Transfer Of Personal Data Research Articles

International Personal Data Transfers and Effective Redress: Concluding Remarks

This concluding piece aims to bring together the various reflections contained in the special issue focused on the right to an effective remedy with specific reference to data protection legislation and international personal data transfers. The piece shows how the contributions to the special issue have unveiled an important function of Article 47, that of 'value exporter' of the EU. However, they have also highlighted the conceptual and definitional challenges and persisting uncertainties surrounding the use of Article 47 with respect to international data transfers.

Automated GDPR compliance assessment for cross-border personal data transfers in android applications

The General Data Protection Regulation (GDPR) aims to ensure that all personal data processing activities are fair and transparent for the European Union (EU) citizens, regardless of whether these are carried out within the EU or anywhere else. To this end, it sets strict requirements to transfer personal data outside the EU. However, checking these requirements is a daunting task for supervisory authorities, particularly in the mobile app domain due to the huge number of apps available and their dynamic nature. In this paper, we propose a fully automated method for assessing the compliance of Android apps with the GDPR requirements for cross-border personal data transfers. We have applied the method to 4593 apps from the Google Play Store discovering that nearly half of the ones sending personal data are potentially non-compliant with GDPR requirements. These results reveal that there is still a very significant gap between what app providers do in practice and what is intended by the GDPR.

Transfer of Personal Data to Third Countries and the “Equivalent Level” of Protection According to the European Court of Justice

Abstract The focus of this study is the transfer of personal data to third countries or international organizations according to EU Regulation No. 679/2016 (GDPR) on the protection of personal data. The primary goal of this Regulation concerning data transfer to third countries is to ensure that the subject’s rights and freedoms are safeguarded at the same level as provided by GDPR. According to GDPR, before any transfer to a third country or international organization, it must first be ascertained whether the European Commission has established that a third country ensures an adequate level of protection. Regarding personal data protection in the third state, the Court of Justice of the European Union has intervened on different occasions. In the last decision, in 2020, the Court declared invalid the European Commission’s Decision No. 2016/1250 on the adequacy of the protection provided by the EU-US Privacy Shield (CJEU, Schrems II, 2020, July 16) because it does not provide effective and enforceable rights for personal data subjects in cases of interference. According to the Court of Justice of the European Union, the US does not guarantee an “essentially equivalent” level of protection to that provided by the European Union under Article 45(1) GDPR, read in conjunction with Articles 7, 8, and 47 of the European Union’s Charter of Fundamental Rights, which guarantee respect for private and family life, personal data protection, and the right to effective judicial protection.

BALANCE OF EFFICIENCY AND SECURITY: IMPROVEMENT OF CHINA'S PERSONAL INFORMATION EXIT COMPLIANCE PATH

The cross-border flow of personal information is the inevitable requirement of the development of Internet technology and global data exchange. Today, cross-border data flows are an important component of international trade and an element of digital service models. However, they are impeded by restrictions on cross-border personal data transfers and data localization legislation (W. Gregory Voss, 2020). At present, China's personal information exit compliance path mainly includes security assessment, standard contract, and professional certification and so on. These compliance paths correspond to different exit situations of personal information, which not only reflect the will of the state supervision, but also guarantee the autonomy of the personal information processor in managing the exit business activities, it plays an important role in promoting the orderly flow of personal information in accordance with the law, but there are still some problems, such as unclear applicable standards, lack of connection with international rules and insufficient autonomy of industry supervision, etc., the system design is biased towards the needs of national security and public interest, neglecting the efficiency improvement of cross-border flow of personal information. Therefore, this article will take the personal information exit facing the risk and the supervision necessity as the breakthrough point, through the analysis related to China's personal information exit regulation legal provisions and normative documents, from the perspective of efficiency and security, this paper evaluates the three compliance paths of personal information exit, and puts forward some suggestions on how to improve the balance between efficiency and security of China's compliance path of personal information exit.

