Search

Αυτό το άρθρο παρέχει συστάσεις προς την Ευρωπαϊκή Ένωση (ΕΕ) ώστε να συμπληρώσει την απαίτηση εκτίμησης αντικτύπου σχετικά με την προστασία δεδομένων (ΕΑΠΔ), όπως προβλέπεται στον Γενικό Κανονισμό για την Προστασία Δεδομένων (ΓΚΠΔ), στοχεύοντας στην επίτευξη ισχυρότερης προστασίας προσωπικών δεδομένων. Τον Απρίλιο του 2016 η ΕΕ κατέληξε στο κυρίως μέρος της μεταρρύθμισης του νομικού πλαισίου για την προστασία προσωπικών δεδομένων. Η Ένωση αυτήν την στιγμή προετοιμάζει μέτρα εφαρμογής και κατευθυντήριες γραμμές για να εκτελέσει στο ακέραιο τις νέες νομικές διατάξεις πριν από την εφαρμογή τους τον Μάιο του 2018. Αυτή η μεταρρύθμιση εισάγει, μεταξύ άλλων «καινοτομιών», μία νέα νομική υποχρέωση για τη διενέργεια της ΕΑΠΔ. Ωστόσο, σ ’αυτήν την υποχρέωση διαπιστώνονται αδυναμίες. Προκειμένου να αντιμετωπιστεί αυτό, ενημερώνοντας αυτήν τη διαρκή διαδικασία χάραξης πολιτικής, η παρούσα συνοπτική έκθεση αποσκοπεί στο σχεδιασμό βέλτιστων πρακτικών για έναν γενικό τύπο εκτίμησης αντικτύπου, π.χ. που συστήνεται για διαφορετικούς τομείς (Ενότητα ΙΙ). Στην Ενότητα ΙΙΙ επιχειρείται μία πρώιμη αξιολόγηση του πώς αυτές οι βέλτιστες πρακτικές σχετίζονται με τη συγκεκριμένη εκτίμηση αντικτύπου η οποία προβλέπεται στον ΓΚΠΔ, ήτοι την ΕΑΠΔ. Των ενοτήτων αυτών προηγούνται συνοπτικές βασικές πληροφορίες στην εκτίμηση αντικτύπου, όπως: ορισμός, ιστορική επισκόπηση, θετικά και αρνητικά χαρακτηριστικά (Ενότητα Ι). Η Ενότητα ΙV ολοκληρώνει το άρθρο υποβάλλοντας προτάσεις για τη συμπλήρωση της υποχρέωσης ΕΑΠΔ στον ΓΚΠΔ: (1) να επεκταθεί το πεδίο της υποχρέωσης ΕΑΠΔ στον ΓΚΠΔ (2) να αναπτυχθούν μέθοδοι για τη διενέργεια αυτής της εκτίμησης (3) να ιδρυθούν «κέντρα αναφοράς» ΕΑΠΔ στις Αρχές Προστασίας Δεδομένων (ΑΠΔ). Αυτή η συνοπτική έκθεση απευθύνεται κυρίως στους φορείς χάραξης πολιτικής στην ΕΕ – και στο επίπεδο Κρατών-Μελών, παρά το γεγονός ότι μπορεί δυνητικά να γίνει αντικείμενο ενδιαφέροντος για τους ομολόγους τους σε παγκόσμιο επίπεδο.

