Search results - CEJSH

1

Anonimizacja niektórych danych w oświadczeniu majątkowym posła

100%

Dubowski R.

Zeszyty Prawnicze BAS

|

2023

|

issue 3(79)

202-209

EN

The issue under analysis concerns the anonymisation of the data of a natural person to whom the Deputy has a financial obligation. After analysing the provisions of the GDPR, the author concludes that they do not preclude the disclosure of the name of the natural person with regard to whom the liability has arisen and do not provide a legal basis for effectively requesting the Marshal of the Sejm to anonymise the data of private individuals with regard to whom the liability has arisen in the declaration of assets.

2

The great escape? Liability of public authorities in the data protection area

100%

Mesarčík M.

The Lawyer Quarterly

|

2021

|

vol. 11

|

issue 1

158-177

EN

The article is focused on the analysis of the liability of public authorities in the data protection area. Public authorities stand outside the spotlight of academics and politics in terms of liability considering the processing of personal data. Nevertheless, public authorities are often controllers of a vast amount of personal data via eGovernment services. Thus, this contribution is aimed to foster the discussion of liability issues concerning public authorities while processing personal data from the point of relevant international data protection legislation and national legislation on the liability of public authorities and its applicability in the data protection area.

3

Digitizing the public administration and safeguarding individual rights: automated decision-making at the intersection of the GDPR and Polish administrative procedure

100%

Geburczyk F.

Ruch Prawniczy, Ekonomiczny i Socjologiczny

|

2021

|

vol. 83

|

issue 1

99-113

EN

Automating administrative decision-making through the use of algorithms integrated into administrative procedures constitutes a major goal of both the Polish government and the EU. Notwithstanding the undeniable benefits of automated administrative decision-making, the tentative development of the law regulating administrative procedures in this regard translates into risks to important elements of administrative due process. Although a systematic regulatory approach to automated administrative decision-making is lacking, an analysis of the provisions of the GDPR concerning profiling algorithms and automated decision-making may prove rewarding, given that they may directly affect the procedural rights of parties in proceedings before national authorities. On the other hand, the imprecise language of the GDPR makes it susceptible to interpretations deeply embedded in the hitherto elaborated practices of the Polish administrative procedure. The article analyses the intersection between the GDPR and Polish administrative procedure in order to examine the potential for mutual influences between both frameworks.

4

Issues of personal data management in organizations – GDPR compliance level analysis

100%

Kucęba R., Chmielarz G.

Informatyka Ekonomiczna

|

2018

|

issue 1(47)

58-71

EN

The paper presents the issues of information and personal data security management in organizations. The authors include in it an analysis of breaches to personal data security in organizations as a vital factor that conditions the necessity to improve the previously applied solutions in this area. Additionally, the paper contains analyses concerning the preparation level of organizations to ensure compliance with the General Data Protection Regulation (GDPR) which is coming into force. The paper constitutes a cognitive query in the scope of the subject matter defined in its title

5

The Court of Justice Kicks Around the Dichotomy Between Data Protection and Competition Law Case Comment of the Preliminary Ruling in Case C-252/21 Meta Platforms v. Bundeskartellamt

100%

Martínez A. R.

Yearbook of Antitrust and Regulatory Studies

|

2023

|

vol. 16

|

issue 28

131-152

FR

La protection des données et le droit de la concurrence sont à la croisée des chemins en ce qui concerne leur intégration. Les autorités antitrust et les autorités de contrôle de la protection des données ont été confrontées à la question de savoir si les deux domaines du droit devaient être repris dans la même analyse. L’autorité allemande de la concurrence a été la première à les fusionner dans le cadre de l’affaire qui a fait jurisprudence contre les conditions générales de traitement des données de Facebook. La théorie du préjudice d’exploitation avancée par le Bundeskartellamt est la première du genre à intégrer des considérations relatives à la protection des données dans l’analyse antitrust, notamment en établissant une distinction entre une infraction au règlement général sur la protection des données (RGPD) et un préjudice anticoncurrentiel. Ce commentaire d’affaire présente les principaux développements au niveau national pour ensuite aborder les questions qui ont été repondues par la Cour de justice de l’Union européenne dans l’affaire C-252/21 concernant l’interprétation du GDPR dans le contexte du droit de la concurrence.

EN

Data protection and competition law have been at a crossroads in terms of their integration. Antitrust authorities as well as data protection supervisory authorities have grappled with the question of whether both fields of law should be combined into the same analysis. The German competition authority, the Bundeskartellamt, was the first to fuse them in its landmark case against Facebook’s data processing terms and conditions. The exploitative theory of harm put forward by the German NCA is the first of its kind to integrate data protection considerations into the antitrust analysis, namely by drawing a line between an infringement with the General Data Protection Regulation (GDPR) and anti-competitive harm. This case comment outlines its key developments at the national level, to then address the questions that have been answered by the Court of Justice of the European Union, CJEU, in Case C-252/21 concerning the interpretation of the GDPR in the context of competition law.

6

Zadania i decyzje Prezesa Urzędu Ochrony Danych Osobowych

100%

Sakowska-Baryła M., Wyporska-Frankiewicz J.

Roczniki Nauk Prawnych

|

2022

|

vol. 32

|

issue 1

61-82

EN

Changes in the field of personal data protection related to the entry into force of the provisions of the GDPR and the Act on the protection of personal data resulted in the imposition of a number of different tasks on the President of the Personal Data Protection Office. Many of them are implemented by this authority using the fundamental legal form of administrative action – i.e. an administrative decision, which in this case is adopted in one-instance proceedings. On this basis, the following analysis was carried out: the status and scope of tasks, including the supervisory powers of the President of the Personal Data Protection Office, and the procedural framework in which they are undertaken – including the form of an administrative decision. It was also considered worth to examine whether, in specific cases, the form of an administrative decision constitutes an adequate means of implementing the tasks entrusted by the provisions of the GDPR to the President of the Personal Data Protection Office. In the conclusion, the authors considered it justified to recommend that the legislator should precisely define the legal form in which the tasks of the President of the Personal Data Protection Office should be performed. Moreover, they indicated that the legislator does not seem to notice that the nature of the tasks entrusted to the President of UODO indicates that the form of an administrative decision does not always seem to be not only the best, but even appropriate. Especially when it comes to the actions of this authority related to the need to issue a warning or issue a reminder – the form of an administrative decision does not seem to be justified.

PL

Zmiany w zakresie problematyki ochrony danych osobowych związane z wejściem w życie przepisów RODO oraz ustawy o ochronie danych osobowych spowodowały nałożenie na Prezesa UODO szeregu różnorodnych zadań. Wiele z nich organ ten wykonuje korzystając z podstawowej prawnej formy działania administracji, jaką jest decyzja administracyjna, która w tym przypadku podejmowana jest w jednoinstancyjnym postępowaniu. Na tym tle podjęto kolejno analizę: statusu i zakresu zadań, w tym uprawnień nadzorczych Prezesa UODO oraz ram proceduralnych, w których są one podejmowane – w tym z wykorzystaniem formy decyzji administracyjnej. Za zasadne uznano też zbadanie, czy w konkretnych przypadkach forma decyzji administracyjnej stanowi adekwatny środek realizacji zadań powierzonych przez przepisy RODO Prezesowi UODO. W konkluzji autorki uznały za konieczne rekomendowanie, aby ustawodawca ściśle określił formę prawną, w jakiej powinny być wykonywane zadania Prezesa UODO. Nadto wskazały one, że ustawodawca zdaje się nie dostrzegać, że charakter powierzonych Prezesowi UODO zadań wskazuje, iż forma decyzji administracyjnej nie zawsze wydaje się być nie tylko najlepszą, ale wręcz odpowiednią. Szczególnie, gdy chodzi o działania tego organu związane z koniecznością wydania ostrzeżenia czy udzielenia upomnienia – forma decyzji administracyjnej nie wydaje się być zasadną.

7

Personal Data Protection as an Expression of Personalism

100%

Chojara-Sobiecka M., Kroczek P.

Philosophy and Canon Law

|

2021

|

vol. 7

|

issue 2

1-9

EN

Human-related issues are the objected personalism. One of the current problems contemporarily recognized and widely known is data protection. The article aims to present a mutual connection between legal regulations of data protection, taking under consideration GDPR, and personalism. The conclusion is that there are many elements in legal regulations that justify the conviction that the protection of personal data can be seen as an expression of personalism.