Data Governance Act: On International Transfers of Non-Personal Data and GDPR Mimesis

In accordance with the European strategy for data, the European Union (EU) aims to enhance the free flow of data and increase trust in data sharing mechanisms within the internal market. This ambition, however, contrasts with the EU’s more ‘protective’ approach to the governance of cross-border data flows. The high standard of data protection in the EU has resulted in a number of restrictions on transfers of personal data outside the European Economic Area (EEA). This article explores whether and to what extent the data protection rationale impacts EU law-making on international transfers of protected non-personal data. To do so it establishes divergences and convergences between the legal design of cross-border data transfers under the General Data Protection Regulation (GDPR) and the Data Governance Act (DGA). It also critically engages with the phenomenon of GDPR mimesis, according to which new EU regulatory initiatives for technology and digital life imitate the regulatory system established by the GDPR. This article argues that EU rules on non-personal data transfers have some similarities with the GDPR international data transfers regime but that the resemblance should not be overstated. The article critically assesses GDPR mimesis as a new regulatory phenomenon and, paradoxically, provides reasons why it has benefits. Keywords: General Data Protection Regulation | Data Governance Act | GDPR Mimesis | Non-Personal Data Transfers

Issues of personal data protection through the lens of sustainable development and law

The paper focuses on the effectiveness of legislation regulating the security of storage, processing, and transfer of personal data. As the main thesis, we assume that it is necessary to give a legal definition of the concept of personal data to build specific legal norms of a protective nature. We describe, examine, and evaluate the provisions of international regulatory legal acts that define the concept mentioned above and correlate with Russian legislation provisions. We thoroughly consider the opinions of scientists on the issue with the justification of our assessments and judgments. The results of the study can be considered recommendations on understanding the definition of personal data, as well as proposals for their protection and development of the system of legal regulation of personal data turnover in various jurisdictions.

An advanced cloud based framework for privacy and security in medical data using cryptographic method

The exchange of medical information has been drastically altered by patient-centered developments such as personal health records (PHR). By giving patients a place to handle their own PHR on a unified transactional platform, personal health record (PHR) services increase the efficiency with which medical information may be kept, accessed, and transferred. With the ultimate objective of providing patients with total surveillance under data, our findings is focused on creating a state-of-the-art infrastructure for the safe transfer of personal health data via cloud computing. Patients have the option of encrypting their PHR files, which provides an additional layer of security and allows them to set access control limits such as who has access to their files and to what degree. When data is encrypted in the cloud, only approved users may access it. Using cloud-based platforms to share health records raises concerns over confidentiality and privacy, which are addressed by the proposed method. Patients may still benefit from data interchange for the goal of better healthcare thanks to the framework’s provision of an encrypted PHR file option. This framework may accommodate attribute-based encryption (ABE) and other kinds of granular security. These measures ensure that people may continue to have access to, and make changes to, their own medical data, even when they are stored on the cloud. This article presents research that attempts to meet the demands of patients while also providing a safe method of transferring individual health information through cloud computing.

Federated analyses of multiple data sources in drug safety studies.

Studies of rare side effects of new drugs with limited exposure may require pooling of multiple data sources. Federated Analyses (FA) allow real-time, interactive, centralized statistical processing of individual-level data from different data sets without transfer of sensitive personal data. We review IT-architecture, legal considerations, and statistical methods in FA, based on a Swedish Medical Products Agency methodological development project. In a review of all post-authorisation safety studies assessed by the EMA during 2019, 74% (20/27 studies) reported issues with lack of precision in spite of mean study periods of 9.3 years. FA could potentially improve precision in such studies. Depending on the statistical model, the federated approach can generate identical results to a standard analysis. FA may be particularly attractive for repeated collaborative projects where data is regularly updated. There are also important limitations. Detailed agreements between involved parties are strongly recommended to anticipate potential issues and conflicts, document a shared understanding of the project, and fully comply with legal obligations regarding ethics and data protection. FA do not remove the data harmonisation step, which remains essential and often cumbersome. Reliable support for technical integration with the local server architecture and security solutions is required. Common statistical methods are available, but adaptations may be required. Federated Analyses require competent and active involvement of all collaborating parties but have the potential to facilitate collaboration across institutional and national borders and improve the precision of postmarketing drug safety studies.

