Processing Of Personal Data Research Articles

New technologies, children and the General Data Protection Regulation (GDPR): The gap between communication, infrastructure and the application of an European Regulation!

One of the central concepts of the General Data Protection Regulation (GDPR) is the “data subject”. This notion in relation to the establishment of rights and obligations for controllers and processors becomes a common denominator in the implementation of this Regulation at the level of all Member States of the European Union. The Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) was adopted, in order to protect the privacy of data subject, whether a parent, an young person or a child. However, starting with the title we can identify two different actions: to assure the protection of personal data and the free movement of this data within and outside the Union borders. In this context we must take the following into account: the reality of conceptual gaps in interpretation of this document; old or non-existent infrastructure; legislative bottlenecks and the risks involved in the protection of children’s data. Are parents, young people or children properly informed about their rights and the risks to which they are exposed in an era of digitalization? Can online school ensure the protection of children? Does the current infrastructure allow the optimal implementation of the General Data Protection Regulation? My research, in this context, has the aim of identifying gaps between information, infrastructure and the application of the GDPR, using the content analysis method and the questionnaire as a qualitative method of research. The expected results of this research are awareness by state institutions about the risks to which children are exposed in an era of digitalization and the awareness of the controllers about the obligation to ensure the protection of children’s data in the processing process.

Personal data: doctrinal interpretation of the category in the sciences of administrative and information law

In the article, on the basis of a review of scientific and regulatory sources, an attempt is made to carry out a generalized analysis of doctrinal approaches to the definition of the content of the «personal data» category, to reveal tendencies and emphasis in solving the corresponding scientific task. It is noted that with the rapid development of methods, processes and methods of using computing equipment and communication systems for the creation, collection, transmission, search, processing and distribution of information, the integration of artificial intelligence in all spheres of social life, including technological processes of collection , processing and protection of personal data, the need to review the theoretical foundations of the legal institution of personal data, updating doctrinal approaches to understanding and interpreting the categorical series in this area is becoming more urgent. It is emphasized separately that the features of the legal regime of martial law definitely leave their mark on the personal data protection mechanisms.
 As a result of a generalized review of doctrinal approaches to defining the content of the «personal data» category, the author recognized the presence of a clear tendency in recognizing the need to detail the legal definition of personal data, as well as making changes to special legislation in this area. As a rule, researchers consider personal data as a special type of information, an object of administrative and/or informational legal relations, an object of protection, etc. In scientific research in the area of the raised issue, emphasis is placed on the importance of developing classification models of personal data with a number of various criteria in order to determine as deeply and systematically as possible all the components of the specified category. In some studies, the thesis about the correctness of the correlation of personal data with other related concepts and categories is emphasized, which has a significant impact not only on the results of scientific research, but also on law enforcement practice in this area.

Administrative-legal support for the protection of citizens personal data: contemporary theoretical approaches

The article is devoted to the issues of modern understanding of the concept, essence and content of administrative and legal support for the protection of personal data of citizens. In this aspect, the author emphasizes the growing need to form an appropriate level of protection of an individual from information threats of the modern world and to form administrative and legal support for the protection of personal data of citizens.
 The methodological basis of the study. The selected issue is approached using a systematic methodology, which incorporates dialectical, formal-logical, and structural-functional methods, in addition to other standard scientific research techniques. Furthermore, specific legal methods, such as formal-logical, systematic-functional, comparative analysis, methods of legal interpretation, and legal forecasting, are employed. The study is grounded in the theory of cognition, with a particular emphasis on materialist dialectics as its overarching method. General scientific research methods used include formal-logical and systematic approaches.
 Results. The author emphasizes that legal protection of personal data by the authorities is based on legislation and regulations governing the rights and obligations of the authorities with respect to personal data processing. It is emphasized that these rules may include requirements for data registration, confidentiality, notification of an individual about the collection and use of his or her personal data, and establishment of liability for violation of data protection rules. The concept of personal data protection by the authorities includes the adoption of appropriate legal measures to ensure the security and confidentiality of these data.
 Conclusions. The administrative and legal support for the protection of citizens’ personal data takes place within the activities of government authorities as an element of their service function. The concept of administrative and legal support for the protection of citizens’ personal data is defined as the regulated administrative and legal activities of entities responsible for ensuring the protection of personal data, primarily the activities of public administration subjects, aimed at administrative and legal regulation, implementation, protection, and safeguarding of public relations in the field of personal data. It guarantees the rights and legitimate interests of all subjects of legal relations, focusing on creating the necessary conditions for compliance with legislation on personal data protection. It is emphasized that administrative support is the activity of public authorities manifested in legal regulation, application, and protection of the rights, freedoms, and interests of citizens.

