scholarly journals Accountability of Platform Providers for Unlawful Personal Data Processing in their Ecosystems – A Socio-Techno-Legal Analysis of Facebook and Apple's iOS according to GDPR

2021 ◽  
pp. 100018
Author(s):  
Christian Kurtz ◽  
Florian Wittner ◽  
Martin Semmann ◽  
Wolfgang Schulz ◽  
Tilo Böhmann
2019 ◽  
Vol 13 (1) ◽  
pp. 45-66 ◽  
Author(s):  
Kristjan Kikerpill ◽  
Andra Siibak

The prevalence of using email as a communication tool for personal and professional purposes makes it a significant attack vector for cybercriminals. Consensus exists that phishing, i.e. use of socially engineered messages to convince recipients into performing actions that benefit the sender, is widespread as a negative phenomenon. However, little is known about its true extent from a criminal law perspective. Similar to how the treatment of phishing in a generic manner does not adequately inform the relevant law, a case-by-case legal analysis of seemingly independent offences would not reveal the true scale and extent of phishing as a social phenomenon. The current research addresses this significant gap in the literature. To study this issue, a qualitative text analysis was performed on (N=42) emails collected over a 30-day period from two email accounts. Secondly, the phishing emails were analysed from an Estonian criminal law perspective. The legal analysis shows that in the period of only one month, the accounts received what amounts to 3 instances of extortion, 29 fraud attempts and 10 cases of personal data processing related misdemeanour offences.


2020 ◽  
Vol 30 (Supplement_5) ◽  
Author(s):  
J Doetsch ◽  
I Lopes ◽  
R Redinha ◽  
H Barros

Abstract The usage and exchange of “big data” is at the forefront of the data science agenda where Record Linkage plays a prominent role in biomedical research. In an era of ubiquitous data exchange and big data, Record Linkage is almost inevitable, but raises ethical and legal problems, namely personal data and privacy protection. Record Linkage refers to the general merging of data information to consolidate facts about an individual or an event that are not available in a separate record. This article provides an overview of ethical challenges and research opportunities in linking routine data on health and education with cohort data from very preterm (VPT) infants in Portugal. Portuguese, European and International law has been reviewed on data processing, protection and privacy. A three-stage analysis was carried out: i) interplay of threefold law-levelling for Record Linkage at different levels; ii) impact of data protection and privacy rights for data processing, iii) data linkage process' challenges and opportunities for research. A framework to discuss the process and its implications for data protection and privacy was created. The GDPR functions as utmost substantial legal basis for the protection of personal data in Record Linkage, and explicit written consent is considered the appropriate basis for the processing sensitive data. In Portugal, retrospective access to routine data is permitted if anonymised; for health data if it meets data processing requirements declared with an explicit consent; for education data if the data processing rules are complied. Routine health and education data can be linked to cohort data if rights of the data subject and requirements and duties of processors and controllers are respected. A strong ethical context through the application of the GDPR in all phases of research need to be established to achieve Record Linkage between cohort and routine collected records for health and education data of VPT infants in Portugal. Key messages GDPR is the most important legal framework for the protection of personal data, however, its uniform approach granting freedom to its Member states hampers Record Linkage processes among EU countries. The question remains whether the gap between data protection and privacy is adequately balanced at three legal levels to guarantee freedom for research and the improvement of health of data subjects.


2021 ◽  
Vol 7 (1) ◽  
Author(s):  
Iwona Karasek-Wojciechowicz

AbstractThis article is an attempt to reconcile the requirements of the EU General Data Protection Regulation (GDPR) and anti-money laundering and combat terrorist financing (AML/CFT) instruments used in permissionless ecosystems based on distributed ledger technology (DLT). Usually, analysis is focused only on one of these regulations. Covering by this research the interplay between both regulations reveals their incoherencies in relation to permissionless DLT. The GDPR requirements force permissionless blockchain communities to use anonymization or, at the very least, strong pseudonymization technologies to ensure compliance of data processing with the GDPR. At the same time, instruments of global AML/CFT policy that are presently being implemented in many countries following the recommendations of the Financial Action Task Force, counteract the anonymity-enhanced technologies built into blockchain protocols. Solutions suggested in this article aim to induce the shaping of permissionless DLT-based networks in ways that at the same time would secure the protection of personal data according to the GDPR rules, while also addressing the money laundering and terrorist financing risks created by transactions in anonymous blockchain spaces or those with strong pseudonyms. Searching for new policy instruments is necessary to ensure that governments do not combat the development of all privacy-blockchains so as to enable a high level of privacy protection and GDPR-compliant data processing. This article indicates two AML/CFT tools which may be helpful for shaping privacy-blockchains that can enable the feasibility of such tools. The first tool is exceptional government access to transactional data written on non-transparent ledgers, obfuscated by advanced anonymization cryptography. The tool should be optional for networks as long as another effective AML/CFT measures are accessible for the intermediaries or for the government in relation to a given network. If these other measures are not available and the network does not grant exceptional access, the regulations should allow governments to combat the development of those networks. Effective tools in that scope should target the value of privacy-cryptocurrency, not its users. Such tools could include, as a tool of last resort, state attacks which would undermine the trust of the community in a specific network.


