Algorithmic Management in the Platform Work Directive: Fixing the GDPR?

The General Data Protection Regulation (GDPR), enacted in the European Union in 2018, has significantly transformed the landscape of personal data management and protection. This article provides an overview of GDPR's impact, focusing on its applicability, fundamental principles and influence on data management practices, particularly within the European Society of Thoracic Surgeons (ESTS) database. GDPR's reach extends to all entities collecting and processing personal data of European Union residents, regardless of their location. It encompasses various data types, emphasizing meticulous handling and protection of identifiable information. Special categories of data, such as health and sensitive attributes, require even more stringent protection. The regulation sets legal, fair and transparent data processing principles, emphasizing accuracy, purpose limitation and data minimization. It also stresses accountability, leading to the appointment of Data Protection Officers and significant penalties for non-compliance. The ESTS database, designed to enhance thoracic surgical research and care, collects data on European procedures. It follows GDPR principles by pseudonymizing data, ensuring secure data transmission and providing clear instructions for data submission. The database contributes to research, policymaking and practice improvement in thoracic surgery by offering a comprehensive dataset for analysis. Here, we aim to shed light on the complexities of GDPR implementation and emphasize the need for comprehensive data management strategies to ensure compliance and enhance privacy protection with the contribution to the ESTS database. GDPR compliance comes with challenges, including potential human dignity and privacy rights violations. Data breaches can result in unauthorized disclosures, and non-compliance can lead to substantial fines and reputational damage. The implementation of GDPR encourages organizations to prioritize ethical data practices, security measures and transparent data handling. In conclusion, GDPR has revolutionized personal data protection by emphasizing accountability, transparency and individual rights. It has impacted organizations globally, promoting responsible data management practices. Adhering to GDPR ensures privacy protection, trust-building and overall enhancement of data management in today's data-driven environment.

Data Protection Impact Assessment under the EU General Data Protection Regulation: A feminist reflection

The Data Protection Impact Assessment, or: How the General Data Protection Regulation May Still Come to Foster Ethically Responsible Data Processing

The IoT is innovative and important phenomenon prone to several services and applications such as the blockchain, but it should consider the legal issues related to the data protection law. We should be taken into account the legal issues related to the data protection and privacy law. Technological solutions are welcome, but it is necessary, before developing applications, to consider the risks which we cannot dismiss. Personal data is a value. It is important to evaluate the European Regulation n. 679/2016, European General Data Protection Regulation (GDPR) that will enter into force on 25 May 2018. The GDPR introduces Data Protection by Design and by Default, Data Protection Impact Assessment (DPIA), data breach notification and significant administrative fines in respect of infringements of the Regulation. It is fundamental to evaluate the legal issues and prevent them, adopting in each project the Data Protection by Design approach. Regarding the data protection and security risks, there are some issues with potential consequences for data and liability. A correct law analysis allows evaluating risks preventing the wrong use of personal data. The contribution describes the main legal issues related to privacy and data protection focusing on the Privacy by Design approach, according to the GDPR.

Jamaica Adopts a Post-GDPR Data Privacy Law

On May 25th, 2018, the EU General Data Protection Regulation (GDPR) came into force. Recognised as a comprehensive regulation for improving privacy and data protection, a substantial impact on data processing disciplines such as Serious Games (SG) research was expected.By conducting a scoping review, this paper explores the effects of GDPR on reporting of ethics approval, informed consent, ethics guidelines and data protection in SG studies. Five scientific databases were searched for research between 2016 and 2020 addressing Serious Games, Exergames and Applied Games. A total of 2146 full-text studies split into equal collections before and after GDPR were included. Lexicometric and keyword-in-context analysis were conducted and comparatively evaluated regarding ethics reporting and trends.Results unexpectedly show that GDPR so far hardly left a mark. While a slight increase of 12% in general ethics reporting can be observed, less than 6% of the studies after GDPR coming-into-force report on data protection. Ethics procedures remained consistent with most researchers reporting the approval from their home university committee and stating the Declaration of Helsinki as followed guidelines. Overall, the verifiable impact of GDPR was found negligibly small, with only 0.5% of studies referring to the regulation in the two years after introduction. Conclusively, further research is suggested to focus on integrating ethics and data protection guided on GDPR from an early conceptual stage to the reporting of the findings.

The chapter presents a proposal for a Human Rights Impact Assessment in the context of Artificial Intelligence (HRIA-AI). Such a proposal builds from the Data Protection Impact Assessment (DPIA) approach sanctioned in the European General Data Protection Regulation (GDPR). The chapter identifies how this DPIA already amounts to a human rights impact assessment under certain circumstances. However, some of its aspects limit the use of DPIA as a HRIA-AI, primarily the link with personal data, which prevents DPIA from being required when no personal data processing occurs. The chapter acknowledges how certain uses of AI might impact human rights even in the absence of personal data processing. Therefore, a new approach to assessing such impacts is proposed.

