I takt med dagens digitaliserade samhälle har skolor alltmer övergått från det analoga till det digitala i både undervisning och arbetsprocesser. Eftersom kommunal grundskola är en organisation där man hanterar en mängd personuppgifter och känslig information blir det viktigt att anpassa teknologier och arbetsprocesser för att säkerställa att hanteringen av information sker på ett säkert sätt. Personuppgifter och känslig information som inte lagras på ett säkert sätt innebär brott mot GDPR. För individen kan brott mot GDPR leda till konsekvenser i form av försämrade möjligheter i livet eller att personuppgifter hamnar i fel händer,och för organisationen kan det leda till straff i form av böter. Eftersom det finns relativt lite kunskap om vilken roll GDPR har i skolan samt hur det påverkar strukturer och arbetsuppgifter har detta varit av intresseatt undersöka för att förstå hur skolan som organisation kan skapa förutsättningar för medarbetarna att arbeta på ett säkert sätt. Syftet blev därmed att undersöka och förstå hur GDPR påverkar det dagliga arbetet i kommunal grundskola. Frågeställningar som formulerades för att möta syftet var; Hur påverkar GDPR de dagliga arbetsuppgifterna i skolan? och Vilka organisatoriska förutsättningar blir viktiga för att kunna möta kraven relaterat till GDPR i skolan?. För att besvara syfte och frågeställningar användes en kvalitativ metod och semistrukturerade intervjuer. Resultatet av studien visade på att GDPR har bidragit till förändrade arbetssätt i skolan då arbetsuppgifter som exempelvis kommunikation och lagring måste anpassas efter kraven relaterat till GDPR. Resultatet visar även på att GDPR bidragit till en ökad arbetsbörda i skolan då det innebär fler faktorer att förhålla sig till i sitt arbete med ökat krav på kontroll och uppföljning. Trots att det visat sig förekomma brister i hantering av personuppgifter i skolan finns en upplevd trygghet i hanteringen av personuppgifter bland personalen vilket kan bero på flera saker. Den upplevda tryggheten kan exempelvis bero på den kompetensutveckling och det stöd som erbjuds inom organisationen, men det kan även bero på en brist på en förståelse för vilka konsekvenser brott mot GDPR kan leda till. Utifrån analysen kunde vi se att organisatoriska förutsättningar som blir viktiga för att möta kraven relaterat till GDPR är: gemensamma rutiner, kompetensutveckling och anpassade system för hanteringen av personuppgifter. Detta blir viktigt för att behålla säkerheten i arbetet i skolan.

Chudobová, M. General Data Protection Regulation and its application in financial consulting. Diploma thesis. Brno: Mendel University in Brno, 2019. This diploma thesis deals with the issue of personal data protection in the practice of financial advisers. The first part focuses on the legal regulation of the protection of personal data from the point of view of the original legislation according to Act No. 101/2000 Coll., On the Protection of Personal Data, also from the perspective of Regulation (EU) No 2016/679 of the European Parliament and of the Council, as well as from the point of view of the draft law on the processing of personal data which was not till the date of the surrender of this work approved (Parliamentary Press 138). In practise part, the knowledge of existing financial advisors and their strengths and weaknesses were identified through questionnaire surveys and in-depth interviews. Here are recommendations for new financial advisers in cooperation with the headquarters.

The diploma thesis deals with the issue of personal data protection in the field of marketing. The aim of the thesis is to propose recommendations that will ensure that the marketing department of the selected company complies with the General Data Protection Regulation (GDPR). The literature review focuses on the legal grounding of personal data protection, the General Data Protection Regulation and the definition of terms that are directly related to the issue. Attention is also paid to the context of marketing activities with the processing and protection of personal data. The own research analyses the level of personal data protection in the marketing department of the selected company, which is then compared to the requirements of the current legislation on personal data protection. At the end of the thesis, the necessary corrective measures are proposed.

Personuppgiftlagen (PUL) fanns mellan 1992 och 2018 för att skydda människors personliga integritet. The General data protection regulation tog över 2018 dels för att fylla i de luckorsom fanns i PUL men också för att samma regler skulle gälla i alla EUs medlemsländer. För alla organisationer innebar det förändringar om på vilket sätt de ska hantera personuppgifter (Danielsson, Nilsson och Lindström 2019a). I den kvalitativa studie intervjuas respondenter från fem olika ideella föreningar för att ta reda på hur de har valt hantera dataskyddsförordningen. Studien kommer att fokusera på hur föreningarna skyddar sitt medlemsregister, skillnaden på hur de arbetar med personuppgifter nu kontra innan GDPR, hur de aktivt arbetar för att följa GDPR och vilka förändringar de har tvingats genomgå.

