Processing Of Personal Data Research Articles

Implementing GDPR-Compliant Surveys Using Blockchain

The immutability of data stored in a blockchain is a crucial pillar of trust in this technology, which has led to its increasing adoption in various use cases. However, there are situations where the inability to change or delete data may be illegal. European Union’s General Data Protection Regulation (GDPR)—applying to any company processing personal data from European citizens—explicitly entitles individuals to the right to rectification and the right to be forgotten. In this paper, we describe the design of a system to deploy and process survey data in a GDPR-compliant manner. It combines an Hyperledger Fabric blockchain to ensure that data cannot be tampered with and InterPlanetary File Systems (IPFS) for storage. With the proposed arrangement, we reap several security benefits enabled by blockchain’s immutability without running afoul of the regulations. Furthermore, the proof-of-concept is generic and can easily be adapted to various domains.

Processing of personal data revealing racial or ethnic origin in the European Union.

aAntwerp Bar Association, ARTES Law, Antwerp bEmergency Medicine Department, UZLeuven, Leuven, Belgium Received 24 January 2023 Accepted 27 January 2023. Correspondence to Marc Sabbe, MD, PhD, UZLeuven, Herestraat 49, Leuven 3000, Belgium Tel: +32 16343927; fax: +32 16343894; e-mail: [email protected]

Compliance e governança de dados como estratégias para as empresas

Law No. 13.709/2018, called the General Law for the Protection of Personal Data – LGPD, changed and regulated the processing of personal data. In addition to providing for the rights of the holders, it brought forms and requirements for the processing of this data, whether carried out online or offline, and specific obligations so that the personal data processing agents can ensure the prerogatives of the holders of these information. The purpose of this article is to offer a systematized view that reconciles theory with practical issues. The paper then addresses theoretical concepts, such as compliance, governance, data governance, but also practical aspects, such as the program, methodology, program phases, guidelines and data governance effectiveness, thus aiming at clarify what are the best strategies to stand out and adapt to the business world that is increasingly competitive. The article concludes that a data privacy program coupled with good management and compliance practices guarantees the protection of the privacy of the personal data of their respective holders as well as the good reputation of the organization in the market. To obtain these results and conclusions, the methodology of integrated, analytical, deductive research and the technique of bibliographic research was used.

Personal Data Protection Issues in the Realm of Telemedicine. Blockchain, Civil Liability and other Methods to Overcome Them.

The subject of this article is the legal regulation of personal data protection in the field of medical care with the use of telemedicine technologies and digital healthcare. Its purpose is to identify and analyze the problems of personal data protection and to find ways to overcome them. The relevance of the work is due to the presence of a large number of leaks of personal data, gaps in regulation, and the lack of an effective system of norms aimed at preventing the compromise of patient information. The author examines the main aspects of regulating the procedure for working with the patient's consent to the processing of personal data. Much attention in the article is paid to blockchain technology, traditionally considered in the Russian legal literature only within the framework of the use of cryptocurrencies. The article also analyzes the issues of the application of civil liability measures for offenses in the field of personal data protection of recipients of telemedicine services.The author criticizes the unreasonably strict regulation of the procedure for obtaining the patient's consent to the processing of personal data by a medical organization, emphasizes the need to introduce a flexible form of consent. This will reduce the amount of information at risk of leakage. In addition, the idea of creating a mechanism for revoking the patient's consent to the processing of personal data and securing the patient's right to demand from the medical organization the termination of their processing is put forward. The paper points to the prospects for the use of blockchain in the field of telemedicine, including for the protection of personal data. A regulatory division of blockchain systems into centralized and decentralized ones is proposed, suggesting their different regulation in relation to the protection of confidential information. In addition, the article notes the lack of elaboration of the norms on civil liability for offenses in the field of working with personal data in telemedicine, it is proposed to tighten regulation in order to increase the level of protection of patients' rights.

