SoK

Case law regularly includes personal data on identifiable persons, often of a rather sensitive nature. This makes the EU General Data Protection Regulation (GDPR) relevant. However, the processing of personal data in case law has until recently not been questioned from the point of view of data protection of the individuals concerned. The Court of Justice of the European Union has taken steps ensure such protection for individuals appearing before the courts. Sweden has chosen another path. As transparency is a highly treasured in Sweden, including transparency in the judiciary, restricting access to the full verdict is sensitive. Instead, the processing of personal data has been restricted in a certain areas, such as research. In order to fulfill the requirements for an ‘appropriate safeguard’ under Article 89 GDPR, an ethical approval is needed for all research on specific categories of sensitive personal data, with no exception for publicly-available official documents like case law. The question posed is how the interest in protection of personal data retrieved from case law can be reconciled with the interest in transparency of the judicial process. It is concluded that even though requirements for an ethical approval of legal research hardly can be seen as a relevant ‘appropriate safeguard’, it cannot be denied that there is a legitimate interest of identifiable persons in case law to have their rights in personal data at least considered. Courts should therefore be stronger in elucidating when and why transparency is of overriding importance, and when and why data protection and the interest of secrecy should prevail. Data protection, transparency, case law, official documents, secrecy, sensitive data, research exception, appropriate safeguard, ethical approval

EU General Data Protection Regulation: Changes and implications for personal data collecting companies

The collection and processing of personal data offers great opportunities for technological advances, but the accumulation of vast amounts of personal data also increases the risk of misuse for malicious intentions, especially in health care. Therefore, personal data are legally protected, e.g., by the European General Data Protection Regulation (GDPR), which states that individuals must be transparently informed and have the right to take control over the processing of their personal data. In real applications privacy policies are used to fulfill these requirements which can be negotiated via user interfaces. The literature proposes privacy languages as an electronic format for privacy policies while the users privacy preferences are represented by preference languages. However, this is only the beginning of the personal data life-cycle, which also includes the processing of personal data and its transfer to various stakeholders. In this work we define a personal privacy workflow, considering the negotiation of privacy policies, privacy-preserving processing and secondary use of personal data, in context of health care data processing to survey applicable Privacy Enhancing Technologies (PETs) to ensure the individuals’ privacy. Based on a broad literature review we identify open research questions for each step of the workflow.

Over Troubled Water: E-Health Platforms and the Protection of Personal Data: The Case of Portugal

Data Protection Directive (EU) 2016/680 for Police and Criminal Justice Authorities

The European General Data Protection Regulation (GDPR), which has been in effect since 25th May, 2018, tightens the requirements regarding data protection for anyone collecting or processing personal data within the European Union (EU) and is connected with heavy fines in case of violations. The topic of data privacy for cyber-physical systems and the related requirements towards development and operation are, however, not new. Many regional laws and regulations pursuing the goals of confidentiality, integrity, availability, storage and purpose limitation, minimisation, transparency and accuracy of personal data have already been in place long before the introduction of the GDPR. But for many companies, dealing with the formal requirements defined by the GDPR is a new and challenging task. We developed a clearly structured approach based on established and proven workflows aimed at integrating data protection topics into existing development processes and thereby achieving compliance with data protection regulations. This approach follows the widely used V-model for development and is inspired by concepts from functional safety development. Both the discipline of functional safety and that of data privacy aim to protect the end-user against harm caused by malfunctions of the system they are using. In the first case this refers to physical harm, while in the second to harm due to violations of fundamental rights and freedoms of natural persons. In the age of digitalisation there are currently indications for a paradigm shift that puts both kinds of harm on the same level. The approach starts by defining the scope of collection and processing of private data as well as the relevant functions and interfaces. Based on this, the threats related to the loss or breach of personal data are analysed and corresponding goals are formulated. A high-level strategy for reaching those goals and preventing data privacy infringements is then derived. This strategy is further refined into concrete technical and process solutions for which verification and validation criteria are defined.

The rapid digital transformation of Tanzania’s economy has significantly expanded the collection and processing of personal data across both public and private sectors, increasing the urgency for effective data-protection mechanisms. The enactment of the Personal Data Protection Act (PDPA) 2023 represents a landmark development in Tanzania’s legal landscape, affirming privacy as both a constitutional and human right within the digital environment. However, despite this legislative milestone, the Act’s implementation remains constrained by vague statutory provisions, overlapping institutional mandates, weak regulatory capacity, and limited public awareness. This article employs a doctrinal and comparative legal analysis to evaluate the effectiveness of Tanzania’s data-protection framework. It situates the PDPA within broader regional and international contexts, comparing it with the European Union’s General Data Protection Regulation (GDPR), the African Union’s Malabo Convention, and Kenya’s Data Protection Act 2019. The analysis reveals that while Tanzania’s PDPA incorporates globally recognised principles of lawfulness, fairness, and accountability, its enforcement potential is undermined by institutional fragility and inadequate legislative harmonisation. The study concludes that the success of the PDPA depends on the operational independence and resource capacity of the Personal Data Protection Commission (PDPC), greater inter-agency coordination, and a culture of compliance among data controllers and processors. It recommends targeted reforms emphasising legal clarity, institutional strengthening, technological innovation, and regional cooperation to align Tanzania’s data-protection regime with international best practices and to promote public trust in the digital economy.