Purpose This article aims to examine the tension between freedom of expression and personal data protection, focusing on criminal conviction and offence data under the General Data Protection Regulation (GDPR). It analyses how legal frameworks, particularly Article 85 of the GDPR, attempt to reconcile public access to information with individual data privacy rights harmoniously. Design/methodology/approach Using a legal doctrinal approach primarily, this study examines GDPR provisions, especially Article 85, alongside relevant case law. The principle of proportionality serves as a key analytical tool to assess the necessity and justification of legal restrictions on data processing. Findings The research underscores the delicate balance between freedom of expression and data protection concerning criminal records. Article 85 plays a crucial role in establishing journalistic exemptions while ensuring data privacy. The principle of proportionality is vital in preventing disproportionate restrictions, requiring case-by-case evaluations. The study highlights the evolving nature of privacy-publicity conflicts, with the right to be forgotten serving as a safeguard against undue harm from outdated or minor convictions. Research limitations/implications This study has limitations, including its reliance on case-specific analyses, which overlook the broader impacts of the evolving digital media landscape, particularly social media and user-generated content. The focus on European legal frameworks (e.g. GDPR) restricts generalisability to non-EU jurisdictions with differing standards. Additionally, the analysis emphasises journalistic exemptions, neglecting other forms of expression – such as academic, artistic and literary – that also require balancing against personal data protection rights. Practical implications The research provides practical guidance for balancing data protection and freedom of expression, particularly under GDPR Article 85. It underscores the need for case-by-case assessments, ensuring proportionality and necessity when handling criminal conviction data. Policymakers and legal practitioners can use these insights to refine journalistic exemptions and prevent data misuse, especially in digital media contexts. Organisations, including media platforms, are encouraged to adopt responsible data-handling practices to safeguard privacy while enabling public interest reporting. Finally, the findings stress the importance of dynamic frameworks that adapt to evolving societal and technological contexts, supporting fair outcomes for both data protection and expression rights. Social implications This research highlights the delicate balance between individual data protection rights and freedom of expression, particularly regarding criminal conviction data. Its implications extend to societal concerns over data privacy, the potential misuse of personal information and the long-term impact on individuals, especially those with minor or outdated offences. As digital media evolves, these issues become more pressing, with the rise of social media and user-generated content complicating the legal landscape. Ensuring that privacy is upheld without stifling public access to essential information is crucial for maintaining both rights and societal transparency in an increasingly interconnected world. Originality/value This study enriches the debate on data protection and freedom of expression in crime-related data processing. By addressing journalistic exemptions and the evolving media landscape, it provides a nuanced perspective on safeguarding privacy while maintaining transparency in an era of digital accessibility.

EU General Data Protection Regulation: Changes and implications for personal data collecting companies

The authors of this work claim that the legislation of the European Union does not adequately protect biometric data, due to the actuality that the protection of biometric data after the death of a person is unresolved within the legal field of personal data protection. The General Data Protection Regulation (GDPR) does not apply to deceased individuals, meaning that biometric data that was processed under the GDPR during the individual's lifetime continues to be at risk of re-processing after the individual's death, meaning that businesses can potentially avoid GDPR when the person has died, and decide the fate of the deceased's biometrics at their own discretion. Taking into account the above, the authors of the work consider it necessary to orient special legislation to overcome the specified legal gap, and since the regulation on the protection of personal data is vague to solve the problem, the research proposal of the authors consists in the application of legal guarantees not only under the GDPR but also in conformity with civil law. Therefore, the authors aim to initiate provisions for potential legislation, including the consolidation of the processing of biometric data of the deceased as part of a person's last will. The development of legal norms that would protect the biometric data of deceased persons by classifying them as non-property rights is especially recommended for countries with a civil law system. The research paper also warns that privileges that belong to the non-property rights of an individual do not, as a rule, automatically pass to heirs. In this regard, in the absence of a person's will to decide the future fate of biometric data that is continuously processed at the time or after death, the authors offer to allow family members and other close persons to exercise the right to the protection of personal data, such as the right to be forgotten, on behalf of the deceased, and to demand the condition of appropriate technical and organizational guarantees in the event of such performance. In this matter, according to the authors, it is expedient to conclude agreements between interested parties and family members to determine the fate of biometric data. However, in order to avoid the realization of the right to the protection of personal data, which the deceased did not have time to realize during his lifetime, and if during the life of the person Article, 9 (2, a) GDPR confirmed as the basis for the permitted biometric data processing because it is subject to the consent of the person, then following the human-centric approach of the European Union, it is proposed to design and indicate in such consent a clause where the individual could specifically determine and decide the fate of the biometric data upon death, for example, to (i) delete, (ii) transfer for the research purposes. Consequently, the authors predict the development of legal regulation of biometric data by assigning it to the category of non-property rights. Hence, the adoption of special provisions for the protection of the deceased biometric data and ensuring the realization of the right to personal data protection is expected not only during life but also after death.

Compensation for Breach of the General Data Protection Regulation

Humanitarian organisations often operate in emergency contexts where strict compliance with data protection laws, such as the General Data Protection Regulation (GDPR), can pose significant practical challenges. This paper explores the need for a differentiated data protection regime tailored to the realities of humanitarian crises, balancing efficiency and the fundamental rights of data subjects. By analysing key European Court of Justice cases, including Schrems II (C-311/18), Nowak (C-434/16) and Pankki S (C-579/21), the paper highlights the importance of adapting core GDPR principles to crisis situations. It also examines the integration of human rights principles, emphasising the protection of dignity and autonomy during emergencies. Furthermore, it addresses regulatory challenges, proposing proactive engagement with authorities to ensure accountability and trust. Practical solutions are proposed such as simplified Data Protection Impact Assessments (DPIAs), the use of pseudonymisation, data minimisation and standardised Memorandums of Understanding (MOUs) to replace complex contractual requirements. These measures aim to ensure compliance while enabling rapid and effective responses in emergencies. The paper concludes by calling for the development of a flexible regulatory framework that integrates data protection into the operational needs of humanitarian organisations without compromising ethical and legal standards.

The European General Data Protection Regulation (GDPR), which has been in effect since 25th May, 2018, tightens the requirements regarding data protection for anyone collecting or processing personal data within the European Union (EU) and is connected with heavy fines in case of violations. The topic of data privacy for cyber-physical systems and the related requirements towards development and operation are, however, not new. Many regional laws and regulations pursuing the goals of confidentiality, integrity, availability, storage and purpose limitation, minimisation, transparency and accuracy of personal data have already been in place long before the introduction of the GDPR. But for many companies, dealing with the formal requirements defined by the GDPR is a new and challenging task. We developed a clearly structured approach based on established and proven workflows aimed at integrating data protection topics into existing development processes and thereby achieving compliance with data protection regulations. This approach follows the widely used V-model for development and is inspired by concepts from functional safety development. Both the discipline of functional safety and that of data privacy aim to protect the end-user against harm caused by malfunctions of the system they are using. In the first case this refers to physical harm, while in the second to harm due to violations of fundamental rights and freedoms of natural persons. In the age of digitalisation there are currently indications for a paradigm shift that puts both kinds of harm on the same level. The approach starts by defining the scope of collection and processing of private data as well as the relevant functions and interfaces. Based on this, the threats related to the loss or breach of personal data are analysed and corresponding goals are formulated. A high-level strategy for reaching those goals and preventing data privacy infringements is then derived. This strategy is further refined into concrete technical and process solutions for which verification and validation criteria are defined.

Case law regularly includes personal data on identifiable persons, often of a rather sensitive nature. This makes the EU General Data Protection Regulation (GDPR) relevant. However, the processing of personal data in case law has until recently not been questioned from the point of view of data protection of the individuals concerned. The Court of Justice of the European Union has taken steps ensure such protection for individuals appearing before the courts. Sweden has chosen another path. As transparency is a highly treasured in Sweden, including transparency in the judiciary, restricting access to the full verdict is sensitive. Instead, the processing of personal data has been restricted in a certain areas, such as research. In order to fulfill the requirements for an ‘appropriate safeguard’ under Article 89 GDPR, an ethical approval is needed for all research on specific categories of sensitive personal data, with no exception for publicly-available official documents like case law. The question posed is how the interest in protection of personal data retrieved from case law can be reconciled with the interest in transparency of the judicial process. It is concluded that even though requirements for an ethical approval of legal research hardly can be seen as a relevant ‘appropriate safeguard’, it cannot be denied that there is a legitimate interest of identifiable persons in case law to have their rights in personal data at least considered. Courts should therefore be stronger in elucidating when and why transparency is of overriding importance, and when and why data protection and the interest of secrecy should prevail. Data protection, transparency, case law, official documents, secrecy, sensitive data, research exception, appropriate safeguard, ethical approval

On defense of “ethification” of law: How ethics may improve compliance with the EU digital laws