The processing of personal data in accordance with the principle of proportionality under EU general data protection regulation

Размещено на http://www.allbest.ru/

The processing of personal data in accordance with the principle of proportionality under EU general data protection regulation

Daria Bulgakova

D.Sc. in Law, Ph. D. in International Law, Postdoc

in Technology Law

(National Yang Ming Chiao Tung University, Law School), Taiwan

Valentyna Bulgakova

Pedagogue Methodist of Highest Category, Ukraine

Abstract

proportionality protect individual data

The processing of personal data is regulated by Article 8 of the Charter of Fundamental Rights of the European Union. At the same time, Article 52(1) of the Charter recognizes that restrictions may be imposed on the exercise of this right, and such restrictions must be provided for by law and comply with the principle of proportionality. Thus, according to Recital 4 of the General Data Protection Regulation (GDPR), personal data must be processed in accordance with the principle of proportionality. The lack of specificity regarding how this principle is applied and guided in the field of personal data processing regulation creates a problem of legal uncertainty that requires further clarification on this issue. This study explores the conceptual meaning and specifics of the principle of proportionality, which guides the processing of personal data for the best protection.

The study examines how this principle has evolved from the human rights framework to the personal data protection field. The analysis presented in this study offers a new understanding of the principle of proportionality under the GDPR, emphasizing the need for a specific legal mechanism under which the doctrine can adequately serve as a tool for protecting individual data. However, it is worth noting that this legal mechanism can only legitimately operate if it meets specially developed legal criteria. The designed model consists of two key components: First, even if there is a legal basis, if it does not meet the requirement of strict necessity, the processing is considered disproportionate due to the uncertainty of the legal basis. Secondly, if the data protection measures are inadequate, the automatic processing adversely affects the interests of the individual, and therefore, the proportionality principle is not met.

Keywords: GDPR, fundamental human right to personal data protection, automotive data processing, balance of interests, purpose limitation, necessity.

Introduction

The principle of proportionality is a fundamental principle formulated among several other legal principles in the European Union (EU) law. It is based on an unwritten nature and is defined as the highest norm in the system of legal sources in the legal structure of EU law. This fact has led to the following main characteristic of the principle of proportionality: that it is a measured criterion for the legality of any form of activity (Dlugosz, 2017). Moreover, the principle of proportionality is frequently applied in the Court of Justice of the European Union (CJEU), particularly in cases related to legal restrictions of fundamental human rights, especially concerning the right to personal data protection; for example, in the ruling of the European General Court (Fifth Chamber) on Case Marine Harvest ASA v European Commission of 6 October 2017 it is stated: "(...) It should be noted, first, that the principle of proportionality requires that measures adopted by EU institutions do not exceed the limits of what is appropriate and necessary to attain the objectives legitimately pursued by the legislation in question; where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued. It follows that fines must not be disproportionate to the aims pursued to compliance with the competition rules, and that the amount of the fine imposed on an undertaking for an infringement of competition law must be proportionate to the infringement, viewed as a whole, account being taken of the gravity of the infringement (...)". In this respect, the research underlines that the personal data protection of individuals has always been a fundamental requirement in the primary legislation of the EU.

Personal data protection is a distinct and stand-alone in the EU legal order guaranteed under Article 8 of the Charter of Fundamental Rights of the European Union (CFREU). Regardless, any processing of personal data shall constitute an interference with this right. As highlighted in the Opinion of Advocate General Saugmandsgaard 0e of 19 July 2016 in (CJEU) Joined cases C-203/15 and C698/15, Tele2 Sverige AB v. post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson, Peter Brice, Geoffrey Lewis, - the processing of data processing subject resembles the requirement "provided for by law". And, following the Opinion of Advocate General Cruz Villalon of 14 April, 2014 in (CJEU) Case C-70/10, Scarlet Extended SA v. Socidtd belge des auteurs compositeurs et dditeurs (SABAM), - to be lawful, the interference must comply with the condition to involve the principle of proportionality listed in Article 52 (1) of the CFREU. Thus, a study has been identified series of judgments of the CJEU, which refer to Articles 8 and 52 of the CFREU involving intervention and deliberation of a European constitutional framework to data protection field of the study.