This thesis aims to analyze the legal relevance and forms of instrumentalization of the right to explanation of automated decisions in the context of European Union Law. Under the prisms of trade secret protection, privacy and data protection, competition and consumer law, the investigation identifies legal provisions of primary and secondary European law, as well as complementary sources, which support the existence of a right to explanation. Additionally, the proportionality in the weighing of fundamental rights can corroborate the legal and technical implementation of this right, for which this thesis proposes practical suggestions that are consistent with the Google Search platform, chosen as the object of study through which the analyzes would be carried out. Revisiting Lawrence Lessig's idea that (computational) code would shape society's behavior, accommodated by Shoshana Zuboff's recent contributions on surveillance capitalism, I propose that law (norms) can also be translated into (programming) code. Many steps in this direction have already been taken and continue to be in recently proposed legislation. Robust laws in the areas of data protection, trade secrets protection, competition and consumer law currently subsidize claims for explanation that can be filed with different administrative bodies and be examined by European courts. Competition authorities have already proven that there can be real consequences in the reformulation of some of these practices in the private sector, as seen in previous cases of Google within the scope of the European Commission. Since there is a large asymmetry of information between automated decision-making platforms and its users, by disclosing a portion of an algorithm’s inner functioning (purposes, reasoning, inputs and deciding parameters taken into consideration etc.), in an appropriate fashion to the average user for whom the explanation is aimed, it is possible to better enforce consumer welfare and safeguard competition standards. The substance of this study recognizes the importance of a right to explanation as a stepping stone for algorithmic governance, especially with regard to Google’s search engine and its applications. / Doctorat en Sciences juridiques / info:eu-repo/semantics/nonPublished

The rise of social media has challenged the traditional notionof CRM and introduced a new paradigm, known as socialCRM. While there are many benefits and opportunitiesassociated with the integration of social data in CRMsystems, a majority of companies are failing their social CRMimplementation. Since social CRM is still considered to be ayoung phenomenon, knowledge regarding itsimplementation and functionalities is limited. The purpose ofthis study is to contribute to the current state of knowledgeregarding the factors which influence the practicalimplementation of social CRM. In order to capturestate-of-the-art knowledge on this topic, a literature reviewwas conducted. In addition, interviews with CRM expertsworking within five Swedish companies were included inorder to gain additional insights from practice. Findingsindicate that the key features needed for social CRMimplementation revolve around the real-time monitoring,collection, processing, storing and analyzing of social data.Advanced technical tools, such as Big Data Technology, aredeemed required in order to handle large volumes of dataand properly transform it into valuable knowledge. The mostsignificant challenges identified heavily revolve aroundlimited knowledge as well as various technical andorganizational limitations. Additionally, findings indicatethat a multitude of uncertainties of practitioners revolvearound data legislations and privacy concerns. Hence, whilesocial CRM can entail a multitude of benefits, there are asignificant number of challenges which seem to stand in theway of unlocking the full potential of social CRM. In orderfor social CRM implementation to be made more accessiblefor organizations in the future, there is a need for moreknowledge and clarity regarding factors such as technicalsolutions, organizational changes and legislations.

Hälsoområdet genomgår en omvälvning där såväl gränsen mellan den privata och offentliga sfären, som den mellan hälsoforskning och hälsomarknad håller på att suddas ut. I det nya hälsolandskapet, fyllt av nya aktörer, ny teknik och nya källor till information, är det avgörande med en enhetlig och fungerande dataskyddsreglering, som tar vara på både individuella och samhälleliga intressen. I denna uppsats läggs fokus på mötet mellan EU:s dataskyddsförordning (GDPR) och användningen av big data analys på hälsoområdet. Här visar sig flera rättsliga spänningspunkter. Dataskyddsprinciper, individuella dataskyddsrättigheter och binära kategoriseringar i förordningen framstår som svårförenliga med vidspridd dataanalys och affärsmodeller som bygger på möjligheten att återanvända och kombinera personuppgifter från olika källor. Detsamma kan sägas för GDPR:s fokus på individen, då den registrerades kontroll och självbestämmande över sina personuppgifter försvåras avsevärt i ett algoritmiskt och datadrivet samhälle. I syfte att balansera skyddet av personuppgifter med intresset för innovation, möjliggörs undantag till både dataskyddsprinciper och individuella dataskyddsrättigheter i GDPR när uppgifter behandlas i forskningssammanhang. Genom den särskilda forskningsordningen i GDPR ges på så sätt datadriven forskning ett större spelrum. Samtidigt kan forskningsundantaget komma att försvaga registrerades självständiga beslutanderätt och dataskydd, med följd att balansen mellan å ena sidan registrerades intressen och å andra sidan intressen hos personuppgiftsansvariga, väger tungt till de senares fördel. I GDPR ges utrymme för medlemsstater att införa ytterligare villkor och forskningsundantag i nationell rätt, vilket ökar risken för en fragmentering av EU-rättsliga forskningsrelaterade personuppgiftsfrågor. I längden riskerar detta att utgöra ett hinder för dataintensiv forskning och det fria flödet av personuppgifter i unionen. Den icke-bindande definitionen av vetenskaplig forskning i skäl 159 GDPR visar att begreppet ska tolkas brett men det kvarstår fortfarande oklarheter i omfattningen av den särskilda forskningsordningen. Att dra tydliga gränser i fråga om vilken personuppgiftsbehandling som bör få stödjas på forskningsundantaget försvåras ytterligare av utvecklingen på hälsoområdet, där gränsen mellan hälsoforskning och hälsomarknad blir allt suddigare. Fortsatta avgränsningar och förtydliganden från organ som EDPB och EDPS är därför avgörande för utvecklingen och bibehållandet av en harmoniserad forskningsdefinition.

