A Layered Approach to Jurisdiction

An individual’s location data is very sensitive geoinformation. While its disclosure is necessary, e.g., to provide location-based services (LBS), it also facilitates deep insights into the lives of LBS users as well as various attacks on these users. Location privacy threats can be mitigated through privacy regulations such as the General Data Protection Regulation (GDPR), which was introduced recently and harmonises data privacy laws across Europe. While the GDPR is meant to protect users’ privacy, the main problem is that it does not provide explicit guidelines for designers and developers about how to build systems that comply with it. In order to bridge this gap, we systematically analysed the legal text, carried out expert interviews, and ran a nine-week-long take-home study with four developers. We particularly focused on user-facing issues, as these have received little attention compared to technical issues. Our main contributions are a list of aspects from the legal text of the GDPR that can be tackled at the user interface level and a set of guidelines on how to realise this. Our results can help service providers, designers and developers of applications dealing with location information from human users to comply with the GDPR.

Download Full-text

Analysis of the US Privacy Model

Research Anthology on Privatizing and Securing Data ◽

10.4018/978-1-7998-8954-0.ch087 ◽

2021 ◽

pp. 1818-1825

Author(s):

Francisco García Martínez

Keyword(s):

Data Privacy ◽

Personal Information ◽

National Level ◽

The United States ◽

The European Union ◽

General Data Protection Regulation ◽

Privacy Laws ◽

The Us ◽

General Data ◽

State Of Art

The creation of the General Data Protection Regulation (GDPR) constituted an enormous advance in data privacy, empowering the online consumers, who were doomed to the complete loss of control of their personal information. Although it may first seem that it only affects companies within the European Union, the regulation clearly states that every company who has businesses in the EU must be compliant with the GDPR. Other non-EU countries, like the United States, have seen the benefits of the GDPR and are already developing their own privacy laws. In this article, the most important updates introduced by the GDPR concerning US corporations will be discussed, as well as how American companies can become compliant with the regulation. Besides, a comparison between the GDPR and the state of art of privacy in the US will be presented, highlighting similarities and disparities at the national level and in states of particular interest.

Download Full-text

Analysis of the US Privacy Model

International Journal of Hyperconnectivity and the Internet of Things ◽

10.4018/ijhiot.2019010103 ◽

2019 ◽

Vol 3 (1) ◽

pp. 43-52

Author(s):

Francisco García Martínez

Keyword(s):

Data Privacy ◽

Personal Information ◽

National Level ◽

The United States ◽

The European Union ◽

General Data Protection Regulation ◽

Privacy Laws ◽

The Us ◽

General Data ◽

The Eu

The creation of the General Data Protection Regulation (GDPR) constituted an enormous advance in data privacy, empowering the online consumers, who were doomed to the complete loss of control of their personal information. Although it may first seem that it only affects companies within the European Union, the regulation clearly states that every company who has businesses in the EU must be compliant with the GDPR. Other non-EU countries, like the United States, have seen the benefits of the GDPR and are already developing their own privacy laws. In this article, the most important updates introduced by the GDPR concerning US corporations will be discussed, as well as how American companies can become compliant with the regulation. Besides, a comparison between the GDPR and the state of art of privacy in the US will be presented, highlighting similarities and disparities at the national level and in states of particular interest.

Download Full-text

Delegation-Based Personal Data Processing Request Notarization Framework for GDPR Based on Private Blockchain

Applied Sciences ◽

10.3390/app112210574 ◽

2021 ◽

Vol 11 (22) ◽

pp. 10574

Author(s):

Sung-Soo Jung ◽

Sang-Joon Lee ◽

Ieck-Chae Euom

Keyword(s):

Data Processing ◽

Data Protection ◽

Data Privacy ◽

Personal Data ◽

General Data Protection Regulation ◽

Personal Data Protection ◽

Compliance Audit ◽

General Data ◽

Data Controller ◽

Data Subject

With the growing awareness regarding the importance of personal data protection, many countries have established laws and regulations to ensure data privacy and are supervising managements to comply with them. Although various studies have suggested compliance methods of the general data protection regulation (GDPR) for personal data, no method exists that can ensure the reliability and integrity of the personal data processing request records of a data subject to enable its utilization as a GDPR compliance audit proof for an auditor. In this paper, we propose a delegation-based personal data processing request notarization framework for GDPR using a private blockchain. The proposed notarization framework allows the data subject to delegate requests to process of personal data; the framework makes the requests to the data controller, which performs the processing. The generated data processing request and processing result data are stored in the blockchain ledger and notarized via a trusted institution of the blockchain network. The Hypderledger Fabric implementation of the framework demonstrates the fulfillment of system requirements and feasibility of implementing a GDPR compliance audit for the processing of personal data. The analysis results with comparisons among the related works indicate that the proposed framework provides better reliability and feasibility for the GDPR audit of personal data processing request than extant methods.

