 Subjects -> PATENTS, TRADEMARKS AND COPYRIGHTS (Total: 29 journals)
|
|
|
- Who is responsible for data processing in smart homes' Reconsidering
joint controllership and the household exemption- Authors: Chen J; Edwards L, Urquhart L, et al.
Pages: 279 - 293
Abstract: Key PointsThe growing industrial and research interest in protecting privacy and fighting cyberattacks for smart homes has sparked various innovations in security- and privacy-enhancing technologies (S/PETs) powered by edge computing. The complex technical set-up has however raised a whole series of legal issues surrounding the regulation of smart home with data protection law.To determine how responsibility and accountability should be fairly assumed by stakeholders, there is a pressing need to first clarify the roles of these parties within the existing data protection legal framework. This article focuses on two legal concepts under the General Data Protection Regulation (GDPR) as the mechanisms to (dis)assign responsibilities to various categories of entities in a domestic Internet of Things (IoT) context: joint controllership and the household exemption.A close examination of the relevant provisions and case-law shows a widening notion of joint controllership and a narrowing scope for the household exemption. While this interpretative approach may prevent evasion of accountability in specific cases, it may lead to the unintended consequence of imposing disproportionate compliance burdens on developers, contributors, and users of smart home safety technologies. By discouraging users to adopt S/PETs, data protection law may likely lead to a lower level of privacy and security protection.The differential responsibilities among joint controllers as envisaged in case-law may reconcile the tensions to some degree, but certain limitations remain. The regulatory dilemma in this regard highlights some underlying assumptions of data protection law that are no longer valid with regard to a smart home, and thus calls for further conceptual and empirical studies on fair reassignment of responsibility and accountability in a domestic IoT setting.
PubDate: Wed, 02 Sep 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa011
Issue No: Vol. 10, No. 4 (2020)
- The ‘right to be forgotten’ online within G20 statutory data
protection frameworks- Authors: Erdos D; Garstka K.
Pages: 294 - 313
Abstract: Key PointsAlthough it is the European Union (EU)’s General Data Protection Regulation and the Google Spain judgment which has brought the concept of the ‘right to be forgotten’ online to the fore, this article argues that its basic underpinnings are present in the great majority of G20 statutory frameworks.While China, India, Saudi Arabia, and the USA remain exceptional cases, 15 out of 19 (almost 80 per cent) of G20 countries now have full-fledged statutory data protection laws. By default, almost all of these laws empower individuals to challenge the continued dissemination of personal data not only when such data may be inaccurate but also on wider legitimacy grounds.Eleven of these countries have adopted statutory ‘intermediary’ shields which could help justify why certain online platforms may be required to respond to well-founded ex post challenges even if they lack most ex ante duties here. However, the precise scope of many data protection laws online remains opaque and the relationship between such laws and freedom of expression is often unsatisfactory.It is argued that G20 countries and G20 Data Protection Authorities should strive to achieve proportionate and effective reconciliation between online freedom of expression and ex post data protection claims, both through careful application of existing law and ultimately through and under new legislative initiatives.
PubDate: Fri, 11 Sep 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa012
Issue No: Vol. 10, No. 4 (2020)
- The normative power of the EU: a case study of data protection laws of
Turkey- Authors: Akcali Gur B.
Pages: 314 - 329
Abstract: Key PointsThe EU has had a normative impact on the development of personal data protection legislation in Turkey and the conditionality mechanism played a key role.For the EU, the alignment of personal data protection with the EU Acquis constitutes a fundamental rights concern that needs to be addressed for continued cooperation between the two jurisdictions, but the reforms in Turkey have been mostly motivated by short term incentives.An adequacy decision on Turkey seems unlikely and some of the promised incentives, such as visa liberalization, have not been granted because of the EU’s broader concerns relating to the rule of law and to fundamental rights. Given the extensive parallels between the two legal frameworks, this outcome could also discourage other non-EU states from following the EU model.This case study raises concerns about the suitability of the EU conditionality mechanism for promoting legislative reforms in the area of data protection law, which requires a well-functioning liberal democracy to be effective.
PubDate: Mon, 24 Aug 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa013
Issue No: Vol. 10, No. 4 (2020)
- Autonomous transport vehicles versus the principles of data protection
law: is compatibility really an impossibility'- Authors: Salami E.
