Towards legal compliance by correlating Standards and Laws with a semi-automated methodology

in Bosse, Tibor; Bredeweg, Bert (Eds.) Communications in Computer and Information Science (2017)

Since generally legal regulations do not provide clear parameters to determine when their requirements are met, achieving legal compliance is not trivial. The adoption of standards could help create an ... [more ▼]

Since generally legal regulations do not provide clear parameters to determine when their requirements are met, achieving legal compliance is not trivial. The adoption of standards could help create an argument of compliance in favour of the implementing party, provided there is a clear correspondence between the provisions of a specific standard and the regulation's requirements. However, identifying such correspondences is a complex process which is complicated further by the fact that the established correlations may be overridden in time e.g., because newer court decisions change the interpretation of certain legal provisions. To help solve these problems, we present a framework that supports legal experts in recognizing correlations between provisions in a standard and requirements in a given law. The framework relies on state-of-the-art Natural Language Semantics techniques to process the linguistic terms of the two documents, and maintains a knowledge base of the logic representations of the terms, together with their defeasible correlations, both formal and substantive. An application of the framework is shown by comparing a provision of the European General Data Protection Regulation with the ISO/IEC 27018:2014 standard. [less ▲]

Roles and Powers of National Data Protection Authorities Moving from Directive 95/46/EC to the GDPR: Stronger and More ‘European’ DPAs as Guardians of Consistency?

in European Data Protection Law Review (2016), 2(3), 342-352

Safeguarding the rights of the citizens to the protection of their personal data in an era of nearly ubiquitous computing has become increasingly challenging. National data protection authorities (DPAs ... [more ▼]

Safeguarding the rights of the citizens to the protection of their personal data in an era of nearly ubiquitous computing has become increasingly challenging. National data protection authorities (DPAs), central actors in the data protection landscape, face a difficult task when fulfilling their missions and acting as guardians of these rights under the provisions of the outdated Directive 95/46/EC. Critical decisions of the Court of Justice of the European Union illustrate the challenge of 'stretching' the provisions regarding the powers and competences of DPAs under the Directive to make them applicable to current data processing realities. The article points out the existing problems under the current framework with regard to powers and competence of DPAs and examines if and to what extent they are mended by the General Data Protection Regulation (GDPR). It analyses substantive and procedural aspects of the new cooperation model under the one-stop-shop and consistency mechanisms and discusses whether and how these new tools successfully contribute to solve existing problems. [less ▲]

Assessing IT Security Standards Against the Upcoming GDPR for Cloud Systems

Poster (2015, March 11)

This work in progress aims at identifying a mapping between the current security standards (in particular, but not limited to, ISO 27001-2013) and the upcoming regulations in data protection. The aim is ... [more ▼]

This work in progress aims at identifying a mapping between the current security standards (in particular, but not limited to, ISO 27001-2013) and the upcoming regulations in data protection. The aim is to find an overlap between the requirements for data protection and the existing security standards, to measure the gap that a business has to cross (and consequently an estimate of the expenses that it must sustain) to achieve compliance with the GDPR. [less ▲]

The "Minimal" Approach: the CJEU on the Concept of "Establishment" Triggering Jurisdiction for DPAs and Limitations of Their Sanctioning Powers

in European Data Protection Law Review (2015)

A New Approach to EU Data Protection

in Kritische Vierteljahresschrift für Gesetzgebung und Rechtswissenschaft (2014), 97(1), 10-27

Die Entwicklung neuer Technologien und die bedeutende Rolle des Internets im heutigen Alltag haben den Datenschutz vor neue Herausforderungen gestellt. Darüber hinaus wirkt sich die uneinheitliche ... [more ▼]

Die Entwicklung neuer Technologien und die bedeutende Rolle des Internets im heutigen Alltag haben den Datenschutz vor neue Herausforderungen gestellt. Darüber hinaus wirkt sich die uneinheitliche Umsetzung der Richtlinie 94/46/EG, die den rechtlichen Rahmen für den Datenschutz in Europa bildet, negativ auf den europäischen Binnenmarkt aus. Vor diesem Hintergrund ist es Ziel des Vorschlags der Europäischen Kommission für eine neue Datenschutz- Grundverordnung, den Rechtsrahmen zu harmonisieren und ein erhöhtes Datenschutzniveau der Bürger zu schaffen. Obwohl sich die Europäische Kommission, das Parlament und der Rat in vielen Punkten noch nicht einig sind, ist eine klare Änderung der Perspektive zu erkennen. Unternehmen sollen selbst tätig werden und eine verantwortliche Haltung zum Datenschutz übernehmen. Die Rechenschaftspflicht der für die Verarbeitung Verantwortlichen wird hiermit in den Vordergrund gestellt. Es gilt nun proaktiv zu handeln, und nicht nur reaktiv. Prinzipien wie Datenschutz durch Technik und datenschutzfreundliche Voreinstellungen spiegeln diesen Ansatz wider. Bürger werden ihrerseits mit am Internetzeitalter angepassten Rechten - wie dem Recht auf Datenübertragbarkeit – ausgestattet, um die Kontrolle über ihre Daten in die eigene Hand nehmen zu können. Die Bedingungen einer gültigen Einwilligung in der Online-Welt werden deutlicher gestaltet und Nutzer und Verbraucher mit erweiterten Rechtsschutzinstrumenten ausgestattet, die die Durchsetzbarkeit des Datenschutzes stärken. Auch wenn vor 2015 kaum mit einer Verabschiedung der Reform zu rechnen ist, verspricht diese neue Herangehensweise, die Chance auf einen effizienteren Datenschutz. [less ▲]