The connection between the principle of proportionality and personal data processing has significantly developed since its reflection and clear establishment in the Regulation (EU) 2016/679 on the Protection of Natural Persons with Regard to the processing of Personal Data and On the Free Movement of Such Data and Repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR). Specifically, in the Recital 4 with the reference to the criterion of principle proportionality measurement stating: "The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not absolute, and it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognized in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and a fair trial, and cultural, religious and linguistic diversity". This establishment provides solid legal support through fundamental rules and conditions for processing all personal data categories which extends globally. The research is guided solely by the right to personal data protection. However, the study also acknowledges the relationship with the right to privacy, particularly when additional information is needed to identify an individual, when processing is limited to only the necessary amount of data required for person's designation and does not extend beyond that.

The increasing use of technologies has brought significant challenges, which require technology-neutral regulation that can be adapted to various forms of automation. According to the (EU) Report on Artificial Intelligence of 2018, extensive data analysis and integration have become possible with the help of data generated through various sources such as websites, weblogs, videos, text documents, and services. However, processing categories of personal data poses challenges. It is evident that due to differentiation of data categories, processing cannot be a `standard' and due to technological progress uses automated processing format requiring proportional consideration to the protection of data on the table. In May, 2021, the United Nations Educational, Scientific, and Cultural Organization published a Science Report on the Biometric Impact, highlighting the crucial importance to protect personal data processed by automatic means. The Report noted that data characteristics are already being used for a person's official digital presentation in the global data space underscoring the need for collaboration between scholars and legislators. The Report also emphasized the significance of legal research in the data area calling for qualitative and quantitative studies that could contribute to the normative adoption and improvement.

Analysis of recent research and publications

Scholars argue that the importance of guaranteeing the right to personal data protection in primary EU law cannot be underestimated (Brkan, 2016). This is also highlighted in (Spadaro, 2016), where the author defines the CJEU's intervention as a crypto- federal constitutional application. In that respect, scholar Pogrebnyak has identified legal conditions that need to be considered when applying the principle of proportionality (Pogrebnyak, 2017). Among those are: 1) the legitimacy and materiality of the purpose - meaning that the purpose of the restriction must be legitimate and substantial; 2) the law on restrictions must make it possible to establish the goal mentioned in the first condition - indicating that the legal framework should enable the establishment of the purpose defined; 3) restrictions must be justified - meaning that the restrictions imposed must be reasonable and necessary; 4) regulations should not impose restrictions that cannot be met - implying that the regulations should not impose restrictions that are impossible to meet; 5) onerous restrictions should be used - stating that only necessary restrictions should be applied. Finally, the research assumes that the effect of the principle of proportionality covers the entire legal system, not just individual areas. Scholar Tsakirakis has pointed out that the application of the principle of proportionality involves legal ambiguity as to which rights and interests need to be balanced, how they should be balanced, and who is responsible for carrying out this weighing - whether it should be the judge or the legislator (Tsakirakis, 2011).

Foreign researchers have compared the principle of proportionality with the American method of weighing interests. While they have emphasized some differences, there are significant contradictions between. As discussed in the work of Cohen-Eliya and Porat, the concept of proportionality in contrast to American law differs from that in EU law (Cohen-Eliya & Porat, 2010). In American law, proportionality involves both procedural and substantive means of ensuring a fair trial, which has led scholars and lawyers to view the discussed principle as a doctrine of the rule of law. In contrast, US and Canadian law use proportionality to protect constitutional rights and freedoms as the basis for verifying the state's actions and the constitutionality of legal acts that may violate, repeal, or restrict fundamental rights. The state's task is to recognize this process as constitutional while considering legitimacy, optimality, and effectiveness proportional to the objectives pursued, with minimal limitations on constitutional rights and freedoms.

This position not only aligns with the belief of scholars that proportionality is based on the concept of the proper substantive legal procedure originating from American constitutional law but also supports the connection with the rule of law, making proportionality a necessary component of it. However, researchers lack to find a common characteristic when comparing proportionality with the American doctrine of weighing arguments. Scholars conclude that the latter doctrine is formed opposite to the understanding of proportionality. Thus, this study demonstrates the difference as the theory of weighing arguments does not unnecessarily protect rights against restrictions as it is weighed against the public interest, which is fundamental in the EU law. In this regard, there is a suitable place to be for the opinion of another researcher who says that under international law, there is no workable recognized shaping (Lubin, 2020).

