Legal regulation of personal data protection in the countries of the world

Размещено на http://www.allbest.ru/

Размещено на http://www.allbest.ru/

Legal regulation of personal data protection in the countries of the world

Liudmyla Rybalchenko

Ph.D. (Economics),

Associate Professor (Dnipropetrovsk State University of Internal Affairs, Dnipro, Ukraine)

Oleksandr Kosychenko

Ph.D. (Technics),

Associate Professor

(Dnipropetrovsk State University of Internal Affairs, Dnipro, Ukraine)

Illia Klinytskyi

Graduate student

(University of Silesia, Katowice, Poland)

Людмила Рибальченко, Олександр Косиченко, Ілля Кліницький. ПРАВОВЕ РЕГУЛЮВАННЯ ЗАХИСТУ ПЕРСОНАЛЬНИХ ДАНИХ В КРАЇНАХ СВІТУ

Відповідно до законодавства персональні дані - це відомості або сукупність відомостей про фізичну особу, яка ідентифікована або може бути конкретно ідентифікована. Технологічний прогрес створює для суспільства дедалі ширший спектр потреб і можливостей, від бізнесу до політики. В останні роки збір і обробка персональних даних все частіше використовується в усіх сферах життя людини. Стрімкий розвиток інформаційних технологій вимагає використання персональних даних не лише для роботи, а й для повсякденного життя, приватного життя, медицини тощо. Є питання щодо порушення прав людини. Тому створення надійного захисту персональних даних від незаконного використання є актуальним для суспільства.

Створення належного рівня системи захисту персональних даних є одним із важливих завдань України на міжнародному просторі. Пріоритетним напрямком побудови державноправового регулювання захисту прав і свобод суспільства, а також інтеграції до міжнародних та європейських стандартів є вдосконалення існуючої системи захисту персональних даних. Конфіденційність персональних даних захищена Конституцією України. Відповідно до законодавства України підприємства, установи, приватні компанії, банки та інші мають право обробляти персональні дані споживачів, при цьому вони зобов'язані захищати ці дані та несуть відповідальність за порушення їх конфіденційності.

Одним із шляхів запобігання порушенням прав людини на захист персональних даних є підвищення рівня обізнаності щодо правових засад обробки та захисту персональних даних. Запровадження у вітчизняне законодавство найкращих інструментів та європейських стандартів захисту персональних даних, посилення відповідальності за його порушення та моніторинг у сфері захисту персональних даних дасть можливість підвищити та посилити захист прав громадян на невтручання в особисте життя.

Ключові слова: персональні дані, конфіденційність інформації, захист персональних даних, розвиток інформаційних технологій.

Abstract

Keywords: personal data, confidentiality of information, protection ofpersonal data, development of information technologies.

Relevance of the study

personal data protection right

The implementation of online services provides opportunities for convenient and quick collection and processing of information about a natural or legal entity. The use of personal data may be misused, illegally, which may lead to its leakage. The economic growth of the quality of life of Ukrainians, their well-being is an important component of the modern level of digitalization of society, implemented through electronic services, mobile applications, etc. Under such conditions, the vulnerability of privacy and confidentiality of personal data becomes a frequent phenomenon for violating the rights and freedom of a citizen. Illegal publication of personal data imposes responsibility on violators in accordance with the legislation of Ukraine.

The legislation of Ukraine defines the obligation of the owners to ensure the protection of personal data against accidental loss, destruction, illegal processing and illegal access to them. In Ukraine, the key document in the field of personal data protection is the Constitution of Ukraine [1], the Law of Ukraine "On the Protection of Personal Data" [2] and documents in the field of personal data protection, the Law of Ukraine "On Access to Public Information" [3], the Law of Ukraine "About information" [4]. Many other legal acts also contain provisions regulating the processing of personal data. The collection, storage, use and distribution of confidential information about a person who has not given consent to its processing is prohibited. Exceptions are cases that are defined by law and act in the interests of national security, economic well-being and human rights.

