Специфика правомочий субъектов персональных данных в современном российском и зарубежном праве

It is said that higher education is where knowledge is not only assimilated but also created. We are proud and elated to bring this saying into reality and to see the efforts of all the contributors fructify in the form of this book titled Personal Digital Data Protection in Digital Age: Issues and Challenges. Progressive Education Society’s Modern Law College had organised a National Seminar on Personal Data Protection in Digital Age: Issues and Challenges which received an overwhelming response in the form of research articles. This book is the compilation of the selected articles submitted by scholars which were found fit as per the themes of the book to provide a comprehensive information to the reader on various perspectives related to digital data protection. There are nine themes which have been divided into nineteen chapters of all the contributors. The themes are International Perspective on Data Privacy Laws, Data Protection, Governance and Compliance, Right to Privacy and other rights of data subjects, Ethical Dilemma surrounding Data Protection, Cross border data transfers and the adequacy status of Indian Protection Laws, Data Protection and its relationship with Cyber Security, Legal regime with respect to Protected Health Information (PHI), Data privacy in context with developing field of Artificial Intelligence and Legislative framework of Digital Data Protection.

The evolution of personal data protection in Albania reflects an effort to align domestic legislation with European Union standards, particularly with the General Data Protection Regulation (GDPR). The new law on personal data protection introduces significant changes compared to the previous law, strengthening transparency, accountability, and individuals' rights over their data. Through this law, the aim is to ensure more effective protection against the challenges of the digital age. The purpose of this paper is to analyze the key differences between the new and the old personal data protection law in Albania, as well as to assess the compliance of these changes with GDPR requirements. In particular, it will review how the new law improves mechanisms for protecting personal data and the rights of data subjects, including new concepts of transparency, data control, and oversight by relevant authorities. The paper also addresses practical challenges in implementing the new law, including the lack of public awareness, the institutional capacities needed for effective supervision, and the adaptation of the private sector to the new obligations. A comparison with the GDPR will help identify potential gaps and the steps needed for a more comprehensive harmonization with European standards. In the end, the paper offers recommendations to enhance the enforceability of the new law, including strengthening institutional oversight, increasing awareness of rights and obligations related to personal data, training key actors in the public and private sectors, and adapting the legal framework to technological developments. These measures will enhance personal data protection and ensure closer alignment with international standards. Received: 20 April 2025 / Accepted: 8 June 2025 / Published: 25 June 2025

The Quest for Information Privacy in Africa: A Review Essay

A comparison of data protection legislation and policies across the EU

This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.

This study explores the main convergences and singularities of data protection and privacy laws in South America. It begins with a historical overview of privacy rights, tracing their evolution from the foundational concept of the “right to be left alone” to the contemporary legal emphasis on consent, personal data lifecycle management, and information security. The research employs a qualitative methodology combining content analysis and the study of foreign law and using the ATLAS.ti software, the authors coded and analyzed privacy and data protection legislation from eight South American countries: Argentina, Brazil, Chile, Colombia, Ecuador, Paraguay, Peru, and Uruguay. The findings reveal a significant degree of alignment among these laws, not only in common terminology such as data subject, controller, and data processing, but also in a shared normative core of principles and data subject rights. Despite these similarities, the study highlights key national distinctions. Brazil’s legislation uniquely defines the use of personal data in scientific research. Ecuadorian law stands out for recognizing the rights of deceased individuals and establishing certifying entities to oversee data protection compliance. In contrast, Paraguay's law is explicitly focused on personal credit data, reflecting a more limited scope. By comparing these regional legal frameworks, the article contributes to a deeper understanding of how global privacy standards are adapted within diverse national contexts in South America.

This article aims to conduct a comparative analysis of personal data protection legislation in Brazil and Uruguay, based on the guiding principles of international privacy law. The study highlights the growing importance of data protection in an increasingly digitalized global environment, where information has become a strategic asset and its governance demands effective regulation. It focuses on Brazil’s General Data Protection Law (Law No. 13,709/2018 – LGPD) and Uruguay’s Personal Data Protection Law (Law No. 18,331/2008), emphasizing convergences in their normative structures, the rights of data subjects, and the creation of national supervisory authorities. The methodology used is qualitative, with a comparative and exploratory approach, based on documentary analysis and bibliographic review. The findings reveal that although both legal systems are aligned with the European Union’s General Data Protection Regulation (GDPR), Uruguay stands out for its earlier adoption and international recognition, having obtained “adequacy status” from the European Union. Brazil, while possessing a comprehensive legal framework, still faces challenges related to the institutional consolidation of its regulatory authority. It is concluded that, despite asymmetries in maturity and global positioning, both countries are moving toward progressive regulatory harmonization and regional cooperation in personal data protection.