Consequently, according to Jizeng's position legislative power must adopt relevant rules to designate the rule of law and ensure justice and resolve disputes that may arise from the exercise of power (Jizeng, 2016). This will lead to a balance between fair and effective governance on the one hand and the protection of citizens from abuses of power on the other. It means that the principle of proportionality is related to the rights of individuals, extends to law making and law enforcement, and is determined by the criterion of assessing the legality of public authority decisions (Newton, 2018).

Petersen's research identified three elements that make up the classical German theory of the principle of proportionality relevant to the discussion (Petersen, 2020). The first element is the measures' appropriateness, meaning that the state's actions must consistently interfere with human rights. For example, any restrictive measure or sanction imposed should reasonably reduce the number of offenses. The second element is the necessity of such measures. When assessing the interference, it should be determined whether these measures are necessary and if there are no alternative measures that could be applied instead. The third element is the affiliation of the measures. This involves confirming that state measures are suitable for the goal that is expected to be achieved. For instance, if the state introduces electronic tax registers to verify taxpayers, it can be agreed that this measure is appropriate for the purpose. In this regard, in the study view, if biometric data of citizens is collected within the framework of maintaining these registers, then the biometric verification method is related to the purpose of taxation. However, the collection of any other personal data is not necessary.

According to Amankwaa's new theoretical doctrine of personal data processing has emerged due to the significant transformation of individuals' digital footprints, mainly due to the widespread use of big data (Amankwaa, 2020). The benefits of automated processing have enabled users to create content independently and manage connections between their and other people's digital footprints through machine governance, including biological footprints. Additionally, for the implementation provisions concerning the processing of special categories of personal data, Member States should consider the principle of proportionality, especially when it comes to biometric data processing (Bulgakova, 2022). The application should be under the particular condition of assessing the necessity (Bulgakova, 2022). Otherwise, it makes a disproportionate correlation with the biological nature of human origin (Bulgakova, 2022).

Also, Hildebrandt argues that the rise of big data has transformed how individuals interact with digital technologies, allowing them to create and manage personal data content and their connections with others through machine governance and footprints (Hildebrandt, 2016). This has resulted increased coordination and inclusion of users in algorithmic processes, particularly in public e-service matters that require personal information. Cloud computing technologies have further increased the storage and processing capabilities of both private and public organizations, as well as individuals, allowing for the effective processing of large amounts of data which require appropriate legal protection.

The literature review shows, that the EU has designed the principle of proportionality to protect individuals who may be facing the power of authorities concerning data. Therefore, its application is a prerequisite for regulatory intervention to be suitable for achieving the intended goals. Hypothesising, the proportionality should only be applied to correlate the processing of personal data and cannot prioritize an authority's general interest over an individual's freedom. Additionally, it should only be applied in a manner relevant to the pursued goal. If a measure is found to be disproportionate to the objective, it will be deemed invalid. The negative impact on those whose interests is affected may outweigh the positive result obtained for the personal data protection. Hence, the research is directed to open up that uncertainty and displays for consideration two statements. The first statement of the problem lies in the uncertainty of the application mechanism of the principle of proportionality and applicable relevant criteria when the data processing subject shall comply with. That is because the protection of personal data characterizes as not absolute and considers the studied principle as a measure to coordinate processing and minimize the risks for the fundamental right. Secondly, because the characteristics of the principle of proportionality employed by scholars are extensive, the personal data protection field of the study deems lack of proportionality criteria appropriate for personal data.

A study designates that personal data's legal nature is only protected following adequate correlation with specific criteria of the principle of proportionality. Otherwise, it is at risk of being processed disproportionately, meaning that GDPR provides no evident protection. Therefore, the overall problem embodies the legal uncertainty about the legal mechanism of application of proportionality in personal data processing and the legal lack of clarification of the principle of proportionality conceptually to the personal data processing peculiarities. Expressly, the research raises doubts about the effectiveness of the introduced protection mechanism in the GDPR Recital 4. In this regard, the research problematic is the extent to which the principle of proportionality applicable for personal data processing as per Recital 4 of the GDPR.

The purpose of the article is to investigate the features of personal data processing in accordance with the principle of proportionality under the general data protection regulation. Oonsequently to the statement of the problem, the article addresses the following questions:

What is the characterization of the principle of proportionality in the EU legal system, and what criteria are appropriate for the personal data protection field?

