Protection Obligations Research Articles

Responsibility for Data Protection in a Networked World – On the Question of the Controller, ‘Effective and Complete Protection’ and Its Application to Data Access Rights in Europe

In the current networked world almost no system in which personal data is processed stands on its own. For example: Websites and mobile applications integrate third party services for behavioral targeting, user analytics, navigation and many others functionalities. Governments build central infrastructures to share data efficiently between different branches of government and with other organizations. This paper analyses the current system in Europe for determining who is (or better: are) responsible for observing data protection obligations in such networked service settings. In doing so we address the problems (1) of ambiguity in applying the concept of data controller in networked settings, and (2) of insufficiencies in the framework for establishing the extent of the responsibilities in situations of joint control. We look at how the law and regulators address these problems and how the European Court of Justice tackles these problems by applying the principle of “effective and complete protection”. The issue of joint responsibility has gained particular relevance in the wake of Wirtschaftsakademie, a case recently decided by the European Court of Justice. In this case, a Facebook fan page administrator was found to be a joint-controller and therefore jointly responsible together with Facebook for observing data protection rules. Following this decision, there are many more situations of joint control than previously thought. As a consequence part of the responsibility for compliance with data protection legislation and risk of enforcement measures is moved to those who integrate external services. This will change the incentive structure in such a way that joint-controllers will place a much higher value on data protection. To explore the practical implications of the legal framework, we analyse a number of examples taken from our earlier empirical work on the right of access to reflect on the newly emerging data responsibility infrastructure. We show that the coordination of responsibilities is complex in practice, because many organizations do not have a clear overview of data flows, because of power imbalances between different actors, and because personal data governance is often happening in separated specialised units.

Structuring cumulative effects assessments to support regional and local marine management and planning obligations

Cumulative effects assessments are a legal requirement in many jurisdictions and are key to informing marine policy. However, practice does not yet deliver fit-for-purpose assessments relative to sustainable development and environmental protection obligations. The complexity of cumulative effect questions, which are embedded in complex social-ecological systems, makes multiple, methodologically diverse assessments a necessity. Using the expansion of marine renewable energy developments in European Union waters as a case study, this paper explores how social-ecological systems thinking and cumulative effects assessment theory can combine to structure CEAs that better support the management and regulation of maritime activities at regional scales. A general perspective for cumulative effects assessment is proposed to remove ambiguity of intent and to orient assessments towards a common objective. Candidate principles for practice are presented for consideration. These principles are integrated into a stepped assessment approach that seeks to improve cumulative effects assessments of localised activities relative to the information needs of decision-makers implementing the ecosystem approach.

The Standard of Due Diligence in Full Protection and Security Obligation: A Pro-Investor Standard?

Recently, a developing country was held liable to a foreign investor for not preventing acts of terrorism. This is not fiction, it is the ICSID case of Ampal v. Egypt. The basis for such responsibility in investment treaties is typically a legal obligation of host states called Full Protection and Security (“FPS”). An ICSID decision like Ampal obviously has wide-ranging implications on the Investment State Dispute Settlement (“ISDS”) system. Although it is often perceived as disastrous by many prominent scholars, it is indeed an eye-opener to the importance of defining the due diligence standard under the FPS. Neither Customary International Law nor ICSID Tribunals had provided for clear and concise borders of the due diligence standard required from host states to fulfill their FPS Obligation. This article aims to read into Customary International Law and ICSID Case Law to provide for specific thresholds that Tribunals can utilize to assess whether a host state complies with its FPS obligation or not.

Data Controllers, Data Processors, and the Growing Use of Connected Products in the Enterprise: Managing Risks, Understanding Benefits, and Complying with the GDPR

Modern enterprises increasingly purchase and deploy products and services from third parties that collect data as part of providing the services. In this context, there is a common belief that the enterprise must be the “data controller” (in the terminology used in European data protection law), and the third-party provider must be a “data processor” acting on behalf of the enterprise. However, such a blanket rule is neither required by the law nor reflective of reality. There are many instances in which a third-party provider acts in whole, or in part, as a data controller. While the characterization of the third-party provider as a controller or a processor has certain legal ramifications, the difference may be less significant under the General Data Protection Regulation (GDPR) than under prior European data protection law. Legal compliance, risk mitigation, and appropriate protection of personal data can be achieved whether using products and services provided by data controllers or data processors; and there are pros and cons to each approach. This paper describes the data protection obligations on organizations that purchase and deploy products and services that collect and transmit data to a third-party provider. For each obligation, it will discuss the similarities and differences (if any) in those obligations between those cases where the data is collected by a data processor and those where the data is collected by a data controller. This paper focuses on those obligations imposed by the European GDPR; but because many of the principles and obligations occur in other privacy laws around the world, many of the conclusions can be generalized for global approaches to compliance.

