Processing Of Personal Information Research Articles

Cross-Border Data Flows and the Protection of Personal Information Act 4 of 2013 – Part I: The Territorial Scope Provision

The Protection of Personal Information Act 4 of 2013 (POPIA) was introduced to protect the right to privacy of the South African data subject. The Act prescribes obligations that a responsible party must fulfil to achieve this purpose. However, for the Act to be enforced against a responsible party who has transgressed any of its provisions, the responsible party needs to be brought under its jurisdiction. To that end, POPIA makes provision for a territorial scope provision (section 3) based on the notion of domicilium and the use of automated and non-automated means for processing personal information situated in the Republic. This article makes use of comparative analysis to interpret the content of these provisions with reference to the European Union (EU)'s 1995 Data Protection Directive (DPD), on which they were modelled, and its successor, the 2016 General Data Protection Regulation (GDPR). The article demonstrates that section 3 can give rise to interpretative uncertainties which could result therein that personal information processed by responsible parties who are outside the Republic would not be regulated by the Act, or that these parties could move their processing activities out of the country to escape liability. An expansive interpretation of these provisions by the courts is needed to plug these gaps; alternatively, legislative revision must be undertaken in line with developments in the EU, where the GDPR endeavoured to address some of these aspects.

개인정보자기결정권과 이익형량 - 대상판결: 대법원 2016. 8. 17. 선고 2014다235080 판결 -

The Personal Information Protection Act (PIPA) stipulates stringent controls over personal information. Data processors are, in principle, prohibited from collecting or processing personal information without the data subject’s consent. This grants the data subject exclusive control over their personal information, which can be compared to the rights of a property owner. However, personal information covers a wide range of data, including neutral information unrelated to the secrecy of private life. Furthermore, since concepts like "identifiability" are vague and indeterminate, it is not easy to define the exact scope of personal information. This suggests that a more flexible approach to protecting personal information is required. The right to control personal information remains abstract, retaining much of its idealistic and declaratory nature from its initial advocacy. As such, this right must consider not only the need for information control but also the public's access to information, freedom of expression, the technological and industrial utility of information, and the interests of data processors who collect and process that information. In the case under review, the data processor collected and provided publicly available personal information without the explicit consent of the data subject. While this may partially limit the data subject's right to control their personal information, the general public interest in utilizing publicly available personal information must also be considered. The current PIPA does not provide a clear legal basis for the broad utilization of publicly available personal information. Justification for such use must instead be found in the general principles of civil law, such as those in Articles 2, 103, 750, and 751 of the Civil Act, along with the balancing of competing interests. This was the general approach to protecting the right to control personal information under Korea's legal system before the enactment of the PIPA, and it remains applicable even after its implementation.

Strict liability versus negligence in the case of data breach

This study compares the efficiency of the strict liability and negligence rules in the case of a data breach. Contrary to standard results, we demonstrate that the strict liability rule cannot induce the efficient activity and care levels of a data controller. This is mainly due to possible positive externalities from data breaches, unlike in usual tort cases. We show that the negligence rule is more efficient than the strict liability rule if the positive externality is sufficiently large. The main insight is carried over to the case where a data controller uses a data processor to process personal information before selling it in the market. If hackers are explicitly introduced into the model, the care level of the data controller increases with the hacking activity, whereas the latter level decreases with the former. In this model, if the hacker’s gain is sufficiently small, the negligence rule can be made more efficient by adjusting due care to a harsher level than the equilibrium care level under strict liability to reduce hacking activity, although a pure strategy equilibrium may not exist for some due care levels.