8

Gloss on the ruling of the Supreme Administrative Court of 25 May 2022, case reference number III OSK 2273/21

100%

Walencik D.

Ius Novum

|

2023

|

vol. 17

|

issue 1 ENG

PL

The glossed ruling covers two key issues concerning the application of the autonomous and comprehensive rules of the protection of natural persons with regard to the processing of personal data applied by organisational units of the Catholic Church in the territory of the Republic of Poland. The first issue concerns the possibility of further application of these autonomous, comprehensive rules after the GDPR came into force. The second issue concerns the ability to designate and grant a legal status to an independent separate supervisory authority: the Ecclesiastical Data Protection Officer. Approving the stance presented in the ruling of the Supreme Administrative Court, the gloss presents arguments confirming the fact that when the GDPR came into force, a regulation concerning the processing of personal data existed in the Catholic Church (it was primarily contained in the standards of the Code of Canon Law of 1983), which the Catholic Church, by the time specified in Article 91(1) GDPR, harmonised with the provisions of that legal act. Moreover, the mode of operation, the manner of designating or dismissing the Ecclesiastical Data Protection Officer does not have to be derived from the universally binding law. It may arise from the internal law of the Catholic Church, provided that the requirements laid down in Chapter VI GDPR, i.e. independence, fulfilment of general conditions concerning data protection supervisory authorities, secrecy, performance of tasks and exercise of the powers laid down in the GDPR (relevant competences), are met. This argument originates from the principle of autonomy and independence of churches and other religious organisations, guaranteed by the provisions of the Constitution of the Republic of Poland. The reasoning is also confirmed in recital 165 of the GDPR preamble, which states that “This Regulation respects and does not prejudice the status under the constitutional law of churches and associations or religious communities in the Member States, as recognised in Article 17 TFEU”.

9

The Analysis of Risks to Personal Data Security

100%

Kosznik-Biernacka S.

Security Dimensions: International & National Studies

|

2020

|

vol. 34(34)

256-267

EN

Article 32 of the EU General Data Protection Regulation imposes the obligation to implement appropriate safeguards to protect personal data. It states that the application of adequate measures is to be preceded by a risk analysis and evaluation. In the current paper, as the main risk factors, probability and consequences were assumed that take into account the basic attributes of information, i.e. confidentiality, integrity and availability. Next, a risk analysis methodology based on the risk matrix is proposed. The issue discussed in the publication is currently valid and still requires careful analysis in order to develop universal standards aimed at establishing certification mechanisms as well as quality labels and markings in terms of personal data protection.

10

Soudní dvůr Evropské unie poprvé k nehmotné újmě způsobené porušením nařízení GDPR

89%

Otta Š.

Právník. Teoretický časopis pro otázky státu a práva (The Lawyer - Scientific Review for Problems of State and Law)

|

2024

|

vol. 163

|

issue 5

500-511

EN

The GDPR celebrated its sixth birthday this year. However, this certainly does not mean that all questions related to its application have been answered. One of the unanswered questions so far has been the interpretation of the conditions for the right to compensation for non-material damage caused by a breach of the Regulation. The Court of Justice has recently changed that with its first answers to the preliminary questions referred by the Austrian Supreme Court. The article presents the legal framework of the GDPR on compensation for non-material damage and then focuses on the Court’s judgment, starting with a description of the facts of the case, the Advocate General’s opinion and an analysis of the Court’s conclusions themselves.

CS

Nařízení GDPR oslavilo v letošním roce již šesté narozeniny své účinnosti. To však rozhodně neznamená, že již došlo k zodpovězení všech otázek spojených s jeho aplikací. Jednou z takových nezodpovězených otázek doposud zůstával výklad podmínek pro přiznání práva na náhradu nehmotné újmy způsobené porušením nařízení. To nedávno změnil Soudní dvůr prvními odpověďmi na předběžné otázky položené rakouským nejvyšším soudem. Článek představuje právní rámec nařízení GDPR ohledně náhrady nehmotné újmy a dále je zaměřen na rozsudek Soudního dvora, počínaje popisem skutkových okolností případu, přes stanovisko generálního advokáta až po rozbor jeho samotných závěrů.

11

Umělá inteligence - nové výzvy z pohledu osobních údajů

89%

Mach M.