ASPECTS OF PROTECTION OF DEVELOPMENT ENTERPRISE’S RIGHTS TO INTELLECTUAL PROPERTY ITEMS

When performing research, development, and engineering (RD&E) financed using state, regional, or municipal budget funds, legal relations between a customer and a RD&E contractor with regard to ownership of a created intellectual property are regulated by Part 4 of the Civil Code of the Russian Federation [1]. The intellectual property includes patentable innovative solutions which are qualified as intellectual property items. According to the applicable legal standards and law enforcement practice, patent protection obligations with regard to the created intellectual property items are imposed on the RD&E contractors. However, patent right holders with regard to these intellectual property items are the RD&E customers. As a result, the RD&E contractors face several difficulties, delays, and limitations with regard to patenting the intellectual property items and do not obtain necessary privileges to the full extent in connection with patenting the created intellectual property items. This article analyses the applicable procedure for distribution of the rights and obligations between the contractors and customers of the RD&E with regard to the patent protection of the created intellectual property items. Using experience of JSC Principle Production and Technical Company Granit as an example, a possibility of protecting RD&E contractors' interests by pre-emptive patenting of the intellectual property items prior to RD&E activities start is explained.

Research on the Relationship between Management Capability and Corporate Environmental Information Disclosure: Based on the Perspective of Moderating Effects of Power Distance and Marketization Process

The construction of ecological civilization is a major strategy in China. Under the background of national strategy, how to deal with the deteriorating ecological environment has become a problem that the whole society needs to solve urgently. As an economic entity that consumes natural resources and discharges pollutants, enterprises should be the backbone of assuming social responsibility and fulfilling environmental protection obligations. Therefore, corporate environmental information disclosure has become a topical issue in theoretical research. Previous studies have shown that managers' personal characteristics and external institutional pressures are important factors that affect the level of corporate environmental information disclosure, but the lack of inspection of management capability that reflected in the overall quality of managers will have an impact on corporate environmental information disclosure. In order to deeply discuss the relevance of management capability and corporate environmental information disclosure quality, the paper is based on the upper echelon theory, reputation theory and legitimacy theory, collected environmental data from the social responsibility report of 340 listed companies in heavy pollution industry in Shanghai and Shenzhen stock markets from 2011 to 2016. By establishing environmental information disclosure index to measure the company's environmental information disclosure quality and DEA-Tobit model to measure management capability to conduct empirical research, the result shows that the management capability is positively correlated with the quality of corporate environmental information disclosure. Then by distinguishing between state-owned enterprises and private enterprises, it finds that the management capability of state-owned enterprises can play a greater role to reveal better environmental information. Furthermore, the paper takes the informal system as breakthrough point, brings forward power distance that based on the Chinese traditional cultural context as a moderator variable, and focuses on the core dual-body structure between chairman of the board and general manager. The research result shows that the power distance would play a regulatory role in the correlation between management capability and the quality of corporate environmental information disclosure. When the power distance between chairman of the board and general manager is higher, it significantly inhibits management capability to improve the quality of corporate environmental information disclosure. It reveals that China's peculiar unity of command phenomenon makes the top leader’s power too concentrated, which is detrimental to the sustainable development of the company. At the same time, the degree of marketization in various regions in China is not balanced. It is valuable to explore the marketization process's role in regulating the relationship between management capability and corporate environmental information disclosure. The research result shows that under the situation of rapid marketization, the positive effect of management capability on the quality of corporate environmental information disclosure is more obvious. Through the study of the correlation between internal and external factors on management capability and environmental information disclosure, the paper puts forward relevant countermeasures from three aspects of the company, the government, and the market, in order to encourage and restrain companies to voluntarily perform environmental responsibility, regulate the environmental information disclosure behavior, improve the quality of environmental information disclosure, and jointly build a green and low-carbon society.