PROCESSING OF PERSONAL DATA BY MEMBERS OF THE RELIGIOUS COMMUNITY OF JEHOVAHS WITNESSES

The author presents a dispute in Finland over a decision prohibiting the religious community of Jehovahs Witnesses from collecting and otherwise processing personal data as part of the preaching activity. The public authorities of this country have recognized that the community and its members are controllers of personal data and entities responsible for the processing of such data. According to the community, preaching is an individual religious practice. Data collected solely on the personal initiative of the members of the Jehovahs Witness community do not constitute a dataset, and the community cannot be considered a controller of personal data. In the questions referred for a preliminary ruling, the referring court took the position that such activity is not subject to the exemption provided for in Art. 3 sec.1st indent of Directive 95/46. He was not sure, however, that the preaching activity could be considered a purely personal or domestic activity within the meaning of Art. 3 sec. 2nd indent of Directive 95/46. The Grand Chamber of the CJEU delivered a balanced judgment taking into account, on the one hand, the right to respect for private life and, on the other hand, the equally important right to freedom of religion.

Addressing the Challenges of Data Privacy Protection Law in Vietnam

The Internet has substantially changed human behaviors in the way of accessing and exchanging information – including personal data – easier and faster than ever. Frontier-less nature of the Internet not only enables the free flow of data across countries, but also brings new challenges including risks to privacy.
 Under the state surveillance, Vietnam has regulated differently privacy from the state and privacy from private actors. The utmost priority focused on regulating cyber activities that impact national security and social order and safety, which is reflected in Law on Cybersecurity No. 24/2018/QH14 on June 12, 2018.
 For personal data protection, the rules for the collection, storage, processing, use, disclosure, and publication of personal data are set out in Vietnam’s Civil Code 2015 and in multiple sectorial laws besides a general framework for data protection promulgated in Law on Network Information Security No. 86/2015/QH13 (Nov 19, 2015). However, these rules are drafted in broad language and are open to interpretation; however, there has been no repository for precedent till now.
 Recently, in order to enhance the best effort in protecting personal data, Vietnam updated its legislative agenda and planned to enact an initial decree on Personal Data Protection drafted by Vietnamese Ministry of Public Security after its first issuance in 2019. This updated draft has a more robust set of rules regulating specific rights of data subjects, cross-border transfer of data, and processing of sensitive personal data, which clarified mostly the longstanding speculation about the direction of Vietnam’s data protection regime beyond state surveillance.
 The objective of the present article is to point out the current status of the legal system in protecting personal data, its potential obstacles to effective protection of the right to data protection, and to put forward solutions for removing those obstacles with regard to data protection in Vietnam.

Overview of the European General Data Protection Regulation (GDPR) impact on medical writing for clinical trials

The European General Data Protection Regulation 2016/ 679 (GDPR) aims to ensure the security and privacy of individuals in the European Union (EU). Companies located within and outside of the EU must comply with GDPR when processing personal data of EU citizens. Medical writing includes the development of documents related to clinical research. To develop those documents, medical writers have access to personal data, including health information considered as sensitive data. Therefore, medical writing falls within the purview of GDPR and must comply with its requirements. This article is an overview of the impact of GDPR on medical writing including security measures such as anonymisation, pseudonymisation, and data minimisation techniques. It also provides an overview of the technical and organisational actions in the framework of medical writing to guarantee respect of data subjects’ rights and freedoms.

3D intraoral scan and diagnostic plaster model under General Data Protection Regulation – Legal protection

No legal subsumption of dental impressions, plaster models and intraoral scanning has been attempted yet. It should be examined to what extent the General Data Protection Regulation (GDPR) applies to them. The aim of this study is to legally classify 3D intraoral scans and plaster models prepared on the basis of alginate impressions within the context of personal data safety and determination of legal protection applicable to their use. The authors set the deliberations concerning legal protection of plaster models and 3D intraoral scans in the light of recently published articles regarding palatal rugae pattern stability, thus enabling accurate personal identification regardless of age or dental treatment. The deliberations concerning legal protection will be based on the analysis of the international legal acts, in particular GDPR. The intraoral scan constitutes biometric data, because it is information about a natural person – a patient is identifiable on the basis of elements defining physical identity. The plaster model itself does not constitute personal data. However, both of them constitutes medical documentation. The biometric data must be processed in a manner compliant with the GDPR provisions. The GDPR shapes only aims which should be attained. When creating a data safety system, ISO or NIST standards may help to ensure the proper level of protection against possible liability resulting from breaches in the scope of personal data processing.