Author(s):  
Dennis Geesen ◽  
H. Jürgen Appelrath ◽  
Marco Grawunder ◽  
Daniela Nicklas

Smart homes are equipped with multiple sensors and actuators to observe the residents and environmental phenomena, to interpret the situation out of that, and finally, to react accordingly. While the data processing for a single smart home is facile, the data processing for multiple smart homes in one smart building is more complex because there are different people (e.g., like several residents, administrators, or a property management) with different interests concerning the processed data. On that point, this chapter shows which kind of typical roles can be found in a smart building and what requirements and challenges they demand for managing and processing the data. Secondly, Data Stream Management Systems (DSMS) are introduced as an approach for processing and managing data in a smart building by presenting an appropriate architecture. Finally, the chapter discusses further concepts from DSMS and illustrates how they additionally meet and solve the requirements and the challenges.


2018 ◽  
Vol 1 (102) ◽  
pp. 305
Author(s):  
Rosario Serra Cristóbal

Resumen:La gestión coordinada de las fronteras y el funcionamiento eficaz de los sistemas de tratamiento de datos de circulación de personas pueden servir como mecanismo de alerta temprana frente al riesgo de ataques terroristas. Puede fortalecer la capacidad colectiva de los Estados para detectar, prevenir y combatir el terrorismo al facilitar el intercambio oportuno de información, permitiendo así adoptar de forma responsable decisiones cruciales.Este trabajo analiza los concretos instrumentos de gestión de datos en fronteras que pueden ser útiles en la lucha antiterrorista, porque el primer paso en inteligencia reside en la obtención de información, que luego será analizada y tratada para convertir esa información en conocimiento. Como tendremos oportunidad de comprobar, muchas de las bases de datos en fronteras se crearon para controlar la entrada de inmigrantes en las fronteras europeas, pero la información que ofrecen dichos sistemas puede servir también para luchar contra ese reto que nos amenaza, el del terrorismo yihadista. No obstante, este trabajo subraya que se trata de fenómenos distintos.Es cierto que la nueva oleada de ataques yihadistas ha coincidido, en el mismo espacio temporal, con la mayor crisis migratoria a la que se ha tenido que enfrentar Europa debido a crisis humanitarias y posteriormente a la guerra de Siria u otros conflictos. Pero, no son lo mismo. El terrorismo yihadista y la inmigración poco o nada tienen que ver, por mucho que se hayan querido vincular o se hayan pretendido justificar determinadas políticas contra la inmigración como algo necesario para luchar contra el terrorismo yihadista, con el fácil argumento de que frenando la inmigración se evita la entrada de potenciales terroristas en Europa.El trabajo advierte del riesgo de que la lucha contra el terrorismo sea utilizada para reforzar los controles de personas en las fronteras con el verdadero objetivo de frenar los flujos migratorios. Al tiempo, subraya la necesidad de que en dichos controles se sigan directrices y prácticas claras y se respeten plenamente las obligaciones que los Estados tienen de conformidad con el Derecho internacional, tal como ha recordado el Tribunal Europeo de Derechos Humanos y el Tribunal de Justicia de la Unión Europea. De hecho, no son pocos los casos en los que estos Tribunales han subrayado la relevancia indubitada de principios como la reserva de ley, la necesidad o la proporcionalidad como sustrato de la licitud de muchas medidas que incluyen el tratamiento de datos personales.Summary:1. Jihadist terrorism as a cross-border phenomenon. 2. The benefit of data exchange on crossing-borders in the Schengen area. 3. New guidelines on data processing and the safeguard of national security. 4. The register of passengers (The Personal Name Record or PNR). 5. When the data cross the external borders. The exchange of data with third countries. 5.1. The failed PNR Agreement with Canada and the EU Court of Justice’s standards regarding the transfer of passengers’ data. 5.2. The exchange of data with the United States. The EU-US Umbrella Agreement and the Privacy Shield. 6. The use of profiles and blacklists of alleged terrorists in cross-bording. 7. ConclusionsAbstract:EU Coordinated border management and effective functioning of data processing systems related to the movement of persons may serve as an early warning mechanism against the risk of terrorist attacks. It can strengthen the collective capacity of States to detect, prevent and combat terrorism by facilitating the timely exchange of information, thereby enabling crucial decisions to be adopted in a responsible manner.This paper analyzes the concrete border data management tools that can be useful in the fight against terrorism. The first step in intelligence lies in obtaining information, which will then be analyzed and treated to turn that information into useful knowledge. As we will have an opportunity to verify, numerous border databases were created to control the entry of immigrants into European borders, but the information offered by these systems can also serve to fight against this challenge that threatens us, that of jihadist terrorism.Nevertheless, we emphasize that terrorism and immigration are different phenomena. The truth is that the new wave of Jihadist attacks took place along the largest migratory crisis that Europe faced due to different humanitarian crises and to the war in Syria and other conflicts. But they represent different realities. Jihadist terrorism and immigration have little or nothing in common. In spite of this, many wish to link both with a view to justify certain anti-immigration policies as necessary actions for coping with Jihadist terrorism. This has been done based on a simple narrative: holding back immigration prevents the entry of potential terrorists in Europe.This paper shows that the risk that the fight against terrorism will be used as a basis to reinforce people controls at the borders, while the true objective of these measures is to curb migratory flows. At the same time, it underlines the need for clear guidelines and practices to be followed when implementing such controls. It also vindicates the need for States to observe their obligations laid down by international law, as recalled by the European Court of Human Rights and the EU Court of the Justice. In fact, in many cases, these jurisdictions highlighted the undoubted relevance of the statutory reserve principle, the principle of necessity or the principle of proportionality, as legal basis for the adoption of measures that include personal data processing.