LEGAL PERSPECTIVES ON SOCIO-ECONOMIC STATUS OF WOMEN IN AZAD JAMMU AND KASHMIR

This article focuses on legal perspectives of women’s social and economic status in Azad Jammu and Kashmir (AJK). The bulk of international human rights instruments provide that human rights are available to ‘everyone’ as grounded in Universal Declaration of human rights (UDHR), (1948) and other human rights instruments. In relation to women, economic, social and cultural (ESC) rights are specifically grounded in UDHR, Women’s Convention and the International Covenant of Economic, social and cultural rights (ICESCR), (1966). In this context, this paper analyses relevant provisions of women’s rights in order to highlight obligations of AJK pertaining to protection of ESC rights. It discusses the ESC status of women with linkage to Millennium development goals (MDGs). It aims to discuss that what are socio-economic conditions of women in AJK? Is there any pattern of vulner-ability in this respect? In general, ESC rights are considered as mere aspirations and goals therefore the Maastricht guidelines are also formulated. The argument developed throughout article is that though AJK is not a State but is state-like entity and has its human rights obligations, in particular, ESC obligations for promotion and protection of women. The women in AJK are vulnerable and may be empowered by promotion of ESC rights. Keywords: ESC rights, women in AJK, human rights

Scientific rationale and international obligations for protection of active hydrothermal vent ecosystems from deep-sea mining

There is increasing interest in mining minerals on the seabed, including seafloor massive sulfide deposits that form at hydrothermal vents. The International Seabed Authority is currently drafting a Mining Code, including environmental regulations, for polymetallic sulfides and other mineral exploitation on the seabed in the area beyond national jurisdictions. This paper summarizes 1) the ecological vulnerability of active vent ecosystems and aspects of this vulnerability that remain subject to conjecture, 2) evidence for limited mineral resource opportunity at active vents, 3) non-extractive values of active vent ecosystems, 4) precedents and international obligations for protection of hydrothermal vents, and 5) obligations of the International Seabed Authority under the UN Convention on the Law of the Sea for protection of the marine environment from the impacts of mining. Heterogeneity of active vent ecosystems makes it extremely challenging to identify “representative” systems for any regional, area-based management approach to conservation. Protection of active vent ecosystems from mining impacts (direct and indirect) would set aside only a small fraction of the international seabed and its mineral resources, would contribute to international obligations for marine conservation, would have non-extractive benefits, and would be a precautionary approach.

Major legal ruling on a company’s data protection obligations outside the country where it is headquartered: Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság

This paper is about the decision of the European Court in Weltimmo. The case concerns a company’s data protection obligations where it conducts services in a country other than where the company has its main business headquarters. This is an important decision as it will potentially affect many businesses, as they will be held accountable to that country’s regulation by their data protection agency. This decision and its implications should also be looked at further in light of the developments made by the introduction of the General Data Protection Regulation (GDPR).

Command Responsibility in Peacekeeping Missions: Normative Obligations of Protection in a Criminal Law Environment

The passive stance taken by respectively Belgian and Dutch peacekeeping commanders towards the commission of genocide in both Kigali (Rwanda) and Srebrenica (Bosnia Herzegovina) has been challenged in domestic courts in recent years. As a result, the individual responsibility of the peacekeeping commanders involved has been addressed. Peacekeeping operations' distinct, normative character combined with the remoteness of peacekeeping troops vis-a -vis the parties to the conflict complicate any legal assessment made regarding the commanders' accountability under international criminal law. This article explores whether a separate type of command responsibility could be developed to fit the specific circumstances in which military commanders operate, based on the command responsibility applied to occupation commanders in post-Second World War trials. Situations of occupation and peacekeeping are characterised by a similar focus on positive rather than negative obligations of protection. Such a normative context may influence how their criminality is perceived. Therefore, this article considers the use of the German Funktionslehre to differentiate between security control and custodial control. That distinction could separate 'peacekeeping command responsibility' from regular command responsibility. Culpability would then be incurred for the failure to act rather than for the crimes committed by a commander's subordinates. Using such a context-sensitive approach to command responsibility for peacekeeping commanders could further a fair assessment of the commander's liability by taking the normative environment in which peacekeeping takes place into account.

Blusun S.A. and others v Italy: Legal (in)stability and renewable energy investments

Blusun S.A. and others v Italy is one of the latest arbitral awards in a torrent of disputes concerning the modification of incentives in the renewable energy market. The tribunal ruled in favour of Italy, reaffirming the power of host States to change regulations to adapt to new needs and elucidating the connection between the concept of ‘legal stability’ and investors’ ‘legitimate expectations’. However, a few months later, in Eiser v Spain, another tribunal ruled in favour of investors, emphasizing that States’ regulatory powers are not absolute, and drastic legislative changes might breach investment protection obligations. The existence of contrasting outcomes in these cases underlines the importance of monitoring the gradual evolution of this sprouting segment of jurisprudence. While each award is closely connected to its specific legal and factual context, this stream of rulings is slowly contributing to clarify the limits to host States’ regulatory freedom in the renewable energy sector.