Research on Personal Information Protection in the Context of Generative Artificial Intelligence

Personal information is the foundation of generative AI, and ChatGPT-like generative AI needs to process a large amount of personal information at various stages such as model training, model generation, and model optimization, which also has a certain impact on traditional personal information protection rules. During the information collection phase, generative AI may fugitive the informed consent rules and infringe on the privacy rights of information subjects. In the information utilization stage, generative AI may impact basic personal information processing rules such as the principle of purpose limitation and the principle of openness and transparency, increasing the risk of personal information leakage. At the information generation stage, generative AI can generate false and discriminatory information. Therefore, in the context of generative AI, personal information protection is faced with the problems of the notification and consent rules being hollowed out, the principle of minimum necessity being voided, and the frequent leakage of personal information. Based on this, it is necessary to promote the transformation of the "personal control center to the risk control center" of the notification and consent rules, promote the risk-based interpretation of the principle of least necessary, and improve the risk-based personal information protection compliance system to solve the problem of personal information protection in the context of generative AI.

Legislative mechanisms of personal data protection in the health care system

Human rights and freedoms, guarantees of their observance and protection should be the basis of the activities of any democratic country in the world. The issue of information security becomes particularly relevant in modern conditions, because medical institutions collect and store personal data of persons who contact them, the results of laboratory and instrumental research, diagnoses, medical histories, etc. Endless reforms, changes in legislation, introduction of an electronic system in the field of health care cause a lot of discussions about individual mechanisms of its functioning and ensuring the protection of personal data. The collection of personal data must be lawful, subject to strict requirements and for a legitimate purpose. In addition, persons or organizations engaged in the collection and processing of personal information must protect it from abuse and respect the rights of data owners guaranteed by law. The reform of legislation in the field of data protection should take place in parallel with the dynamic process of development of Internet technologies, including the creation of a formalized system of legislation in the field of privacy. In addition, considerable attention should be paid to the level of awareness of citizens about how their personal data may be collected and used. In particular, the request for consent to the processing of personal data must be clear; access to own data should be simplified and their mobility should be increased for easier transfer of data from one service to another; companies and organizations must report serious security breaches in a timely manner. And of course, ensuring the appropriate level of responsibility and reporting of all those involved in personal data processing. Health care is increasingly reliant on information technology. More and more hospitals and healthcare institutions are using information and communication technologies to support and improve their work. Digital technologies are widely used in the public health care sector, including electronic prescriptions, appointments with a family doctor, records of services rendered, hospitalization, hospital discharge, etc. In this context, a wide range of eHealth tools and services have emerged. Electronic medical records are created in such a way that it is possible to transfer patient data between different medical professionals. Although digital health technologies have so many important functions, their high dependence on sensitive patient health information can cause information security issues. At the same time, a significant part of personal health data is often collected without informing patients about it.

Research on the legal framework of personal information privacy protection in automated administrative environment: centered on data security and rights balance

In the digital age, with the increasing importance of personal information, especially in the field of automated administration, the protection of personal information is particularly urgent. Ensuring the security of personal information in automated administration not only helps to safeguard the realization of individual dignity rights and meet the inherent requirements of the principle of proportionality, but also regulates the use of algorithms to avoid discrimination. However, although the legislation on the protection of personal information in automated administration has made some progress, there are still some shortcomings: the legislation is not directly specified, the law is not operable, the supervision and management mechanism is not perfect; There are also problems at the law enforcement level: improper use of immunity in administrative procedures, excessive expansion of the scope of personal information processing; In the relief aspect, there are also challenges: the provisions of administrative public interest litigation are vague, and there are loopholes in the way of liability. In order to improve the protection mechanism of personal information in automated administration, it is necessary to expand the direct regulation of automated administration in legislation, enhance the operability of laws, and improve the supervision and management mechanism of personal information. At the same time, it is also necessary to amend the administrative due process and strictly implement the principle of least necessity at the level of law enforcement. In terms of relief, the applicable rules of administrative public interest litigation should be clarified, and more targeted ways of assigning blame should be established.

