AI and Law I - Lecture 5: AI and Data Protection Law I

Please also view the Lecture 1 Course for links to all the other lectures. Note: This lecture was used to finish the content of Lecture 4. The cards for that have been moved to Lecture 4.

15 flashcards · Law · by daniel-eder

1. When was the GDPR enacted?

   2016, but applicable only since 25.05.2018

2. Is the GDPR targeting specific technologies?

   No, it is tech-neutral

3. What are the consequences of GDPR violations?

   Fines Compensation for material and immaterial damages Prohibition of (Data) Processing Loss of reputation

4. Why follow the requirements of the GDPR?

   it comes down to really really high fines up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher.

5. Is the GDPR directly applicable?

   It is a Regulation, and as such directly applicable But it contains opening clauses, these allow the EU MS to enact their own provisions using these opening clauses

6. What are white/blacklists in the GDPR?

   Enables EU MS and their Data protection agencies to create lists of activities where: whitelist: no data processing impact assessment has to be made blacklist: data processing impact assessment always has to happen -> it is not sufficient to just look at the GDPR, also national legislation has to be consulted

7. What is the material scope of the GDPR?

   Applies to processing of personal data wholly or partially by automated means and (non-automated) processing of personal data which form part of a filing system or are intended to form part of a filing system

8. What is a filing system?

   any structured set of personal data which are accessible according to specific criteria = structured and sorted whether centralised, decentralised or dispersed on a functional or geographical basis IMPORTANT: filing system can refer to a physical system. File in the physical sense! Not just a computer database. Examples employee records patient files telephone book etc..

9. What is exempt from the material scope of the GDPR?

   Household Exemption This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity. -> If there is any link to a professional activity, then the GDPR is applicable. Example: you capture an image … of a relative with a broken leg and put it in the family album -> GDPR not applicable of a colleague of yours and put it on your club’s website -> GDPR applicable

10. What is the territorial scope of the GDPR?

    Establishment Principle Minimum Contracts Principle

11. What is the establishment principle?

    activities of a company established in the Union, regardless whether the processing takes place in the Union e.g. Austrian Company uses US company to send a newsletter -> GDPR applicable

12. What is the minimum contracts principle?

    processing of personal data of data subjects who are in the union, by a company not established in the union where the processing activities are related to: offering goods or services eg US online shop available in german language or Euro currency or monitoring of their (the data subject's) behaviour as far as their behaviour takes place in the Union eg trackers

13. What is personal data in the GDPR?

    any information relating to an identified or identifiable natural person (= data subject) -> including wrong information "Lukas XYZ has a red car" but he has a blue one, it is still personal data

14. What is an identifiable natural person?

    can be identified directly or indirectly by an identifier such as: name ID number location data online identifier e.g IP address, including dynamic IP also personalized email address one or more factors specific to that natural person physical, physiological, genetic, mental, economic, cultural, social

15. What is information in the GDPR?

    all kinds of statements about a natural person objective (measurable) or subjective (opinions) including wrong statements! in any format (tech-neutral!): text, audio, ... including embedded metadata including negative information e.g. query covid vaccine register - no result means not vaccinated -> information and thus personal data if related to data subject