Este documento fornece recomendações para a União Europeia (UE) que facilitam o cumprimento da exigência legal de elaboração de relatórios de Avaliação de Impacto sobre a Proteção de Dados (AIPD), conforme definido pelo Regulamento Geral de Proteção de Dados (RGPD), com o objetivo de atingir uma proteção de dados pessoais mais robusta. Em abril de 2016, a UE concluiu a parte central da reforma do seu regime jurídico de proteção de dados pessoais. A UE está, atualmente, preparando medidas e diretrizes de implementação e manuais para dar pleno efeito às novas disposições jurídicas antes da sua entrada em vigor em maio de 2018. Tal reforma introduziu, dentre outras ‘novidades’, uma obrigação legal de elaboração de um AIPD. Entretanto, tal exigência padece de alguns pontos fracos. De forma a remediar essas limitações e para alimentar esse processo contínuo de elaboração de políticas, este documento de política (‘policy brief’) busca esboçar boas práticas para um tipo genérico de avaliação de impacto, i.e., recomendado para diferentes áreas (seção II). A seção III faz uma avaliação preliminar sobre como essas boas práticas se relacionam com os requerimentos específicos determinados pelo RGPD para relatórios de avaliação de impacto, i.e., Data Protection Impact Assessment (DPIA). Essas seções são precedidas por informações contextuais sucintas sobre avaliações de impacto como por exemplo: definição, panorama histórico, suas vantagens e desvantagens (seção I). A Seção IV conclui com recomendações para o cumprimento da exigência de AIPDs pelo RGPD de forma a: (1) expandir o âmbito de aplicação dessa obrigação legal; (2) desenvolver métodos para a realização dessas avaliações de impacto; (3) estabelecer ‘centros de referência’ em AIPD nas autoridades nacionais de controle dos tratamentos de dados pessoais. Este documento de política é endereçado principalmente a formuladores de políticas públicas na União Europeia e em seus Estados-membros, sem prejuízo do potencial interesse que possa despertar nos seus pares ao redor do mundo.

The present deliverable outlines the TARES Impact Assessment method that the project intends to follow to conduct. This assessment is broader than just a data protection impact assessment (DPIA) pursuant to Article 35 of the General Data Protection Regulation (GDPR). It will not only include the objectives of the latter, but also refer to the ethical and societal concerns of the project (ethical impact assessment - ‘EIA’) and privacy aspects not falling under the data protection impact assessment (privacy impact assessment – ‘PIA’). The TARES impact assessment implies a proactive approach contributing to informed decision-making by considering potential consequences of the project, direct and indirect, to the rights and freedoms of natural persons, before its occurrence. An impact assessment evaluates the origin, nature and severity of impacts that the processing operations, real or hypothetical, of a specific project entail. The present impact assessment method intends to describe the steps to take in order to generate useful information to consortium partners and assist them in taking informed decisions about the development and deployment of the HR-Recycler technology. There is no one-size-fits all model for conducting impact assessments.

Recent advancements in human-computer interaction, machine learning and in artificial intelligence hold the potential to influence both the curriculum and the pedagogy of school children. While the impacts of new technologies remain uncertain, ongoing research and innovation projects are already developing and testing such technologies in schools. This article builds on the experience of the authors as advisors for a Horizon 2020 (H2020) project conducting research with schoolchildren in twenty schools across the United Kingdom, Italy and Spain (the project MaTHiSiS). This contribution presents and discusses how the authors lived up to the obligation of conducting research in line with “ethical principles”.

This paper provides recommendations for the European Union (EU) to complement the requirement for data protection impact assessment (DPIA), as set forth in the General Data Protection Regulation (GDPR), with a view of achieving a more robust protection of personal data. In April 2016 the EU concluded the core part of the reform of its legal framework for personal data protection. The Union is currently preparing implementing measures and guidelines to give full effect to the new legal provisions before their applicability from May 2018. This reform introduces, among other ‘novelties’, a legal requirement to conduct a DPIA. However, this requirement bears a few weak points. In order to inform this on-going policy-making process, the present policy brief attempts to draft a best practice for a generic type of impact assessment, i.e. recommended for different areas (section II). Section III makes an early evaluation of how this best practice relates to the specific impact assessment requirement set forth in the GDPR, i.e. DPIA. These sections are preceded by succinct background information on impact assessments as such: definition, historical overview, and their merits and drawbacks (section I). Section IV concludes this paper by offering recommendations for complementing the DPIA requirement in the GDPR: (1) to expand the scope of the DPIA requirement in the GDPR; (2) to develop methods for conducting such an assessment; (3) to establish ‘reference centres’ on DPIA at data protection authorities (DPAs). This policy brief is addressed predominantly to policy-makers at the EU- and Member State-level, notwithstanding the potential interest it might gain from their counterparts elsewhere in the world.