Plugins and POPI: A Critical Discussion into the Legal Implications of Social Plugins and the Protection of Personal Information

Social plugins are one of the many trackers used by companies with an online presence. However, under the Protection of Personal Information Act 4 of 2013 (POPI), these trackers have certain legal consequences for internet users. The main reason for this is that trackers tend to process personal information without informing internet users that their data are being collected, the reason for the collection or processing thereof, or who the responsible parties are that are collecting and processing the personal information. The article looks at these issues, amongst others, in the light of a 2019 judgment from the Court of Justice of the European Union or CJEU, namely, Case C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW e.V. EU:C:2019:629. Due to the fact that it has had data protection legislation for much longer than other countries or legal jurisdictions, including South Africa, the European Union (the EU) has a substantial body of case law interpreting the data protection legislation of the EU itself as well as that of the individual member states. One of the main instruments used as guidance by the drafters of POPI was Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (hereafter Directive 95/46). Directive 95/46 was previously considered the gold standard, before Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation) (hereafter the GDPR) was enacted and Directive 95/46/EC was finally repealed. Since Directive 95/46 was one of the main guiding documents used in drafting POPI, one may expect that the South African courts may turn to the EU and consider how the CJEU has interpreted the similar provisions contained in Directive 95/46, especially since there is very little South African jurisprudence available on POPI. The four main issues under discussion are: who, other than the internet users, has the locus standi to bring an application in terms of POPI? Second, what are the responsibilities of joint responsible parties towards internet users? Third, where there are joint responsible parties, do both need a legitimate interest to process personal information? Lastly, who will be responsible for obtaining the necessary consent to process the personal data?

Safeguarding Minors' Personal Data: Legal Principles in Information Security in Ukraine and Eurupean

The research aims to uncover the legal regulations pertaining to the protection of minors' personal data, considered a crucial component of informational security. Through an analysis of Ukrainian and European legislation, in conjunction with the General Data Protection Regulation and the California Consumer Privacy Act, this study seeks to explore preventive measures against third-party abuse of children's information. The research highlights the responsibilities imposed on state authorities and legal entities, based on Ukrainian and European legislation, to safeguard personal data. The methodology employed in this article involves the utilization of both general scientific and specialized methods of scientific cognition. The specificity of the research subject, along with its purpose and tasks, guided the selection of these methods. The research results reveal various problematic issues related to the collection, storage, use, and distribution of personal data of minors. The obligation to protect an individual's rights to the processing and preservation of personal data or private information is a responsibility placed on state authorities in accordance with the legislation of Ukraine and European countries (Germany, Switzerland, France, Italy, Norway, Great Britain), as well as on legal entities that own or store the specified personal data. In conclusion, the protection of personal data emerges as a fundamental right, integral to the broader rights of family and private life. The study also underscores the importance of international cooperation mechanisms in addressing this multifaceted issue.

A comparative study between zero-knowledge proof (ZKP) and ring signatures targeting the legal and regulatory implications with the general data protection law (GDPL) and general data protection regulation (GDPR)

Privacy protection ensures that individuals have control over personal data, preventing abuse and preserving trust in the use of online services. In the “Digital Era”, where the collection, storage and processing of personal information have become ubiquitous, data privacy emerges as a relevant topic. In this sense, laws were created, such as the General Data Protection Law (LGPD) in Brazil and the General Data Protection Regulation (GDPR) in Europe, to control privacy and the processing of personal data. The article presents a comparative analysis of 2 (two) data privacy mechanisms, the Zero-Knowledge Proof (ZKP) and Ring Signatures, used in Blockchain, aiming at the legal and regulatory implications with the LGPD and GDPR. The comparative study between ZKP and Ring Signatures highlights the flexibility of ZKP in various contexts, including voting and secure authentication systems, while Ring Signatures offer significant advantages in terms of scalability and efficiency in systems where subscriber anonymity is considered fundamental. Furthermore, the legal and regulatory implications of the ZKP are discussed, mainly in relation to LGPD and GDPR. Finally, the article concludes that the comparative analysis offers insights into applications, challenges and legal and regulatory implications, particularly in relation to data privacy and compliance with regulations such as LGPD and GDPR.

