How can the experience of the data breach notification obligations in the law of the United States be beneficial for the interpretation of the new personal data breach notification obligations pursuant to GDPR?

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14220%2F19%3A00109652" target="_blank" >RIV/00216224:14220/19:00109652 - isvavai.cz</a>

Result on the web

<a href="https://easychair.org/smart-program/TILTing2019/2019-05-15.html" target="_blank" >https://easychair.org/smart-program/TILTing2019/2019-05-15.html</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

How can the experience of the data breach notification obligations in the law of the United States be beneficial for the interpretation of the new personal data breach notification obligations pursuant to GDPR?

Original language description

Following the enactment of the bill California S.B. 1386 in 2002, also known as California data security breach notification law, majority of US states adopted some form of mandatory data breach notification legislation. The experience with this type of legal instrument in the legal systems of the United States over the last decade and a half may therefore serve as a valuable case study for the general data breach notification obligation under Articles 33 and 34 of the General Data Protection Regulation 2016/679. The data breach notification obligation is for most data controllers a new obligatory requirement that presents a new challenge for monitoring of internal processes. Taking into consideration the proximity of the legal systems, similar economic realities, technological development and social values, the substantial record of data breach notification practice in the United States holds a sizeable potential for analysis and an opportunity for comparative transfer of relevant conclusion to help the implementation of the newly established GDPR general data breach notification obligation. There are on the other hand unavoidable differences in conceptual framework of this instrument between American and European approach as well as to some degree within the United States complex legal structure itself. Understanding these limitations is therefore an essential part of the analysis that is affecting the conclusion about the overall potential value of the lessons that can be learned. Beyond the historical developments of the institute, its interpretation and application are of special interest to the contribution the current challenges related to the boom of Internet of Things solutions and the influence this technological change has or may have on the purpose and function of the data breach notification obligation.

Czech name

—

Czech description

—

Type

O - Miscellaneous

CEP classification

—

OECD FORD branch

50501 - Law

Project

<a href="/en/project/TL02000398" target="_blank" >TL02000398: Legal and technical tools for privacy protection in cyberspace</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Publication year

2019

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů