Consumer Data Protection In Brazil, China And Germany: A Comparative Study

Description

The rapid development of new information and communication technologies has changed people's everyday life and consumption patterns significantly. The worldwide spread of those technologies provides many innovations for consumers, but it can also bear risks, such as the indiscriminate collection, storage and cross-border flow of personal data, illegal spying on Internet activities, dissemination of personal information, and abuse of user passwords. The study deals with the current state of consumer data protection law in Brazil, China and Germany from a comparative perspective. It covers the main legal issues of consumer privacy and data protection in these countries and seeks to explain current issues and case law concerning consumer data protection from a practical perspective. GIZ_book_160509.pdf......Page 0 Table of Contents......Page 7 A. Project Summary......Page 13 B. Research Activities......Page 15 C. General Overview of the Study......Page 16 I. Introduction......Page 19 1. Character of legislation......Page 20 3. Telecommunication......Page 23 6. Specific acts for e-commerce......Page 24 III. Applicability of data protection acts......Page 25 IV. Definitions of consumer and data......Page 26 V. General guiding principles......Page 28 VII. Approaches to consent......Page 30 VIII. Publicity and transparency......Page 31 X. Data control, data portability and the right to access, modify and delete collected data......Page 32 XI. Roles and responsibilities of intermediaries......Page 33 XIII. Provisions on data retention......Page 34 XV. Enforcement......Page 36 1. Civil law......Page 38 3. Administrative law......Page 39 XVI. Role of self-regulation and co-regulation......Page 40 I. Introduction......Page 41 1. Character of the legislation......Page 42 2. General legal framework for consumer data protection......Page 47 3. Telecommunication......Page 50 4. Banks......Page 51 5. Media-related acts......Page 53 6. Specific acts for e-commerce......Page 54 III. Applicability of data protection acts......Page 55 IV. Definition of consumer and data......Page 56 V. General guiding principles......Page 57 VI. Collecting, storing and processing consumer data......Page 59 VII. Approaches to consent......Page 60 VIII. Publicity and transparency......Page 62 IX. Data security......Page 63 X. Data control, data portability and the right to access, modify and delete collected data......Page 64 XI. Roles and responsibilities of intermediaries......Page 65 XII. Access to user data by third parties......Page 68 XIII. Provisions on data retention......Page 69 1. Civil law......Page 70 2. Criminal law......Page 72 3. Administrative law......Page 74 XVI. Role of self-regulation and co-regulation......Page 76 I. Introduction......Page 77 1. Character of the legislation......Page 78 4. Specific acts for e-commerce......Page 82 III. Applicability of data protection acts......Page 83 IV. Definitions of consumer and data......Page 87 b. Anonymized, pseudonymized and encrypted data......Page 88 c. Absolute and relative approach to the identifiablity of persons......Page 89 2. Personal data under the General Data Protection Regulation......Page 94 V. Basic concepts......Page 97 VI. Collecting, storing and processing consumer data......Page 100 VII. Approaches to consent......Page 101 1. Informed consent according to the Data Protection Directive......Page 102 2. Informed consent and obligation of transparency under the General Data Protection Regulation......Page 103 1. Information......Page 105 3. Privacy by design and default......Page 106 4. Privacy seal......Page 107 IX. Data security......Page 108 X. Data control, data portability and the right to access, modify and delete data collected......Page 109 XI. Roles and responsibilities of intermediaries......Page 110 b. Joint controlling......Page 111 c. Processing on behalf of the controller......Page 113 a. Rules for the controller......Page 118 c. Rules regarding the processor......Page 119 XIII. Provisions on data retention......Page 121 a. Data Protection Directive......Page 122 b. General Data Protection Regulation......Page 126 d. Third-country actions against data controllers......Page 129 1. Civil law......Page 131 2. Criminal law......Page 132 3. Administrative law......Page 133 4. The Data Protection Officer......Page 134 a. The position of the Data Protection Officer......Page 135 c. Independence of the Data Protection Officer and the special dismissal protection......Page 136 d. Status and duties of the Data Protection Officer towards the data protection supervisory authority......Page 137 e. The Data Protection Officer and the proposal for a General Data Protection Regulation......Page 138 XVI. Role of self-regulation and co-regulation......Page 139 I. UN Guidelines for Consumer Protection......Page 140 II. OECD Guidelines......Page 141 III. The Global Privacy Enforcement Network (GPEN)......Page 147 IV. Convention 108......Page 151 1. Asia Pacific Economic Cooperation (APEC)......Page 153 2. Association of South East Asian Nations (ASEAN)......Page 155 3. Economic Commission for Latin America and the Caribbean (ECLAC)......Page 156 I. Credit scoring......Page 159 1. Case......Page 160 2. Concept of credit scoring......Page 161 4. Regulation of consumer credit databases in the Consumer Defense Code......Page 162 5. Positive Credit Information Law (Law No. 12.414 of 2011)......Page 163 7. Limitation: privacy and transparency......Page 165 1. Sindec......Page 166 a. Wal-Mart......Page 167 b. Internet connection services......Page 168 1. Illegal collection and use of personal information......Page 169 2. Disclosure and illegal release of customers’ personal information......Page 170 3. Sending electronic advertisements without customers’ prior consent......Page 174 4. The boundaries of the legal protection of privacy......Page 175 1. Acquiring personal information......Page 176 2. Selling and illegally providing citizens’ personal information......Page 179 3. Criminal means of illegally acquiring citizens’ personal information......Page 181 4. “Aggravated circumstances”......Page 183 III. Administrative enforcement of law......Page 185 II. Credit scoring......Page 187 III. Cloud computing......Page 190 IV. “Big data”......Page 191 V. Profiling......Page 192 VI. Unsolicited e-mails......Page 195 VII. Rating platforms......Page 196 VIII. The right to be forgotten......Page 198 IX. Data Retention......Page 199 D. Challenges of New Technologies for Consumer Data Protection (Privacy International with Consumers International)......Page 201 I. Cloud Storage......Page 202 III. Big data......Page 203 VI. Smart Cities, Buildings and People......Page 204 IX. Browse configurations and Ad-blocks......Page 205 XII. The Onion Router (TOR)......Page 206 XIII. Off the Record (OTR)......Page 207 I. Fundamentals and the existing legal framework......Page 209 II. Applicability of data protection acts......Page 210 1. Applicability to cross-border cases......Page 211 III. Personal data......Page 212 IV. General guiding principles......Page 213 V. Restrictions to the collection, processing and transfer of (consumer) data......Page 217 VI. Approaches towards the principle of consent......Page 218 VII. Transparency......Page 219 VIII. Responsibility......Page 221 X. Data retention......Page 224 XI. Enforcement......Page 225 XII. Self-regulation and co-regulation......Page 227