Skip to main content
Fachgebiete
Automobil + Motoren Bauwesen + Immobilien Business IT + Informatik Elektrotechnik + Elektronik Energie + Nachhaltigkeit Finance + Banking Management + Führung Marketing + Vertrieb Maschinenbau + Werkstoffe Versicherung + Risiko
DE
EN
Bücher
Zeitschriften
Themenseiten
Organisationspsychologie Projektmanagement Marketing Smart Manufacturing
Weitere Formate
Podcasts Webinare Technik Webinare Wirtschaft Kongresse Veranstaltungskalender Awards
Jetzt Einzelzugang starten
Zugang für Unternehmen
Referenzkunden
SLX-Digitalkonferenz: Zukunftswerkstatt 2024

Mehr Umsatz mit Top-Kontakten

Am 7. Mai erfahren Sie, wie Vertriebsteams Leadgenerierung, Leadnurturing und Leadstrategien effizient steuern können.
Erweiterte Suche
Anmelden
nach oben
Erschienen in:
Internet of Things Cybersecurity Paradigm Shift, Threat Matrix and Practical Taxonomy Kapitel lesen Erstes Kapitel lesen

2019 | OriginalPaper | Buchkapitel

6. Evolution of Data Protection Norms and Their Impact on the Internet of Things

verfasst von : Luca Bolognini, Sébastien Ziegler

Erschienen in: Internet of Things Security and Data Protection

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

This chapter will provide an overview of international data protection norms. It will specifically discuss and explain the recent evolution in Europe with the adoption of the European General Data Protection Regulation and its impact on other countries. It will clarify the main concepts and the differences among the various geographic areas.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Jetzt informieren
Vorheriges Kapitel Network Threat Analysis
Nächstes Kapitel Universal Privacy Risk Area Assessment Methodology
Fußnoten
6
Accountability is dependent on, and completed by, the respect of the above principles and the capacity of the data controller/processor to prove the compliance; the data controller is required to put in place appropriate and effective measures to demonstrate, at the request of the supervisory authority, the compliance of the processing activities with the GDPR, including the effectiveness of the mentioned measures.
 
7
The data controller is defined by Article 4.1.7 GDPR as the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, where the purposes and means of such processing are determined by Union or Member State law and the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
 
8
The data processor is defined by Article 4.1.8 GDPR as a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
 
9
Article 9.1 prescribed that processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation shall be prohibited, unless one of the exception listed in Article 9.2 applies.
 
10
A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:
(a)
A systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person.
 
(b)
Processing on a large scale of special categories of data referred to in Article 9 (1) or of personal data relating to criminal convictions and offences referred to in Article 10.
 
(c)
A systematic monitoring of a publicly accessible area on a large scale.
 
 
11
Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679. Available at http://​ec.​europa.​eu/​newsroom/​document.​cfm?​doc_​id=​44137.
 
13
L. BOLOGNINI, E. PELINO, C. BISTOLFI, Il regolamento privacy europeo. Commentario alla nuova disciplina sulla protezione dei dati personali, Milano, 2016, p. 336.
 
14
Joint Statement of the Japan-US Cyber Dialogue. Available at https://​www.​state.​gov/​r/​pa/​prs/​ps/​2017/​07/​272815.​htm.
 
15
J. VAN DEN HOVE, R. WEBER, A. GUIMARAES PEREIRA, F. DECHESNE, Fact Sheet-ethics Subgroup Iot -version 4.0,2012, 17.
 
16
Opinion 8/2014, cit.
 
17
Which shall include:
(a)
The identity and the contact details of the controller and, where applicable, of the controller’s representative, including reference to the agreement under Article 26 GDPR, and of the DPO, where appointed.
 
(b)
The purposes of the processing for which the personal data are collected (e.g. marketing, for performing the service).
 
(c)
Obligations imposed by law or by a contract under which the data are collected and consequence of not providing consent.
 
(d)
Lawful basis under Article 6 GDPR (consent, contract, legal obligation, public interest, legitimate interest). If the processing is based on point (f) of Article 6 (1), such legitimate interests pursued by the controller shall be described.
 
(e)
The recipients or categories of recipients of the personal data, to whom data shall or might be communicated (whether data processor or persons in charge of the processing).
 
(f)
The fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission or of an agreement such as the EU-US Privacy Shield, standard contractual clauses, binding corporate rules, code of conduct, and certification mechanism, as well as reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
 
(g)
The period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period.
 
(h)
The existence of the right to withdraw consent at any time, the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability and the right to lodge a complaint with a supervisory authority.
 
(i)
The existence of automated decision-making, including the creation of profiles on the preferences and habits of the data subject (“profiling”), and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
 
 
18
The following information shall be added to the ones listed in the previous note:
1.
From which source the personal data originate and, if applicable, whether it came from publicly accessible sources.
 
2.
The categories of the personal data and if such data belong to common, special, or judicial data.
 
Also, the information notice may not be provided insofar as:
  • The provision of such information proves impossible or would involve a disproportionate effort.
  • Obtaining or disclosure is expressly laid down by law, which provides appropriate measures to protect the data subject’s legitimate interests.
  • Where the personal data must remain confidential subject to an obligation of professional secrecy.
 
19
In addition to the information provided in the direct information, the following additional information shall be added:
1.
Indication of the new purpose.
 
2.
Data retention times with respect to the new purpose and, if not possible, the criteria used to determine this period.
 
3.
Any legal or contractual obligations underlying the provision of personal data and consequences of the refusal.
 
4.
The existence of automated decision-making processes, including profiling, and, in that case, the indication of the applied logic, as well as the importance and consequences of such processing for the data subject.
 
5.
The rights of the data subject to withdraw consent, access the data, or request rectification or erasure of personal data, or the limitation of the processing of personal data concerning him; the right to data portability, to object to the processing, and to lodge a complaint with the supervisory authority.
 
6.
If the data controller has not collected the data directly from the data subject, the additional information must contain the following further information:
 
7.
The origin of personal data (i.e. how and from what sources have been collected), in particular any expressed indication that the data comes from sources accessible to the public.
 
8.
Legal basis of the processing (e.g. consent, contract, legal obligation, public interest) and, if there is a legitimate interest of the data controller or the third party, the specification of such legitimate interest.
 
 
23
Internet of Things (IoT) Cybersecurity Improvement Act of 2017 available at https://​www.​congress.​gov/​bill/​115th-congress/​senate-bill/​1691/​text.
 
24
L. BOLOGNINI, E. PELINO, C. BISTOLFI, op. cit., 723.
 
25
ivi, 725.
 
26
ivi, 726.
 
Metadaten
Titel
Evolution of Data Protection Norms and Their Impact on the Internet of Things
verfasst von
Luca Bolognini
Sébastien Ziegler
Copyright-Jahr
2019
Buch
Internet of Things Security and Data Protection

Print ISBN: 978-3-030-04983-6

Electronic ISBN: 978-3-030-04984-3

Copyright-Jahr: 2019

DOI
https://doi.org/10.1007/978-3-030-04984-3_6

Neuer Inhalt

    Bildnachweise