The General Data Protection Regulation (GDPR) is a European Union
 law that came into force in May 2018 and aims to ensure the protection of EU
 citizens’ personal data. The GDPR sets out a number of obligations for organiza
tions processing personal data, including obtaining data subjects’ explicit consent
 to process their data, ensuring that data is only used for specific purposes and
 implementing appropriate security measures to protect data. The regulation also
 gives data subjects the right to request access to, correct or delete their personal
 data, as well as the right to object to the processing of their data and data porta
bility. The GDPR applies to all organizations that process personal data of EU
 citizens, regardless of their location, and has significant global reach, affecting
 businesses around the world that handle personal data of individuals in the EU.
 In this context, this study focused more specifically on the area covered by the
 Intermunicipal Community of Douro (CimDouro) in order to assess the state of
 implementation of the GDPR in Local Public Administration, particularly in the
 municipalities that constitute this Cim.info:eu-repo/semantics/publishedVersio

Lopes, Isabel Maria

Padrão, Pascoal

Ribeiro, Maria Isabel

English

Biblioteca Digital do IPB

Implementation of the General Regulationon Data Protection – In the IntermunicipalCommunity of Douro, PortugalPascoal Padrão1, Maria Isabel Ribeiro1,2 , and Isabel Lopes1,3,4(B)1 Instituto Politécnico de Bragança, Campus de Santa Apolónia, 5300-253 Bragança, Portugalpascoalpadrao@gmail.com, {xilote,isalopes}@ipb.pt2 Centro de Investigação de Montanha (CIMO), Laboratório Associado Para a SustentabilidadeE Tecnologia Em Regiões de Montanha (SusTEC), Instituto Politécnico de Bragança, Campusde Santa Apolónia, 5300-253 Bragança, Portugal3 UNIAG, Instituto Politécnico de Bragança, Campus de Santa Apolónia, 5300-253 Bragança,Portugal4 Algoritmi, Universidade do Minho, Largo do Paço, 4704-553 Braga, PortugalAbstract. The General Data Protection Regulation (GDPR) is a European Unionlaw that came into force in May 2018 and aims to ensure the protection of EUcitizens’ personal data. The GDPR sets out a number of obligations for organiza-tions processing personal data, including obtaining data subjects’ explicit consentto process their data, ensuring that data is only used for specific purposes andimplementing appropriate security measures to protect data. The regulation alsogives data subjects the right to request access to, correct or delete their personaldata, as well as the right to object to the processing of their data and data porta-bility. The GDPR applies to all organizations that process personal data of EUcitizens, regardless of their location, and has significant global reach, affectingbusinesses around the world that handle personal data of individuals in the EU.In this context, this study focused more specifically on the area covered by theIntermunicipal Community of Douro (CimDouro) in order to assess the state ofimplementation of the GDPR in Local Public Administration, particularly in themunicipalities that constitute this Cim.Keywords: General Regulation on Data Protection · Municipalities · DataProtection Officer · Information systems · Safety1 IntroductionThe General Data Protection Regulation (GDPR) as previously mentioned, applies toall organizations, including Portuguese municipalities. As municipalities process a largeamount of personal data, including information about public services, voters and munic-ipal employees, it is important that they follow the rules of the GDPR to ensure dataprivacy and security.Portuguese municipalities must comply with the provisions of the GDPR, whichinclude obtaining data subjects’ consent to process their personal information, ensuring© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024C. Montenegro et al. (Eds.): ICMTT 2023, LNNS 773, pp. 360–367, 2024.https://doi.org/10.1007/978-3-031-44131-8_35Implementation of the General Regulation on Data Protection 361data accuracy, protecting data, and notifying authorities and data subjects in case of adata breach.To ensure compliance with the GDPR, Portuguese municipalities must appoint a dataprotection officer, conduct data protection impact assessments, establish data protectionpolicies and provide regular training for employees handling personal data.Municipalities must also ensure that their data protection policies comply with EUand Portuguese data protection laws and regulations. Failure to comply with the GDPRcan result in significant fines, so it is important that municipalities are aware of theirobligations and strictly comply with them.Thus our study focuses on Portuguese municipalities, although to avoid the studybecoming excessively long, we have chosen to limit our analysis to the nineteenmunicipalities that make up the CIMDouro, rather than covering all 308 Portuguesemunicipalities. However, our aim is to eventually study all CIM’s to achieve a wideruniverse.The current work follows a structure composed of an introduction, a documentaryreview on the General Data Protection Regulation and its implementation, on the otherhand, we explain the basic precautions that Information Systems Professionals shouldtake into account when implementing the GDPR, a section dedicated to the researchmethodology, in which the target