Background. The right to privacy is every persons right, data regulation laws suchas the GDPR and privacy preserving concepts like Privacy by Design (PbD) aid inthis matter. IoT devices are highly vulnerable to attacks because of their limitedstorage and processing capabilities, even more so for internet connected cameras.With the use of security auditing techniques and privacy analysis methods it ispossible to identify security and privacy issues for Internet of Things (IoT) devices. Objectives. The research aims to evaluate three selected IoT cameras’ ability toprotect privacy of their consumers. As well as investigating the role GDPR and PbDhas in the design and operation of each device. Methods. A literature review was performed in order to gain valuable knowledgeof how to design a case study that would evaluate privacy issues of IoT devices incorrelation with GDPR and PbD. The case study consists of 14 cases designed toexplore security and privacy related issues. They were executed in a monitored andcontrolled network environment to detect data flow between devices. Results. There was a noticeable difference in the security and privacy enhancingtechnologies used between some manufactures. Furthermore, there was a distinctdisparity of how transparent each system was with the processed data, which is acrucial part of both GDPR and PbD. Conclusions. All three companies had taken GDPR and PbD into considerationin the design on the IoT systems, however to different extents. One of the IoTmanufactures could benefit from incorporating PbD more thoroughly into the designand operation of their product. Also the GDPR could benefit from having referencesto security standards and frameworks in order simplify the process for companies tosecure their systems.

The purpose of this study is to examine what reasons internet users have for accepting, declining, or adjusting cookie settings. The study’s research question is: what reasons do Internet users have for accepting, declining, or adjusting cookie settings? To answer the research question, we constructed three research support questions: 1) how do internet users access the internet?, 2) What are internet users’ perspectives on privacy on the internet?, 3) How do internet users interact with cookie consent notices? The study’s theoretical framework consists of informed consent, contextual integrity, nudging, and political economy. We conducted semi-structured interviews in order to get a deeper understanding of the internet users’ experiences with cookie consent notices. We analyzed the material through thematic coding. Due to the Covid19 pandemic, all interviews were conducted through Zoom. The sample consisted of eight media and communication students at Karlstad University. There were four key findings: 1) The interviewees in our study accessed the internet primarily via applications on their smartphones. 2) There were mixed opinions about who has the greatest responsibility for private citizens’ privacy on the internet. Although many thought that the individual bears most of the responsibility, a majority thought there is a need for more governmental regulation regarding collecting and processing private data. 3) All interviewees thought cookie consent notices are an excellent tool for protecting one’s privacy, but none of them adjusted the cookie settings regularly when prompted by cookie consent notices. 4) The reasons why the interviewees accept cookies without adjusting cookie settings varied. Habits and annoyance were key factors.  The current climate where notice and choice is the de facto privacy measure for internet users is not sustainable. In conclusion, legislators and policymakers should focus on regulating how personal data is processed rather than pushing the responsibility of safeguarding personal data onto the users.

Regarded as the biggest change in data protection law in a generation, the General Data Protection Regulation (or simply its more renowned name: the GDPR) is due to take effect on May 25th 2018. The purpose of the GDPR is to strengthen the protection of personal information, harmonize the data protection laws in the entire European Union, and modernize privacy laws to fit today’s technologically advanced society. As good as all organizations have to conform to the new law. Libraries, as prominent bearers of information and personal data, are thus no exception to the rule. This study’s objective is to gain knowledge of Swedish public libraries’ main GDPR preparations, regarding both the practical work and the difficulties they faced during the process. The result is based on the answers from an online survey, sent to every central library in Sweden’s 290 municipalities. 182 answers were received, which generated a response rate of roughly 63 percent. The theoretical analysis derives from five of John Kotter’s eight phases, concerning difficulties in early change management. The authors of this study identify the libraries’ focal points, in relation to the change work, as mainly consisting of inventory of personal data and education in the law. Difficulties are mostly found in understanding the law and how to practice it. Nonetheless, a majority of the Swedish central libraries consider themselves fairly ready for the GDPR when May 25th arrives.