Moral autonomy of patients and legal barriers to a possible duty of health related data sharing

Informed consent bears significant relevance as a legal basis for the processing of personal data and health data in the current privacy, data protection and confidentiality legislations. The consent requirements find their basis in an ideal of personal autonomy. Yet, with the recent advent of the global pandemic and the increased use of eHealth applications in its wake, a more differentiated perspective with regards to this normative approach might soon gain momentum. This paper discusses the compatibility of a moral duty to share data for the sake of the improvement of healthcare, research, and public health with autonomy in the field of data protection, privacy and medical confidentiality. It explores several ethical-theoretical justifications for a duty of data sharing, and then reflects on how existing privacy, data protection, and confidentiality legislations could obstruct such a duty. Consent, as currently defined in the General Data Protection Regulation – a key legislative framework providing rules on the processing of personal data and data concerning health – and in the recommendation of the Council of Europe on the protection of health-related data – explored here as soft-law – turns out not to be indispensable from various ethical perspectives, while the requirement of consent in the General Data Protection Regulation and the recommendation nonetheless curtails the full potential of a duty to share medical data. Also other legal grounds as possible alternatives for consent seem to constitute an impediment.

Gloss on the Ruling of the Supreme Administrative Court of 25 May 2022, Case Reference Number III OSK 2273/21

Abstract The glossed ruling covers two key issues concerning the application of the autonomous and comprehensive rules of the protection of natural persons with regard to the processing of personal data applied by organisational units of the Catholic Church in the territory of the Republic of Poland. The first issue concerns the possibility of further application of these autonomous, comprehensive rules after the GDPR came into force. The second issue concerns the ability to designate and grant a legal status to an independent separate supervisory authority: the Ecclesiastical Data Protection Officer. Approving the stance presented in the ruling of the Supreme Administrative Court, the gloss presents arguments confirming the fact that when the GDPR came into force, a regulation concerning the processing of personal data existed in the Catholic Church (it was primarily contained in the standards of the Code of Canon Law of 1983), which the Catholic Church, by the time specified in Article 91(1) GDPR, harmonised with the provisions of that legal act. Moreover, the mode of operation, the manner of designating or dismissing the Ecclesiastical Data Protection Officer does not have to be derived from the universally binding law. It may arise from the internal law of the Catholic Church, provided that the requirements laid down in Chapter VI GDPR, i.e. independence, fulfilment of general conditions concerning data protection supervisory authorities, secrecy, performance of tasks and exercise of the powers laid down in the GDPR (relevant competences), are met. This argument originates from the principle of autonomy and independence of churches and other religious organisations, guaranteed by the provisions of the Constitution of the Republic of Poland. The reasoning is also confirmed in recital 165 of the GDPR preamble, which states that “This Regulation respects and does not prejudice the status under the constitutional law of churches and associations or religious communities in the Member States, as recognised in Article 17 TFEU”.

Wybrane aspekty komplementarności praw informacyjnych względem czynnego prawa wyborczego

The text deals with the complementarity of information rights with respect to the active electoral right, using the example of the right of access to public information and the right to protection of personal data. These two information rights well reflect the most relevant aspects of an individual’s information status. At the same time, these rights interestingly interact with the exercise of the active electoral right. The article explains the concept of “information rights” and the concept of the sovereignty of the people, and identifies the obligations incumbent on public authorities to ensure the exercise of information rights and the active electoral right. From the analyses carried out, there are strong interactions between the right of access to public information and the active electoral right. The situation is different in the case of the right to protection of personal data. The analysis makes it possible to claim that the relationship between the right of access to public information and the active electoral right as political rights is more intense due to the goals set for them. The right to protection of personal data belongs to personal rights. Its exercise involves complying with a number of procedures for processing personal data and securing personal data in technical and organizational terms. Procedures defining the principles of personal data processing are currently described primarily in the General Data Protection Regulation (GDPR). The joint application of the Election Code and personal data protection procedures is not easy, and the Polish regulation in this regard is sometimes unclear and insufficient.