Why is the processing of personal data shall be according to the principle of proportionality?

How is the legal mechanism for applying the principle of proportionality designed and how GDPR employs it?

A methodology is deemed significant because it guides the preparation of the research and ensures that the study is critically approached and original. The proposed research defines a critical approach together with a well-structured scholars' accomplishments to address designated issues and contributes with findings. Also, the research utilizes hypothesizing as a fundamental scientific method, enabling the formulation of ideas and original points of view. The research design interprets facts, revises theories and legislation, and identifies practical applications through case studies.

The principle of proportionality and its interference with data protection processing are studied utilizing the method of normative analysis (Saks & Spellman, 2016). For this intend, the study integrates Hutchinson and Duncan's double steps strategy involving the initial selection sources of law, evaluating, and dissecting them (Hutchinson & Duncan, 2012). Perceived legitimacy is a crucial concept projected through a combination of the principle of proportionality and GDPR Recital 4. Those tools are vital as it allows for theoretical criticism within the boundaries set by the law. Notably, the study focuses on the formal-legal method in relation to Recital 4 of the GDPR and data processing singularity, emphasizing the necessity appeal to legal norms for processing personal data requirements. Hence, interpretation of specific legal norms leads to recommendations, call to legislative amendments or additions to existing legal norms. The research design is crucial in expressing the uniqueness of theoretical research and obtaining qualitative and quantitative results employing qualitative approach to understand the nature of the principle of proportionality and personal data protection conceptions and them theoretical basses, while quantitative data measures phenomes for generalization. Therefore, four categories of tools are used: data selection, process-writing, analysis, and sampling.

Formulation of the main material

This research focuses on exploring how the principle of proportionality correlates to personal data processing and its role in ensuring individuals' right to data protection. The study is divided into two sections to address those issues. The first section, titled "The Legal Relationship between the Principle of Proportionality and the Right to Personal Data Protection Based on the Fundamental Framework of the European Union", examines how the principle of proportionality is applied within the framework of data protection laws. The second section, "The Legal Mechanism of Application of the Principle of Proportionality in the GDPR", explores the specific mechanisms and unique criteria of the studied principle within the GDPR for the personal data processing set. Through this double-step solution, the study comprehensively understands the principle of proportionality and its role in personal data protection.

The Legal Relationship between the Principle of Proportionality and the Right to Personal Data Protection based on the Fundamental Framework of the European Union. For a significant period, the European Community did not prioritize the legal regulation of personal data protection (Krivogin, 2017). However, the lack of positive norms regarding the protection of fundamental human rights in the EU's legal system was compensated by the human rights system of the Council of Europe, particularly by the Convention for the Protection of Human Rights and Fundamental Freedoms (1950).

The right to personal data protection were established in two essential documents: in Article 12 of the Universal Declaration of Human Rights of 1948 and Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms of 1950. According to the modern theory of international law, the right to personal data protection is closely linked with the concept of humanity. The relevance of data protection in a particular situation determines this link. When machine-like techniques are used to process personal data, legal protection is provided through the right to data protection, specifically by protecting an individual's authentic characteristics. This reduces the essence of humanity to a new level of human rights techniques.

International documents that establish the grounds and procedural requirements have become crucial as for example, the United Nations General Assembly Resolution's International Covenant on Civil and Political Rights (1966) in Article 17 included the right to personal data protection. This played a significant role in shaping the current European vision on data protection and is recognized as a fundamental right of the individual under the primary law of the EU. Therefore, a study argues that this understanding of the right to personal data protection is shaped by internationally adopted documents and has influenced the European approach to data protection. In addition, the European legal guarantee for the right to personal data protection has been established in documents with supreme legal force within the EU. These documents include the Treaty on the Functioning of the European Union (TFEU), the Treaty on the European Union (TEU), and the CFREU. This aspect has become a crucial for the Union's primary legal system, which was reformed by signing the Lisbon Treaty. As a result, the legal importance of fundamental law has been established in this area and implemented to constituent personal data protection legislation.