The Fundraiser's Transfer of Personal Data from the European Union to the United States in Context of Crowdfunding Activities

European start-up companies must overcome more ‘transfer hurdles’ when personal data is transferred from the European Union to the US (United States of America) as part of crowdfunding campaign activities. Transfer of personal data is commonly not associated with (small scale) crowdfunding activities. However, the strict rules of the EU GDPR (European General Data Protection Regulation) on safeguarding personal data apply to all companies when data is transferred from the EU to the US - regardless the size of the business.
 This article identifies exchange of personal data that takes place between primarily fundraiser and crowdfunding service provider in different steps of fundraising campaigns. The framework for rewardbased crowdfunding for goods production that is provided by the US based Indiegogo platform is used as example and context. The article highlights by way of example the obligations that must be met by European fundraisers as "data controllers" when personal data is transferred to Indiegogo. No easy solutions are provided by either European Union or national data protection authorities on how to establish an adequate level of personal data protection. Paradigms on how to secure transfer of personal data to third countries are available in form of so-called standard contractual clauses, but still conditions for transfer of personal data from Europe to the US are hard to comply with. Apart from entering into an inter partes agreement on use of standard contractual clauses with the crowdfunding platform provider, a European fundraiser must furthermore make a so-called "transfer impact assessment" to ensure that third party access to personal data is avoided. In the case of transfer of personal data from the EU to the US the fundraiser must consider using encryption of data as a "supplementary measure" to block third party access. Encryption of data is however not suitable for exchange of data in a dynamic crowdfunding campaign so other means for protection of data must be found and applied.
 The reason and explanation for making data transfers from the EU to the US that hard for e.g., fundraisers are thus to be found at interstate level in the relation between the EU and the US. According to EU law, more specifically the GDPR and several of the provision of the Charter of Fundamental Rights of the European Union, US security legislation authorises a disproportionate access for US intelligence services to citizens' personal data. A solution on manageable transfer of personal data from the EU to the US may be found before the end of 2022, since a new TADP (Trans-Atlantic Data Privacy Framework) is currently being negotiated between EU and US at top politician level. However, the implementation of the TADP may take som time since the EU legislative framework needs adjustments to make the new transfer possibilities operational.

Kişisel Sağlık Verilerinin Dijitalleşmesi ve Büyük Veri

Çalışmanın amacı, kişisel sağlık verilerinin dijitalleşmesi sonucu oluşan büyük veri kavramının önemini ortaya koymaktır. Bu anlamda; kişisel sağlık verileri, elektronik sağlık kayıtları ve büyük veri kavramları ile ilgili literatür taraması yapılmıştır. Ayrıca büyük veri ile kişisel sağlık verileri arasındaki ilişki ele alınmıştır. Yapılan literatür taramasında, bilgi ve iletişim teknolojilerinin gelişmesi sonucu, kişisel sağlık verilerini işleme, depolama ve aktarma aşamalarında değişiklik ve elektronik sağlık kayıtlarının oluşturulduğu tespit edilmiştir. Elektronik sağlık kayıtlarının depolanması için fiziki arşivlerin yerine, büyük veri depolama alanlarının kullanıldığı belirlenmiştir. Böylece geliştirilen büyük veri sayesinde; klinik karar verme, kaliteli hizmet sunumu gibi birçok alanda sağlık hizmetlerine katkı sağladığı tespit edilmiştir. Çalışmada, kişisel sağlık verileri ile büyük veri arasındaki ilişkinin, sağlık hizmetlerini geliştirdiği ve insan kaynaklı hataları azalttığı sonucuna ulaşılmıştır. Diğer bir yandan, büyük veri kavramının gelişiminde; siber saldırılar, kötü niyetli yazılım şirketleri veya kullanıcı olarak bireylerin sağlık bilgi sistemlerine karşı olası güvensizlik kaygısına yönelik olumsuz tutum ve davranışlar gibi, önemli zorlukları oluşturduğu değerlendirilmiştir.

