AI and Law I - Lecture 6: AI and Data Protection Law II
Please also view the Lecture 1 Course for links to all the other lectures. Note: This lecture was used to finish the content of Lecture 5. The cards for that have been moved to Lecture 5.
40 flashcards · Law · by daniel-eder
What two roles are differentiated for those handling data?
Controller determines purposes and means of processing Processor processes on behalf of the controller natural or legal person does not need a purpose or legal basis for processing is derived from the controller Covered by Processing Agreement according to Art 28 GDPR Art 28 covers the required contents
How is personal data classified?
Simple eg name, date of birth, address, income, profession Special categories ethnic origin political opinions, philosophical beliefs genetic data biometric data data concerning health data concerning sex life and sexual orientation
Would the social security number be considered medical data? How about a picture of someone wearing glasses or being in a wheelchair?
It depends on the purpose - what are you going to do with the data? use SSN within a hospital to find medical data -> then it is considered medical data and as such special category use SSN as employer to fulfill e.g. financial obligations -> then it is not medical data, just "simple" category same applies to the picture - it depends on how it will be used
How are simple and special categories of personal data treated differently?
Both are protected, but special more comprehensively/strictly
What is not considered personal data (exceptions)?
Anonymized Data cannot be tracked back to an individual with reasonable effort Data of deceased person -> no longer a living natural person but that data may still be protected by national civil codes, eg in Austria § 16 ABGB Data of legal persons limited only to the data of the legal person itself (eg company name) employees, including leadership, are natural persons and protected
What is processing in the GDPR?
any operation which is performed on personal data, whether automated or not such as recording organizing storage retrieval erasure ...
What are the principles related to processing of personal data?
Listed in Art 5 para 1 GDPR lawfulness, fairness and transparency purpose limitation processing only with purpose data minimization accuracy it is forbidden to collect and save incorrect data storage limitation integrity and confidentiality
What is the consequence of a violation of any of the principles of Art 5 para 1 GDPR?
The higher fines of 20 Million / 4% of global turnover
Lawfullness of processing of simple personal data?
= requires a legal basis For Simple Personal Data (Art 6 para 1 GDPR) the legal basis can be Consent (of data subject) Performance of a Contract (for data subject) Legal Obligation Protection of Vital Interests (of Data Subject) Task carried out in the public interest or exercise of official authority Legitimate Interests pursued by the Controller or by third party (Bold/Green ones are the most relevant ones)
Lawfullness of processing of special categories of personal data?
= requires a legal basis For Special Categories (Art 9 para 2 GDPR) that can be Explicit Consent (of data subject) Obligations/Rights of the controller or the data subject in employment, social security or social protection law ... Establishment, Exercise or Defence of legal claims ... Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
What is the key problem with consent under the GDPR?
The definition requires "freely given" "affirmative action". That means e.g. a pre-checked checkbox cannot be used Further there cannot be any pressure on the data subject to give consent
What types of legal basis for data processing exist in the GDPR?
Legal basis for processing directly in the GDPR Opening Clause for special provisions set out in a European or National Act
When does a Data Protection Officer (DPO) need to be designated?
if core activities of controller/processor consist of processing operations which require regular and systematic monitoring of data subjects on a large scale, OR core activities of the controller/processor consist of processing on a large scale of special categories of data according to Art 9 or 10
Is it permissible for a controller to export data out of the EU?
Allowed if there is an adequacy decision (= statement of the EC that the standards of that country are comparable to EU), OR The controller has a contract with the foreign controller that includes the Standard Data Protection Clauses by the EC, OR There is a specific situation allowing the transfer, e.g. explicit consent of the data subject, OR Data Protection Authority has allowed the transmission
Why can Data be exported to the US?
EU US DPF (Data Privacy Framework) = an adequacy decision But limited: Only to companies listed on https://www.dataprivacyframework.gov/s/participant-search
When do you need to conduct a DPIA (Data Protection Impact Assessment)?