In Indonesia, the most recent case of personal data leakage of e-commerce consumers was the personal data leak of the Tokopedia marketplace which occurred in early May 2020. Around 91 million Tokopedia user account data were hacked and sold on the dark web for US$ 5,000. This personal data leak case a lawsuit was filed against the Minister of Communication and Informatics and PT Tokopedia and has been decided by Decision Number: 235/PDT.G/2020/PN.JKT.PST. Protection of personal data in Indonesia deserves to be studied and the problem must be resolved immediately. In this study, a normative juridical method was used and it was found that problems related to regulation also contributed to the fact that the protection of personal data of online application consumers in Indonesia was not maximized. This is due to the fact that existing laws regarding the protection of consumer personal data are still deemed unable to overcome the problems. In addition to regulatory issues, there are also problems regarding the government's lack of oversight of online applications that surf in cyberspace that collect personal data of application users. In this case, it is necessary to immediately pass the Bill on Personal Data Protection.

The article seeks to emphasize existing tendencies in regulation personal data in Russia and in foreign countries. The wide use of modern technologies of data processing “big data”, “artificial intelligence”, “internet of things” does not only open new opportunities for business and people but also makes more evident the gap between individual’s interests for control of his data processing and thus protecting its privacy and commercial use of data by Internet companies. The state, on the other hand, seeks to get a more wide and exclusive access to the data collected by business entities, trying to apply a renewed concept of data sovereignty using its citizens’ personal data protection as a legal ground. The author notes the growing desire from both the state and business entities to undermine individual’s right to control his data processing as an inherent right of a data subject in order to facilitate the access to them and guarantee their interests. Awareness by the state and business of the new opportunities given by processing metadata including personal data, as a fundamental resource for the digital economy development can potentially lead to the situation where an individual will no longer be able to participate in determining the key parameters of their use. Most recent changes in Russian legislation on open access personal data that are to come into force in 2021 also leave much ground for uncertainty. In fact, they can shift the balance even more towards the interests of big business and the state.

The Consumer Protection Law does not expressively verbis state the protection of consumer personal data as part of consumer rights that must be protected by business actors. The existence of cybercrime and the negligence of business actors can cause leakage of consumer personal data to be something that needs to be anticipated. This paper aims to discuss the application of the PDP Law to consumer protection of personal data and how the form of liability of business actors in the perspective of the PDP Law in ensuring consumer protection. This paper uses normative research with a conceptual approach, a statutory approach, and a case approach. This paper also concluded that The handling of consumer disputes related to personal data breaches should be handled in parallel by applying the PDP Law and the Consumer Protection Law. Business actors should protect consumers' personal data based on the provisions prohibiting disclosing personal data unlawfully. The application of the principle of absolute accountability or strict liability is intended so that business actors can be fully responsible for the interests of consumers. In the event that there is negligence on the part of the business actor, resulting in a violation of the protection of consumers' personal data. Business actors cannot escape responsibility for any reason because they have neglected to protect consumers' personal data.

Faculty of Business and Management Sciences, Kolej Universiti Islam Perlis, Malaysia As digital technology develops globally, the protection of personal data in the commercial sector becomes extremely important. Cases of selling data to third parties are increasing, and the government is required to tighten provisions in personal protection laws. Therefore, the Personal Data Protection Act 2010 (Act 709) was passed by the Parliament of Malaysia for the purpose of regulating the processing of personal data and to prevent the misuse of the personal data in commercial transactions. The Act confers rights on Data Subjects in relation to the collection, use and or retention (processing) of their Personal Data, and places obligations on Data Users. The Personal Data Protection Order (Group Data Users) 2013 lists the categories of data users who need to register with Personal Data Protection Department. One of group data users is the education sector including educational institutions and private higher education registered under the Private Higher Education Institutions Act 1996 (Act 555). As data users, private higher education institutions are responsible for protecting Personal Data of two categories of data subjects, namely students and employees in the institution. The obligation including to exercise an appropriate policies and procedures to safeguard the Personal Data collected, to maintain data accuracy, and to prevent unauthorized disclosure. This paper aims to measure the implementation of personal data protection laws including the formulation of operational policies and procedures in private higher education institutions. This will be done by looking at the provisions from the Act regarding the principles of data protection as well as the duties for compliance to the legislation. Furthermore, non-compliance of the Act commits an offence and on conviction, be liable to a fine not exceeding RM500,000 or to imprisonment for a term not exceeding 3 years or both. The study also seeks to determine what are the challenges in implementing the Act successfully.