The future of international data transfers: Managing legal risk with a ‘user-held’ data model

The General Data Protection Regulation (GDPR) contains a blanket prohibition on the transfer of personal data outside of the European Economic Area (EEA) unless strict requirements are met. The rationale for this provision is to protect personal data and data subject rights by restricting data transfers to countries that may not have the same level of protection as the EEA. However, the ubiquitous and permeable character of new technologies such as cloud computing, and the increased inter-connectivity between societies, has made international data transfers the norm and not the exception. The Schrems II case and subsequent regulatory developments have further raised the bar for companies to comply with complex and, often, opaque rules.Many firms are, therefore, pursuing technology-based solutions in order to mitigate this new legal risk. These emerging technological alternatives reduce the need for open-ended cross-border transfers and the practical challenges and legal risk that such transfers create post-Schrems. This article examines one such alternative, namely a user-held data model. This approach takes advantage of ‘personal data clouds’ that allows data subjects to store their data locally and in a more decentralised manner, thus decreasing the need for cross-border transfers and offering end-users the possibility of greater control over their data.

The Mechanism of Personal Data Transfers of Social Network Users

The Mechanism of Personal Data Transfers of Social Network Users

Division of Data Ownership Between the Individual and the Enterprise That Collects the Data

More and more cases involve disputes between users and platform providers over the protection of personal information and the ownership of the right to personal information. In the big data era, data is an emerging object of civil rights. The ownership of data is very important to the protection of personal information and data transfer. However, there is no explicit legislation to regulate the ownership. In this regard, the author is of the opinion that the original/underlying personal data shall belong to the user, and the fully anonymized dataset based on the original data shall enjoy the property rights and interests in the context of competition.

Library Patrons’ Personal Data as Regards to Access to Licensed Resources

The article deals with some issues of personal data processing and management in Russian libraries interactions with licensed resources providers. The author analyzes international practice on the libraries’ way to establishing main principles of personal data privacy and security: minimal data transfer and informed patron’s agreement on personal data processing. List of principles set up by “NISO consensus principles on users’ digital privacy in library, publisher, and software-provider systems” are analyzed as well as American Library Association documents. Specific problems of personal data transfer from Russian electronic library systems providers to libraries are analyzed and some solutions are suggested.

Personal Data Transfers Outside the European Economic Area in the Insurance Sector Context

The article aims to cite and synthetically analyse key regulations in the field of personal data transfers outside the European Economic Area, taking into account the specificity and requirements of the insurance sector. It covers both national and European legislations, recent case law, guidelines of competent authorities as well as relevant industry standards. It also identifies the key risks for personal data controllers, particularly in the context of the Schrems II case and related requirements defined in the guidelines of the European Data Protection Board. In addition, it presents general recommendations on best practices related to the adequate protection of personal data transfers for the insurance sector entities.

