UNIT 1 FOUNDATIONS OF DATA PROTECTION Flashcards
(46 cards)
Data breach
A data breach occurs
when unauthorized parties gain access to private
information
Protection of both enterprise and personal data has two essential dimensions
:ensuring
data integrity by protecting it from corruption or errors, and safeguarding data confidentiality by limiting access exclusively to authorized individuals.
behavioral advertising
For example, imagine that after browsing for a new pair of shoes online, you start to see
ads for shoes from several brands on social media or other websites.
Universal Declaration of Human Rights
is an international document adopted by the United Nations General Assembly that enshrines the rights and freedoms of all human beings. In 1950
Data protection
is a personal right that is a subset of the fundamental human right to privacy, and it is given force by privacy laws and regulations that govern the collection, storage, processing, or dissemination of personal information.
What does the term “twin-right” refer to in the context of data protection and privacy?
Twin-right” refers to the concept in early data protection frameworks where the right to data protection was viewed either as a subset of privacy interests or as a closely linked, complementary right to privacy. This relationship highlights the interconnectedness and mutual reinforcement between privacy and data protection.
Which EU documents recognize the personal right to data privacy and provide it with legal force?
The personal right to data privacy is acknowledged at the EU level by Article 8 of the European Charter of Fundamental Rights (EUCFR) and Article 16 of the Treaty on the Functioning of the European Union (TFEU). Legal force is provided through various directives and regulations, most prominently the General Data Protection Regulation (GDPR).
Data
Data are a collection of facts, recorded observations, statistics, or other raw elements that
are gathered and organized for analysis or planning purposes (Zins, 2007). Data can take
various forms, such as text, numbers, or images, and serve as a basis for decision-making,
insight generation, and strategic planning.
Personal Data
Personal data refers to any data that relate to an identified or identifiable individual (a
data subject; Directive 2016/680). Examples of personal data include names, email
addresses, ethnicity, gender, biometric data, web cookies, and political opinions. Even
pseudonymous information, which does not directly identify an individual, may still be
considered personal data if it enables positive identification of the individual
Sensitive Data
Sensitive data (or special category data in the GDPR) includes data about a data subject’s
racial or ethnic origin, political opinions, religious beliefs, trade union membership,
health, sexual orientation, and genetic or biometric data (Directive 2016/680). Sensitive
data are a subset of personal data and requires special protection because there is a
greater risk that it can be used to harm or discriminate against an individual.
Data Processing
Data processing refers to any action performed on a given set of data, whether carried out
manually or through automated means (Directive 2016/680). This broad definition
includes activities such as collecting, recording, organizing, storing, structuring, editing,
deleting, and otherwise manipulating data throughout its life cycle.
Data Subject
Data subject refers to any living individual whose data are being processed (European
Union, 2018). Protecting the rights and privacy of data subjects is of utmost importance.
Organizations should respect the rights of data subjects throughout the data processing
activities.
term Data controller
A data controller can be a
“natural or legal person,
public authority, agency
or other body”
Data controller
The data controller is the individual or entity that decides how data will be processed
(Directive 2016/680). The data controller bears the responsibility for complying with data
protection laws, implementing appropriate security measures, and ensuring that data
processing activities align with legal requirements
Data Processor
A data processor refers to any party, internal or external to an organization, that engages
in processing data on behalf of the data controller (Directive 2016/680). Third party (external) processors may include service providers such as email or cloud service providers.
Data processors have a contractual obligation to process data in accordance with the
instructions provided by the data controller, ensuring the same level of protection and
compliance. The data controller and the data processor may be the same entity.
Data Protection Officer
The data protection officer (DPO) is the entity responsible for identifying compliance
issues, conducting internal audits, and handling complaints related to privacy regulations
(Directive 2016/680, p. 56). The DPO serves as a point of contact for individuals to address
privacy concerns and ensures that the organization adheres to data protection laws.
What is the significance of including privacy as a human right in international declarations?
The inclusion of privacy as a fundamental human right in documents like the European Convention for Human Rights and the EU Charter for Fundamental Rights helps emphasize and legally protect individuals’ privacy rights.
What does Article 8.1 of the European Convention for Human Rights protect?
Article 8.1 protects the individual’s privacy rights including respect for private and family life, home, and correspondence.
How does the EU Charter for Fundamental Rights (EUCFR) contribute to privacy protection?
The EUCFR upholds privacy by highlighting rights related to private and family life, home, and correspondence, establishing a solid foundation for privacy laws within the EU.
What common principle about personal data is established in privacy laws?
Privacy laws generally establish the principle that empowers individuals to control how their personal information is shared.
The term of Fair Information
Practices
These are a set of internationally recognized practices that govern the collection and use of personal
data. They form the foundation of most contemporary privacy laws and policies
What were the FIPs and when were they introduced?
The Fair Information Practices (FIPs), introduced in a 1973 report by the U.S. Department of Health, Education, and Welfare, were principles that responded to the inadequacy of privacy rights in the age of large-scale automated data processing.
How did international organizations influence data protection laws?
International organizations like the OECD and the Council of Europe played significant roles, with the OECD creating guidelines based on the US FIPs in 1980 and the Council of Europe establishing the first binding international legislation on data protection with Convention 108 in 1981.
What are some key laws and directives that have shaped data protection in the EU?
The EU’s 1995 Data Protection Directive and the 2005 APEC Privacy Framework significantly shaped data protection by emphasizing individual choice and rights over personal data.