Právník. Teoretický časopis pro otázky státu a práva (The Lawyer - Scientific Review for Problems of State and Law)

|

2025

|

vol. 164

|

issue 4

347-360

EN

In 2023, we saw the rise of artificial intelligence (AI) and its expansion to mass use by users around the world. However, AI also brings significant privacy challenges, as do all previous significant changes in modern technology. Globally, two approaches to AI in the context of data protection can be observed, one approach represented mainly by the United States of America and the other approach represented mainly by the European Union. The US focuses mainly on innovation and flexibility, while the EU emphasises privacy and security over technological advancement. The present paper will focus on the protection of users when using AI and the specific privacy risks of AI, including unauthorised access to sensitive data, misuse of data for tracking and profiling users, and lack of transparency of algorithms. In relation to the risks of using AI, the paper will focus on the EU’s proposed regulation setting out harmonised rules for AI, the so-called AI Act. This would provide a comprehensive framework for AI regulation, including obligations for AI developers and users, to minimise risks and ensure the ethical use of AI. Finally, the paper will focus on whether the AI Act effectively ensures the protection of users in the context of AI.

CS

V roce 2023 jsme zažili vzestup umělé inteligence (AI) a její rozšíření k masovému používání uživateli po celém světě. Umělá inteligence však také přináší významné výzvy v oblasti ochrany osobních údajů, tak jako všechny předchozí výrazné změny v oblasti moderních technologií. Celosvětově lze sledovat dva přístupy k AI v souvislosti s ochranou osobních údajů, jeden přístup reprezentují zejména Spojené státy americké a druhý přístup reprezentuje zejména Evropská unie. USA se zaměřují zejména na inovace a flexibilitu, zatímco EU klade důraz na ochranu soukromí a bezpečnost nad technologický posun. Předkládaný příspěvek se zaměří na ochranu uživatelů při užívání umělé inteligence a na konkrétní rizika ochrany osobních údajů u AI zahrnující neoprávněný přístup k citlivým datům, zneužití dat pro sledování a profilování uživatelů a nedostatečnou transparentnost algoritmů. V souvislosti s riziky užívání AI se příspěvek zaměří na nařízení stanovující harmonizovaná pravidla pro umělou inteligenci EU, tzv. AI Act, publikovaný EU. Ten by měl představovat komplexní rámec pro regulaci AI, který zahrnuje povinnosti pro vývojáře a uživatele AI, s cílem minimalizovat rizika a zajistit etické využití AI. Příspěvek se na konci bude zabývat tím, zda AI Act efektivně zajišťuje ochranu uživatelů v souvislosti s AI.

12

DeepSeek jako precedent - test odolnosti evropské regulace umělé inteligence

89%

Mach M.

Právník. Teoretický časopis pro otázky státu a práva (The Lawyer - Scientific Review for Problems of State and Law)

|

2025

|

vol. 164

|

issue 11

1068-1080

EN

This article discusses the privacy issues surrounding the DeepSeek AI system, which is facing allegations of transferring user data to China. The author analyses the legal framework for data protection in the EU, in particular with regard to the GDPR and the AI Act, and assesses whether DeepSeek complies with the requirements of these regulations. The study also reflects on the European Union’s approach to AI regulation and the application of the precautionary principle, which has been used in the past, for example, to restrict access to certain digital services in Europe. The paper also compares the EU and US approach to technology companies based in China, highlighting the similar case of ByteDance, TikTok’s parent company, which faced allegations of data sharing with Chinese authorities. The author assesses possible regulatory scenarios for DeepSeek, including security threat listing, temporary banning or permanent blocking of its services in the EU. Particular attention is paid to the question of proportionality and effectiveness of these measures, both in terms of data protection and geopolitical implications. The study concludes that, although the EU emphasises dialogue and redress, if there are reasonable doubts about data security, it would be appropriate to temporarily restrict DeepSeek’s operations until it demonstrates full compliance with European legal standards.