Achieving Algorithmic Transparency and Managing Risks of Data Security when Making Decisions without Human Interference: Legal Approaches

Objective: to compare modern approaches in law to the use of program codes and algorithms in decision-making that meet the principles of transparency and openness, as well as the increasingly stringent requirements for ensuring the security of personal and other big data obtained and processed algorithmically.Methods: the main methods for researching the principle of transparency in algorithmic decision-making were formal-legal and comparative analysis of legal acts and international standards of information security, as well as the principles and legal constructions contained in them.Results: it was determined that the development of information security standardization, inclusion in legal acts of requirements for the development of information technologies that comply with the principles of transparency and openness of applied algorithms will minimize the risks associated with the unlawful processing of users' big data and obtaining information about their privacy. Proposals were identified, related to the implementation of algorithmic transparency in the field of data processing legal regulation. Recommendations were formulated, based on which the legislator can solve the problem of ensuring the openness of the logic of information technology algorithms with regard to modern standards of information security.Scientific novelty: it consists in the substantiation of new trends and relevant legal approaches, which allow revealing the logic of data processing by digital and information technologies, based on the characterization of European standards of the “privacy by design” concept in new digital and information technologies of decision-making and data protection, as well as on the new legal requirements for artificial intelligence systems, including the requirement to ensure algorithmic transparency, and criteria for personal data and users' big data processing. This said, data protection is understood as a system of legal, technical and organizational principles aimed at ensuring personal data confidentiality.Practical significance: it is due to the need to study the best Russian and international practices in protecting the privacy of users of digital and information technologies, as well as the need for legislative provision of requirements for the use of algorithms that meet the principles of transparency and openness of personal data processing, taking into account the need to ensure confidentiality at all stages of the life cycle of their processing, which will ensure the continuity of security management.

Ways to Obtain the Consent of the Subject of Personal Data for Their Processing in the Process of Organizing Educational Online Courses

The authors, using an example from their teaching practice, consider a special case of obtaining and processing the consent of the subject of personal data to the processing of personal data. The relationship between an educational organization and students of online advanced training courses is taken as an example. The authors show the problems they faced as organizers of educational activities and share their experience in solving these problems. They come to the conclusion that consent to the processing of personal data can be obtained using such electronic means of communication and datatransmission as e-mail, the Yandex Forms service and similar services. The use of these electronic means of communication allows you to quickly and economically solve some organizational issues that arise in educational practice.

Legal problems of building an internal corporate compliance system in the field of personal data protection

The article analyzes the norms of legislation that allow to determine the required elements of the internal corporate compliance system in the field of personal data protection in modern legal conditions. The corporate and judicial practice, reflecting the change in the legal regulation of the compliance of organizations in the field of collection and use of personal data, is being studied, recommendations are being formed for the development of internal documents of the corporation that regulate the processing of personal data of the corporation.

Problems of personal data protection in the context of digital transformation

The article presents an analysis of domestic legislation regulating the protection of personal data; the problems of personal data protection in the context of increasing the role of digital resources, the use of tracking technology and digital technologies that allow recording, collecting and processing personal data of individuals are considered; the argumentation is given to substantiate the need to develop modern effective methods, technical means of detecting and preventing unauthorized use of personal data, additional legal regulation of the institute of personal data protection, and certain provisions of the law – in discussion and subsequent correction.

