Processing Of Personal Data Research Articles

Principles of processing personal data of minors in educational institutions

Principles of processing personal data of minors in educational institutions

Traditional Quizzing with a Twist: Involving University Students in the Development Process

Quizzes have been used for educational purposes for many years. Mainly it has been digital quizzes like Kahoot or ZippyGo. However, there is an ongoing debate on the security of students’ data. As the university cannot be responsible for what is stored in computers outside of Norway and at the same time paying attention to the General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is a critical framework for data privacy across Europe, including the UK, Norway, and the EU (ICO, 2024). The GDPR came into force in 2018, agreeing data privacy laws across all member states. It applies to any organization processing personal data of individuals in the EU, regardless of the company's location. The regulation grants rights such as data access, correction, and deletion, and imposes strict penalties for non-compliance (ICO, 2024). As part of the European Economic Area (EEA), Norway implements the GDPR similarly to EU countries. The regulation applies to Norwegian businesses processing data of EU citizens, ensuring that data privacy standards are uniform across the region (Team, 2016; ICO, 2024). Therefore, utilizing digital games have become increasingly difficult. The students, however, are missing the gaming, and the lecturers are missing the opportunity to utilize games-based learning techniques. This leads the lecturer in the research methodology course to “Go Native” and turn to the “old style” analogue quizzing. However, previous research showed that students are not only engaged in the solving of the quizzes, but also, they engage in the development of the questions and answers for the quizzing, i.e. ‘co-creating’. This paper will present a pilot study of a paper-based quiz developed by university students, and their reactions from this. Through informal interviews, data was collected to establish how they felt about this “old school” quiz type of learning after having had several different digital tools for educational games. In this paper, and based on our previous research findings (from the informal interviews with the students), we will develop this further into a digital but low-tech version of a quiz game; it should be still both fun and educational.

Data protection legislation in Africa and pathways for enhancing compliance in big data health research

BackgroundThe increasing availability of large volumes of personal data from diverse sources such as electronic health records, research programmes, commercial genetic testing, national health surveys and wearable devices presents significant opportunities for advancing public health, disease surveillance, personalized medicine and scientific research and innovation. However, this potential is hampered by a lack of clarity related to the processing and sharing of personal health data, particularly across varying national regulatory frameworks. This often leaves researcher stakeholders uncertain about how to navigate issues around secondary data use, repurposing data for different research objectives and cross-border data sharing.MethodWe analysed 37 data protection legislation across Africa to identify key principles and requirements for processing and sharing of personal health and genetic data in scientific research. On the basis of this analysis, we propose strategies that data science research initiatives in Africa can implement to ensure compliance with data protection laws while effectively reusing and sharing personal data for health research and scientific innovation.ResultsIn many African countries, health and genetic data are categorized as sensitive and subject to stricter protection. Key principles guiding the processing of personal data include confidentiality, non-discrimination, transparency, storage limitation, legitimacy, purpose specification, integrity, fairness, non-excessiveness, accountability and data minimality. The rights of data subjects include the right to be informed, the right of access, the right to rectification, the right to erasure/deletion of data, the right to restrict processing, the right to data portability and the right to seek compensation. Consent and adequacy assessments were the most common legal grounds for cross-border data transfers. However, considerable variation exists in legal requirements for data transfer across countries, potentially creating barriers to collaborative health research across Africa.ConclusionsWe propose several strategies that data science research initiatives can adopt to align with data protection laws. These include developing a standardized module for safe data flows, using trusted data environments to minimize cross-border transfers, implementing dynamic consent mechanisms to comply with consent specificity and data subject rights and establishing codes of conduct to govern the secondary use of personal data for health research and innovation.

Legal aspects of children’s privacy on the Internet: balance between protection and freedom

The article is devoted to the study of legal aspects of protection of personal data of minors in the digital environment. In today’s world, the development of information technologies and the widespread use of the Internet create new challenges for the legal system, in particular with regard to the protection of personal data of children and adolescents. The article analyzes national and international legislation regulating the protection of personal data of minors, in particular the provisions of the General Data Protection Regulation (GDPR) and Ukrainian legal acts. Different approaches to giving consent to the processing of personal data by minors are highlighted, in particular, the role of parents or legal representatives in this process. Existing methods of ensuring consent, such as double opt-in, as well as challenges associated with the practical implementation of these methods are considered. The article also outlines the risks children face online, including illegal data collection, including cyberbullying, phishing, child trafficking and other threats. The need to implement effective legal mechanisms for the protection of children on the Internet, which ensure both safety and freedom of information activity, is emphasized. Ensuring the security of personal data of minors in the digital environment should become one of the priority tasks of modern legal regulation, which requires a comprehensive approach and integration of the best international practices. The author concludes that the effective protection of children’s personal data requires a balanced approach that would combine a high level of security with respect for the rights and freedoms of the child in the digital environment. Increasing the level of digital literacy among children and their parents, as well as creating an appropriate legal infrastructure, are important factors that will contribute to reducing risks in the digital environment. The integration of such approaches into the national legal system should become a priority to ensure the sustainable development of the information society. Successful implementation of these initiatives will not only reduce potential threats to children, but also contribute to the formation of a safe and responsible information space for future generations.