Simulation of cross‐pedestrian flow in intersection based on direction fuzzy visual field

AbstractPedestrian flow refers to the spatiotemporal distribution of people moving in a defined area. At crosswalks, pedestrian dynamics exhibit complex self‐organization patterns resulting from interactions between individuals. This paper proposes a novel crosswalk pedestrian flow model based on the concept of directional fuzzy visual field (DFVF) to capture pedestrian heterogeneity. The DFVF defines fuzzy distributions of personal space and information processing capabilities, enabling improved representation of diversity compared to previous models. Incorporating k‐nearest neighbour rules in the DFVF pedestrian network topology also better mimics real‐world interactions. Using a cellular automata framework, pedestrian self‐organization effects like stratification and bottleneck oscillation are simulated at intersections. The model replicates empirically observed dynamics of density, velocity, and evacuation time. Results demonstrate that controlling pedestrian conflicts can effectively enhance crosswalk flow efficiency. This research introduces new techniques for simulating pedestrian psychology and behaviour, providing a valuable contribution to pedestrian flow theory and supporting crosswalk design optimization.

Ensuring information security of Ukraine in the conditions of modern challenges and threats from the Russian Federation

The article examines the issue of ensuring information security of Ukraine in the conditions of modern challenges and threats from the Russian Federation. It is noted that the stability of the functioning of institutions of public authority, the preservation of law and order is a necessary prerequisite for the observance of human rights. In the conditions of technological development, ensuring information security is one of the most important guarantees of human rights. The basis of such guarantees is the observance of the principles of confidentiality, integrity and availability of information and information systems. In order to ensure the information security of the individual, special legal frameworks for the protection of the right to the inviolability of private life are being developed, as well as additional mechanisms for its protection related to the establishment of specific requirements in the field of collection and processing of personal information. In order to ensure national security and information security of the state as one of its components, the most important guarantee of human rights is the observance of the principle of proportionality when restricting them. Most states have responded to the threats to national security that have grown recently by expanding the authorities' powers to access, collect and process personal information, which are now not limited to any particular categories of information. At the same time, approaches to ensuring the proportionality of measures taken to ensure national security may also differ in different states. It is emphasized that the actions of modern terrorists go beyond elementary humanitarian principles (in this context, we can talk about the Russian Federation as the most dangerous terrorist of the modern period of human development). There is contempt for the basics of humanity. In the conditions of such a struggle, it is difficult to call for respect for human rights, to apply this message to those who completely ignore it. Almost every day, state institutions, mass media, critical infrastructure objects, and the life support system are exposed to powerful cyber attacks using advanced information technologies. All this is part of a coordinated informational aggression against Ukraine. It was concluded that special attention should be paid to the tasks of protecting the relevant resources of the executive authorities, including the Ministry of Foreign Affairs of Ukraine. It is necessary to constantly improve the measures taken for this purpose, to establish day-to-day control of the execution of relevant assignments of the Cabinet of Ministers of Ukraine. It is emphasized that in the conditions of geopolitical instability and transformation of the world order, modern cyber­attacks, which are characterized by non-standard methods, methods and means of their perpetration, require, at the legislative level, prompt work to prevent and prevent a destructive impact on domestic information resources and the information infrastructure of the public and private sector.

Broad consent for biobank research in South Africa - Towards an enabling ethico-legal framework

ABSTRACT Broad consent is permitted by the South African National Department of Health Ethics Guidelines but appears to be prohibited by section 13(1) of the Protection of Personal Information Act 4 of 2013. Additionally, the Act mandates that all personal data (including biobank sample data) be collected for lawful, explicit, and clearly defined purposes. There is possibility for ambiguity in interpretation because of this discrepancy between the two instruments. Given the association between the transfer of samples and data, the long-term nature of biobanking, which makes it impractical to provide too much or enough information because it is simply not available at the time of sample collection, and the various ways that the Protection of Personal Information Act 4 of 2013 have been interpreted, we aim to demonstrate that South Africa’s current regulatory framework should appropriately permit broad consent use for biobank research where the transfer of samples and their associated data are contemplated. In summary, the proposed amendments include removing regulatory ambiguity regarding broad consent use, ensuring adequate safeguards for research participants by specifying rules for data access and personal information processing, and incorporating consent form information requirements into the national Consent Template.