CS

Článek se zabývá problematikou ochrany osobních údajů v souvislosti s AI modelem DeepSeek, který čelí podezřením z předávání osobních dat uživatelů do Číny. Výzkum analyzuje právní rámec ochrany osobních údajů v EU, zejména s ohledem na nařízení GDPR a AI Act, a hodnotí, zda DeepSeek splňuje požadavky těchto regulací. Studie rovněž reflektuje přístup Evropské unie k regulaci AI a aplikaci principu předběžné opatrnosti, který byl v minulosti využit například při omezení přístupu k některým digitálním službám v Evropě. Zároveň se věnuje i komparaci přístupu EU a USA vůči technologickým společnostem se sídlem v Číně, přičemž poukazuje na obdobný případ společnosti ByteDance, mateřské společnosti vlastnící sociální síť TikTok, která čelila obviněním ze sdílení dat s čínskými úřady. Autor hodnotí možné regulatorní scénáře pro DeepSeek, včetně zařazení na seznam bezpečnostních hrozeb, dočasného zákazu či trvalé blokace jeho služeb v EU. Zvláštní pozornost je věnována otázce proporcionality a účinnosti těchto opatření, a to jak z pohledu ochrany osobních údajů, tak z hlediska geopolitických důsledků. Studie dochází k závěru, že ačkoli EU klade důraz na dialog a možnost nápravy, v případě důvodných pochybností o bezpečnosti dat by bylo vhodné dočasně omezit provoz DeepSeeku, dokud neprokáže plný soulad s evropskými právními normami.

13

The US lessons for the EU personal data breach notification

88%

Kasl F.

The Lawyer Quarterly

|

2021

|

vol. 11

|

issue 1

192-205

EN

The new obligation to notify personal data breaches under Articles 33 and 34 of the General Data Protection Regulation 2016/679 can be seen as a reflection of the US regulatory approach to security breach incidents, which has an established tradition since the enactment of Security Breach Information Act in California in 2002. The contribution presents in two parts the relevant legal frameworks of the US and the EU, in order to provide a discussion on their similarities and differences. The aim is to identify available intellectual stimuli to the respective academic debate regarding interpretation, application and specification of the EU provisions based on inspiration from the US experience. The Part II adds the insight into the respective EU regulatory approach and contains the discussion of the parallels of the US and EU frameworks and available insight to be drawn from this doctrinal research.

14

Ochrana osobních údajů v kriminologickém výzkumu

88%

Nová K., Drápal J.

Česká kriminologie (Czech Criminology)

|

2021

|

vol. 6

|

issue 1-2

1-20

EN

Empirical researchers often use secondary data collected by others, especially state institutions. Due to the increasing availability of data online and the ever-growing ease of merging various datasets, the protection of personal data and adherence to the principles of data processing is becoming increasingly important for researchers. In criminal justice research, the protection of personal data is especially important, as information on convictions or criminal proceedings is under special protection. This article presents the basic principles for conducting research using personal data, focusing on their application in criminological research and especially on the use of secondary data. The article further discusses the responsibilities of personal data administrators and their role in the context of processing data for research purposes, data security, creating databases and their various forms, and the process of anonymization and pseudonymization. The article concludes with practical recommendations for ensuring ethical and legal practices in the field of criminological research vis-à-vis personal data protection.

15

Zakres danych o obywatelach gromadzonych przez organy administracji rządowej w ostatnich 15 latach

88%

Kurczewska K.

Zeszyty Prawnicze BAS

|

2023

|

issue 4(80)

254-305

EN

The article presents changes in the method and scope of data collected and processed about citizens by government administration that have occurred over the last 15 years. During this time, there has been a significant increase in the number of areas in which data is collected, as well as the level of detail of the data itself. The reasons for the changes are the development of technologies for managing large data sets, adapting legislation to EU standards, increasing the number of public benefits and services, and increasing the scope of control and supervision exercised by administrative bodies. The article also presents changes in the methods of obtaining data.

16

Cross-Border Flow of Personal Data in the Context of Emigration of the Faithful of the Catholic Church from Poland

88%

Kroczek P.

Ecumeny and Law

|

2021

|

vol. 9

|

issue 2

141-149

EN

The increased emigration of Poles has caused numerous problems of legal and canonical nature, also relating to the activity of the Catholic Church. The article concerns the cross-border processing of personal data carried out by the Catholic Church entities in the context of the emigration of the faithful. Processing of the data of believers takes place, for example, in the formalities related to preparation for entering marriage. From the point of view of canon law the article deals with such issues as: the legality of the process of cross-border data processing, the obligations of the data controller carrying out such a process and the role of the supervisory authority.