Laparoscopic Access in Radical Surgical Treatment of Complicated Gastric Cancer: a Single-Center Experience

Over the past decades, there has been an active introduction of minimally invasive surgical technologies in the treatment of various diseases, including gastric cancer. In Asian countries and Europe, laparoscopic gastrectomy is an alternative to open gastrectomy for early gastric cancer, with a tendency to displace the latter. In the Russian Federation, laparoscopic gastrectomy is performed in a few specialized centers. From 2013 to 2022, the surgeons of our Center treated 141 patients diagnosed with gastric cancer at different stages (64 men, 39 women, mean age of 60.5±10 years). Of these, 52 patients (50.5%) underwent open surgeries (group I), 51 (49.5%) — laparoscopic surgeries (group II). The study included patients diagnosed with gastric cancer complicated by bleeding or gastric outlet/cardioesophageal junction obstruction, over 18 years of age, who signed consent for the processing of personal data and inclusion of their clinical data in the research and underwent surgical treatment. We analyzed such parameters as the duration of surgical intervention and the duration of hospital stay, the rates of hospital/relapse-free 2-year survival, and uncomplicated postoperative period. Laparoscopic-assisted surgeries lasted longer; however, due to more precise technique and better visualization of anatomical structures, there was a smaller volume of intraoperative blood loss. During laparoscopic-assisted radical gastrectomy, it is possible to perform more precise lymph node dissection, increase the number of harvested lymph nodes and, thus, increase the probability of detecting lymph nodes with metastases; which, in turn, has a direct impact on increasing the 2-year relapse-free and 2-year overall survival of patients. There was no significant difference in the incidence or severity of postoperative complications and mortality. These data are an important indicator of the effectiveness of the minimally invasive surgical method of treatment, which indicates greater safety of the laparoscopic method compared to intervention from laparotomy access.

What militaries need to know about data protection and the right to digital privacy/private life

Abstract With the advent of socio-technical systems that gather and process personal data, the capacity to identify and even locate people in an automated fashion has dramatically increased. This article discusses what militaries need to know about data protection and the right to digital privacy/private life when personal data is processed. The focus in this discussion is on sensitive data that makes individuals identifiable. It is here argued that the right to data protection and the right to digital privacy/private life are distinctive and separate rights and should be treated as such, despite some overlaps. Although the law of armed conflict approaches processing of sensitive data in a topical manner, it remains firm on the delimitation between what is permissible and what becomes unlawful when it comes to processing data. This article illustrates that elements of both data protection and protection of the right to privacy/private life can be traced in the law of armed conflict. In fact, both rights remain distinctive also in times of armed conflict and must be separately protected through obligations of result as well as obligations of conduct.

The Privacy/Antitrust Curse: Insights from GDPR Application in Competition Law Proceedings

In response to the emergence of large online platforms whose business model revolves around the collection and processing of personal data, it is usually suggested that competition and data protection are synergistic, hence requiring an integrated approach. In this respect, Europe represents the testing ground for evaluating how privacy breaches may inform antitrust investigations. Indeed, the General Data Protection Regulation (GDPR) on the one side and the German Facebook antitrust decision on the other side are considered the benchmarks of this new stance aimed at linking market power and data power. This paper tests the concrete viability of such an approach, analyzing how data protection rules and principles have been applied in antitrust proceedings by the European Commission and national competition authorities. Notably, the paper aims at demonstrating the fallacy of the narrative which describes the relationship between privacy and antitrust in terms of synergy and complementarity. Furthermore, the paper maintains that the principles recently affirmed by the European Court of Justice in Meta do not appear conclusive in addressing the issue. The strategic use of privacy as a business justification to pursue anticompetitive advantages currently addressed in the numerous Apple ATT investigations indeed shows the tension between these areas of law. Therefore, rather than strengthening the antitrust enforcement against gatekeepers and their data strategies, the inclusion of privacy harms in antitrust proceedings turns out to be a potential curse for competition authorities, providing players with an opportunity for regulatory gaming to undermine the antitrust enforcement. JEL Codes: D83, K21, L12, L4

