regulatory powers. Even before the Brazilian general data protection act came into effect, a major opinion was formed around the idea that, in its current structure, the Brazilian Data Protection Authority (BDPA) would fail. The author of this paper intends to provide a different view on the subject. Amid the uncertainty, he opted for looking at the glass “half full” instead of seeing it “half-empty”. He highlights that even in its current format the BDPA is remarkable progress and could be very useful to the Brazilian personal data protection system. After all, more important than the structure of the regulatory body are its capacities and how they will be exercised in practice. To provide this text with a scientific basis, the author conducted a structuralist analysis drawing a comparison between the Brazilian Data Protection Authority and the equivalent institution in Uruguay (URCDP), which has a very similar structure and has been carrying out its duties with success for over a decade. In the end it was possible to demonstrate that the initial structure of the BDPA is not a barrier that could prevent it from carrying on its duties. Therefore, it is prudent to trust the BDPA and monitor how it will operate.

The GDPR enforcement fines at glance

The General Data Protection Regulation (GDPR) came into force in 2018. After this enforcement, many fines have already been imposed by national data protection authorities in Europe. This paper examines the individual GDPR articles referenced in the enforcement decisions, as well as predicts the amount of enforcement fines with available meta-data and text mining features extracted from the enforcement decision documents. According to the results, three articles related to the general principles, lawfulness, and information security have been the most frequently referenced ones. Although the amount of fines imposed vary across the articles referenced, these three particular articles do not stand out. Furthermore, a better statistical evidence is available with other meta-data features, including information about the particular European countries in which the enforcements were made. Accurate predictions are attainable even with simple machine learning techniques for regression analysis. Basic text mining features outperform the meta-data features in this regard. In addition to these results, the paper reflects the GDPR’s enforcement against public administration obstacles in the European Union (EU), as well as discusses the use of automatic decision-making systems in judiciary.

REJECTING THE TRANSATLANTIC OUTSOURCING OF DATA PROTECTION IN THE FACE OF UNRESTRAINED SURVEILLANCE

On 16 July 2020, the Grand Chamber of the Court of Justice of the European Union (‘CJEU’), in a departure from the Advocate General’s (‘AG’) Opinion, invalidated the the key mechanism for EU-United States data transfers, Privacy Shield for not affording ‘essentially equivalent’ protection to that provided under the EU legal order for personal data transferred to the US. The Court upheld the validity of the SCC for international data transfers, ruling that the National Data Protection Authorities (‘DPAs’) must take action where these clauses do not provide ‘essentially equivalent’ protection to EU law. The Schrems II judgement will have significant implications for many areas of EU law and policy, transatlantic relations and global data governance more generally. It will impact the EU-US data transfers, data transfers to third countries beyond US, including the post-Brexit UK, because SCCs are relied on by 88 per cent of EU companies transferring data outside the EU. Following the Snowden revelations in 2013, the CJEU has developed a powerful body of jurisprudence which rejects the transatlantic outsourcing of data protection without adequate safeguards. Schrems II reasserted the fundamental role of data protection in the EU legal order and transatlantic relations, and emphasised the need for EU to suspend, limit, or even block data transfers to countries where fundamental rights are not protected. Full implications of Schrems II are yet to be seen but the effects will be felt for many years to come.

The ‘right to be forgotten’ beyond the EU: an analysis of wider G20 regulatory action and potential next steps

ABSTRACT It has been increasingly asserted that data protection can and should enable individuals to exert some control at least ex post over online data dissemination. Notwithstanding contrary suggestions, therefore, the ‘right to be forgotten’ is not solely an EU phenomenon. Post-2014 the majority of the eight national Data Protection Authorities (DPAs) s operating in non-EU G20 jurisdictions with established data protection legislation have sought to implement such a right through guidance and, in three cases, also enforcement. These jurisdictions span three regions and encompass jurisdictions such as Australia and Canada with a similar outlook to the EU. In light of the profoundly globalised nature of the internet, greater transnational coordination would be valuable. Whilst the G20 is itself ill-suited to this task, the pan-regional Data Protection Convention framework overseen by the Council of Europe as well as the Global Privacy Assembly could play an important role.