The EU General Data Protection Regulation (GDPR) recognizes the data subject’s consent as one of the legal grounds for data processing. Targeted advertising, based on personal data processing, is a central source of revenue for data controllers such as Google and Facebook. At present, the implementation of consent mechanisms for such advertisements are often not well developed in practice and their compliance with the GDPR requirements can be questioned. The absence of consent may mean an unlawful data processing and a lack of control of the user (data subject) on his personal data. However, consent mechanisms that do not fully satisfy GDPR requirements can give users a false sense of control, encouraging them to allow the processing of more personal data than they would have otherwise. In this paper, we identify the features, originating from GDPR requirements, of consent mechanisms. For example, the GDPR specifies that a consent must be informed and freely given, among other requirements. We then examine the Ad Consent Mechanism of Facebook that is based on processing of user activity data off Facebook Company Products provided by third parties with respect to these features. We discuss to what extent this consent mechanism respects these features. To the best of our knowledge, our evaluation of Facebook’s Ad Consent Mechanism is the first of its kind.

INTRODUCTION This chapter introduces the European approach to privacy and data protection. Two things are important to point out from the start. First, there are differences between the right to privacy and the right to data protection, which will be described in more detail below. Perhaps the most prominent difference lies in the material scope. The right to privacy usually does not extend to the collection of nonprivate and non-privacy-sensitive data, whereas the term ‘personal data’, central to most data protection documents, is not limited to private or sensitive information, but extents to any data with which someone could potentially be identified. ‘Even ancillary information, such as “the man wearing a black suit” may identify someone out of the passers-by standing at a traffic light. ’Second, this study will primarily discuss the European perspective and in doing so will refer to documents of both the European Union (EU) and the Council of Europe (CoE). For privacy, the case law by the European Court of Human Rights (ECtHR) on Article 8 of the European Convention on Human Rights (ECHR) will be central and with regard to data protection, the EU's Data Protection Directive and the General Data Protection Regulation, which will replace the Directive over time, will function as the primary (though not exclusive) points of reference. Article 8 ECHR grants a right to respect for private and family life, home and correspondence: 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others. The right to data protection is currently protected by the Data Protection Directive, which contains rules for data controllers such as: store data only when necessary, store data safely, process personal data with a legitimate aim, be transparent about the processing activities, etc. It also contains some rights for data subjects, such as the right to have access to personal data, to correct inaccurate data and to object to certain types of data processing.

The General Data Protection Regulation (GDPR), enacted in the European Union in 2018, has significantly transformed the landscape of personal data management and protection. This article provides an overview of GDPR's impact, focusing on its applicability, fundamental principles and influence on data management practices, particularly within the European Society of Thoracic Surgeons (ESTS) database. GDPR's reach extends to all entities collecting and processing personal data of European Union residents, regardless of their location. It encompasses various data types, emphasizing meticulous handling and protection of identifiable information. Special categories of data, such as health and sensitive attributes, require even more stringent protection. The regulation sets legal, fair and transparent data processing principles, emphasizing accuracy, purpose limitation and data minimization. It also stresses accountability, leading to the appointment of Data Protection Officers and significant penalties for non-compliance. The ESTS database, designed to enhance thoracic surgical research and care, collects data on European procedures. It follows GDPR principles by pseudonymizing data, ensuring secure data transmission and providing clear instructions for data submission. The database contributes to research, policymaking and practice improvement in thoracic surgery by offering a comprehensive dataset for analysis. Here, we aim to shed light on the complexities of GDPR implementation and emphasize the need for comprehensive data management strategies to ensure compliance and enhance privacy protection with the contribution to the ESTS database. GDPR compliance comes with challenges, including potential human dignity and privacy rights violations. Data breaches can result in unauthorized disclosures, and non-compliance can lead to substantial fines and reputational damage. The implementation of GDPR encourages organizations to prioritize ethical data practices, security measures and transparent data handling. In conclusion, GDPR has revolutionized personal data protection by emphasizing accountability, transparency and individual rights. It has impacted organizations globally, promoting responsible data management practices. Adhering to GDPR ensures privacy protection, trust-building and overall enhancement of data management in today's data-driven environment.