Article 32 of the Constitution of Ukraine [1] states that no one can interfere in personal and family life. Article 6 of the Law of Ukraine "On the Protection of Personal Data" [2] states that "personal data is processed for specific and lawful purposes, determined with the consent of the subject of personal data, or in cases provided for by the laws of Ukraine, in the manner established by legislation". According to Article 5 of the Law of Ukraine "On Protection of Personal Data", personal data can be classified as confidential information about a person by law or by the relevant person [2]. The issue of information security is related to information technologies that are used to ensure information security. Protection of information security consists not only in the application of unauthorized access to information, but also in the use of appropriate methods for its security and protection [14].

Recent publications review. The study of theoretical and practical aspects of personal data protection and information security dedicated to the works of Ukrainian scientists:

O.Bodruk, V. Horbulin, V. Krysachenko, O. Manachinskyi, B. Parakhonskyi, T. Starodub,

O.Shevchenko, O. Vlasyuk and others. Conceptual problems of information security were investigated by domestic and foreign scientists: R. Aron, K. Clausewitz, K. Hajieva, B. Liddell- Hart, N. Machiavelli, H. Moltke, K. Popper, P. Proudhon, E. Rybkin, S. Tyushkevich, M. Tsyurupa, A. Schweitzer, and others. No matter of wide number of reseaches, personal data protection and information security as scientific field is still in the conditions of the formation and requires more attention.

The article's objective is to systemize and analyze the legal regulation of personal data protection in the the foreign countries and Ukraine.

Discussion. January 28 is recognized as the International Day of Personal Data Protection. Data Protection Day is celebrated in all countries and in European countries. The establishment of such a day is related to the fact that network users do not forget to observe the rules of behavior on the Internet, which help to secure their virtual and real life and to improve the legal regulation of personal data protection at the international level.

For legal regulation in the field of personal data protection, the European Union has developed a regulation on the protection of personal data (General Data Protection Regulation, GDPR, hereinafter - the Regulation), which entered into force on May 25, 2018 [5]. According to the provisions of the Regulation, personal information is information that identifies, relates to, describes, can be linked directly or indirectly to a specific data subject or household.

The deepening of cooperation between Ukraine and the EU in the field of personal data protection is stipulated precisely in our national legislation. If it is necessary to transfer data from the EU to Ukraine, companies sign a document called Standard Contractual Clauses (SCC), which is the proper basis for data transfer in this case. In June 2021, a new version of the SCC was adopted. In June 2018, the law on the protection of personal data was signed in the USA. California Governor Jerry Brown signed the California Consumer Privacy Act 2018 (the "Act") [6]. This Privacy Act includes data security that is important to the safety and well-being of the people of California and the entire nation's economy. It should be noted that the California Consumer Privacy Act is a "victory" and a big step forward in the protection of personal data in

the United States. The Act provides new privacy rights for California consumers, including:

- the right to know about the personal information the company collects about them and how it is used and shared;

- the right to delete personal information collected from them;

- the right to refuse the sale of your personal information;

- the right to non-discrimination to exercise their rights under the CCPA [6].

Many well-known companies pay special attention to the protection of personal data. Thus, the Cisco company, with its obligations, respects the protection of the confidentiality of personal data of its employees, clients, business partners and other interests [9]. For whom, Cisco has run a global privacy program so that I can enforce and uphold high standards of privacy, selection, disclaimer, voice, privacy, privacy, transmission of personal data, and access to them of those other forms. Under the hour of collecting personal data from the entire world, Cisco is subject to ambush, which is designated by the global privacy policy. It expands on personal data, as it is processed by Cisco in the world, like electronic means, so in a familiar look, on paper wear.

The Global Privacy Policy, together with the Global Privacy Policy, the European Privacy Policy and the Business Personal Data Privacy Policy, are also intended to implement appropriate safeguards for the processing of personal data entrusted to Cisco and transferred from countries whose laws require adequate protection. This enables Cisco to share personal data globally. The general principles that establish Cisco's practices regarding the collection, use, disclosure, storage, protection, transfer, access, and other processing of personal data are as follows: authenticity, purpose limitation, proportionality, data integrity, data storage and deletion, data protection, rights of data subjects and reporting [9].

From July to September 2021, European data protection regulators (DPAs) imposed the 2 largest fines for GDPR violations:

- the Luxembourg DPA imposed a €746 million fine on Amazon (it is believed that the reason for the fine is Amazon's use of targeted advertising without proper user consent);

- the Irish DPA imposed a €225 million fine on WhatsApp due to data transparency

issues.