population and the structure of the questionnaire areidentified. The results of the research are discussed in Sect. 5, followed by the conclusionsthat were drawn. Finally, we identify the limitations of this research study and suggestpossible topics for future research.2 General Regulation on Data ProtectionDirective 95/46/EC, (1995) of the European Parliament and of the Council of 24 Octoberwas repealed with the entry into force of Regulation (EU) 2016/679, (2016a) on 27 Aprilby the European Parliament (2016) on the protection of natural persons with regard tothe processing of personal data and on the free movement of such data being mirroredin Art:1. This Regulation lays down the rules relating to the protection of individuals withregard to the processing of personal data and on the free movement of such data.2. This Regulation protects the fundamental rights and freedoms of natural persons andin particular their right to the protection of personal data.3. The free movement of personal data within the Union shall neither be restricted norprohibited for reasons connected with the protection of natural persons with regardto the processing of personal data” [1].Thus the GDPR brings several important innovations compared to previous dataprotection laws, Thus, data protection in Europe in this new digital age must complywith:– Data processing subject to consent;– Restricted use of automated data processing for decision-making, such as “profiling”;– Right to rectify and delete data, including the. “right to be forgotten” for data collectedduring childhood;362 P. M. I. Ribeiro and I. Lopes– Right to notification of compromised data;– More and better information on data processing;– Right to transfer data from one service provider to another;– Easier access to personal data;– Stronger safeguards on the transfer of personal data outside the EU [2].On the other hand as an Information Systems Professional, there are several basic pre-cautions you should take into account when implementing the General Data ProtectionRegulation (GDPR). Here are some important steps you can follow:1. understand the requirements of the GDPR: The first step is to understand the require-ments of the GDPR and how they apply to your organisation. Read the regulationcarefully and make sure you understand your obligations and responsibilities.2. Conduct a data audit: Identify all the personal data your organisation collects, pro-cesses and stores. Document what data, where it is located and how it is being used.This will help identify areas where changes may need to be made to comply with theGDPR.3. Obtain consent: Make sure you obtain valid, informed consent from individuals beforecollecting and processing their personal data. This means providing clear and conciseinformation about how their data will be used and giving them the opportunity to optout if they wish.4. Implement appropriate security measures: Ensure that appropriate security measuresare in place to protect personal data from unauthorized access, disclosure or loss.This includes implementing organizational measures and techniques, such as accesscontrols, encryption and regular security assessments.5. Respond to data subject requests: The GDPR gives individuals the right to access,rectify and delete their personal data. You should have procedures in place to respondto these requests and provide individuals with the information they need.6. Undertake regular training: Train all staff who handle personal data about the GDPRand their responsibilities. This will help ensure that everyone in your organizationunderstands their obligations and can help protect personal data.7. Keep up to date with changes: Finally, keep up to date with changes to the RGPDand any relevant guidance from data protection authorities. This will help ensure thatyour organization remains compliant with the latest requirements.3 Research MethodologyIt is important that the Public Administration is aware of the need to implement theGDPR in its entirety. To ensure the security and protection of personal data, the PublicAdministration must comply with technical and organizational measures to protect thatdata. It is possible to outsource an external organization to assist in this process, but itis important that it complies with the standards set out in the GDPR [3].Given the nature of the problem under analysis and since no generalizations of resultsare sought, an approach of an interpretative and exploratory nature was chosen by takingby design, the case study. The purpose of this strategy is the understanding of the studyof a specific case and not that of other similar cases or to formulate generalizations.Implementation of the General Regulation on Data Protection 363Thus “almost anything can be a “case” - an individual, a character, a small group,an organization, a community - where the aim is to understand “the case as a wholeand in its uniqueness” [3], on the other hand, “a case study is an empirical enquiry thatinvestigates a phenomenon (the ‘case’) in depth and within its real-world context” [4].Thus, given that our study does not aim to understand other cases, but its own case,we reinforce that the objectives of this research are in line with the objectives guidingcase studies, namely: to explore, describe, explain, evaluate and/or transform [5].In order to meet the objectives, set out in this study, we