Modelling user notification scenarios in privacy policies

The processing of personal data gives a rise to many privacy concerns, and one of them is to ensure the transparency of data processing to end users. Usually this information is communicated to them using privacy policies. In this paper, the problem of user notification in case of data breaches and policy changes is addressed, besides an ontology-based approach to model them is proposed. To specify the ontology concepts and properties, the requirements and recommendations for the legislative regulations as well as existing privacy policies are evaluated. A set of SPARQL queries to validate the correctness and completeness of the proposed ontology are developed. The proposed approach is applied to evaluate the privacy policies designed by cloud computing providers and IoT device manufacturers. The results of the analysis show that the transparency of user notification scenarios presented in the privacy policies is still very low, and the companies should reconsider the notification mechanisms and provide more detailed information in privacy policies.

Prawne i praktyczne aspekty dotyczące przetwarzania danych osobowych w procesie rekrutacji

The subject of this article is to identify good practices, occurring risks and irregularities in the processing of personal data of job candidates as part of the employee recruitment process and to develop principles for verifying the correctness of the functioning of this process as a tool supporting the audit task. The recruitment process and the associated staff turnover is one of the key areas where the employer should ensure the organizational and legal security of the processed personal data, which undeniably affects its professionalism and the perception of external customers, such as job candidates. The uniformity of the legality of this process is influenced by both national labor laws and EU regulations. The key principles to ensure the compliance of processed data with the requirements of labor laws in the recruitment process are the principle of data minimization and storage limitation, as well as the processing of personal data of job candidates by persons only authorized by the employer, who have committed themselves to the principles of confidentiality and impartiality. The above is also related to the implementation of the controller’s information obligations to job candidates and their correlation with the actual processing of personal data by the controller and its authorized personnel.

The Digital Personal Data Protection Act, 2023: An Ambitious Government Step Towards Ensuring Its Wide Reach

This article is divided into three major segments. The initial section offers a concise overview of the requisite data protection laws in India, aiming to regulate and oversee the collection, processing and utilisation of personal data. The second section delves into an in-depth examination of the Digital Personal Data Protection Act, 2023 (the Act), accompanied by illustrative examples and its scope of applicability. The concluding part presents an analysis of the Act, focusing on its efforts and challenges in safeguarding wide reach as well as its implications for rural populations.

Transparency and consent as the main principles of personal data protection in Ukraine

The rapid digitization of the modern world has led to an increase in the collection and processing of personal data. The principles of transparency and consent have become crucial for citizens to understand how their data is being used and to be able to give their voluntary consent to its processing. Ukraine is actively adapting its legislation to EU standards in the field of personal data protection. In particular, the General Data Protection Regulation (GDPR) affects approaches to data collection and processing. Examining transparency and consent in the context of these changes can help identify which aspects of the law need special attention. Citizens are becoming increasingly cautious about who they trust with their data. This article analyzes and evaluates the role and impact of the principles of transparency and consent on the effective mechanism of personal data protection in Ukraine, taking into account modern technological and legislative challenges. Studying these principles demonstrates their importance and relevance in today’s digital society. The principle of transparency determines the need for accessible and understandable information for data subjects regarding the processing of their data. Openness is a fundamental requirement for maintaining trust between organizations and citizens. Providing the ability to control and regulate their data allows data subjects to play a more active role in the processing and use of their personal data. The principle of consent, in turn, emphasizes the voluntary and informed nature of consent to data processing. The consent of the data subject determines the basis for the legal processing of personal data, ensuring harmony between the rights of citizens and the interests of organizations. As technology advances and legislation changes, transparency and consent become even more important aspects. They help build trust between organizations and citizens, ensure responsible use of personal data, and empower individuals to control their own information.

Navigating GDPR Compliance: The Intersection of Data Governance, Accountability, and Organizational Culture

This Abstract highlights the GDPR's important role in shaping data protection practices within the EU and its broader implications for data governance. The GDPR harmonizes data protection laws across EU, establishing comprehensive guidelines for the collection, processing, storage, and transfer of personal data. The GDPR directs significant penalties for non-compliance, thereby reinforcing the importance of adhering to data protection standards. Additionally the GDPR also validates the principles of lawfulness, fairness, transparency, and accountability in the processing of personal data.