These cases confirm a general trend - the efforts of regulators to force large companies to follow uniform rules and prevent another mass abuse during data processing.

The rapid development of information technologies takes place with large volumes of data processing, which is related to personal data, state institutions, banks, supermarkets, mobile communication devices, etc.

The functions of monitoring compliance with the legislation on the protection of personal data have been transferred to the Commissioner for Human Rights of the Verkhovna Rada of Ukraine. The processing of personal data on racial or ethnic origin, political, religious or ideological beliefs, membership in political parties and trade unions, criminal convictions, as well as data related to health, sexual life, biometric or genetic data is prohibited. The processing of these categories of personal data should take place only in exceptional cases with the provision of higher standards of both protection and compliance with the rights of the subjects of personal data. Previously, all personal data, with the exception of depersonalized data, was considered information with limited access. According to the new version of the law, information about receipt of budget funds, state or communal property by an individual in any form does not belong to information with limited access.

Indicative is the attitude towards the protection of personal data in Estonia [7], where each of its citizens has their own online account, in which they can track all requests for their personal data and know who, when and for what purpose applied to them. If a person believes that the request was unreasonable, he can file a complaint with the Personal Data Protection Inspectorate. Employees of the inspection have the right to check all state authorities for compliance with the rules of personal data protection. Since the adoption of the GDPR (General Data Protection Regulation) in Estonia, no violations and fines have been recorded. Estonia' s cyber security strategy is based on 4 principles:

1) The protection and promotion of fundamental rights and freedoms in cyberspace and in the physical environment are equally important;

2) Measures to support cyber security in Estonia are considered as a stimulator of the speed of digital development, which is the basis of the socio-economic growth of the country. Security must support innovation, and innovation must support security;

3) Ensuring the security of cryptographic solutions is of unique importance to Estonia, as

Scientific Bulletin of Dnipropetrovsk State University of Internal Affairs. 2022. Special Issue № 1 it is the foundation of the digital ecosystem;

4) Transparency and public trust in the state are important for a digital society. Therefore, Estonia undertakes to adhere to the principle of open public communication.

In addition to the Ministry of Defense of Estonia, national cyber defense is supported by the Cyber Defense Division of the Estonian Defense League, a unit that includes cyber security experts from both public and private institutions [7].

According to the NCSI (National Cyber Security Index) in 2021, the leaders of the level of the national cyber security index in the world were: Greece (96.1), Lithuania (93.51), Belgium (93.51), the Czech Republic (92.21) and Estonia (90,91). Regarding the level of cyber security, Estonia (99.48) ranks 2nd after the United Kingdom (99.54) in the global cyber security index among European countries in 2021 [10, 11].

In Estonia, the legal regulation of information security is provided by the Constitution of Estonia, the Law "On Public Information", the Law "On Protection of Private Data", the Law "On Cyber Security", Cyber Security Strategy for 2019-2022. Estonia's level of information security has been tested by critical situations and has shown its efficiency and effectiveness. All state bodies and private structures of the country systematically interact with each other to prevent and overcome negative consequences. The Estonian experience shows that the issue of regulating information security requires balanced multifaceted solutions.

In France, the control of compliance with the legislation in the field of personal data protection is entrusted to the National Commission for Informatization and Freedoms (Commission Nationale de Tinformatique et des Libertes, CNIL) [8]. CNIL is an independent administrative body with state funding, the main task of which is to ensure compliance with human rights, inviolability of private life, and protection of personal or public freedoms in the process of implementation and use of information technologies [8]. The decision of the CNIL can be appealed in the administrative court.

The activity of the French special-purpose state bodies in the field of information security is a component of measures aimed at the implementation of three main tasks inherent in special services: diplomatic intelligence, military defense and protection of economic interests. Individual issues of information security of the state are entrusted to one of the main intelligence agencies - the General Directorate of External Security (La Direction generale de Ia securite exterieure, DGSE), which is subordinate to the Ministry of Defense [8].

Looking at the statistics in the field of personal data protection, one can see that in recent years there has been an increase in the number of appeals received to the Authorized Body regarding violations in the field of personal data protection [13].

Table 1Violations of personal data protection