A Scoping Review on Analysis of the Barriers and Support Factors of Open Data

Background: Using personal data as Open Data is a pervasive topic globally, spanning various sectors and disciplines. Recent technological advancements, particularly in artificial intelligence and algorithm-driven analysis, have significantly expanded the capacity for the automated analysis of vast datasets. There’s an expectation that Open Data analysis can drive innovation, enhance services, and streamline administrative processes. However, this necessitates a legally and ethically sound framework alongside intelligent technical tools to comprehensively analyze data for societal benefit. Methodology: A systematic review across seven databases (MEDLINE, CINAHL, BASE, LIVIVO, Web of Science, IEEExplore, and ACM) was conducted to assess the current research on barriers, support factors, and options for the anonymized processing of personal data as Open Data. Additionally, a supplementary search was performed in Google Scholar. A total of n=1192 studies were identified, and n=55 met the inclusion criteria through a multi-stage selection process for further analysis. Results: Fourteen potential supporting factors (n=14) and thirteen barriers (n=13) to the provision and anonymization of personal data were identified. These encompassed technical prerequisites as well as institutional, personnel, ethical, and legal considerations. These findings offer insights into existing obstacles and supportive structures within Open Data processes for effective implementation.

Criminal influence in information security crimes and the establishment or dissemination of criminal influence as a criminal offense against public safety: ratio problem

Scientific article devoted to the study of the concept of «criminal influence» in its various criminal law meanings. The subject of the author's scientific interest is the relationship between the concept of "criminal influence" as a component of complicity - in the commission of a criminal offense by prior conspiracy by a group of persons in the field of information security and as a component of establishing or spreading criminal influence as a criminal offense against public safety.
 The content of establishing or spreading criminal influence as an independent socially dangerous act and as an element of criminal acts when committing criminally punishable acts in the field of information security is disclosed. Attention is focused on the main forms of criminal influence during the commission of criminal offenses in the field of information security. Formulated author's proposals regarding the levels of criminal influence.
 The issue of the criminal-legal qualification of acts related to the establishment or expansion of criminal influence has recently developed. And already published scientific works that deserve attention and their study and analysis. At the same time, for the field of information security, the problem of qualification of illegal acts using such a feature as the establishment or spread of criminal influence has not yet acquired an adequate level of research. The issue of distinguishing criminal influence as a component of the commission of a criminal offense based on a prior conspiracy by a group of persons and as an independent criminal offense provided for in Art. 255-1 of the Сriminal code of Ukraine.
 The current state of development of relations in the field of information technologies has a steady trend towards the total digitalization of all social processes without exception. The expanded use of information technologies during the collection and processing of personal data of a person, the transfer of financial transactions to a cashless form and even the availability of personal electronic documents - all this in its entirety significantly simplifies the process of developing social relations, realizing the rights of a person and satisfying his interests. At the same time, similar trends lead to the reorientation of criminal influence from real to virtual space, which contributes to the spread and modernization of crime in the field of information relations.

Genomic privacy?

This paper explores the processing of sensitive personal data for genealogical purposes by studying how the privacy policies of three direct-to-consumer genetic testing companies relate to the general Data Protection Regulation (GDPR). The methodological approach is content analysis. The privacy policies are analysed in relation to the three core principles of 1) adherence to GDPR; 2) transparent processing of personal data; and 3) consent. The paper also discusses privacy in relation to third parties whose sensitive personal data is processed indirectly due to the nature of DNA as shared between family members. The main result is that the privacy policies rarely mention GDPR; when mentioned it is done in a brief way; the privacy policies studied convey insufficient transparency as regards data processing; and genetic relatives of users are not taken into consideration even though their personal data is being processed indirectly.

