Jump to content

User:Prizmic/Privacy law

From Wikipedia, the free encyclopedia

IN PROGRESS

[from main page] Privacy law refers to the laws that deal with regulating, storing, and using of personally identifiable information of individuals, which can be collected by governments, public or private organizations, or by other individuals.

Privacy laws are considered in the context of an individual's privacy rights or within reasonable expectation of privacy.

International legal standards on privacy[edit]

Asia-Pacific Economic Cooperation (APEC)[edit]

APEC created a voluntary Privacy Framework that was adopted by all 21 member economies in 2004 in an attempt to improve general information privacy and the cross-border transfer of information.[1] The Framework consists of nine Privacy Principles that act as minimum standards for privacy protection: Preventing harm, Notice, Collection limitation, Use of personal information, Choice, Integrity of personal information, Security safeguards, Access and correction, and Accountability.[1]

In 2011, APEC implemented the APEC Cross Border Privacy Rules System with the goal of balancing "the flow of information and data across borders while at the same time providing effective protection for personal information, essential to trust and confidence in the online marketplace."[2] The four agreed-upon rules of the System are based upon the APEC Privacy Framework and include: self-assessment, compliance review, recognition/acceptance, and dispute resolution and enforcement.[2]

Council of Europe[edit]

The Council of Europe also addressed privacy protection in regards to the Internet in 1998 when it published "Draft Guidelines for the protection of individuals with regard to the collection and processing of personal data on the information highway, which may be incorporated in or annexed to Code of Conduct."[3] The Council developed these guidelines in conjunction with the European Commission, and they were adopted in 1999.[3]

European Union (EU)[edit]

The 1995 Data Protection Directive (officially Directive 95/46/EC) recognized the authority of National data protection authorities and required that all Member States adhere to universal privacy protection standards.[3] Member States must adopt strict privacy laws that are no more relaxed than the framework provided by the directive.[4] Additionally, the Directive outlines that non-EU countries must adopt privacy legislation of equal restriction in order to be allowed to exchange personal data with EU countries. Furthermore, companies in non-EU countries must also adopt privacy standards of at least equal restriction as provided in the Directive in order to do business with companies located in EU countries.[4] Thus, the Directive has also influenced the development of privacy legislation in non-European countries.[3] The proposed ePrivacy Regulation, which would replace the Privacy and Electronic Communications Directive 2002, also contributes to EU privacy regulations.

The General Data Protection Regulation will replace the Data Protection Directive of 1995 when it takes effect on 25 May 2018. A notable contribution that will come from the General Data Protection Regulation is its recognition of a "right to be forgotten", which requires any group that collects data on individuals to delete the data related to an individual upon that individual's request.[5] The Regulation was influenced by the aforementioned European Convention on Human Rights.[5]

Organization for Economic Co-operation and Development (OECD)[edit]

In 1980, the OECD adopted the voluntary OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data in response to growing concerns about information privacy and data protection in an increasingly technological and connected world.[6] The OECD Guidelines helped establish an international standard for privacy legislation by defining the term "personal data" and outlining fair information practice principles (FIPPs) that other countries have adopted in their national privacy legislation.[6]

In 2007, the OECD adopted the Recommendation on Cross-border Co-operation in the Enforcement of Laws Protecting Privacy. This framework is based on the OECD Guidelines and includes two cooperation based model forms to encourage the enforcement of privacy laws among member states.[7] The Recommendation is also notable for coining the term "Privacy Enforcement Authority."[8]

United Nations (UN)[edit]

On 18 December 2013, the United Nations General Assembly adopted resolution 68/167 on the right to privacy in the digital age. The resolution makes reference to the Universal Declaration of Human Rights and reaffirms the fundamental and protected human right of privacy.[9]

Privacy laws by country[edit]

Malaysia[edit]

After their independence from Great Britain in 1957, Malaysia's existing legal system was based primarily on English common law.[10] The following common law torts are related to personal information privacy and continue to play a role in Malaysia's legal system: breach of confidence, defamation, malicious falsehood, and negligence.[10] In recent years, however, the Court of Appeal in Malaysia has referred less to English common law and instead looked more toward other nations with similar colonial histories and whose written constitutions are more like the Malaysian Constitution.[10] Unlike the courts in these other nations, such as India's Supreme Court, the Malaysian Court of Appeal has not yet recognized a constitutionally protected right to privacy.[10]