The Regulatory Landscape of Biobanks In Europe: From Accreditation to Intellectual Property

Abstract: Biobanks are necessary resources for the storage and management of human biological materials, such as biofluids, tissues, cells, or nucleotides. They play a significant role in the development of new treatments and the advancement of basic and translational research, especially in the field of biomarkers discovery and validation. The regulatory landscape for biobanks, which is necessary to safeguard both privacy and scientific discoveries, exhibits significant heterogeneity across different countries and regions. This article outlines the standards that modern biobanks should fulfill in the European Union (EU), including general, structural, resource, process, and quality requirements. Special attention is given to the importance of transparency and donor consent following the General Data Protection Regulation (GDPR) and the ISO 20387:2018, the international standard specifies general requirements for biobanks. A dedicated section covers the preparation of donor information materials, emphasizing consent for research involvement and personal data processing. The delicate balance between donors' privacy rights and scientific research promotion is also discussed, with a focus on the patenting and economic use of biological material- derived inventions and data. Considering these factors, it would be warranted to refine legal frameworks and foster interdisciplinary collaboration to ethically and responsibly expand biobanking.

RESEARCH ON ERROR PROBABILITY ASSESSMENT IN USER PERSONAL DATA PROCESSING IN GDPR-COMPLIANT BUSINESS PROCESS MODELS

The only right strategy for businesses and government organizations in Ukraine and other countries that may face aggression is to recognize themselves as a potential target for cyberattacks by the aggressor (both by its government agencies and related cybercriminal groups) and take appropriate measures in accordance with the European Union’s General Data Protection Regulation (GDPR). The main purpose of the GDPR is to regulate the rights to personal data protection and to protect EU citizens from data leaks and breaches of confidentiality, which is especially important in today’s digital world, where the processing and exchange of personal data are integral parts of almost every business process. Therefore, the GDPR encourages organizations to transform their day-to-day business processes that are involved in managing, storing, and sharing customers’ personal data during execution. Thus, business process models created in accordance with the GDPR regulations must be of high quality, just like any other business process models, and the probability of errors in them must be minimal. This is especially important with regard to the observance of human rights to personal data protection, since low-quality models can become sources of errors, which, in turn, can lead to a breach of confidentiality and data leakage of business process participants. This paper analyzes recent research and publications, proposes a method for analyzing business process models that ensure compliance with the GDPR regulations, and tests its performance based on the analysis of BPMN models of business processes for obtaining consent to data processing and withdrawal of consent to user data processing. As a result, the probability of errors in the considered business process models was obtained, which suggests the possibility of confidentiality violations and data leaks of the participants of the considered business processes associated with these errors, and appropriate recommendations were made.

Better alone than in bad company: Addressing the risks of companion chatbots through data protection by design

Recent years have seen a surge in the development and use of companion chatbots, conversational agents specifically designed to act as virtual friends, romantic partners, life coaches or even therapists. Yet, these tools raise many concerns, especially when their target audience is comprised of vulnerable individuals. While the recently adopted AI Act is expected to address some of these concerns, both compliance and enforcement are bound to take time. Since the development of companion chatbots involves the processing of personal data at nearly every step of the process, from training to fine-tuning to deployment, this paper argues that the General Data Protection Regulation (“GDPR”), and data protection by design more specifically, already provides a solid ground for regulators and courts to force controllers to mitigate these risks. In doing so, it sheds light on the broad material scope of Articles 24(1) and 25(1) GDPR, highlights the role of these provisions as proxies to Fundamental Rights Impact Assessments (“FRIAs”), and peels off the many layers of personal data processing involved in the companion chatbots supply chain. That reasoning served as the basis for a complaint lodged with the Belgian data protection authority, the full text and supporting evidence of which are provided as supplementary materials.

Critical points for the processing of personal data by the government: An empirical study in Brazil

The General Law for the Protection of Personal Data (LGPD), issued in Brazil in August 2018, establishes as one of the legal bases for the processing of personal data the execution of public policies by the State. A systematic review of the literature identified the existence of six critical points that represent challenges for public managers in the elaboration and implementation of policies that require the processing of personal data. The objective of this research is to establish the levels of criticality of the factors identified by the literature review, as well as to verify the existence of other critical points on which the literature has not yet advanced. To this end, a group of 11 specialists was selected to participate in the research that used the Delphi Method, a technique that consists of applying a set of questionnaires sequentially and individually, in order to establish a dialog between the participants and build a collective response. The results indicate a coherence between what was verified in the theory and the perception of the specialists. Another 10 critical points for the processing of personal data by the government were mentioned by the participants. In general, the main elements of tension identified addressed the lack of training of public officials and the sharing of personal data.

Information security and data protection at an industrial enterprise in modern conditions

It is impossible to imagine a modern enterprise without automation and digitalization of production processes. At the same time, new ways of doing business in the digital era are accompanied by such information threats as: data leaks, encryption viruses and attacks on critical information infrastructure. All data and assets need protection. This is not only a business requirement, but also the requirements of laws on CII and the processing of personal data. This is where information security comes to the aid of companies and enterprises.