Cross-Border Data Flows, the GDPR, and Data Governance

Today, cross-border data flows are an important component ofinternational trade and an element of digital service models. However, they are impededby restrictions on cross-border personal data transfers and data localization legislation. ThisArticle focuses primarily on these complexities and on the impact of the new EuropeanUnion (“EU”) legislation on personal data protection—the GDPR. First, this Articleintroduces its discussion of these flows by placing them in their economic and geopoliticalsetting, including a discussion of the results of a lack of international harmonization of lawin the area. In this framework, rule overlap and rival standards are relevant. Once thissituation is established, this Article turns to an analysis of the legal measures that havefilled the gap left by the lack of international regulation and the failure to harmonize law:extraterritorial laws in the European Union (regional legislation) and the United States(state legislation); and data localization laws in China and Russia. Specific provisionsrestricting cross-border personal data transfers are detailed under EU legislation, as are theinternational agreements that have been invaluable in allowing flows between the UnitedStates and the European Union to continue—first the Safe Harbor, and now the Privacy Shield. Finally, in this context, the role of data governance is investigated, both in thecontext of data controllers’ accountability for the actions of other actors in global supplychains under EU law and under the Privacy Shield. Thus, this Article goes beyond the lawitself, to place requirements in the context of the globalized business world of data flows,and to suggest ways that companies may improve their compliance position worldwide.

The features of legal regulation of personal data of remote workers

To date, the Russian Federation has been formed as an information state, the priority task of which is to protect the interests of the individual, his rights and freedoms guaranteed by the Constitution of the Russian Federation. The widespread use of modern technologies, in particular all kinds of transfers of personal data, poses a real threat to the violation of not only constitutional guarantees for privacy, personal and family secrets, but also labor legislation. It should be recognized that electronic document management increases the opportunities for abuse of rights by workers and employers. In the article, the authors analyze some of the problems arising in the processing and protection of personal data of remote workers, law enforcement practice, and also propose ways of improving labor legislation in this field.

The competence of the employer on the issue of the adoption of local regulations

This article sets out to formulate limits and content of the employer’s competence as a subject of local rule-making. The article expresses a judgment about the possibility of filling gaps in the law with local norms, for which the employer should be guided by principles of legal regulation of labor and relations directly related to them, its goals, and objectives. It is also noted that the legislator, leaving behind the local normative acts not only the function of filling the gaps, but also the function of concretizing the legal norms of labor legislation, forms a certain list of local normative acts, the adoption of which by the employer is obligatory. When analyzing the norms of labor legislation, some difficulty arises in the exact definition of local regulatory legal acts binding for the employer, which is an unconditional defect of legal regulation. The author proposes internal labor regulations, local regulatory act on remuneration, staffing (job descriptions as part of it), local regulatory acts on the temporary transfer of employees to remote work, rules and instructions on labor protection for employees, and a local regulatory act on the transfer of employee personal data within one organization, from one individual entrepreneur. The same defect should be considered the absence of a precise content of the local regulations obligatory for adoption by the employer, which allows, inter alia, to differentiate them among themselves, as well as to understand the sufficiency of the regulatory regulation of a particular issue. Since some of these local regulations must be adopted by the employer, taking into account the opinion of the representative body of employees (if there is such a body), it is proposed at the legislative level to clarify the list of those local acts that, in exceptional cases, can be adopted by the employer alone.

The Pivotal Role of DPAs in Digital Privacy Protection

With the widespread use of the Internet in both personal and professional life, data protection has become a critical aspect of privacy protection. The mechanisms developed in administrative law are the main tools for personal data protection in modern societies. Within the European integration process, the Republic of Serbia has established an independent data protection authority (DPA) that supervises and ensures the implementation of data protection rules, conducts inspections, acts on complaints of persons to whom the data relates, and determines whether there has been a violation of the law. This paper commences with an analysis of international legal instruments imposing a duty to establish an independent data protection supervisory authority. It goes on to further analyze the main characteristics of the national data protection system, the personal, territorial, and material scope of its application, as well as specific rights of data subjects. The efficient protection of digital privacy primarily depends on the investigative powers of the independent supervisory authority, which are also analyzed in detail. Given the global character of the Internet, the protection of personal data also depends on efficient cooperation among DPAs, the extraterritorial application of data protection rules, and adequate regulation of international transfer of personal data.

Supplementary Measures and Appropriate Safeguards for International Transfers of Personal Data after Schrems II

Supplementary Measures and Appropriate Safeguards for International Transfers of Personal Data after Schrems II