In June 2010, the Malaysian Parliament passed the Personal Data Protection Act 2010, and it came into effect in 2013.[11] It outlines seven Personal Data Protection Principles that entities operating in Malaysia must adhere to: the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle, and the Access Principle.[11] The Act defines personal data as "'information in respect of commercial transactions that relates directly or indirectly to the data subject, who is identified or identifiable from that information or from that and other information."[11] A notable contribution to general privacy law is the Act's distinction between personal data and sensitive personal data, which entails different protections.[12] Personal data includes "information in respect of commercial transactions ... that relates directly or indirectly to a data subject" while sensitive personal data includes any "personal data consisting of information as to the physical or mental health or condition of a data subject, his political opinions, his religious beliefs or other beliefs of a similar nature".[13] Although the Act does not apply to information processed outside the country, it does restrict cross-border transfers of data from Malaysia outwards.[4] Additionally, the Act offers individuals the "right to access and correct the personal data held by data users", "the right to withdraw consent to the processing of personal data", and "the right to prevent data users from processing personal data for the purpose of direct marketing".[11] Punishment for violating the Personal Data Protection Act can include fines or even imprisonment.[4]

Other common law and business sector-specific laws that exist in Malaysia to indirectly protect confidential information include:

Singapore[edit]

Singapore, like other Commonwealth jurisdictions, relies primarily on common law, and the law of confidence is employed for privacy protection cases.[14] For example, privacy can be protected indirectly through various common law torts: defamation, trespass, nuisance, negligence, and breach of confidence.[15] In February 2002, however, the Singaporean government decided that the common law approach was inadequate for their emerging globalized technological economy.[14] Thus, the National Internet Advisory Committee published the Model Data Protection Code for the Private Sector, which set standards for personal data protection and was influenced by the EU Data Protection Directive and the OECD Guidelines on the Protection of Privacy.[14] In the private sector, businesses can still choose to adopt the Model Code, but in 2005 Parliament decided that Singapore needed a more comprehensive legislative privacy framework.[11]

In January 2013, Singapore's Personal Data Protection Act 2012 came into effect in three separate but related phases.[4] The phases continued through July 2014 and dealt with the creation of the Personal Data Protection Commission, the national Do Not Call Registry, and general data protection Rules.[4] The Act's general purpose "is to govern the collection, use and disclosure of personal data by organisations" while acknowledging the individual's right to control their personal data and the organizations' legal needs to collect this data.[14] It imposes eight obligations on those organizations that use personal data: consent, purpose limitation, notification, access, correction, accuracy, protection/security, and retention.[2] The Act prohibits transfer of personal data to countries with privacy protection standards that are lower than those outlined in the general data protection rules.[11] The Personal Data Protection Commission is responsible for enforcing the Act, which is based primarily on a complaints-based system.[14] The punishments for violating the Act can include being ordered by the Commission to stop collecting and using personal data, to destroy the data, or to pay a penalty of up to $1 million.[14]

Singapore has also passed various sector-specific statutes that more indirectly deal with privacy and personal information, including:

There are also more specific acts for electronically stored information:

  • Spam Control Act 2007
  • Electronic Transactions Act
  • National Computer Board Act
  • Computer Misuse Act[11]

Taiwan[edit]

The right to privacy is not explicitly mentioned in the Republic of China Constitution, but it can be protected indirectly through judicial interpretation. For example, article 12 of the Constitution states "the people shall have freedom of confidentiality of correspondence" while article 10 states "the people shall have freedom of residence and of change of residence."[16] Along with several other articles that assert the Constitution's protection of freedoms and rights of the people, the Grand Justices are able to decide how privacy protection fits into the legal system.[16] The Justices first made reference to privacy being a protected right in the 1992 "Interpretation of Council of Grand Justices No. 293 on Disputes Concerning Debtors' Rights," but it was not directly or explicitly declared to be a right.[16]