Download Full-text

Anonymization, tokenization, encryption. How to recover unrecoverable data

Computer Science and Mathematical Modelling ◽

10.5604/01.3001.0010.8235 ◽

2018 ◽

Vol 0 (6/2017) ◽

pp. 9-13

Author(s):

Olga Dzięgielewska

Keyword(s):

Risk Analysis ◽

Data Protection ◽

Data Privacy ◽

Personal Data ◽

Insider Threat ◽

General Data Protection Regulation ◽

Analysis Phase ◽

Data Layer ◽

General Data ◽

Financial Consequences

The data privacy is currently vastly commented topic among all the organizations which process personal data due to the introduction of the European Union’s General Data Protection Regulation. Existing methods of data protection are believed to be sufficient as they meet the risk-based approach requirements in every mature organization, yet the number of publicly known data breaches confirms that this assumption is false. The aftermath of such incidents in countless cases prove that the risk-based approach failed as the reputational and financial consequences by far exceed the original estimations. This paper stressed the importance of the data layer protection from the planning, through design, until maintenance stages in the database lifecycle, as numerous attack vectors originating from the insider threat and targeting the data layer still sneak through unnoticed during the risk analysis phase.

Download Full-text

The Data Privacy Law of Brexit: Theories of Preference Change

Theoretical Inquiries in Law ◽

10.1515/til-2021-0019 ◽

2021 ◽

Vol 22 (2) ◽

pp. 111-152

Author(s):

Paul M. Schwartz

Keyword(s):

Data Protection ◽

Data Privacy ◽

Preference Change ◽

General Data Protection Regulation ◽

Privacy Law ◽

The United Kingdom ◽

General Data ◽

Different Dimensions ◽

The Uk ◽

Domestic Law

Abstract Upon Brexit, the United Kingdom chose to follow the path of EU data protection and remain tied to the requirements of the General Data Protection Regulation (GDPR). It even enacted the GDPR into its domestic law. This Article evaluates five models relating to preference change, demonstrating how they identify different dimensions of Brexit while providing a rich explanation of why a legal system may or may not reject an established transnational legal order. While market forces and a “Brussels Effect” played the most significant role in the decision of the UK government to accept the GDPR, important nonmarket factors were also present in this choice. This Article’s models of preference change are also useful in thinking about the likely extent of the UK’s future divergence from EU data protection.

Download Full-text

Blockchain can both enhance and undermine compliance but is not inherently at odds with EU privacy laws

Journal of Investment Compliance ◽

10.1108/joic-10-2020-0037 ◽

2021 ◽

Vol ahead-of-print (ahead-of-print) ◽

Author(s):

Lokke Moerel ◽

Marijn Storm

Keyword(s):

Data Protection ◽

Design Methodology ◽

New Technology ◽

Extensive Experience ◽

Content Type ◽

General Data Protection Regulation ◽

Blockchain Technology ◽

Privacy Laws ◽

General Data ◽

The Eu

Purpose To explain the authors’ position that the use of blockchain technology is not incompatible with European Union privacy laws and in particular the EU General Data Protection Regulation (GDPR). Design/methodology/approach Explains the basics of blockchain technology and the GDPR, several reasons why some scholars consider BC not to be compatible with the GDPR, and why the authors believe that the GDPR will be able to regulate the use of blockchain technology. Findings The current perception is that blockchain is not compatible with EU privacy laws. The authors disagree that this is the case and explain why none of the issues identified by legal scholars and stakeholders are likely to pose issues for blockchain technology. Their conclusion is that EU privacy laws are well able to regulate also this new technology. This does however not mean that blockchain will thus be suitable for all use and deployment cases. Originality/value Practical guidance and explanation of complex issues by lawyers with extensive experience and expertise in dealing with data protection, cybersecurity, privacy, intellectual property and related issues.

Download Full-text

The Proposed Data Protection Regulation: The Illusion of Harmonisation, the Private/Public Sector Divide and the Bureaucratic Apparatus

Cambridge yearbook of European legal studies ◽

10.5235/152888713809813639 ◽

2013 ◽

Vol 15 ◽

pp. 27-46 ◽

Cited By ~ 1

Author(s):

Peter Blume ◽

Christian Wiese Svanberg

Keyword(s):

Data Protection ◽

Current Data ◽

General Data Protection Regulation ◽

Data Protection Directive ◽

Central Elements ◽

Scope Of Application ◽

General Data ◽

Data Protection Law ◽

Draft Regulation ◽

Practical Implications

AbstractThe proposal for a new General Data Protection Regulation has been billed as a harbinger of increased harmonisation, better enforcement and modernised rules within the area of data protection law. Through an analysis of several central elements in the draft Regulation—and European data protection law in general—as well as an assessment of the practical implications the proposal is likely to have if adopted, this chapter challenges whether the proposal will be able to deliver the harmonised rules that have been promised. It focuses particularly on the proposed regulations scope of application, its legal architecture, the use of discretionary provisions and related issues.It is argued that the proposal not only fails to address the root causes of why the current data protection directive (Directive 95/46) failed to bring about harmonisation and effective rules, but also looks set to transplant them into the new regulation.