Reasonably, according to TFEU Art. 16(1), everyone is entitled to personal data. This right holds significant weight, mainly because the legal norms of the EU system take precedence over the norms of Member-States' legal systems. This universal notion encompasses the norms and sources of both legal systems, which may conflict with one another (Taylor, 2015). P. Balboni emphasizes the need to enshrine the right to personal data protection in primary law. This implies that the right must be entertained when drafting and adopting other EU regulations (Balboni, 2019). Similarly, the Union's institutions must apply the principle of proportionality to the right to personal data protection. Furthermore, rules must uphold the special effects provided in TEU Article 39 for special policies outside the EU. Besides, TEU Article 6(1) explicitly states that the Union acknowledges of the rights, freedoms, and principles enshrined in the CFREU has equal legal value to the Treaties. For instance, provisions of CFREU Title VII govern the interpretation and application of these rights, freedoms, and principles. Despite this, it is conceivable to argue that the CFREU should be considered something other than a fundamentally new document that significantly alters the European system of fundamental values and principles. Even during its development, the CFREU must be viewed as an act reflecting the already achieved progress in fundamental human rights and the principle of proportionality.

Forward of the principle of proportionality to the right to data protection is also supported by the CJEU's practice and is based on constitutional traditions. Hence, the European Parliament, in conjunction with the Council of Europe and the European Commission, has identified two distinct legal categories related to individual rights: the right to privacy and the right to personal data protection. The separation is reflected in the CFREU Article 7, addressing the right to privacy, and Article 8, focusing on the right to personal data protection where both as well as all fundamental human rights safeguarded by Article 52(1) of the CFREU, which directly proclaims the principle of proportionality oversight. Accordingly, the CFREU emphasizes the importance of affiliation data protection and the principle of proportionality, with the limitation of purpose being one of its core components. As a result, data processing must be carried out without manipulation, for clearly defined intent, with the free `will' of the person concerned or under other legal bases.

The principle of proportionality comes into play when an individual's rights are limited, and the discretion of those in power affects the individual's legal interests. In the case of personal data, individuals should be aware of the potential risks and have their legitimate interests promptly complied while also considering the legal capabilities of others and the public interests in society, as seen from the case CJEU, C-201/14, Smaranda Bara and Others v. Casa Nafionala de Asigurari de Sanatate and Others of 1 October, 2015.

The EU legal order places conditions on limitations to exercise the right to personal data protection, and any such limitation must be subject to the principle of proportionality test. This can be achieved using pseudonymization techniques regardless to the data processing to minimize interference with individual autonomy while achieving the greatest public interest (Cheung, 2020). However, the study notes that the proportionality test is not simply weighing conflicting interests; it is always result-oriented (Gill-Pedro, 2020).

The study has established that the framework of proportionality extends beyond the administrative domain, as the power of actions is also subject to regulation. The research highlights this crucial distinction by arguing that, firstly, proportionality expresses the notion of limiting public power, including the power of the state and local bodies, their officials, and entities delegated to public authority where the power is separated from the state and not delegated by the law. Secondly, assessing proportionality's impact on the individual is not a data protection issue but instead falls under the processing requirements for data processing subjects. It is because the proportionality is not a legal concept outside the scope of actions of power or the power that is substantiated in public relations, where one participant is a subject of power, and the other is a subject of administrative service rather than the subject of realisation of the right to personal data protection.

Lastly, the principle of proportionality applies to both bodies and officials who carry out public administration/processing. The administrative-legal regulation's foundation is the relationship which can take both positive and negative forms, such as operational activities and jurisdictional activities. This allows the research to distinguish the scope of various public disputes. Constitutional and legal disputes arising in connection with maintaining procedural order, human rights, and the power of higher authorities relate purely to the administration of justice. In contrast, administrative-legal or public-law disputes arise concerning implementing public administration. Therefore, proportionality may also be used to manage administrative-legal relations of power-subordination for compliant data processing performance by data processing subject.

Consequently, in the view of the abovementioned, the legislator has linked the concept of proportionality with the assessment of the legality of decisions made by those in power, with the primacy of the individual's rights and legitimate claims taking precedence over the interests of the bodies and representatives of power.

