Big Data and Law

Maria Cristina Caldarola is assistant lecturer of the Master Program Business Innovation at the University St Gallen. Joachim Schrey is an honorary professor at the University of Frankfurt/Main and was a member of the advisory board of DC Data Centre Group GmbH.

• A. Introductory remarks I. Why Big DataII. Why must a party not established in the EU comply with GDPR with respect to Big Data applications? III. Which data are affected? IV. What are the differences between the data types?V. Which verification steps need to be considered for a Big Data application?B. Types of data I. Personal data II. Non-personal dataIII. Databases and collections IV. Protection as business or trade secretV. Householder’s right with regard to the collection of factual data VI. Virtual householder’s rightVII. Factual data linked to IP addresses or other identifying characteristics VIII. No data ownershipC. The controller I. Processor II. Joint controllers, Art. 26 GDPRIII. Dynamic matrix structuresIV. Cloud computingD. Specific requirements and tasks of the data protection officer with regard to Big Data applications I. Specialist knowledge II. Organizational and operational involvement of the data protection officer III. Communication with data subjectsIV. Information and monitoring obligations V. Cooperation and control obligations VI. Internal procedure in the event of a data protection violation E. Lawful ground for data processing (collection, acquisition, transmission, evaluation and commercialization)I. Statutory lawful grounds for personal dataII. Processing of non-personal factual data F. Data processing and data cycle (level of data purpose)I. Data processingII. Life cycle of dataIII. Collection of personal data for purposes other than their use in Big Data applications – a change of purposeG. Third country transfer/Applicable law (Level of applicable law)H. Development of a Big Data application I. Collection of data II. Obtaining and acquiring data from data service providersIII. Combination of dataIV. Extending the range: anonymization/pseudonymization of data stored in a Big Data databaseV. Transmission of data from several controllers to a central Big Data applicationVI. Evaluation and analysis of dataVII. Continuation of personal reference even after evaluation and analysis of data I. Erasure obligations I. Development of an erasure conceptII. Implementation of a data erasure conceptIII. Necessary elements of a data erasure concept? IV. Start times of retention and erasure obligations V. Assignment of data types to erasure classesVI. Resolution of conflicts when using one data type in different databasesVII. What does “erasure” of data mean in contrast to its “blocking”, “masking”, “pseudonymization” or “anonymizationVIII. Obligation to erase personal data regarding a data subjectIX. Erasure obligations towards licensors, data suppliers etc. independent of the data content X. Uniform erasure period for all documents and data XI. Erasure obligations for cross-border data processing XII. Storage locations and erasure obligationsJ. Relevant rights of data subjects in Big Data applications according to the GDPR I. Information obligations according to Art. 13, 14 GDPRII. Rights of data subjects pursuant to Art. 15 et seq. GDPRIII. Records of processing activities according to Art. 30 GDPRIV. Implementation of technical and organizational measures to protect personal data from unauthorized access V. General principles for the processing of personal data in Art. 5 GDPRK. Data protection impact assessmentL. System data protection when operating Big Data applications I. System data protection for personal data II. System data protection for non-personal data only in a Big Data Application M. Protection of Big Data applicationsI. Technical and organizational measures II. Protection of the algorithms underlying the Big Data applicationIII. Compliance management system IV. Aspects of copyright contract law in the database management system N. Legal consequences of non-compliance with the legal requirements set out in this guide I. Sanctions in case of violation of data protection regulations II. Legal consequences of infringement of copyrights in collective works or database protection rights III. Violation of virtual householder’s rights IV. Sanctions for infringing business or trade secrets pursuant to the German Trade Secrets ActV. Contractual claims O. Big Data Applications as a service P. Recommended Actions