Ensuring information security in order to preserve the national interests of Russia at the beginning of the 21st century

The purpose of this article is to analyze the main risks of information security in Russia in the new millennium and the effectiveness of information security programs in the Russian Federation. The object of the study is the information security system of the Russian Federation. The article identified the main risks of information security in Russia, such as cybercrime, violations of the rules for processing personal data, leaks of confidential information, and others. The authors analyzed the distribution of the listed types of threats to information security of Rostelecom's client companies for 2022. Attention is focused on the fact that a low culture of information security among military personnel and personnel working at the facilities of the Armed Forces can lead to vulnerabilities and risks of data leakage of important strategic facilities. The programs for ensuring information security of the Russian Federation were considered, including the Federal Target Program "Information Russia", the Federal Law "On the Protection of Personal Data" and others. The authors identified the main goals and indicators of such national programs. An analysis of the effectiveness of the information security system of the Russian Federation is carried out and a forecast of its development is presented. State programs aimed at developing the digital economy, protecting critical information infrastructure, developing mechanisms to combat cyber threats, as well as creating modern technologies for the Russian Armed Forces and cryptography are the key areas of Russia's work in this area. The authors also analyzed the forecast for the development of the Russian cybersecurity market, as well as the global forecast for the development of information security technologies. It is concluded that despite the measures taken by the Russian Federation to ensure information security, the system is still vulnerable to new threats. recommendations were developed to improve the current information security system in the Russian Federation.

An Analysis of Infractions and Fines in the Context of the GDPR

The General Data Protection Regulation (GDPR) is the regulation that determines the directives inherent to the collection, processing, and protection of personal data in European Union (EU) countries. It was implemented in May 2018 and over the past few years, several public and private companies have been affected by serious penalties. With more than 1500 fines already registered, it is important to have an analysis and insights about them. This paper proposes a detailed analysis of the public records of fines under GDPR, understanding the average fines imposed, the main causes for their application and how they have evolved over time. It is also intended to understand the most affected sectors and point ways to mitigate these penalties. It is concluded that fines under GDPR have an increasing trend over time, both in number of fines and in value, with Industry and Commerce & Media, Telecoms and Broadcasting being the most affected sectors. DOI : https://doi.org/10.54663/2182-9306.2023.sn12.42-58

Processing personal health data in the context of the European online pharmacy market: lawful bases under the GDPR and Swedish law.

Over the past three years, the European online pharmacy market has grown significantly and is expected to continue to grow at a rapid pace. One of the key factors that may further catalyse this growth is the personal health data that online pharmacies can collect. If online pharmacies use these data lawfully and with the public interest in mind, this may provide the opportunity to positively transform not only the online pharmacy market but also the entire healthcare industry. In order to maximise the benefits of these personal health data for improving public health but at the same time protect European citizens’ privacy, further analysis of the data protection laws and their applicability in the context of the online pharmacy market is necessary. Currently, there still lacks clarity, for example, regarding the lawful bases under the GDPR for processing personal health data for scientific research purposes. Therefore, this article identifies the main purposes for which online pharmacies may choose to process personal health data and which lawful bases under the GDPR may be suitable to address them. This article will additionally address Swedish law in order to provide an example of the interaction between national laws and the GDPR when processing personal health data in the online pharmacy market.