The Legal Mechanism of Application of the Principle of Proportionality in the GDPR. To analyse the relationship between the principle of proportionality and GDPR in light of previous discussion, this study proposes examining the necessary components for lawful processing, such as legitimacy and balanced interests. The analysis emphasizes the importance of ensuring the legitimacy of restrictions on fundamental human rights, which must be provided for by law and proportional to the goal outlined in the law. When data processing interferes with the right to personal data protection, any intervention must be justified, necessary, and proportionate. The right to personal data protection is a nonabsolute legal category in the theory of EU law, making it difficult to establish clear boundaries for this right within the robust legal framework of the EU. Thus, the examination asserts that any legal restrictions on this fundamental right must be met following by the proportionality principle.

In legal theory, the principle of proportionality is invoked when there are limits and restrictions on a particular right. This is because such constraints can exceed the necessary limits and pose a risk of taking extreme measures to achieve the restrictive enough involved interest. However, this vital principle also applies even if there are no restrictions to confirm that the specified right is fulfilled and lawfully exercised. The study argues that any restriction of rights, despite their objective necessity, should be reasonable and proportionate, and the associated burden should not be excessive. The breakdown concludes that impediments are only justifiable if they do not prohibit the lawful exercise of fundamental human rights and if a particular restrictive measure has the most negligible impact on a right.

The adoption of the Lisbon Treaty was a significant milestone in data protection law, as it not only elevated the CFREU to the level of primary law but also established the right to personal data protection. Another significant development was the adoption of the GDPR, which modernized EU data protection legislation to safeguard this right in the context of digital, economic, and social challenges. Consequently, the principle of proportionality serves as a mechanism for ensuring that any action taken is lawful and considers balancing the public and private interests in this legal relationship. This principle effectively limits the power and usability of data processing, prioritizing the protection of this fundamental right before, within, and after processing. Moreover, the investigation arguments that this scientific reflection is not only correct but also is the only one based on the fundamental concept in the CFREU Article 52(1), which states that "Any limitation on the exercise of the rights and freedoms recognized by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognized by the Union or the need to protect the rights and freedoms of others". This provision implies to data protection and is inseparable from it. Therefore, it is clear from the research that the principle of proportionality plays a fundamental role in the framework of the right to personal data protection serving a legal regulator for the automotive data processing.

The GDPR not only preserves but also enhances data subjects' core principles and rights. It introduces new obligations that require organizations to implement data protection by design and, by default, appoint a data protection officer, comply with data portability, and confirm proportionality. Member States are prohibited from issuing and enforcing data collection and processing rules that conflict with EU provisions, resulting in consistent data protection regulations throughout the EU and shall promote legal certainty for operators (data processing subject) and individuals (data subjects). However, M. Macenaite noted that exceptions and specific requirements for processing certain categories of personal data might apply (Macenaite, 2017). This evolution prompts a re-examination of the principle of proportionality in light of GDPR standards and conformity, particularly regarding modern automatic data processing. The application of proportionality is crucial, especially when discretions to the right enshrined in CFREU Article 8 are necessary for the unique identification of an individual, as such an invasion is regulated by GDPR Article 9. Therefore, abides the normative application of the principle of proportionality within the GDPR is essential.

Proportionality plays a crucial role in the rulemaking of the modern research field. The GDPR compasses compliance with the principle of proportionality, as renowned in Recital 4. This principle serves two critical functions: first, it regulates the exercise of the right to personal data protection broadly, and second, it provides a legal mechanism for the guidance to comply with fundamental criteria due to the limitation of the right to data protection for the necessity to process it regardless intrusions of the data processing subjects. In essence, proportionality regulates legal relations when automatic data operations are involved. Additionally, it acts as a safeguard for interests of both, when data processing subject interested in compliant actions and data subjects interested in realisation guarantee of the right to data protection before, within, and after its processing, especially when data processing is necessary for the interests of a party other than the individual whose data is being processed. Which means interests of one side (data processing subjects) are often prevail over the interests of the other side (data subject), therefore, principle of proportionality serves as a measurement between. Furthermore, the GDPR rules can be challenging for parties, and in this respect the principle of proportionality beneficial to mitigate the risks posed to data, and non-compliant processing with rules set. Thus, this principle is essential to assure that parties shifting align with legal requirements and respect fundamentalism. Hence, the legal mechanism of the proportionality application into data processing is needed.