Download Full-text

Data Protection Commissioner v. Facebook Ireland Ltd. and Maximillian Schrems (C.J.E.U.)

International Legal Materials ◽

10.1017/ilm.2020.62 ◽

2021 ◽

Vol 60 (1) ◽

pp. 53-98

Author(s):

Michael S. Aktipis ◽

Ron B. Katwan

Keyword(s):

Data Protection ◽

Data Privacy ◽

Personal Data ◽

The United States ◽

Transfer Mechanism ◽

The European Union ◽

Privacy Concerns ◽

General Data Protection Regulation ◽

General Data ◽

The Eu

On July 16, 2020, the Court of Justice of the European Union (CJEU) issued its ruling in Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems, commonly known as Schrems II, invalidating the EU–U.S. Privacy Shield as a valid transfer mechanism under the EU's General Data Protection Regulation (GDPR) and creating significant legal uncertainty for the continued availability of another widely used transfer mechanism, Standard Contractual Clauses (SCCs), for transfers of EU personal data from commercial entities in the EU to the United States. The widely anticipated ruling marked the second time in five years that the CJEU had invalidated the legal foundation for such data transfers, which in both cases had been the result of a carefully negotiated compromise balancing European data privacy concerns with statutory and constitutional limitations of the U.S. system (see Schrems I).

Download Full-text

Resolución contractual y destino de los datos y contenidos generados por los usuarios de servicios digitales = Ttermination of contract and destination of data and content generated by users of digital services

CUADERNOS DE DERECHO TRANSNACIONAL ◽

10.20318/cdt.2020.5226 ◽

2020 ◽

Vol 12 (1) ◽

pp. 838

Author(s):

Sergio Cámara Lapuente

Keyword(s):

Data Protection ◽

Personal Data ◽

Digital Content ◽

General Data Protection Regulation ◽

Personal Data Protection ◽

Use Of Data ◽

Digital Services ◽

Scope Of Application ◽

General Data ◽

The One

Resumen: Durante el uso de los contenidos y servicios digitales puestos a disposición del consumidor por los distintos proveedores, los usuarios facilitan y crean gran cantidad de datos. El tratamiento legal del control sobre el destino de estos datos se bifurca en la actualidad en dos normas: por una parte, si se trata de datos personales, se aplicará el Reglamento (UE) General de Protección de Datos de 2016 (RGPD); por otra parte, respecto a contenidos generados por los usuarios que no sean datos personales, las reglas de la reciente Directiva (UE) 2019/770, de 20 de mayo de 2019 sobre contratos de suministro de contenidos y servicios digitales (DCSD) será de aplicación tras su transposición.Este ensayo analiza la intersección de las normas sobre protección de datos personales con las normas sobre la defensa contractual del consumidor al tiempo de la extinción de este tipo de contratos por vía de resolución. Para ello compara los rasgos de los derechos de supresión, olvido y portabilidad del Reglamento con los nuevos derechos de impedir el uso de los datos y de recuperarlos establecidos en la Directiva y concluye críticamente acerca del escaso impacto que estos últimos pueden llegar a tener debido a su reducido ámbito de aplicación, las escasas facultades y las excesivas excepciones incorporadas finalmente en uno de los preceptos centrales de la Directiva 2019/770.Palabras clave: contenidos digitales, servicios digitales, resolución, contrato de suministro, datos personales, portabilidad, derecho al olvido, derecho de supresión, Directiva (UE) 2019/770, Reglamento General de Protección de Datos, conformidad, contenidos generados por los usuarios, consumidor.Abstract: During the use of digital content and services made available to the consumer by different traders and platforms, users provide and create large amounts of data. The legal treatment of control over the destination of these data currently splits into two pieces of legislation: on the one hand, in the case of personal data, the 2016 (EU) General Data Protection Regulation (GDPR) will apply; on the other hand, in the case of user-generated content other than personal data, the rules of the recent Directive (EU) 2019/770 of 20 May 2019 on contracts for the supply of digital content and services (DCSD) will apply after transposition in Member States.This paper analyses the intersection of the rules on personal data protection with the rules on the contractual protection of the consumer at the time of the extinction of this type of contract by means of termination. To this end, it compares the features of the rights to erasure, to be forgotten and to portability of the Regulation with the new rights to prevent further use of data and to retrieve them established in the Directive, and critically concludes that the latter may have little impact due to their reduced scope of application, the limited powers and the excessive exceptions finally incorporated in one of the central articles of Directive 2019/770.Keywords: digital contents, digital services, termination, contract of supply, personal data, portability, right to erasure, right to be forgotten, Directive (EU) 2019/770, General Data Protection Regulation, conformity, user generated contents, consumer.

Download Full-text