POPIA does indeed apply to health research: A response to Bronstein and Nyachowe

Bronstein and Nyachowe recently argued that the conditions for the lawful processing of personal information, as provided in the Protection of Personal Information Act 4 of 2013 (POPIA), do not apply to health research in South Africa. This article critically analyses the authors’ interpretation of section 3(2)(b) of POPIA and challenges two of its aspects.

Cooperative governance mechanisms for personal information security: an evolutionary game approach

PurposeThis paper aims to investigate the cooperative governance mechanisms for personal information security, which can help enrich digital governance research and provide a reference for the formulation of protection policies for personal information security.Design/methodology/approachThis paper constructs an evolutionary game model consisting of regulators, digital enterprises and consumers, which is combined with the simulation method to examine the influence of different factors on personal information protection and governance.FindingsThe results reveal seven stable equilibrium strategies for personal information security within the cooperative governance game system. The non-compliant processing of personal information by digital enterprises can damage the rights and interests of consumers. However, the combination of regulatory measures implemented by supervisory authorities and the rights protection measures enacted by consumers can effectively promote the self-regulation of digital enterprises. The reputation mechanism exerts a restricting effect on the opportunistic behaviour of the participants.Research limitations/implicationsThe authors focus on the regulation of digital enterprises and do not consider the involvement of malicious actors such as hackers, and the authors will continue to focus on the game when assessing the governance of malicious actors in subsequent research.Practical implicationsThis study's results enhance digital governance research and offer a reference for developing policies that protect personal information security.Originality/valueThis paper builds an analytical framework for cooperative governance for personal information security, which helps to understand the decision-making behaviour and motivation of different subjects and to better address issues in the governance for personal information security.

Rights of data subjects in the processing and use of personal information by automated decision-making systems

Rights of data subjects in the processing and use of personal information by automated decision-making systems

Unraveling the behavioral influence of social media on phishing susceptibility: A Personality-Habit-Information Processing model

Frequent and habitual engagement with social media can reinforce certain activities such as sharing, clicking hyperlinks, and liking, which may be performed with insufficient cognition. In this study, we aimed to examine the associations between personality traits, habits, and information processing to identify social media users who are susceptible to phishing attacks. Our experimental data consisted of 215 social media users. The results revealed two important findings. First, users who scored high on the personality traits of extraversion, agreeableness, and neuroticism were more likely to engage in habitual behaviors that increase their susceptibility to phishing attacks, whereas those who scored high on conscientiousness were less likely. Second, users who habitually react to social media posts were more likely to apply heuristic processing, making them more susceptible to phishing attacks than those who applied systematic processing.

Streamlining regulatory processes for health researchers: To what extent does POPIA apply?

Personal information in health research commands utmost protection while also preserving the growth of health research.This paper aims to establish which legislation applies when processing personal information for health research. South Africa regulates health research on human subjects through a network of Human Research Ethics Committees. The Protection of Personal Information Act No. 4 of 2013 (POPIA) has recently come into force. Section 2(3)(b) of POPIA provides that POPIA does not apply where other legislation creates 'more extensive'conditions for the lawful processing of personal information than Chapter 3 of POPIA does. We show that the provisions of the sectoral legislation on health aremore extensivethanthe conditions in Chapter 3 of POPIA and hence the sectoral legislation prevails.Thissimplifies the regulation of health research.One of theimplications of this finding is that the definition of broad consent in the sectoral legislation for health research should be applied to the exclusion of the consent provisions in POPIA.