Unified System for Processing Non-Personalized Data

The purpose of the study. The purpose of this article is to study the possibility of creating a unified register of non-personalized data, that is, data that cannot be attributed to a specific subject of personal data. The objective of the study is to analyze relevant materials for the purpose of the study, to determine the need for this system, to determine possible areas of application of the system, to determine the system sources and data on which the system can be based. The object of the study is a unified system for processing non-personalized data, the issue of creating this system and the opportunities that open up to the user.The subject of the study is the question of the data that can be processed in this system, as well as the section in which the data can be interpreted.Research methods. The article uses the following research methods: analysis of open data sources, modeling of the target solution in the form of a concept.Results. The article presents an example of the implementation of a system for processing non-personalized data. The variants of systems that currently have a set of data on personal data subjects and are ready to conduct a preliminary scoring analysis are presented. A possible result of the application of scoring is presented, using the example of the banking industry. An analysis of the current state of citizens' data processing systems was carried out. The results of the analysis showed that currently there is no single system that would allow for scoring analysis on the subject of personal data, aggregating data from various sources of state systems. There are no data in open sources on the progress of the development of a system that allows for scoring analysis based on non-personalized data. At the same time, the creation of a unified system for processing non-personalized data can both have a positive impact on the economic indexes of consumers connected to it, and contribute to the implementation of strategic plans of the state.Conclusion. During the study, a project was proposed for implementation to create a unified system for processing non-personalized data. A variant of data that can be used for primary scoring is proposed. The advantages of this system include a positive economic effect for organizations connected to the system, due to the reduction of monetary losses, improving the quality of sales, increasing customer loyalty, for the state, a positive effect can be an increase in the transparency of citizens' data and a decrease in the number of economic crimes, for citizens, the positive side of the system is to reduce information noise, due to a decrease in the number of studies from the companies, reduction of fraudulent actions, in relation to consumers. The disadvantages of the system include a high risk of data leakage, as a result of an increase in the number of crimes, incorrect interpretation of data by the scoring model, unavailability of various services for clients of organizations due to lack of data, the risk of data misuse by the operator of personal data processing. As a result, we can conclude that with the proper level of user data protection and clear rules for working with data, this system has good prospects for achieving the economic goals of both private companies and the state.

АКТУАЛНИ ПРОБЛЕМИ В РЕДАКЦИОННИТЕ И ИЗВЪНРЕДАКЦИОННИТЕ СЪДЪРЖАНИЯ НА БЪЛГАРСКИТЕ МЕДИИ В КОНТЕКСТА НА GDPR

The paper analyzes current problems in the handling of personal data in the media and the attempt of the Bulgarian legislation to synchronize the requirements under Regulation (EU) 2016/679 for the handling of personal data with the constitutional framework of the communication rights for freedom of expression and information, provided in Art. 39, 40 and 41, which also affect the freedom of media. Emphasis is placed on the latest amendment to the Bulgarian Personal Data Protection Act of 2019, which, among others, covers the requirements for the processing of personal data in journalistic content. In this regard, in relation to the Bulgarian media environment, several particularly broad problem areas which await their solution are commented on.

The judgment of the CJEU in Inspektor (Purposes of the processing of personal data – criminal investigations) of 8 December 2022 and the concept of further processing under the Law Enforcement Directive

In the context of criminal law enforcement and cooperation, the fundamental right to the protection of personal data is not complemented by the General Data Protection Regulation (Regulation (EU) 2016/679 – ‘GDPR’), but by the national law implementing Directive (EU) 2016/680 (‘LED’) together with other pieces of EU legislation. The preliminary ruling of the Court of Justice of the European Union in Case C-180/21 Inspektor (Purposes of the Processing of Personal Data – Criminal Investigations) delivered by the Fifth Chamber on 8 December 2022 is the first judgment in which the Court considered the LED beyond its scope of application. It represents an important milestone for data protection law in the area of criminal law enforcement. This paper will provide an analysis of the main findings of the judgment, with particular focus on the concept of “further processing” and a first reflection on the consequences it may have on the work of competent authorities such as public prosecutors.

