{"title":"Digital Humanism: The Constitutional Message of the GDPR","authors":"Edoardo Celeste, G. De Gregorio","doi":"10.54648/gplr2022002","DOIUrl":"https://doi.org/10.54648/gplr2022002","url":null,"abstract":"This article aims to analyse the constitutional message of the General Data Protection Regulation (GDPR) in the age of artificial intelligence. Although the GDPR does not formally have any constitutional character, it can be said to play a para-constitutional role from a functional point of view: it translates and implements core constitutional principles in the context of the algorithmic society. This article traces the legislative origin of the GDPR’s framework on automated decision-making showing that it aims to enhance a series of key constitutional values, preserving human autonomy, increasing legal certainty, and providing procedural safeguards. The article finally highlights how the GDPR is promoting a constitutional message deeply rooted in a new form of ‘digital humanism’: a conception of the digital society where the human being and her dignity should resolutely outrank machines, technology and, ultimately, economic efficiency.\u0000artificial intelligence, GDPR, digital humanism, rule of law, human dignity, constitutionalism","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-02-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129169228","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The Right to Be Forgotten in the European Union: Towards a Uniform Approach?","authors":"B. Zelger","doi":"10.54648/gplr2022003","DOIUrl":"https://doi.org/10.54648/gplr2022003","url":null,"abstract":"This article aims to shed light on the application of the ‘right to be forgotten’ in the case law of the Court of Justice of the European Union (CJEU or Court) as well as the German Highest Courts, that is, the German Federal Constitutional Court (Bundesverfassungsgericht) and the German Federal Court of Justice (Bundesgerichtshof) from a fundamental rights perspective, thereby also considering the principles established by the European Court of Human Rights (ECtHR). While the CJEU in its decision in Google Spain (Case C-131/12) established a rebuttable presumption of supremacy in favour of the right to privacy, the German Highest Courts have ever since acknowledged the equal weight of fundamental rights in order to ensure a fair balancing of the latter against each other. However, considering the CJEU’s decision in GC and Others (Case C-136/17), the Court has arguably shifted its approach, thereby getting closer to an actual fair balancing of fundamental rights. It will be argued that such change in paradigm arguably provides for an approximation of the latter approaches in favour of the approach of the German Highest Courts. Such development is welcome, not only because it is in line with the principles established by the ECtHR and thus provides for a uniform standard of protection of fundamental rights within the EU, but also because of the existing lack of a hierarchy of the respective fundamental rights concerned which, as a consequence and matter of principle, obstructs the presumption of supremacy of one over the other.\u0000artificial intelligence, GDPR, digital humanism, rule of law, human dignity, constitutionalism","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-02-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121719852","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cross-Border Data Flows: An Evolving Multi-Layered Regulatory Approach Required!","authors":"Robert Walters","doi":"10.54648/gplr2022004","DOIUrl":"https://doi.org/10.54648/gplr2022004","url":null,"abstract":"This article will discuss the increasing importance of the multi-layered approach that personal data is taking in transnational cross-border data flows. It examines the role personal data plays in the evolving digital economy. The article will address a further accentuating question as to how far, if at all, the cross-border data flows are being considered in the area of national security. Throughout the outbreak of coronavirus, technology has been used by nation states to trace and collect health data of its citizens, in the interest of the broader national interest/security of individual states. Some states in developing the technology to track and trace their citizens went one step further and established bilateral agreements to share some of the data, such as Australia and Singapore. What emerged, was the evolving complex layers regulating while enabling data flows. The dichotomy facing governments and regulators is to allow for the free flow of personal data, while ensuring data subjects do not relinquish their privacy. To achieve this, I propose a Theory Of Action (TOA). Such an approach is widely accepted in other industry sectors where governments regulated a minimum standard, such as primary, human health and food production.\u0000Cross-Border Data Flows, Data Transfers, Digital Economy, National Security, Trade in Data","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-02-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132563916","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Reconciling Competing Data Security Standards Applicable to Data Held by Retail Banks Operating in California in Light of Van Buren and TransUnion","authors":"Michael R. Sneberger","doi":"10.54648/gplr2021023","DOIUrl":"https://doi.org/10.54648/gplr2021023","url":null,"abstract":"When operating in California, retail banks face competing, seemingly inconsistent, federal, state, and industry data security standards. The article describes what regulations prescribe data security standards for banks operating in California. It analyses private rights of action available in the event of a data breach, how such private rights may be affected by the Van Buren and TransUnion decisions, and what data security standards are set forth by each of the controlling regulatory regimes, as well as other industry standards which may inform the applicable standard of care regarding non-personal information. Finally, the article presents a position on how a California bank can reconcile the applicable security standards, and provides a suggestion for a data security benchmark for retail banks operating in California by positing that a ‘reasonable’ data security program is not only one based on assessment of risk and industry best practices, but is also reconcilable with the seemingly competing regulatory regimes applicable to banks operating in California.","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114656696","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Do Social Media Platforms Always Use Personal Data Lawfully?","authors":"Jason Flint","doi":"10.54648/gplr2021026","DOIUrl":"https://doi.org/10.54648/gplr2021026","url":null,"abstract":"The article considers the principal concerns posed by the increasing influence of social media and analyses the potential and actual legal bases relied upon by selected platforms for the processing of personal data. Special reference is made to the EU General Data Protection Regulation (Regulation (EU) 2016/679). The article concludes that the application of those legal bases may be questionable in certain situations and that platforms may struggle to achieve the transparency and proportionality required by applicable rules.