17

Limitation of the Right to Request the Erasure of Personal Data in the Context of Sacramental Matters and Canonical Status in the Catholic Church in Poland

88%

Trojanowski B.

Teka Komisji Prawniczej

|

2022

|

vol. 15

|

issue 1

341-356

EN

The introduction of new rules for the protection of personal data in European law has caused increased interest in the issue of respecting the rights of persons resulting from the European regulation. Among these rights are the right to request erasure of personal data and/or the right to be forgotten. Due to the specificity of churches and religious communities, the European legislator also takes into account their autonomy in terms of the possibility of applying their own detailed rules for the protection of personal data. Therefore, the Catholic Church in Poland has adapted her data protection law to the European regulation so that she can continue to carry out her mission in the modern world while retaining the possibility of applying the law on the protection of personal data, taking into consideration the Catholic doctrine regarding the sacraments and the canonical status of the faithful who belong or belonged to her. In these two aspects, the right to delete data is not vested in the faithful but is only recognized as a request for confidentiality of data that cannot be used without the consent of the competent church authority.

18

Protecting Employee Privacy and Security in the Age of Digital Performance Monitoring: A Legal Comparative Analysis of Post-Communist Countries – Poland, Croatia, and the Republic of North Macedonia

88%

Domalewska D., Tišma S., Veljanovska K.

Polish Political Science Yearbook

|

2025

|

issue 2(54)

51-68

EN

In the context of rapidly increasing digital performance monitoring in the workplace, concerns over employee privacy and ethical considerations arise. This tension between organizational control and employee privacy becomes especially complex in postcommunist societies like Poland, Croatia, and the Republic of North Macedonia, which have a history of state surveillance and control. Drawing on various academic sources and employing a doctrinal-legal method, this study examines how cultural, historical, and legal factors shape perceptions and protections of privacy. It also analyzes the legal frameworks of privacy rights in the workplace. The research reveals that post-communist legacies influence public attitudes towards digital privacy, which is reflected in a low interest in digital privacy in these countries and legislation that lags behind rapid technological advancements. Despite their EU-aligned legislation that provides guidelines for ethical data collection and surveillance, an ambivalent perception of privacy exists among citizens, influenced by their history of state surveillance and control. All three countries have specific legislations that encompass civil, criminal, administrative, and labor law to protect privacy in the workplace. The study concludes with policy recommendations, emphasizing the need for ongoing legislative scrutiny to strike a balance between privacy protection and a stable and secure work environment.

19

Protection of Whistleblowers vs. Protection of Personal Data

88%

Varga P.

Teka Komisji Prawniczej

|

2025

|

vol. 18

|

issue 2

575-586

EN

Directive 2019/1937 on the protection of whistleblowers and Regulation 2016/679 (GDPR) on data protection are key legal instruments safeguarding individual rights within the European Union. Despite their shared objective of protecting individuals, their concurrent application presents practical and legal challenges. To ensure compliance, organizations must adopt integrated mechanisms that reconcile whistleblower protection with data privacy obligations. This article explores the need for a coordinated approach that enables effective implementation of both frameworks, emphasizing the importance of legal clarity and operational balance in practice.

20

The Powers of the Supervisory Body in the GDPR as a Basis for Shaping the Practices of Personal Data Processing

88%

Hajduk P.

Review of European and Comparative Law

|

2021

|

vol. 45

|

issue 2

57-75

EN

The purpose of this article is to analyse the competences of the supervisory authority provided for in the General Data Protection Regulation (GDPR) as a tool to shape the practice of personal data processing. This article verifies the thesis that the status of the supervisory authority formed in the GDPR, taking into account the authority’s independence, makes it possible to exercise the authority thoroughly, which is the basis for shaping personal data processing practice. Supervisory authorities have a wide range of powers to carry out the duties assigned to them. This is guaranteed by their independence. The exercise of powers resonates with all entities that fall under the jurisdiction of those authorities. The decisions of the authorities become the subject of interest of both the literature and personal data administrators. The powers connected with imposing administrative penalties might play a particular role. Their imposition causes that entities which are in similar circumstances may expect to be subject to the same penalties. In order to avoid this situation, they tend to adapt their practices to the model adopted in the decision. Opinions and recommendations, as well as codes of conduct approved by the supervisory authorities for particular sectors, which are a benchmark for administrators in those sectors, play an important preventive role.

Refine search results