IEEE Technology and Society Magazine - December 2020 - 62

the right to the protection of the personal data of individuals " [10].
It is worth emphasizing that, some of the most
important regulations (other than GDPR) in EU law
regarding personal data protection are the Charter of
Fundamental Rights of the European Union [11] (the
" Charter " ), and the Treaty on the Functioning of the
European Union [12] (TFEU). In article 16(1) (TFEU), a
rule is established that everyone has the right to the
protection of personal data concerning them.
Moreover, according to the previsions from the article 8 of the Charter of Fundamental Rights of the European Union, everyone has the right to the protection of
personal data concerning them. Moreover, such data
must be processed fairly for specified purposes and
with the consent of the person concerned, or some
other legitimate basis laid down by law. Everyone has
the right of access to data which has been collected
concerning them, and the right to have it rectified.
According to the judgements of the Court of Justice EU,
" The right to the protection of personal data is not, however, an absolute right, but must be considered in relation to its function in society. " 1
At a time when more people are entrusting cloud services with their personal data, and breaches are a daily
occurrence, Europe has signaled its firm stance on data
privacy and security by introducing the " Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on
the free movement of such data, and repealing Directive
95/46/EC, " a.k.a., The General Data Protection Regulation (GDPR). The GDPR contains 99 Articles followed by
173 Recitals. The Articles state the main requirements
of the Regulation and the Recitals provide further clarification and refinement to the intent of the Articles. GDPR
is more specific than previous incarnations of regulations [13].
Even though it was drafted and passed by the EU, the
GDPR concerns organizations outside it as well, as long
as they process data related to people in the EU and
European Economic Area (EEA). The regulations have
given individuals control over their personal information
and are fully enforceable in all EU member states. The
regulations also address export of personal information
outside the EU [14]. Although the GDPR was passed by
the European Parliament in 2016, all organizations were
required to become compliant by May 25, 2018. If they
had not done so, they would be punished, as the regulation will levy harsh fines against anyone who violates its

1
See: Judgment of the Court (Grand Chamber) of Nov. 9, 2010, Joined
Cases C 92/09 and C 93/09, Volker und Markus ScheckeGbR and Hartmut
Eifert v Land Hessen, point 48.

privacy and security standards. The penalties may reach
into tens of millions of euros. There are two tiers of penalties, which max out at €20 million or 4% of global revenue, whichever is higher. The regulation itself is large
(88 pages, not including the accompanying directives),
far-reaching, and fairly light on specifics.

Legal terms
The GDPR introduces an array of legal terms defined
in article 4. It must be noted that the GDPR gives a
more detailed definition than previous regulations did.
Some of the most important terms that this text refers
to include:
Personal data means any information relating to an
identified or identifiable natural person ( " data subject " ).
An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to
an identifier such as a name, an identification number,
location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural
person [art. 4 (1)].
Processing means any operation or set of operations
that is performed on personal data or on sets of personal data, whether or not by automated means[15], such
as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction [art. 4 (2)].
Profiling means any form of automated processing
of personal data consisting of the use of personal
data to evaluate certain personal aspects relating to a
natural person, in particular to analyze or predict
aspects concerning that natural person's performance at work, economic situation, health, personal
preferences, interests, reliability, behavior, location,
or movements [art. 4 (4)].
Processor means a natural or legal person, public
authority, agency or other body which processes personal data on behalf of the controller [art. 4 (8)].
Controller means the natural or legal person, public
authority, agency, or other body who, alone or jointly
with others, determines the purposes and means of the
processing of personal data; where the purposes and
means of such processing are determined by Union or
Member State. The controller or the specific criteria for
its nomination may be provided for by Union or Member State law [art. 4 (7)].
Importantly, the new regulation introduced a definitions of biometric and genetic data. Biometric data
means personal data resulting from specific technical
processing relating to the physical, physiological, or
behavioral characteristics of a natural person, which

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

∕

DECEMBER 2020

IEEE Technology and Society Magazine - December 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2020