An Employment Contract with a Teacher: Actual Problems of Concluding Such Contracts and Content of Supporting Documents

The pedagogical activity of a teacher at an educational organization is of a special social significance. The principles of continuity and professionalism of organization and conduct of the educational process have a significant impact on relations regulating conclusion, renewal and the content of an employment contract with a teacher. A turning point in law enforcement practice, as well as in the legislator’s approach to regulating the relations under consideration, took place when Resolution of the Constitutional Court of the Russian Federation No. 32‑P of 15.07.2022 was passed. A modern employment contract with a teacher is not limited to one document. The educational organization (an employer) should pay attention to the documents accompanying the employment contract with the teaching staff. Based on the analysis of current provisions of labor legislation and legislation protecting personal data, the doctrine, judicial and business practice, the author makes conclusions and recommendations regarding the solution of problems related to the conclusion, renewal and content of an employment contract with the teacher, as well as regarding the accompanying documents. The paper substantiates the composition and content of such documents, makes proposals regarding lawful processing of personal data of the teaching staff and reporting to Roskomnadzor.

International legal protection standards personal information

The article examines the specificities of personal data protection at the international level, clarifying the meaning of concepts such as “personal information”, “personal data”, “person” and “identity”. The analysis and synthesis of existing norms of international standards have been carried out, allowing to identify the range of issues requiring elimination of contradictions at the legislative level, in order to increase the efficiency of their application, given the rapid processes of globalisation, development of high technologies and as a consequence – appearance of a new international terrorism form – cyber terrorism, the society requires new approaches and definition of new standards for modern personal data system, resolution of contradictions arising in modern law, legal control over the development of electronic environment and computer systems. To address these issues, the dynamics and specifics of legal regulation in this area have been studied.
 A significant number of monographs and periodicals are devoted to the issue personal data protection. Among them, we can highlight the scientific achieve-ments of M. Bem. K. Bennett, V. Bryzhko, S. Vorren, T. Kostetska, T. Obukhovska, A. Paziuk, K. Polinkevych, I. Sopilko, M. Shvets. Given a large number of statutory regulations and their differences in defining conceptual and categorical apparatus, mechanisms of application of personal information protection standards, a large range of issues in this area of relations are unresolved today, in connection with which their consideration and systematization are relevant.
 Definition of the content and scope of essential features of the "personality", "natural person" and "personal data" terms. The statutory regulations of the European legal system regulating issues related to the protection of personal data are investigated and the most important provisions are highlighted. New European standards in accordance with Regulation 2016/679 are identified.
 It should be noted that international documents in the field of personal data protection have a similar purpose, but at the same time, they do not have a single definition of basic concepts, such as natural person, information, information about a natural person, identified natural person, personal data processing, etc. that complicates their effective understanding and application by all participants of these relations.
 It is worth noting that the adoption of Regulation 2016/67 was a breakthrough in the simplification of the legal regulation. After all, the framework Directive 95/46/EC, which was in force before its adoption, was interpreted differently by each country, which caused many misunderstandings and created obstacles to ensure the human right to privacy. That is why the issue of unification of legal regulation in this area is always relevant and requires continuous improvement and timely response to changes in the information technology space.

PRIVACY AND PROTECTION OF PERSONAL DATA – CRIMINAL LAW ASPECT

Currently, across the globe and on different levels, serious debates are held on the possibilities of modern information communication technologies (ICT), including the internet, as well as their undesirable consequences. To an ordinary person, the “new” way of communicating via the internet and mobile phone is at the same time easy, simple, quick, and essential – it has become a fact of their daily lives. Moreover, the modern age purports the internet as one of the critical means of communication. If used “properly”, it represents an abundance of information on nearly every topic and entails many opportunities. With a vast and varied amount of collected data, it easily negotiates the acquirement of new learning and the shaping of lifestyle. However, the use of modern technologies which constantly transform, at times even completely changing and automatising nearly all areas of human activity, has its dark, destructive, and devastating side. Within that perspective, life in a network becomes increasingly more susceptible to manipulation and abuse. And the list of abuses is long... from having these technologies abused as a database, to an assault on someone’s privacy, stalking, cyber-mobbing, peer violence, sexual harassment and violence, human trafficking, organ trafficking, etc. Thus, a stance is formed – the emergence of new technologies has significantly endangered the right to privacy. In recent years, the right to privacy has been mostly associated with personal data, so, in that regard – when speaking about privacy, it is nearly always done in the context of personal data processing. The right to privacy and personal data protection falls within basic human rights, so, being that it is a fundamental right of man and citizen, the baseline of its protection in our legislation is comprised within, above all, the Constitution, The Law of data protection and The Criminal Code (Art. 146. Unauthorized collection of personal data). As the title suggests, the criminal law aspect of privacy and protection of personal data provided for in Art. 143 of the CC is the focus of this paper. In this context, the author, first of all, embarked on an analysis of the current state of threats to the right to privacy as a prerequisite for action in the direction of its protection. Abandoning the general consideration of this type, the examination is then focused on concretely explaining the meaning and essence of the criminal act – unauthorized collection of personal data, the forms in which it manifests itself, the criminal responsibility and punishment of the person who committed this act. With the statement that this is a dynamically changing reality, some of the key problems and challenges in the application of appropriate mechanisms for the protection of the right to privacy in the Republic of Serbia (with a special emphasis on the year behind us) were highlighted.