Formation of the institute of personal data protection and experience of its implementation in the countries of the EU

The development of digital technologies in the modern world led to an increase in interference in the private life of a person and the number of human rights violations related to private life. Ukrainian legislation on personal data protection does not meet the latest trends and standards of the European Union (EU) in this area and needs to be updated. The article is intended to analyse the development of the institute of personal data protection in the world to identify ways to adapt the national legislation of Ukraine to the current personal data protection standards of the EU. To carry out the research, the following scientific methods were used: inductive, deductive, dialectical, analysis and synthesis, comparative legal, historical legal. According to the results of the research, the personal data protection institute has gone through a significant path of development from individual notions and concepts to a structured set of standards and tools legally established at the EU level. A characteristic feature of this development is the adoption of new legal acts on personal data protection, as well as increasingly strict and comprehensive regulation of issues related to personal data processing. Ukrainian personal data protection legislation, although historically improved in line with European standards, as of 2023 is based on the outdated Directive 95/46/EC, which has already been rejected by the EU. Compared to the legal systems of neighbouring countries such as Poland, Bulgaria and Romania, Ukrainian personal data protection legislation is not only inferior, but also significantly lags behind in terms of detail, definition of key terms and principles. The results of the research can be used in law-making work, in particular, when drafting a new bill of the basic data protection law and for further research on ways to improve Ukrainian laws and laws of other candidates for membership in the European Union on personal data protection

Compliance with the principle of equal treatment in public procurement law through the protection of personal data

This study aims to summarize the application of the principle of equal treatment in public procurement law within the legislation of the European Union and in the legal system in Romania and also the fair processing of personal data as an expression of the principle of equal treatment by actors involved in public procurement in Romania and in public procurement litigation as reflected in doctrine, legislation and judicial practice.
 The research method chosen is epistemological and empirical analysis, whilst highlighting legislation incidents pertaining to the chosen subject and of the judicial practice, resulting in the improvement of the research topic addressed, for a better understanding and application of the legal provisions in the matter of respecting the principle of equal treatment and that of protection personal data in public procurement law. In the end, the study highlights the conclusions reported to the analysis of the topic dealt with.

Declaração de política de privacidade e proteção de dados

The opinion has as its theme the need for a statement of privacy and data protection policy applied to the Brazilian company Empreendedorismo Inovador, headquartered in São Pau-lo/SP, which provides services through a platform intended to offer courses theoretical and practical in the field of entrepreneurship and innovation. The privacy and data protection policy statement is one of the main documents that must be formalized by the data controller in order to demonstrate, in a clear and documented manner, good practices and governance with regard to the treatment of personal data held by him. The opinion answers questions about the essential elements of the privacy and data protection policy statement, its principles, the rights of data subjects, the legal bases for drafting the privacy and data protection statement. The privacy and data protection policy statement must contain all information that involves the processing of personal data, highlighting the occurrence of processing of personal data of minors, as well as the international sharing and transfer of data. The research methodology used in the report is the integrated, analytical, deductive and bibliographic research technique.

Problems in ensuring the proper implementation of personal data processing for journalistic purposes in the Ukrainian and European Union law

"Technological advances have increased the media’s power, requiring journalistic activism and the invasion of privacy. This research aims to analyse the ways of ensuring the proper implementation of personal data processing for journalistic purposes in Ukraine and the European Union (EU). The study focuses on a comparison of case law and the experience of European countries to determine the reasons for granting journalists access to personal data, the limitations of such cases and the applicability of the proportionality test in practice. As a result, the author found out that journalistic exemption allows the dissemination of personal data, if necessary, in a democratic society while respecting the interests of citizens and their right to privacy. In conclusion, the author states that some European countries and Ukraine have to revise their national laws to balance the right to journalism with the General Data Protection Regulation (GDPR) requirements. Therefore, this research proposes several ways for their further cooperation in the field of personal data protection. Keywords: personal data, GDPR, right to journalism."