\u0000Social Media, Data Protection, Legal Basis, GDPR","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125652202","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"How (Not) to Regulate Data Processing: Assessing Nigeria’s Data Protection Regulation 2019 (NDPR)","authors":"Adekemi Omotubora","doi":"10.54648/gplr2021024","DOIUrl":"https://doi.org/10.54648/gplr2021024","url":null,"abstract":"Data protection has become a key policy issue in Nigeria and for many years, law and policymakers have proposed to regulate data processing without success. The Nigeria Data Protection Regulation (NDPR) was issued by the National Information Technology Development Agency (the NITDA) in 2019 ostensibly to fill this regulatory void. While the NDPR has generated more awareness of data protection among stakeholders, this article argues that it is unlikely to change the regulatory landscape for data protection in Nigeria. This is firstly because the NDPR misapprehends key concepts and principles of data protection, thus creating interpretative and compliance problems, and secondly, because its enforcement mechanisms are deficient when measured against best practices in the regulation of data processing. The article demonstrates that in spite of the fact that the NDPR models the EU General Data Protection Regulation (GDPR) and emulates most of its aspects, it has significant limitations in terms of effectiveness and enforcement. It proposes that in order for Nigeria to truly join the global data protection regime, a new data protection law must not only address the challenges identified in the NDPR but must also incorporate emerging best practices in data protection.\u0000Nigeria, NDPR, GDPR, Data Protection, Data Processing","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129005085","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Data Protection in Mexico: One Right, Two Systems, Different Protections and Uncontrolled Data Breaches","authors":"Héctor E. Guzmán-Rodríguez","doi":"10.54648/gplr2021019","DOIUrl":"https://doi.org/10.54648/gplr2021019","url":null,"abstract":"To obtain a complete understanding of how data protection laws apply in Mexico, readers must start with the following fact: There are two main data protection laws in Mexico. One applies to companies and individuals processing personal data for non-household activities, the other provides the framework that all Mexican States shall follow to regulate data processing by public entities identified as ‘sujetos obligados’ or ‘obligated subjects’. Even when both laws regulate ‘data protection’ in a very similar way, a close look into them reveals that they provide different rights to data subjects and different obligations for data controllers. As we will indicate, this situation may lead to problems on the differentiated protections and obligations when citizens’ rights are processed by two types of data controllers that otherwise should not have different obligations when processing this information.\u0000Mexico, Data Protection, Data Subjects, Portability, Impact Assessment, Breach, Security","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127691420","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Mexico (Non-)Adequacy to European Standards on Personal Data Protection in the Context of Employment","authors":"M. Ramírez","doi":"10.54648/gplr2021018","DOIUrl":"https://doi.org/10.54648/gplr2021018","url":null,"abstract":"This article analyses the main standards and regulations put in place by the European Union (EU) and the Council of Europe with respect to the privacy and personal data protection of workers. It demonstrates that there is a current tendency toward the establishment of specific rules aimed at strengthening employees’ rights vis-à-vis employers’ interests. It also shows that there is a preventive rather than a reactive approach in the European model. However, this article argues that, albeit strongly influenced by Europe, the Mexican legal framework on personal data protection does not follow this trend, due to legislative asymmetries between the public and private sector, as well as the lack of specific regulation in this field.\u0000Chile, Privacy, Constitutional Law, Personal Data, Private Communications, Informational Self-Determination","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125425196","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Dark Patterns, Privacy and the LGPD","authors":"Luiza Jarovsky","doi":"10.54648/gplr2021016","DOIUrl":"https://doi.org/10.54648/gplr2021016","url":null,"abstract":"This article deals with the topic of dark patterns in personal data collection (DPPDC), arguing that they are still under the radar of lawmakers and privacy advocates, and that data protection laws such as the Brazilian Lei Geral de Proteção de Dados (LGPD) do not offer enough protection against it. The article presents the general concept of dark patterns, followed by a legal analysis of DPPDC, highlighting that their prevalence is made possible by the outdated decision making model tacitly endorsed by data protection laws. To illustrate this argument, I examine the recently enacted LGPD, which emphasizes data subjects’ autonomy without offering additional protection against malicious actors’ commonly used techniques. Turning to the legal text, I inquire whether DPPDC can be deemed legal or not given the LGPD’s current provisions regarding lawfulness of data processing. Lastly, after identifying the legal gaps that enable DPPDC to flourish, I argue that data protection law needs a paradigm change, so that data subjects can be guaranteed a fair decision making process and adequate levels of protection of their privacy.\u0000Dark Patterns, Data Protection, Brazil, Lei Geral de Proteção de Dados (LGPD), General Data Protection Regulation (GDPR), Fairness, Privacy","PeriodicalId":127582,"journal":{"name":"Global Privacy Law Review","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133226402","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}