Building data management capabilities to address data protection regulations: Learnings from EU-GDPR

The European Union’s General Data Protection Regulation (EU-GDPR) has initiated a paradigm shift in data protection toward greater choice and sovereignty for individuals and more accountability for organizations. Its strict rules have inspired data protection regulations in other parts of the world. However, many organizations are facing difficulty complying with the EU-GDPR: these new types of data protection regulations cannot be addressed by an adaptation of contractual frameworks, but require a fundamental reconceptualization of how companies store and process personal data on an enterprise-wide level. In this paper, we introduce the resource-based view as a theoretical lens to explain the lengthy trajectories towards compliance and argue that these regulations require companies to build dedicated, enterprise-wide data management capabilities. Following a design science research approach, we propose a theoretically and empirically grounded capability model for the EU-GDPR that integrates the interpretation of legal texts, findings from EU-GDPR-related publications, and practical insights from focus groups with experts from 22 companies and four EU-GDPR projects. Our study advances interdisciplinary research at the intersection between IS and law: First, the proposed capability model adds to the regulatory compliance management literature by connecting abstract compliance requirements to three groups of capabilities and the resources required for their implementation, and second, it provides an enterprise-wide perspective that integrates and extends the fragmented body of research on EU-GDPR. Practitioners may use the capability model to assess their current status and set up systematic approaches toward compliance with an increasing number of data protection regulations.

Mathematical Model Investigation of a Technological Structure for Personal Data Protection

The contemporary digital age is characterized by the massive use of different information technologies and services in the cloud. This raises the following question: “Are personal data processed correctly in global environments?” It is known that there are many requirements that the Data Controller must perform. For this reason, this article presents a point of view for transferring some activities for personal data processing from a traditional system to a cloud environment. The main goal is to investigate the differences between the two versions of data processing. To achieve this goal, a preliminary deterministic formalization of the two cases using a Data Flow Diagram is made. The second phase is the organization of a mathematical (stochastic) model investigation on the basis of a Markov chain apparatus. Analytical models are designed, and their solutions are determined. The final probabilities for important states are determined based on an analytical calculation, and the higher values for the traditional version are defined for data processing in registers (“2”: access for write/read −0.353; “3”: personal data updating −0.212). The investigation of the situations based on cloud computing determines the increasing probability to be “2”. Discussion of the obtained assessment based on a graphical presentation of the analytical results is presented, which permits us to show the differences between the final probabilities for the states in the two versions of personal data processing.

Technical Requirements and Approaches in Personal Data Control

There has been a trend of moving from simply de-identification to providing extended data control to their owner (e.g., data portability and right to be forgotten), partly due to the introduction of the General Data Protection Regulation (GDPR). Hence, in this paper, we survey the literature to provide an in-depth understanding of the existing approaches for personal data control (e.g., we observe that most existing approaches are generally designed to facilitate compliance), as well as the privacy regulations in Europe, United Kingdom, California, South Korea, and Japan. Based on the review, we identify the associated technical requirements, as well as a number of research gaps and potential future directions (e.g., the need for transparent processing of personal data and establishment of clear procedure in ensuring personal data control).