Blockchain-based access control system for efficient and GDPR-compliant personal data management

New digital technologies generate large amounts of information. This data is processed by Service Providers in order to improve and develop new services and products, but also to fund themselves. However, processing personal data may result in the extraction of sensitive information, which, in turn, may lead to jeopardizing the users’ privacy. To mitigate this significant risk, the European Parliament and Council of the European Union elaborated the General Data Protection Regulation (GDPR). This regulation forces Service Providers to obtain Data Subjects’ explicit consent prior to collecting and processing their personal data. Nevertheless, the GDPR’s legislative text does not define how Service Providers must transparently demonstrate that they already have these consents. Moreover, most individuals do not know the rights they have over their personal data, neither does this regulation provide them with efficient methods to be aware of what third parties are doing with such data. In order to address this situation, we propose a lightweight blockchain-based GDPR-compliant personal data management platform. The new solution provides public access to immutable evidences that reflect the reached agreements between Data Subjects and Service Providers. In this way, Service Providers can effectively demonstrate that they are fulfilling the regulation, and Data Subjects are able to control and manage their personal data according to their legitimate rights. We have implemented the new system, and we have performed a detailed study which includes: GDPR-compliance, provided functionality, security and privacy issues, and the cost in terms of gas and US dollars of the different operations to be run on the blockchain.

The Evolving Privacy Right: an Analysis of Tanzania’s Legal Scheme in E-health Data Protection

Rapid technological developments and globalization have brought new challenges to the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale to pursue their activities. Natural persons increasingly make personal information available publicly and globally. The importance of the subject of privacy and data protection has gained unprecedented attention in recent years, requiring better and more elaborate rules of protection. Individuals are sometimes exposed to possible abuse and even to harmful consequences as a result of the developments in information and communication technology (ICT) and the role it plays in the collection of personal information, and the tendency of companies and business enterprises to collect and use personal information in making business decisions. It is therefore not surprising that many countries in the West enacted comprehensive legislation on data protection some time ago. Europe in particular, through the recently passed General Data Protection Regulation, 2016, is heading towards the harmonization of data protection laws to have consistency within the region This article aims to provide an overview of the evolving “right to privacy (Data protection)” in this digital health (e-health) world to give the main key facts to stakeholders in e-health sectors to adapt their practices and ensure compliance with the current evolving legal scheme in Tanzania. The processing of personal health data, genetic data biometric data, and other kinds of sensitive information is strictly regulated and even widely interpreted by justice-dispensing organs.

Citizen scientists as data controllers: Data protection and ethics challenges of distributed science

Citizen-science is a rapidly expanding approach to knowledge production that increasingly involves the collection of personal data in various forms. This processing of personal data invokes relevant data protection laws and, specifically, the designation of data controller, the person(s) or organisation(a) who determine if and how personal data is to be processed and hence are charged with the legal responsibility for compliance with the General Data Protection Regulation (GDPR). Traditionally, in the context of research, professional researchers would be designated controllers, and research participants whose data was processed would be “data subjects” and hence enjoy the GDPR's protections. Yet, citizen-scientists adopt a dual role, acting both as participants and as researchers. This paper maps the implications this dual role has from the perspective of data protection law and research ethics. We explain how the data protection concept of controller has been interpreted very broadly. As a result, in their dual role, citizen scientists can be both data subjects entitled to protection and data controllers, sometimes of their own data, tasked with data protection compliance obligations. If citizen scientists share the objectives of research projects they participate in or co-shape those objectives, it is likely that they – together with the professional researchers - will be considered controllers, and held responsible for the processing of personal data in compliance with the GDPR. The paper discusses how this can affect both the quality of protections provided to participants (including participant-researchers), thus undermining the fundamental goal of research ethics, generally, as well as the practice of citizen science itself. We analyse this question of citizen scientists as data controllers as both a matter of law and research ethics. We conclude with policy recommendations that can be applied both on the level of data protection law (to reconsider how the role of controller is assigned) and research ethics guidelines that should take a nuanced approach to the circumstances of assignment of the status of data controller in citizen science projects as an important step toward responsible and ethical participatory research.