The legal mechanism for proportionality is crucial and based on several key findings. Firstly, it directly influences rulemaking by serving as a guide for regulatory activities and provide a compliance test for businesses. Compliance with proportionality is essential in the legal theory and practice, as it helps businesses consider the content of GDPR principles when adopting regulations for data protection. Secondly, proportionality helps to clarify the rule of law in a studied branch by forming a methodological framework for interpreting the legal norms of GDPR and combining them with the content of the legal system. Thirdly, a proportionality expects to resolve conflicts and gaps in the legal relationship. The principle used by the analogy of law based on its conceptual criteria, which aid to resolve disputes involving data processing especially where there is no clear rule to regulate legal relations or there is lack of specific norms. This also allows the Data Protection Authority (DPA) and national courts to resolve disputes concerning both rulemaking and supervision. The legal mechanism for proportionality is critical and takes precedence over its multi-functional stage structure. Its application, among other things, helps businesses to comply with GDPR principles, clarifies the rule of law in the studied branch, and guides the resolution of disputes involving personal data processing. Thus, applying the proportionality principle allows interested parties to realize wished results in the observance of the law and comply with the right to personal data protection and legitimate interests granted to a person.

Hence, it is essential to prioritize the application of proportionality in theory and practice for obedience and decide stakes because the principle creates a framework for the law enforcer and outlines the legitimacy based on what a confrontation must be resolved. In the view of the research, a criterion of lawfulness must be applied primary under GDPR Article 6 (1), which states: "Processing shall be lawful only if and to the extent that at least one of the following applies: a) data subject has given consent to the data processing for one or more specific purposes; b) processing is necessary for the performance of a contract; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority; f) processing is necessary for the purposes of the legitimate interests, except where such interests are overridden or fundamental rights and freedoms of the data subject which require personal data protection".

The breakdown assumes that legal norms are subject to proportionality, rendering the formalist understanding of legality impractical. As a result, authorities are bound to act solely on the legal basis established in a specific norm, within their given jurisdiction and following the guidelines set forth in the referenced article. Processing can only be carried out within the framework of GDPR as per Recital 40, and officials must first evaluate the data subject's action as stipulated. For instance, GDPR, Recital 41 requires determining whether the processing was carried out within or outside the GDPR, whether the data processed falls under a particular category of data with respect to GDPR Article 9 (1) (2), and whether the requirements are based on standard norms for personal data. A balanced/proportional interference occurs via the automatic emergence of data employment. In other words, the observance of the law should not be an end and should not be formalist, which is, tied to the letter of the law (Marchant et al., 2011, p. 127). Instead, the parties should use and understand the law as a tool to ensure the broadest possible field of freedom for individuals.

In determining applicable restrictions to an individual, proportionality is applied where the content of the provisions allows for identification selecting the least burdensome option. Implementing the principle, as mentioned earlier, would reinforce compliance with the normative actors' requirements in the setup above. This is supported by the European Commission's Guide (2017) to the Case Law of the European Court of Justice on Articles 49 TFEU, assuming that rule-making acts can be challenged. The application mechanism is manifested not only in the fact that it allows eliminating gaps but also configures that the subject of power in any situation acted to the proportionality accordingly. Here, the role of courts is difficult to overestimate. The application mechanism is necessary for law execution, especially in justice. Due to that, it is expedient to study the resource of the discussed principle not only in the theoretical aspect but also as a compass developed within justice ruling. This benefit should be distinguished. Tracing the doctrinal achievement of the resource to complete the mechanism in the legal and practical field has a direct connection with the principle of justice because it simultaneously protects the rights, freedoms, and interests of individuals from unlawful interference, and at the same time provides a balance between private and public interests by minimizing interference for the sake of achieving the public interest (Cheung, 2020).

Further, the functional perspective of the application mechanism can be viewed through the lens of proportionality. When there is a dispute between a subject of power and a natural person regarding decisions, actions, or omissions, the court uses proportionality as the criterion for review. The application of proportionality is not limited to human rights law. However, it extends to all legal substantive and procedural relations where there is interference with the legal capacity of individuals. The study suggests fundamental regimes should align with democratic principles and be subject to elected officials. Transparency and accountability frameworks are required, as set out in GDPR Article 5, Recitals 13, 39, 58, 78, 85, and 100. Alike, proportionality is also vital when there is a significant impact on private life, it is necessary for the exercise of power, and when public power needs to be limited. Personal data protection restrictions and mandatory mechanisms are accompanied by the principle of safeguarding the fundamental rights. However, if there are no viable alternatives to interference, the application of proportionality should be minimized.