Обеспечительный платеж как способ обеспечения внедоговорных охранительных обязательств

Обеспечительный платеж как способ обеспечения внедоговорных охранительных обязательств

The Practical Consequences of the CJEU Judgment of 18 July 2013 Changing Its Doctrine on the Respective Competences of the EU and its Member States to Apply the TRIPS Agreement: Have We Seen the Tip of the Daiichi Iceberg Yet?

In its judgment of 18 July 2013, the Court of Justice of the European Union (“CJEU”) came to the conclusion that after the entry into force of the Lisbon Treaty on 1 December 2009, all the provisions of the TRIPS Agreement fall within the field of the common commercial policy and that, therefore, national courts of Member States are no longer competent to apply and/or interpret them on their own. This was a radical change from the doctrine laid down in its judgments of 14 December 2000 and 11 September 2007, where the CJEU had concluded that in the fields (such as patents) where the EU has not yet legislated, the Member States remained principally competent. This article, by analyzing the practical consequences that such judgment has had on the case law of national courts during the past three years, demonstrates that this bold change of doctrine in fields such as patent law has placed the EU and its Member States in an impossible situation: the institution (EU) that, according to the CJEU, would now be competent is incapable of complying with the obligations of protection introduced by the TRIPS Agreement. This is because the EU does not have a patent office and it has recently decided that it does not want to have one. Furthermore, the institutions (administrative and judicial authorities of Member States) that would be capable of complying with such patent protection obligations would no longer be competent. As a result, this change of doctrine has paradoxically left the EU and its Member States exposed to the risk of being called before the WTO Dispute Settlement Body for failing to comply with such protection obligations (in particular, Art. 70.7 of the TRIPS Agreement).

The Rise of Consensual Containment: From Contactless Controll to Contactless Responsibilityy for Forced Migration Flows

This chapter centres on the rise and reinforcement of the 'containment paradigm' of refugee flows in developed countries, particularly in Europe. It traces the emergence of new forms of trans-national cooperation with neighbouring States, especially Libya and Turkey, for the 'management' (if not deterrence) of unwanted fluxes of forced migrants (typically impeding access to asylum), taking the form of training, financing, and other capacity-building activities. The key argument put forward is that, despite the absence of direct contact with the persons concerned by EU Member States, the ILC Articles on State Responsibility contemplate instances of contribution to wrongful conduct that may nonetheless trigger their international responsibility. The provisions on complicity, direction and control, and independent responsibility are explored in detail, taking account of the specific role that 'knowledge' plays in that regard, following developments in the case law on the ECHR. The ultimate goal is to demonstrate the continued relevance of international protection obligations and the persistence of responsibility in relation to this new generation of 'contactless', yet effective, means of control.

Source Water Protection in Rural Newfoundland and Labrador: Limitations and Promising Actions

The purpose of this paper is to exemplify through recent research in Newfoundland and Labrador (NL) the extent of the current limitations for source water protection and potential opportunities for improvement in the province, particularly for rural communities. The findings of this paper draw from the results of four related studies led by the co-authors. These four studies took place in NL between 2012 and 2016, and derived data through a mixed-method approach using literature reviews, key informant interviews, surveys, and consultations. The article provides an overview of the state of source water protection in NL and the challenges faced, with case examples to illustrate key points. Findings indicate there is currently a source water protection gap in NL limiting local governments in implementing their source water protection obligations under provincial policy and regulations. This implementation gap has been attributed to a lack of capacity for watershed monitoring, a lack of awareness of the need for source water protection and of municipal responsibilities, conflicts over multi-use watersheds and a lack of watershed planning and management. Greater education and collaboration in source water protection efforts amongst all watershed users, watershed groups, local governments and the provincial government could offer promise to fill this gap.