In 1995, Taiwan passed the Computer-Processed Personal Data Protection Act which was influenced by the OECD Guidelines and enforced by each separate Ministry depending on their industry sector responsibility.[17] It has also only protected personal information managed by government agencies and certain industries.[12] In 2010, Taiwan enacted the Personal Data Protection Act that laid out more comprehensive guidelines for the public and private sectors and was still enforced by individual Ministries.[17] In the 2010 Act, personal data is protected and defined as any "data which is sufficient to, directly or indirectly, identify that person", and includes data such as name, date of birth, fingerprints, occupation, medical records, and financial status, among many others.[11]

A few other administrative laws also deal with communication-specific personal privacy protection:

  • Telecommunications Act
  • Communications Protection and Surveillance Act

Additionally, chapter 28 of the Criminal Code outlines punishments for privacy violations in article 315, sections 315-1 and 315-2. The sections primarily address issues of search and seizure and criminal punishment for wrongful invasion of privacy.[16]

Finally, articles 18(I),184(I), and 195(I) of the Taiwanese Civil Code address the "personality right" to privacy and the right to compensation when one injures the "rights" of another, such as when someone uses another's name illegally.[16]

Thailand[edit]

Thailand's unique history of being an authoritarian buffer state during the Cold War and being under the constant threat of a coup d'état means that privacy laws have so far been limited in order to preserve national security and public safety.[18] Thailand uses bureaucratic surveillance to maintain national security and public safety, which explains the 1991 Civil Registration Act that was passed to protect personal data in computerized record-keeping and data-processing done by the government.[18]

The legislature passed the Official Information Act 1997 to provide basic data protection by limiting personal data collection and retention in the public sector.[17] It defines personal information in a national context in relation to state agencies.[11] Two communication technology related laws, the Electronic Transactions Act 2001 and the Computer Crime Act 2007, provide some data privacy protection and enforcement mechanisms.[18] Nevertheless, Thailand still lacks legislation that explicitly addresses privacy security.[18]

Thus, with the need for a more general and all-encompassing data protection law, the legislature proposed the Personal Data Protection Bill in 2013, which is heavily influenced by the OECD Guidelines and the EU Directive.[11][18] The draft law is still under evaluation and its enactment date is not yet finalized.[11]

Vietnam[edit]

Vietnam, lacking a general data protection law, relies on Civil Code regulations relating to personal data protection. Specifically, the Code "protects information relating to the private life of a person."[11] The 2006 Law on Information Technology protects personal information, such as name, profession, phone number, and email address, and declares that organizations may only use this information for a "proper purpose". The legislation, however, does not define what qualifies as proper.[11] The 2005 Law on Electronic Transactions protects personal information during electronic transactions by prohibiting organizations and individuals from disclosing "part or all of information related to private and personal affairs ... without prior agreement."[19] These laws do not provide a precise framework for what type of personal data is protected. The 2010 Law on Protection of Consumers' Rights provides further protection for consumer information, but it does not define the scope of that information or create a data protection authority; additionally, it is only applicable in the private sector.[17]

In 2015, the Vietnam legislature introduced the Law on Information Security, which ensures better information safety and protection online and in user's computer software. It took effect on 1 July 2016 and is Vietnam's first overarching data protection legislation.[20]


Related pages[edit]

References[edit]