Systematic construction of lawfulness of processing employees’ personal information under China's personal information protection law

With the rapid development and widespread use of digital technologies in the workplace in China, employers’ right to monitor and direct employees has often been abused, raising a number of disputes over the infringement of employees’ right to privacy in terms of their personal information. China must urgently develop an appropriate approach to balancing these two conflicting interests. However, there is currently no coherent and uniform regime governing the protection of employees’ personal information in China. The primary legal source on which employers can rely is the latest version of the Chinese Personal Information Protection Law (PIPL), which offers three lawful bases for employers’ processing of their employees’ personal information. These bases are employee consent; “necessity for the conclusion or performance of an employment contract”; and “necessity for conducting human resource management.” Concerns have been expressed regarding the reasonableness and effectiveness of the three lawful bases under the PIPL. First, it is both legally and practically problematic for the PIPL to rely so heavily on employee consent. Second, it is unclear whether the other two lawful bases relieve employers of the duty of notification and, if so, how to safeguard employees’ right to know. Third, the ambiguous standard of “necessity” requires clarification.This article argues that China should adopt many elements from EU law, while US law should be only followed in relation to the standard of “necessity”. In relation to employee consent, the EU approach is preferable to the US approach. As the EU approach does not generally regard employees’ consent as a lawful basis for the processing of their information and uses the other two lawful bases as alternatives to employee consent, this approach better reflects the customary practices of employee subordination and employer control in China. In contrast, US law deems employee consent to be an absolute general defense to the tort of privacy violation and adopts an employer favoritism approach to balancing these two conflicting interests, which is not appropriate in the Chinese context. In relation to the scope of necessity, three tests taken from the EU and US approaches should be considered by the Chinese courts. In addition, when processing personal information based on the other two lawful bases, employers should safeguard employees’ right to know through collective contracts concluded with labor unions or employee representatives under the Chinese Labor Contract Law, which would effectively address employers’ arbitrariness. Ultimately, these changes would produce a better balance between employees’ right to privacy in terms of their personal information and employers’ need to subordinate and control employees.

A novel privacy protection method of residents' travel trajectories based on federated blockchain and InterPlanetary file systems in smart cities.

The government does have to record and analyze the travel trajectories of urban residents aiming to effectively control the epidemic during COVID-19. However, these privacy-related data are usually stored in centralized cloud databases, which are prone to be vulnerable to cyber attacks leading to personal trajectory information leakage. In this article, we proposed a novel secure sharing and storing method of personal travel trajectory data based on BC and InterPlanetary File System (IPFS). We adopt the Hyperledger Fabric, the representative of Federated BC framework, combined with the IPFS storage to form a novel mode of querying on-chain and storing off-chain aiming to both achieve the effectiveness of data processing and protect personal privacy-related information. This method firstly solves the efficiency problem of traditional public BC and ensures the security of stored data by storing the ciphertext of complete personal travel trajectory data in decentralized IPFS storage. Secondly, considering the huge amount of information of residents' travel trajectories, the method proposed in this article can obtain the complete information under the chain stored in IPFS by querying the index on the chain, which significantly improves the data processing efficiency of residents' travel trajectories and thus promotes the effective control of the new crown pneumonia epidemic. Finally, the feasibility of the proposed solution is verified through performance evaluation and security analysis.

Digital Health Information Systems in the Member States of the Commonwealth of Independent States: Status and Prospects

This paper examines the status of the development of national digital health information systems (HIS) in Commonwealth of Independent States (CIS) member states. Data for research were collected using a questionnaire adapted from the questionnaire of the WHO’s Third Global Survey on eHealth. The results showed that the digital transformation of HIS was occurring in all seven CIS member states (participating in the study), which were financed by different resources. Laws and regulations on electronic medical records (EMR) use were present in almost all participating CIS member states. Various international standards and classifications were used to support development and the interoperability of digital health information system (d-HIS), including International Classification of Diseases (ICD), Digital Imaging and Communications in Medicine (DICOM), ISO 18308, Logical Observation Identifiers, Names, and Codes (LOINC), Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT), and ISO TC 215. Several CIS member states had adopted a national information security strategy for the safe processing of both personal data and medical confidential information. The digital transformation of healthcare and the Empowerment through Digital Health initiative are taking place in all CIS member states, which are at different stages of introducing electronic medical and health records.