How the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 Has Undermined US Refugee Protection Obligations and Wasted Government Resources

Seeking asylum is a human right, enshrined in the Universal Declaration of Human Rights. The 1951 Convention relating to the Status of Refugees (“Refugee Convention”) and its 1967 Protocol relating to the Status of Refugees (“1967 Protocol”) prohibit the United States from returning refugees to persecution, and the 1980 Refugee Act set up a formal process for applying for asylum in the United States. However, the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA) created a barrage of new barriers to asylum. These impediments have blocked many refugees from accessing asylum in the United States and inserted additional layers of technicalities, screening, and processing, undermining the effectiveness of the US asylum system. The barriers imposed by IIRIRA are significant. They include a filing deadline on asylum applications, which prevents genuine refugees from receiving asylum if they cannot prove they have filed the application within one year of arriving in the United States. IIRIRA also established summary deportation procedures, including “expedited removal” and “reinstatement of removal,” which block asylum seekers from even applying for asylum or accessing an immigration court removal hearing, unless they first pass through a screening process. Finally, IIRIRA imposed “mandatory detention” on certain immigrants, including asylum seekers who are placed in expedited removal proceedings upon their arrival at a US port of entry. Each of these provisions imposed new processes and procedures that have contributed to an increasingly ineffective immigration system. The current backlog in the immigration courts has reached a record high, surpassing half a million cases, while the backlog of affirmative asylum cases before the Asylum Division of US Citizenship and Immigration Services (USCIS) has increased by a factor of six in just three years. Backlogs, which lead to long delays in adjudication, undermine system integrity as bona fide asylum seekers wait for years in legal limbo — some with families waiting abroad in dangerous and life-threatening situations — and individuals without meritorious claims may be encouraged to file applications to receive a work permit during the lengthy waiting period. Twenty years later, as the world faces the largest global refugee crisis since World War II, the asylum barriers injected into the US system under IIRIRA have proven harmful to refugees, and detrimental to the US asylum system. This paper highlights recent research, litigation, and advocacy efforts that have further brought to light the rights violations and systemic inefficiencies generated by IIRIRA. It concludes with a series of recommendations, calling on the US government to eliminate these counterproductive barriers and to take steps to assure access to asylum.

Keynote - How Much Personal Protection is too Much? Conflicts Between Optimal Performance and Protective Obligations

Keynote - How Much Personal Protection is too Much? Conflicts Between Optimal Performance and Protective Obligations

PROTECTION OF HUMAN RIGHTS IN ARMED CONFLICTS: A REVIEW OF THE YEMENI CIVIL WAR FROM SHARIAH AND LEGAL PERSPECTIVES

This article aims to examine the level of the compliance of the Yemeni civil war with the obligation of protection of fundamental human rights under Shariah and the international laws. A combined methods of descriptive legal approach and in-depth interview techniques are adopted for the study. For the interview, six respondents were selected to answer questions on the adverse effects of the war on the economy, social affairs, health care system and most vulnerable group, as well as the level of compliance of the war with international laws. Even then, it was uncovered that the armed conflict in Yemen infringed on all the moral and legal principles of war under the Shariah and international laws. For example, the justification for the Yemeni war is not ‘self-defence’ as contrary to the presumption of the laws. The interview further revealed that there is a complete infringement of fundamental human rights which constitutes a devastating consequence on the spirits of the citizens and the economic resources, in the war. It is therefore concluded that there is a necessity for a concerted effort for the charting of a modality for a gradual mitigation of the negative effects of the war and to its final ending.

How the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 Has Undermined US Refugee Protection Obligations and Wasted Government Resources

Seeking asylum is a human right, enshrined in the Universal Declaration of Human Rights. The 1951 Convention relating to the Status of Refugees (“Refugee Convention”) and its 1967 Protocol relating...

Pseudonymization and impacts of Big (personal/anonymous) Data processing in the transition from the Directive 95/46/EC to the new EU General Data Protection Regulation

In order to carry out the so-called “Big Data analysis”, the collection of personal data seems to be inevitable. The opportunities arising from the analysis of such information need to be balanced with the risks for the data protection of individuals. In this sense, the anonymization technique might be a solution, but it seems to be inappropriate in certain circumstances, among which Big Data processing can be included. In fact, anonymization has a high degree of uncontrollability of the impacts of profiling directed to individual targets whose data has been anonymized. In this sense, pseudonymization can be used both to reduce the risks of reidentification and help data controllers and processors to respect their personal data protection obligations by keeping control over their activities. On the one hand, pseudonymization ensures the capability to reconstruct the processes of identity masking, by allowing re-identification. On the other hand the accountability of the data controller and data processor is guaranteed, thanks to the fact that there will always be a person who can re-identify subjects included in a cluster, acting as a “data keeper”.