  1. ^ a b Greenleaf, Graham (2009). "Five years of the APEC Privacy Framework: Failure or promise?". Computer Law & Security Report. 25: 28–43. doi:10.1016/j.clsr.2008.12.002. S2CID 62198335. SSRN 2022907 – via SSRN.
  2. ^ a b c Marvin, Lynn M.; et al. (2015). "Conducting U.S. Discovery in Asia: An Overview of E-Discovery and Asian Data Privacy Laws". Richmond Journal of Law & Technology. 21 – via HeinOnline. {{cite journal}}: Explicit use of et al. in: |last= (help)
  3. ^ a b c d Reidenberg, Joel R. (2000). "Resolving Conflicting International Data Privacy Rules in Cyberspace". Stanford Law Review. 52 (5): 1315–1371. doi:10.2307/1229516. JSTOR 1229516 – via JSTOR.
  4. ^ a b c d e f Bhasin, Madan Lal (2016). "Challenge of guarding online privacy: role of privacy seals, government regulations and technological solutions". Socio-Economic Problems & the State. 15 – via EBSCO.
  5. ^ a b Victor, Jacob M. (November 2013). "The EU General Data Protection Regulation: Toward a Property Regime for Protecting Data Privacy" (PDF). The Yale Law Journal. 123 (2): 513–528. JSTOR 23744289 – via JSTOR.
  6. ^ a b Tene, Omar (2013). "Privacy Law's Midlife Crisis: A Critical Assessment of the Second Wave of Global Privacy Laws". Ohio State Law Journal. 74 – via HeinOnline.
  7. ^ "OECD Recommendation on Cross-border Co-operation in the Enforcement of Laws Protecting Privacy - OECD". www.oecd.org. Retrieved 2018-03-21.
  8. ^ Greenleaf, Graham (2012). "Independence of data privacy authorities (Part 1): International standards". Computer Law & Security Review. 28 – via ScienceDirect.
  9. ^ "III.V.7 UNITED NATIONS GENERAL ASSEMBLY RESOLUTION 68/167 (ON THE RIGHT TO PRIVACY IN THE DIGITAL AGE)". International Law & World Order: Weston's & Carlson's Basic Documents. doi:10.1163/2211-4394_rwilwo_com_033375.
  10. ^ a b c d e Thomas, Mathews (2004). "Is Malaysia's MyKad the "one card to rule them all"? The urgent need to develop a proper legal framework for the protection of personal information in Malaysia". Melbourne University Law Review: 1–38. SSRN 2065036 – via SSRN.
  11. ^ a b c d e f g h i j k l m n o Anon. 2017. "Global Data Privacy Directory". Norton Rose Fulbright. Retrieved 21 March 2018. http://www.nortonrosefulbright.com/files/global-data-privacy-directory-52687.pdf
  12. ^ a b Chik, Warren B. (2013). "The Singapore Personal Data Protection Act and an assessment of future trends in data privacy reform". Computer Law & Security Review. 29 (5): 554–575. doi:10.1016/j.clsr.2013.07.010. S2CID 62566690 – via Elsevier ScienceDiret.
  13. ^ Parliament of Malaysia (June 2010). "Laws of Malaysia - Act 709 Personal Data Protection Act 2010" (PDF).
  14. ^ a b c d e f g Chesterman, Simon (2012). "After Privacy: the Rise of Facebook, the Fall of Wikileaks, and Singapore's Personal Data Protection Act 2012". Singapore Journal of Legal Studies: 391–415. SSRN 2255274 – via SSRN.
  15. ^ Chandran, Ravi (2000). "Privacy in Employment". Singapore Journal of Legal Studies. 2000: 263–297. JSTOR 24868246 – via JSTOR.
  16. ^ a b c d e Peng, Shin-Yi (2003). "Privacy and the Construction of Legal Meaning in Taiwan". The International Lawyer. 37 (4): 1037–1054. JSTOR 40707869 – via JSTOR.
  17. ^ a b c d Greenleaf, Graham (2012). "Independence of data privacy authorities (Part 2): Asia-Pacific experience". Computer Law & Security Review. 28 (2): 121–129. doi:10.1016/j.clsr.2012.01.002. SSRN 1971627 – via SSRN.
  18. ^ a b c d e Ramasoota, Pirongrong; et al. (2014). "Online Privacy in Thailand: Public and Strategic Awareness". Journal of Law, Information & Science. 23: 97–136 – via HeinOnline. {{cite journal}}: Explicit use of et al. in: |first= (help)
  19. ^ The National Assembly of the Socialist Republic of Vietnam. (2005). "Legislature XI, Session 8: Law on E-Transactions." https://www.wto.org/english/thewto_e/acc_e/vnm_e/WTACCVNM43_LEG_5.pdf
  20. ^ Treutler, Thomas J.; et al. (March 2016). "Legal Update: New Regulations in the ICT Sector in Vietnam" (PDF). Tilleke & Gibbins. {{cite journal}}: Explicit use of et al. in: |last= (help)
Retrieved from "https://en.wikipedia.org/w/index.php?title=User:Prizmic/Privacy_law&oldid=1092337170"