Necessary if a type of processing (esp using new technology) is likely to result in a high risk to rights and freedoms of natural persons National black/whitelists + criteria-based evaluation to know when to perform it
How do controllers and processors have to protect data?
implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk
What is the Record of Processing Activitites for the Controller?
Controller must document every processing activity, including the purpose, the details (e.g categories of processing) and where possible, a general description of the technical and organisational security measures
What is the Record of Processing Activitites for the Processor?
Controller must document every processing activity, including the controller it was performed for the details (e.g categories of processing) and where possible, a general description of the technical and organisational security measures
What is the duty to inform data subjects?
= Privacy Policy must provide information on certain aspects relating to the processing of the personal data Two sets of information about data received from the data subject itself about data received (about the data subject) from third party
What are the rights of data subjects?
Right of Access Right to Rectification Right to Erasure = to be Forgotten Right to Restriction of Processing Right to Data Portability Right to Object Right to Non-Automated Decision Making
What does the Principle "Lawfulness of processing" mean?
Any data processing needs a legal basis
What does the principle "purpose limitation" mean?
for each processing, you need a pre-specified purpose -> you cannot go beyond this purpose
What does the principle "data minimization" mean?
Collected personal data has to be adequate, it has to be relevant and limited to what is necessary in relation to the purpose You should ask the question: Do I need this data to reach my purpose? -> prevents you from collecting more data than what is needed for the purpose!
What does the principle "accuracy" mean?
Personal data has to be accurate and has to be kept up to date -> all reasonable steps have to be taken to ensure inaccurate data is erased or corrected -> it is forbidden to collect or save incorrect data
What does the principle "storage limitation" mean?
Data cannot be stored for an unlimited amount of time You need to define time limits, and after the time limits have passed the data must be deleted
What does the principle "integrity and confidentiality" mean?
Security of the data must be ensured -> Protection against unauthorized or unlawful processing -> Protection so Data is not lost, destroyed, damaged needs appropriate organization and technical measures
Examples for "suitable technical and organizational measures" to ensure a level of security appropriate to the risk
pseudonymization ... encryption ability to restore availability and access to personal data (in a timely manner) ...
What is the "Right of Access"?
The data subject can get information how their data is processed and receive a copy of the data
What is the "Right to non-automated decision making"?
Right not to be subject to a decision based solely on automated processing, which produces legal effects concerning them or similarly significantly affects them Exceptions: necessary for entering into or performance of a contract (credit checks) Authorization by Union or member state law or explicit consent of the data subject
Complete the sentence: The GDPR centers around ...
the processing of personal data by a controller or processor for one or more specific purposes
What is the "Right to Rectification"?
Data subject can demand wrong data to be corrected
What is the "Right to Erasure / Right to be Forgotten"?
Data subject can demand their personal data be deleted -> Company has to comply, unless an exception is fulfilled legal obligation to store data (e.g. 7 year storage term of billing information in Austria) ongoing legal claim
What is the "Right to Restriction of Processing"?
If making use of this right then the only processing action the data controller can perform is storage, most others (including deletion) require permission of the data subject
What is the "Right to Data Portability"?
data subjects have the right to receive personal data in a structured, commonly used and machine readable format. they also have the right to request that a controller transmits this data directly to another controller
What is the "Right to Object"?
data subject can demand that certain types of processing are not performed always if processing is for commercial purposes (e.g. advertisting) data subject has to explain the reason for objection if it is any other processing purpose
What is the legal basis "Performance of a contract"?
Data is required for the controller to fulfill the contract. E.g. online shop -> needs address to print label for shipping
What is the legal basis "legal obligation"?
e.g. Austrian Commercial Code requires retention of certain billing data for 7 years -> this allows the controller to store data to meet this obligation
What is the legal basis "legitimate interests"?
e.g. for purposes such as: fraud prevention for legal claims to identify attacks on websites ...
What is the difference between consent (legal basis for simple personal data) and explicit consent (legal basis for special categories)?
with explicit consent the data subjects have to be informed in more detail and more precisely so they know what they are consenting to