The Right to Data Portability as a Personal Right

The right to the portability of personal data guarantees the interested party the right to receive personal data that concern themselves. Specifically, data which a person has provided to a ‘data collector’ in a structured format can currently be transmitted to another ‘data collector’ without any legal consequences as long as the original ‘collector’ has received consent either derived via a contract or other means. This data transaction from one ‘collector’ to another is often carried out by automated means; it is easily technically possible and is therefore considered to not negatively affect the rights and freedoms of others. This right to data transfer is guaranteed when it comes to data collected in the public interest or in the exercise of public powers conferred on the ‘collector’. The main precedent to the right to data portability is the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, regarding the protection of natural persons with respect to the processing of personal data and their free circulation, which repeals Directive 95/46/EC (General Data Protection Regulation). In Article 20, this regulation discusses the right to data portability, establishing the basic guidelines for this right. Thus, a new personal right is guaranteed, given the context of the general protection of data. In order to strengthen control over their own data, a natural person must also be allowed to receive data in the same structured way.

Legal protection of personal data for emergency contacts unilaterally included in illegal online loan services

New opportunities for digital financial services (Fintech) have emerged to accelerate digital financial inclusion amid social distancing, one of which is through Online Loans. The convenience offered by Online Loans in the process of borrowing money or financing without having to visit conventional financial institutions such as banks directly, is one of the factors supporting the increasing popularity of Online Loans, thereby opening up more opportunities for Online Loan Providers to expand their industry. However, issues arise due to the ease of this technology, one of which is the misuse of borrowers' emergency contacts, causing inconvenience to the owners of those contacts whose personal lives are disrupted. The study is conducted using normative legal research. The experience of convenience offered by Online Loans is much greater; the borrowing process only takes place through a website or mobile phone, allowing consumers to confirm only through the system and do it anytime and anywhere. However, the conveniences provided by Online Loans are often not accompanied by adequate education in society regarding the technology used or the legal and lending provisions. This has become a loophole for "predatory lending" actors to develop their businesses. Legal protection for borrowers is already regulated in the Financial Services Authority Regulation Number 10/POJK.05/2022 Regarding Information Technology-Based Borrowing and Lending Services. Borrowers regarding their personal data have also been clearly regulated in Law Number 27 of 2022 Concerning Personal Data Protection, as well as the presence of Financial Technology associations that accompany the pace of technology-based borrowing and lending services. Control of personal data must obtain explicit consent from the data subject to process personal data. There are several sanctions for online loan customers who provide emergency contact numbers without consent. These sanctions include written warnings, temporary cessation of all personal data processing activities, deletion or destruction of personal data, and/or administrative fines.

Legislative mechanisms of personal data protection in the health care system

Human rights and freedoms, guarantees of their observance and protection should be the basis of the activities of any democratic country in the world. The issue of information security becomes particularly relevant in modern conditions, because medical institutions collect and store personal data of persons who contact them, the results of laboratory and instrumental research, diagnoses, medical histories, etc. Endless reforms, changes in legislation, introduction of an electronic system in the field of health care cause a lot of discussions about individual mechanisms of its functioning and ensuring the protection of personal data. The collection of personal data must be lawful, subject to strict requirements and for a legitimate purpose. In addition, persons or organizations engaged in the collection and processing of personal information must protect it from abuse and respect the rights of data owners guaranteed by law. The reform of legislation in the field of data protection should take place in parallel with the dynamic process of development of Internet technologies, including the creation of a formalized system of legislation in the field of privacy. In addition, considerable attention should be paid to the level of awareness of citizens about how their personal data may be collected and used. In particular, the request for consent to the processing of personal data must be clear; access to own data should be simplified and their mobility should be increased for easier transfer of data from one service to another; companies and organizations must report serious security breaches in a timely manner. And of course, ensuring the appropriate level of responsibility and reporting of all those involved in personal data processing. Health care is increasingly reliant on information technology. More and more hospitals and healthcare institutions are using information and communication technologies to support and improve their work. Digital technologies are widely used in the public health care sector, including electronic prescriptions, appointments with a family doctor, records of services rendered, hospitalization, hospital discharge, etc. In this context, a wide range of eHealth tools and services have emerged. Electronic medical records are created in such a way that it is possible to transfer patient data between different medical professionals. Although digital health technologies have so many important functions, their high dependence on sensitive patient health information can cause information security issues. At the same time, a significant part of personal health data is often collected without informing patients about it.