This paper reports ongoing research on the process and results of implementing a conceptual model of privacy by design. The model is based on building blocks derived from a comparative analysis of approaches to privacy by design by different authors. We then implemented the model to the data processing operations of Slovenia's central health information system (eHealth). The main goal of our research was to ensure personal data processing compliance with the General Data Protection Regulation (GDPR) and privacy by design criteria set by the model. Findings were used to answer the research questions: whether the proposed conceptual model is general enough to be used in most personal data processing operations, regardless of context; does the successful implementation of conceptual model requirements in personal data processing operations lead to compliance with the GDPR and with the additional requirements of privacy by design, and is the efficiency of complying with personal data processing higher when using the conceptual model compared to other approaches. Current results show that the model is robust enough to be used in a complex system of personal data processing. It also enables a relatively quick assessment of the gap between the actual and target situation, while suggesting which measures should be taken to comply. However, the model still must be tested in several organizations and other contexts of personal data processing, as only a comparative meta-analysis can provide reliable answers to the questions posed.

Financial Intelligence Units (FIUs) are key players in the current Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) legal system. FIUs are specialised bodies positioned between private financial institutions and states’ law enforcement authorities, what renders them a crucial middle link in the chain of information exchange between the private and public sectors. Considering that a large share of this information is personal data, its processing must meet the minimum data protection standards. Yet, the EU data protection legal framework is composed of two main instruments, i.e. the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED), which provide different thresholds for the protection of personal data. The aim of this paper is to clarify the applicable data protection legal regime for the processing of personal data by FIUs for AML/CFT purposes. To that end, the paper provides an overview of the nature and goals of AML/CFT policy and discusses the problem of the diversity of existing FIU models. Further, it proposes a number of arguments in favour of and against the possibility of applying either the GDPR or LED to the processing of personal data by the FIUs and reflects on how convincingly these arguments can be used depending on the specificities of a given FIU model.

The EU data protection reform package adopted in 2016 introduced two main legal instruments regulating the processing of personal data, namely the General Data Protection Regulation (GDPR) applicable to all data processing operations carried out in both private and public sector with a few explicitly enumerated exceptions, and the Law Enforcement Directive (LED) limited to the processing of personal data "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties". Since these two legal acts constitute separate legal regimes with different thresholds for the protection of personal data, it is crucial to draw precise borderlines between the scopes of their application. With the assumption that where the specific rules of the LED are not applicable, the general rules of the GDPR should apply, this chapter focuses on the former instrument and aims at providing a comprehensive analysis of the material scope of its application. In doing so, it identifies some areas of uncertainty, which if not hamper, then at least, bring into question the process of harmonization of the rules for data processing in the law enforcement context.

The General Data Protection Regulation (GDPR) harmonizes data privacy laws and regulations across Europe. Through the GDPR, individuals are able to better control their personal data in the face of new technological developments. While the GDPR is highly advantageous to individuals, complying with it poses major challenges for organizations that control or process personal data. Since no automated solution with broad industrial applicability currently exists for GDPR compliance checking, organizations have no choice but to perform costly manual audits to ensure compliance. In this paper, we share our experience building a UML representation of the GDPR as a first step towards the development of future automated methods for assessing compliance with the GDPR. Given that a concrete implementation of the GDPR is affected by the national laws of the EU member states, GDPR's expanding body of case law and other contextual information, we propose a two-tiered representation of the GDPR: a generic tier and a specialized tier. The generic tier captures the concepts and principles of the GDPR that apply to all contexts, whereas the specialized tier describes a specific tailoring of the generic tier to a given context, including the contextual variations that may impact the interpretation and application of the GDPR. We further present the challenges we faced in our modeling endeavor, the lessons we learned from it, and future directions for research.

The General Data Protection Regulation (GDPR), passed in 2018, outlined new data privacy standards applying to residents of the European Union (EU). The impact of this law stretches beyond the EU to anyone - such as researchers across the world - collecting or processing data from EU residents. Researchers have had to augment their methodologies to ensure GDPR compliance. This initiative intersects with at-scale educational programs, which often enroll EU students and are also often the subject of institutional research. While creating a study to research students in an online Master of Science in Computer Science (MSCS) program, some of whom are in the EU, we encountered difficulties with ensuring GDPR compliance. This paper discusses the implications of the GDPR related to both general research and our specific study. We discuss the challenges of interpreting the GDPR and integrating it into our methodology as well as potential solutions, our ultimate resolution, and practical recommendations, and we consider what the future of data privacy legislation means for researchers.