Pages: 330 - 345
Abstract: Key pointsAutonomous (transport) vehicles have evolved from science fiction into a feature of reality (in) which we now live.From a data protection standpoint, one of the challenges confronting the integration of autonomous vehicles into the society is the question of whether or not this disruptive technology is capable of being compliant with the principles of data protection law.The importance of focusing on the principles of data protection law lies in the fact that these principles encompass the entire body of data protection law. Failure to achieve compliance with said principles automatically amounts to a failure to comply with data protection law.With a focus on the European Union and the European Economic Area, this article seeks to identify the extent to which the extant data protection laws are capable of protecting the right to data protection of data subjects in the use of autonomous vehicles while also making recommendations on how compliance can be best achieved.
PubDate: Sat, 28 Nov 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa017
Issue No: Vol. 10, No. 4 (2020)
- The right to compensation of a competitor for a violation of the GDPR
- Authors: Walree T; Wolters P.
Pages: 346 - 355
Abstract: Key PointsAlthough the General Data Protection Regulation (GDPR) is primarily aimed at the protection of data subjects, competitors of the controller may also suffer damage due to an infringement.Article 82(1) of the GDPR stipulates that ‘any person’ shall have the right to receive compensation. It does not clarify whether a competitor can also invoke this right.At first sight, a right to compensation for competitors does not match the primary purpose of the GDPR.However, the GDPR also intends to advance the free movement of personal data, strengthen the protection of personal data, and harmonize data protection law. The right to compensation of competitors can make a meaningful contribution to these objectives.Furthermore, other provisions of European origin also allow enforcement by competitors.
PubDate: Thu, 17 Dec 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa018
Issue No: Vol. 10, No. 4 (2020)
- Decentralized data processing: personal data stores and the GDPR
- Authors: Janssen H; Cobbe J, Norval C, et al.
Pages: 356 - 384
Abstract: Key PointsWhen it comes to online services, users have limited control over how their personal data are processed. This is partly due to the nature of the business models of those services, where data are typically stored and aggregated in data centres. This has recently led to the development of technologies aiming at leveraging user control over the processing of their personal data.Personal data stores (PDSs) represent a class of these technologies; PDSs provide users with a device, enabling them to capture, aggregate, and manage their personal data. The device provides tools for users to control and monitor access, sharing, and computation over data on their device. The motivation for PDSs are described as (i) to assist users with their confidentiality and privacy concerns, and/or (ii) to provide opportunities for users to transact with or otherwise monetize their data.While PDSs potentially might enable some degree of user empowerment, they raise interesting considerations and uncertainties in relation to the responsibilities under the General Data Protection Regulation (GDPR). More specifically, the designations of responsibilities among key parties involved in PDS ecosystems are unclear. Further, the technical architecture of PDSs appears to restrict certain lawful grounds for the processing, while technical means to identify certain special categories of personal data, as proposed by some, may remain theoretical.We explore the considerations, uncertainties, and limitations of PDSs with respect to some key obligations under the GDPR. As PDS technologies continue to develop and proliferate, potentially providing an alternative to centralized approaches to data processing, we identify issues that require consideration by regulators, PDS platform providers, and technologists.
PubDate: Mon, 28 Dec 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa016
Issue No: Vol. 10, No. 4 (2020)
- How to de-identify personal data in South Korea: an evolutionary tale
- Authors: Ko H; Park S.
Pages: 385 - 394
Abstract: Key PointsIn early 2020, South Korea’s legislature made amendments to major laws in the area of data protection in order to, among others, promote the utilization of pseudonymized personal data.With these amendments, pseudonymized personal data can be processed, without consent from data subjects, for archiving purposes, scientific research purposes, or statistical purposes.Arguably, these amendments are largely inspired by the relevant provisions contained in the EU GDPR, although details differ between GDPR and South Korea’s amended statutes.One unique aspect of South Korea’s amended statutes is that they introduce a scheme under which designated agencies carry out the task of combining pseudonymized data that different entities possess.
PubDate: Mon, 09 Nov 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa015
Issue No: Vol. 10, No. 4 (2020)
- Brendan Van Alsenoy, Data Protection Law in the EU: Roles,
Responsibilities and Liability- Authors: Kamarinou D.
Pages: 395 - 398
Abstract: Van AlsenoyBrendan, Data Protection Law in the EU: Roles, Responsibilities and Liability, KU Leuven Centre for IT & IP Law Series, Cambridge: Intersentia Ltd, 2019, xxv + 694 pp, €115.00, ISBN 9781780688282.
PubDate: Wed, 26 Aug 2020 00:00:00 GMT
DOI: 10.1093/idpl/ipaa014
Issue No: Vol. 10, No. 4 (2020)
|
Hybrid journal (It can contain Open Access articles)