To outline, the concept of personal data processing accordingly to the principle of proportionality, can be viewed narrowly and broadly. In the narrow sense, it relates to one element of its content, such as balancing legitimate interests. In contrast, in the broad sense, it encompasses all content elements, irrespective of the purpose of processing. The application of proportionality performs several functions, including sectoral rulemaking, gap-solving, and data protection execution. It determines its resource allocation based on the importance of protecting fundamental human rights and the legitimate interests of individuals while also guaranteeing the rule of law and democracy. Proportionality is complex and includes several criteria, such as the necessity and balance of conflicting interests and the determinability of the purpose of data processing. Unlike the principle of subsidiarity, which regulates the exercise of powers by the EU, the proportionality seeks to set limits on the actions taken by EU institutions to achieve the objectives of the Treaties, as outlined in TEU Article 5. Also, the proportionality execution is set out in Protocol (No 2) on applying the principles of subsidiarity and proportionality annexed to the Treaty.

Accordingly, based on the previous discussions and findings presented in the preceding sections, the study has illustrated a functional Table titled "The Legal Mechanism of Application of the Principle of Proportionality in the GDPR" (Table 1), developed and designed by Bulgakova, who pays a special attention to the special categories of personal data under GDPR Article 9 (1) (2) because its limits right to personal data protection due to exceptions provided regardless escape from the strict prohibition to process distinct categories of data, as for example biometric, and therefore calls to apply the studied principle following its appropriate legal mechanism designed for data protection field of the study (Bulgakova, 2021).

Table 1. The Legal Mechanism of Application of the Principle of Proportionality in the GDPR

Source: (Bulgakova, 2021)

The offered legal mechanism is advantageous in both theoretical and practical senses, as it enables private parties, rulemaking activities, and other actors to select the least burdensome compliance approach while complying with data protection during data processing. By operating the mentioned Table 1, parties involved in specific legal relations, can effectively realize data processing rather than relying solely on abstract provisions of the law. A key hint is establishing a legal mechanism for applying the principle of proportionality, as described in the table "The Legal Mechanism of Application of the Principle of Proportionality in the GDPR" in the legislation. This is important because without such a mechanism, data processing subjects may collect and use personal data for identification or other purposes without proper legal oversight. The legal mechanism should provide adequate safeguards for individuals as well as ensuring that the processing is compliant with GDPR and fundamental framework and assessing the interests of all parties involved. Moreover, to ensure the responsible and legal processing of personal data, it is important to follow the principle of proportionality, which involves adhering to relevant legislation. A study suggests that limitations must be put in place to minimize the risk of interference, and the proportionality is valuable to determine whether any interference is proportionate. This safeguard should be implemented for the responsible use of automotive technology paying attention on the device used for processing, whether its storage centralized or decentralized and to prioritize the data subject's rights. Finally, the research contends that the legislator needs to adequately address the fact that personal data can be processed with or without the individual's knowledge. Therefore, specific processing rules should be implemented proportionately for each data characteristic separately.

Conclusions

The principle of proportionality is essential to ensure the comprehensive protection of the right to personal data. Since the CFREU gained legal force, data protection has achieved a clear and effective constitutional status with binding application in EU law. The study argues that the CFREU protects personal data by guaranteeing the corresponding right and applying the principle of proportionality. This is justified because the EU law strictly protects personal data as a fundamental value and assures its enactment through the studied principle. Member States must implement these limits for data processing subject, and national remedies are essential in respecting them.

The principle of proportionality ensures that data protection legislation complies with EU law restrictions, and any exemptions or restrictions must be necessary and proportionate. This creates a transparent system for protecting personal data in the EU. In this regard, the theory of data protection law distinguishes several complex elements related to the principle of proportionality performance. These elements include: a) the necessity of application and absence of any alternative measures - indicating that the state's actions must be necessary and there should be no alternative measures that could be applied instead; b) compliance with the legitimate purpose - meaning that the state's actions must be consistent with the legitimate purpose of interfering with human rights; c) the negative result of the interference for the right to personal data protection must be less than the positive result for the public interest - stating that the negative impact on an individual must be less than the positive impact on the public interest.