Data Protection by Design
From Abstract Principles to Implementation
Buch in deiner Nähe kaufen
Beschreibung
This book examines the obligation of data protection by design and provides practical guidance on complying with Article 25 of the General Data Protection Regulation (GDPR). The GDPR significantly reshaped EU data protection law and introduced, for the first time, a legal requirement that data controllers implement technical and organisational measures to embed data protection principles into the design and operation of digital systems. While related concepts such as Privacy Enhancing Technologies (PETs) predated the GDPR, Article 25 established a binding obligation to ensure data protection by design and by default.
The book analyses the requirements of Article 25 GDPR and explains how organisations can comply with this broadly framed provision. Particular attention is given to the risk-based approach adopted by the GDPR, under which the level of protection must correspond to the risks posed to data subjects. This approach creates uncertainty because Article 25 does not specify which safeguards are sufficient in practice. Similar ambiguity exists regarding anonymisation techniques, which the author identifies as important measures for achieving compliance with the principle of data minimisation.
To address these challenges, the book examines officially approved Codes of Conduct and certification requirements in data protection law. These instruments provide detailed guidance on implementing data protection by design and help translate the GDPR’s abstract requirements into concrete compliance measures. The analysis further demonstrates that the EU law principle of legitimate expectations can protect organisations that rely on officially approved standards.
Adopting an interdisciplinary perspective, the book also explores Knowledge Graphs (KGs) as tools for embedding data protection requirements into technological systems. Focusing on Knowledge Graphs developed through Semantic Web technologies, it shows how legal rules can be expressed in machine-readable formats that support compliance by design. The monograph concludes by proposing best practices for the development of vocabularies and ontologies that represent data protection obligations in a structured, machine-readable way.
This book examines the obligation of data protection by design and provides practical guidance on complying with Article 25 of the General Data Protection Regulation (GDPR). The GDPR significantly reshaped EU data protection law and introduced, for the first time, a legal requirement that data controllers implement technical and organisational measures to embed data protection principles into the design and operation of digital systems. While related concepts such as Privacy Enhancing Technologies (PETs) predated the GDPR, Article 25 established a binding obligation to ensure data protection by design and by default.
The book analyses the requirements of Article 25 GDPR and explains how organisations can comply with this broadly framed provision. Particular attention is given to the risk-based approach adopted by the GDPR, under which the level of protection must correspond to the risks posed to data subjects. This approach creates uncertainty because Article 25 does not specify which safeguards are sufficient in practice. Similar ambiguity exists regarding anonymisation techniques, which the author identifies as important measures for achieving compliance with the principle of data minimisation.
To address these challenges, the book examines officially approved Codes of Conduct and certification requirements in data protection law. These instruments provide detailed guidance on implementing data protection by design and help translate the GDPR’s abstract requirements into concrete compliance measures. The analysis further demonstrates that the EU law principle of legitimate expectations can protect organisations that rely on officially approved standards.
Adopting an interdisciplinary perspective, the book also explores Knowledge Graphs (KGs) as tools for embedding data protection requirements into technological systems. Focusing on Knowledge Graphs developed through Semantic Web technologies, it shows how legal rules can be expressed in machine-readable formats that support compliance by design. The monograph concludes by proposing best practices for the development of vocabularies and ontologies that represent data protection obligations in a structured, machine-readable way.
Examines the obligation of data protection by design in the GDPR, a topic with global implications Provides a comprehensive guide of best practices about data protection by design and by default Offers an interdisciplinary analysis covering a vast array of questions from both fields of law and computer science
Autor*in
Efstratios Koulierakis
Themen in »Data Protection by Design«
privacy EU law personal data protection General Data Protection Regulation (GDPR) data protection principles Article 25 GDPR Privacy Enhancing Technologies (PETs) data protection by design data protection by default data minimization pseudonymization anonymization soft law certification codes of conduct