The presence regulations related to personal data protection in Indonesia, provide a new task for the Indonesian government.Power in terms of personal data protection Still not yet given space maximum movement related to handling model processing of personal data, including the institution given authority.This research targets existence ecosystem model formulation protection of personal data by institutions processing of personal data.The model was obtained by conducting a comparison law between Indonesia and Malaysia.This is due to Because The Personal Data Protection Law in Malaysia has enacted since 2010.Another thing worth noting apply in the Indonesian PDP Law, namely regarding articles that regulate the duties and functions of the Data Protection Officer (DPO) in terms of his obligation protect personal data in a company.In addition, adjustments and arrangements overlap the overlap understanding from the concept of personal data must aligned.Because this concept is the key decomposer overlap the overlap rule Because the ambiguity of the concept of personal data protection in each regulation legislation.Previous research only conducted research to the extent of personal data protection, not yet leading to the DPO.There is room open to conduct further research related to the role of the DPO.This research uses socio-legal research methods, by linking various discipline science to answer his research.Related to DPO regulations in the ecosystem this personal data protection , Indonesia can be called late realize the rules are different from Malaysia which has own a system personal data protection and plans to improve to keep up with developments This personal data protection system.Malaysia's protection system is in accordance with OECD regulations so that the system formed has apply well.

The article examines the current state of legislation governing the protection of personal data, the challenges arising in its implementation, and the prospects for improving the protection mechanism through the use of blockchain technology. Frequent cases of unlawful dissemination of personal data in Kazakhstan are directly linked to unresolved issue of cybersecurity and the need to address vulnerabilities in the existing legislation, which underscores the relevance of the chosen research topic. The purpose of this study is to establish a legal framework for the protection and security of personal data through the use of digital technologies. The scientific novelty of this work lies in the fact that, for the first time since the formation of the legislative framework governing personal data in the Republic of Kazakhstan, legal norms regarding personal data have been defined, as well as areas of legal regulation for the circulation of certain types of personal data. Measures to improve existing legislation governing the circulation of personal data have been proposed. The above constitutes a national scientific doctrine in the field of personal data protection. New practical conclusions have been summarized, allowing for the improvement of existing national legislation and, consequently, their application in legislative activity. The research methods used include a general logical approach (induction, deduction), systematization, analysis, formulation, scientific methods, and empirical methods. Ensuring the security of personal data is a state obligation arising from the duty to protect individual human rights; therefore, the authors emphasize the particular importance of strengthening control over digital threats and introducing a procedure for assessing their impact on human rights in accordance with international standards. The study concludes that the Republic of Kazakhstan should accede to international instruments establishing standards for the protection of personal data. A potential pathway for strengthening the legal framework on personal data protection lies in establishing systemic safeguards that restrict unauthorized access to information. Such mechanisms should operate across all levels of data governance, ensuring consistent compliance among data holders, processors and supervisory entities. Based on the results of the research, it is proposed to adopt a legal norm regulating continuous control and monitoring by data owners, operators, and persons responsible for organizing the processing and storage of personal data.

Purpose: The research objective to be achieved in this study is to determine the protection of personal data in peer to peer lending activities. In this data analysis technique, researchers use research materials in the form of books, journals, documents and research results obtained from a literature review. Methodology: In the data analysis technique, the data obtained will be analyzed using qualitative methods. The qualitative method is observing in their environment by interacting and trying to understand language and interpretations of the world around them. Results: Information technology-based service providers through online, have an obligation to meet personal data protection standards. Protection of personal data is one of the most important things in conducting online transactions, because personal data is related to user security. Limitation: This research contributes to the government and the community must be able to act more thoroughly, meticulously and have a prudent nature, especially when carrying out technology-based lending and borrowing services. Contribution: It is hoped that this law will become a strong legal umbrella for the management and protection of citizens' personal data and government administrators.

The enactment of Law Number 27 of 2022 on Personal Data Protection (PDP Law) marks a significant milestone in safeguarding individual human rights in the digital sphere in Indonesia. This law responds to the urgent need for a comprehensive and unified regulatory framework to replace the previously fragmented sectoral approach that lacked standardization and legal certainty. The PDP Law establishes clear principles for data processing, defines the rights of data subjects, imposes obligations on data controllers and processors, and outlines systematic mechanisms for supervision and law enforcement. This legal framework provides legal certainty not only for individuals as data owners but also for institutions managing personal data, emphasizing transparency, accountability, and data security. However, the implementation of the PDP Law still faces several challenges, including the formation of an independent supervisory authority, institutional readiness, and the public’s limited awareness of data protection rights. Therefore, synergy among the government, private sector, and civil society is essential to ensure effective enforcement. The PDP Law is not merely a normative instrument but also reflects the state’s commitment to upholding citizens' privacy rights as part of broader human rights protection in the digital era.