Author(s):  
Tatiana-Eleni Sinodinou

The present chapter explores privacy issues posed by the use of RFID systems and applications. The existing legal framework for data protection is analyzed in order to discover how general privacy safeguarding principles should be applied in the case of RFIDs, with special focus on the main areas which are going to experience widespread use of such applications. The structure of the chapter is based on a chronological order which follows the consecutive phases of contact and interaction between the individual and the RFID tag. The implementation of a tag to a product or in the human body establishes the first point of contact of the individual with the RFID tag. This stage of data processing is examined in the first part of the chapter. In more particular, this part deals with the application of general principles of fair processing, such as information transparency, the debate about the necessity to require the prior consent of the individual (possible opt-in and opt-out solutions) and the precondition of a clearly defined purpose of the data processing. The symbiosis of the person with the tag is examined in the second part. Indeed, privacy concerns are equally significant during the phase of processing of personal information, even if processing is conducted lawfully, either based on the legal ground of the individual’s consent or justified on another legal basis. The requirement of data quality and the obligation to secure the RFID system against unauthorized interceptions or alterations of data by third parties constitute essential guarantees of fair data processing. Privacy protection in the activation phase of the tag is also ensured by the obligation to inform the tagged individual every time a reading takes place and by the right to verify the accuracy of the tag data, whether stored from the beginning or added at a later date. Finally, the last part of the chapter examines the legal regime of separation between the person and the tag. This phase refers to the termination of the processing either by act of the data subject or by act of the RFID system controller. The focus is given to the exercise of the right to object to the processing of personal data through RFID devices. In this context practical solutions, such as the “tag kill” or “tag sleep” command should be taken into consideration in order to the make the exercise of the right to object feasible.


2021 ◽  
Vol 10 (2) ◽  
pp. 66-79
Author(s):  
Vít Pászto ◽  
Jaroslav Burian ◽  
Karel Macků

The article is focused on a detailed micro-study describing changes in the behaviour of the authors in three months before and during the COVID-19 pandemic. The study is based on data from Google Location Service. Despite the fact it evaluates only three people and the study cannot be sufficiently representative, it is a unique example of possible data processing at such a level of accuracy. The most significant changes in the behaviour of authors before and during the COVID-19 quarantine are described and interpreted in detail. Another purpose of the article is to point out the possibilities of analytical processing of Google Location while being aware of personal data protection issues. The authors recognize that by visualizing the real motion data, one partially discloses their privacy, but one considers it very valuable to show how detailed data Google collects about the population and how such data can be used effectively.


2020 ◽  
Vol 15 (1) ◽  
pp. 65-69
Author(s):  
Margita Majerčáková ◽  
Peter Jucha

In order to protect the rights and freedoms of individuals in the processing of personal data, each company had to take technical and organizational measures as of 25 May 2018 to meet the legislative requirements on the protection of personal data. This obligation also applies to transport services undertakings. At the same time, the company must regularly assess the security of the processing from the point of view of the nature of the processed personal data after the implementation of the measures. The periodic assessment should also ensure that the personal data processing undertaking in company is able to demonstrate that it has taken all reasonable and effective technical measures necessary in view of the nature, scale and purpose of the processing of the personal data it processes as well as the risks to rights and freedom of data subjects.


Sign in / Sign up

Export Citation Format

Share Document