Search

Copyright of Public Security & Public Order / Visuomenes Saugumas ir Viesoji Tvarka is the property of Mykolas Romeris University and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Socialiniai Tyrimai is the property of Vilnius University and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Financial institutions process large amounts of personal data, and for many different purposes. The prevention of money laundering and terrorist financing requires the processing of personal data, and with this in mind financial institutions collect data on projected turnover in accounts, relatives related to politics, etc, which is based on the principle of “know your customer”. In this article the authors assess the processing of personal data for identification purposes from the standpoint of the data minimisation principle, which is required under the provisions of the General Data Protection Regulation of the European Union. The latter examines whether the processing of personal data for these purposes can be considered proportionate activity, that is to say carried out for defined purposes and only to the extent necessary. A discussion of the related legal regulation is presented which also examines the objectives of such regulation. The article also examines the criteria for the lawful processing of personal data and their application in the processing of personal data for the abovementioned purposes. [ABSTRACT FROM AUTHOR]

With the global spread of COVID-19, remote work and provision of services remotely have become the norm in many areas of activity, including the provision of healthcare services. Following the decision of the government of the Republic of Lithuania to declare quarantine and introduce restrictions to limit movement and activities, recommendations were adopted for public and private sector entities to organize work and provide remote services for customers. The only exception made was in the case of certain functions that could only be physically performed in the actual workplace. Priority for remote provision of services was established in the healthcare sector. Hence, the unprecedented situation presented by COVID-19 has obliged healthcare (and many other sectors) to adapt, and even switch, to remote work, despite doubts or a reluctance to adopt telemedicine. A key challenge in providing distance healthcare is the proper identification of a data subject (patient). Given that the provision of healthcare services is linked to the processing of sensitive personal data, the intended method of identification of a data subject must adhere to strict protocols. These are determined by the potential severity of the consequences that may arise for a patient (and also the healthcare provider) due to misidentification. Qualified data protection officers, supported by appropriate legislation, are essential for the successful implementation of the principles established in the General Data Protection Regulation, and in particular the principle of data minimisation and the principle of transparency, regardless of the way in which the healthcare services are provided (remotely or in person upon arrival to the healthcare institution). Ensuring the education and continuous training of the personnel can help to prevent healthcare institutions from violating the security of personal data, as well as ensure they maintain principles of integrity and confidentiality, especially when and where services are provided remotely. [ABSTRACT FROM AUTHOR]

This article analyses employees as separate data subjects to explore the peculiarities in the processing and protection of employees’ data. Hence, the article presents an analysis of whether or not all the legal bases set out in the General Data Protection Regulation are appropriate and acceptable for the processing of employees‘ personal data. The analysis includes the expediency limits of the collection and processing of employees’ personal data, and identifying the risks of collecting and storing excessive amounts of data. Further, it considers employers’ personal data storage regulation in Lithuania, and compares it with the General Data Protection Regulation principles of limiting the duration of personal data storage and reducing the amount of data collection. Taking into account the respective interests of employer and employee (and the unequal power balance), the employer has a greater responsibility to ensure diligence, specificity, detail and clarity by properly informing employees about the processing and storage of their personal data. [ABSTRACT FROM AUTHOR]

Protecting the data rights of a subject depends to a large extent on the existence of appropriate enforcement mechanisms. This article explores one of the basic rights of the data subject, the right of access and the new rights of the data subject, and evaluates the practical aspects of the implementation of these data subject‘s rights. In the digital age, data processing is ubiquitous, which makes it increasingly difficult for individuals to understand these processes, and also control them. In view of the power imbalance between data subjects and data controllers, individuals have been granted certain rights, giving them more control over the processing of their personal information. One of the fundamental rights of the data subject, which was enshrined in Directive 95/46/EC of the European Parliament, and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, is the data subject‘s right of access to their data. The main amendments to Regulation (EU) 2016/679 are also related to one of the objectives of the personal data protection reform - strengthening the rights of the data subject, therefore new rights of the data subject are introduced alongside existing rights, including: the right to data portability; the right to be forgotten; the right to restrict data processing; the right to object to automated decision-making. [ABSTRACT FROM AUTHOR]

The introduction in Lithuania of new regulation on the protection of personal data is in direct response to the mandatory requirement for uniform and up-to-date legislation in all member states of the European Union. The aim is to ensure the fundamental human right that personal data is protected – as well as to create conditions for the development of the digital economy and to strengthen the fight against crime and terrorism. The data protection package adopted on 27 April 2016 split the State Data Protection Inspectorate of the Republic of Lithuania into two parts: before and after the General Data Protection Regulation. To a greater or lesser extent, the latter has impacted the Inspectorate and almost all of its inspection activities in the performance of tasks set out in the Regulation. The first steps taken by the personal data protection supervisory authority in applying the Regulation and strengthening international cooperation have established a strong basis for the effective protection of personal data. However, the General Data Protection Regulation will continue to require greater attention from the supervisory authority. [ABSTRACT FROM AUTHOR]

With the continuing COVID-19 pandemic, the world is experiencing serious economic dislocation, threats to well-established lifestyles, social stability and challenges to long-held values. In seeking to deal with the pandemic and manage the crisis, governments face various challenges, one area being data protection. For the European Union and its member states clarity is needed around this subject. For data controllers the question is: what is the relationship between COVID-19 pandemic restrictions and the protection of personal data? This article considers the relation between the General Data Protection Regulation and COVID-19 restrictions in the main areas of data management most affected by coronavirus, i.e. the processing of personal health data, the processing of workers‘ personal data and the processing of personal data in COVID-19 pandemic applications. Each of these areas has particular issues in terms of personal data processing, and these are discussed in the light of: the interpretations and experience of the European Union; the European Data Protection Board and other competent authorities; and the basic principles of personal data processing which remain unchanged as an essential duty of every controller. [ABSTRACT FROM AUTHOR]