Page 101

AD ALTA

JOURNAL OF INTERDISCIPLINARY RESEARCH

Fourthly, the consent and its conditions were changed to
simplify and make the consent and its withdrawal as easy, clear
as possible. Processing of a sensitive personal data is prohibited
unless the exception applies (ex. The person makes such a data
public voluntarily (on social media or other way or a separate
consent was given). Separate consent with profiling is also
needed. Profiling as itself has separate rules which needs to be
followed. The discussion about the consent and whether is given
free is ended in the regulation stating that the consent should not
be a condition to the entering into contract in case data are not
necessary for preforming the contract.

Fifthly, one stop shop mechanism was established to simplify the
contact with public authorities. Supervisory Authority is the only
authority the data controllers and operator has to deal with. In
case they are multinational companies they deal with the
authority based on its establishment and with the Lead
Supervisory Authority also.

The topic of the data protection reform is very broad and this
part of article can only outline the general idea of the data
protection reform.

On the other hand, some critics of the reform stated that the
reform is not perfect.
Right of data portability has more practical challenges and
challenges in the enforcement procedure. Right of data
portability applies only to the data provided by the subject based
on the wording of the art. 20 of the regulation. This might limit
the current development of the cyberspace as far the data added
by others might be also important part of the subject data which
he might be interested in. On the other hand, the data added by
the subject might include also data about third party. Then the
question remains whether based on the wording of the article 20
regulation those data should be transmitted also or not?

Until

now the practical realization of the right of data portability is in
question. The costs and the technical support needed for
realization of such a right are not know yet. Based on the
wording of the article 20 there is only a word “technically
feasible”. The explanation of the working party is more about
not providing any obligation on data controllers only asking
them not to make any barriers in the transfer. In practice, this
might lead to blocking the real usage of the right with stating of
the data controller that the transfer is not technically feasible.
The Union should provide more practical guidance on the
technical support of the real exercise of the right, otherwise it
can happen that the right will not be exercised in practice due to
the technical issues.
More critic as the IT experts are worried about the practical
exercise of some provision of the regulation. Discussion about
the cloud and their usage and their security level and compliance
with the regulation started.

General data protection regulation affects all kind of life and
different sectors. Artificial intelligent is a specific topic which
arise also from the General Data Protection Regulation and its
regulation is currently in question and subject of a discussion.
Genetic research is another specific sector which will be affected
by the General Data Protection Regulation as far they also fall
into the scope of the personal data and are specified as sensitive
data.

The regulation applies only on personal data as they are defined
in the regulation.

For establishing the digital single market we

For more critics about the right of portability see: Diker Vanberg, A. & , Ünver,

MB.: The right to data portability in the GDPR and EU competition law: odd couple
or dynamic duo?, In: European Journal of Law and Technology, Vol 8, No 1, 2017
and also https://medium.com/mydata/gdpr-data-portability-is-a-false-promise-af460d
35a629 (30.12.2017)

An Example of discussion https://www.cbronline.com/cloud/public/5-tech-

reactions-to-the-eu-data-protection-regulation-4756923/ (30.12.2017)

For more see: Shabani, M., Borry, P.: Rules for processing genetic data for research

purposes in view of the new EU General Data Protection Regulation, In: European
Journal of Human Genetics (2017)

‘personal data’ means any information relating to an identified or identifiable

natural person (‘data subject’); an identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an identifier such as a
name, an identification number, location data, an online identifier or to one or more

also need rules for non-personal data. The unrestricted
movement of non-personal data across borders and technology
systems in the EU is also considered a key building block of the
EU's Digital Single Market strategy. In September 2017
Commission proposed a draft regulation

on free flow of non-

personal data which is based on the communication with the
topic Building a European Data Economy

. The proposal of the

regulation is much shorter than the General Data Protection
Regulation and has 10 articles and shall apply to storage or other
processing of electronic data which are other than personal data
as defined in General Data Protection Regulation and stipulates
the free movement of such a data. A more power is proposed to
be given to authorities by data availability for competent
authorities means that relevant national law or Union authorities
might provide assistance with obtaining the relevant data stored
in different Member State.

4 Conclusion

There is no doubt that establishing a Digital Single Market is a
difficult goal which on the other hand after reaching it will
enable the European Union to use its potential in the digital
world where the Union is nowadays behind. The impact of the
establishment of the Digital Single Market will be on grow will
be on all areas of life, law, technology, medicine, research,
education, etc. To reach this goal the European Union has lots of
work ahead of it. The first base stone was already laid down and
that is the personal data protection reform. Personal data
protection reform enables people “to move” in the digital world
safely having specified clear rules, rights and a clear mechanism
of supervision was set. The personal data protection reform does
not apply yet, but already there are some gaps, overlaps and
questions which shall be solved.

On the other hand, to establish the Digital Single Market this is
not enough. Several goals have been already achieved such as:
a) canceling the retail roaming charges

, b) cross-border

portability of online services

, c) end of the unjustified geo-

blocking

. Directive on measures to reduce the cost of

deploying high-speed electronic communications networks

was enacted in order to facilitate the deployment and/or roll-out
of high-speed electronic communications networks (mobile as
well as fixed broadband networks) by reducing the cost of
deployment.

Establishing a safe cyberspace which can be digital single
market needs common cybersecurity law which has the plan –
cybersecurity package adopted by Commission in September
2017. The first NIS directive was already adopted

in July 2016.

This put in place the necessary structures for strategic and
operational cooperation between Member States and for making
networks and information systems within the EU more resilient.
A proposal for Cybersecurity Act

is already prepared by

Commission where a new Agency on the Union level will be
created (ENISA).

factors specific to the physical, physiological, genetic, mental, economic, cultural or
social identity of that natural person – art. 4 para 1

Proposal for a Regulation of the European Parliament and of the Council on a

framework for the free flow of non-personal data in the European Union
COM(2017)495

COM(2017) 9, "Building A European Data Economy", 10 January 2017

COM(2016) 399, Regulation (EU) No 531/2012 of the European Parliament and of

the Council of 13 June 2012 on roaming on public mobile communications networks
within the Union, OJ L 172, 30.06.2012, p. 10; Regulation (EU) 2015/2120 of the
European Parliament and of the Council of 25 November 2015 laying down measures
concerning open internet access and amending Directive 2002/22/EC on universal
service and users’ rights relating to electronic communications networks and services
and Regulation (EU) No 531/2012 on roaming on public mobile communications
networks within the Union, OJ L 301/1, 26.11.2015

COM(2015) 627

COM(2016) 289

Directive 2014/61/EU of the European Parliament and of the Council of 15 May

2014 on measures to reduce the cost of deploying high-speed electronic
communications networks, OJ L 155/1

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 july

2016 concerning measures for a high common level of security of network and
information systems across the Union, OJ L. 194/1, 19.7.2016

Proposal for a Regulation Of The European Parliament And Of The Council on

ENISA, the "EU Cybersecurity Agency", and repealing Regulation (EU) 526/2013,
and on Information and Communication Technology cybersecurity certification
(''Cybersecurity Act''), COM(2017)477

- 101 -