then use a mixed analysismethodology that integrates quantitative and qualitative analysis. The sample will becomposed of all the municipalities belonging to CimDouro.While conducting the study, we used two instruments to collect data: a question-naire and document review. The questionnaire aimed to provide an overview of themunicipalities in relation to the RGPD, allowing to obtain a more comprehensive andcontextualized picture of their reality.The questionnaire was available between 1 August 2022 and 30 September 2022,totaling a period of two months. Fifteen responses were obtained, which represents aresponse rate of approximately 78.94%.4 ResultsSince the GDPR came into force, there has been a significant effort by businesses andorganizations to adapt to the new rules and requirements of the GDPR. Many organiza-tions have reviewed and updated their data privacy and security policies and proceduresto ensure they are compliant with the GDPRRegarding the study of the implementation of the RGPD in Public Administration,the results may vary depending on the context of each municipality and its adaptation tothe requirements of the RGPD. However, it is essential that the Public Administrationis in compliance with the regulation to ensure the protection of citizens’ personal dataand avoid possible fines or sanctions.The municipalities surveyed in the CIM-Douro, out of the total of 19 municipalities,4 did not respond, 10 have not yet implemented the RGPD and only 5 have proceededto its implementation, which corresponds to only 26% (see Fig. 1).In this question, the same five answers were obtained, of which 5% of the muni-cipalities answered that they used external entities, 21% of the municipalities wereresponsible for the implementation themselves (see Fig. 2).As for the question of how long ago the regulation was implemented, in the formula-tion of the question, the answer was immediately defined in three time periods, in whichits beginning corresponds to the entry into force of the RGPD.From the resulting analysis of the graph, we can see that 16% of the municipalitiesimplemented the RGPD in the period between 2020 and 2021, 11% of which in theperiod between 2018 and 2019. One of the municipalities did not provide any response(see Fig. 3).The following three graphs focus on the municipalities that have not yet implementedthe RGPD, so in CIM-Douro it is the majority. The implementation of the RGPD has beena legal imperative since 25 May 2018, both in the private and public sector, so it should364 P. M. I. Ribeiro and I. LopesFig. 1. Implementation of the RGPDFig. 2. Who implemented it?already be implemented in all municipalities, in the case under study we found that ofall the municipalities that answered the questionnaire and have not yet implemented theRGPD all of them are aware of it, as evidenced by the Fig. 4.Of the municipalities that have not yet implemented the RGPD half of them are inthe process of implementation as we can see in Fig. 5, a frankly deficient result.Implementation of the General Regulation on Data Protection 365Fig. 3. How long ago have you adopted the measures contained in the RGPD?Fig. 4. Are you aware of the GDPR?Finally, and in order to confirm their awareness of the implications of not imple-menting the RGPD, all respondents are fully aware of the penalties they incur, as shownin Fig. 6.366 P. M. I. Ribeiro and I. LopesFig. 5. Is it in the process of implementation?Fig. 6. Are you aware of the fines applied for non-compliance with the GDPR?Implementation of the General Regulation on Data Protection 3675 ConclusionsIt is important that the Public Administration is aware of the need to implement theGDPR in its entirety. To ensure the security and protection of personal data, the PublicAdministration must comply with technical and organizational measures to protect thatdata. It is possible to outsource an external organization to assist in this process, but itis important that it complies with the standards set out in the GDPR [1].The vast majority of personal data processed by Local Public Administration is nec-essary to carry out its functions in relation to citizens. This enables objective decision-making and the determination of necessary measures adapted to the context. However,the implementation of RGPD requires effort and adaptation on the part of Municipal-ities, and it is the responsibility of the Public Administration to help and assist LocalAdministration in this process [6].RGPD has brought greater legal uniformity and new rights for the data subject,such as the right to forget and portability. We conclude that most of the CIM-Douromunicipalities have not yet implemented the RGPD, although there are still some thathave already done so.With regard to the limitations of this study, it is important to mention the limitednumber of questionnaires conducted, as well as the intrinsic limitations of the instrumentsused and the possibility of there being subjectivity in data interpretation.In short, it is important that the public administration continues to raise awarenessabout the need to implement the GDPR in its entirety and comply with its legal obligationsto protect citizens’ personal data.Acknowledgements. The authors are grateful to the Foundation for Science and Technology(FCT, Portugal) for financial support through national funds FCT/MCTES (PIDDAC) to CIMO(UIDB/00690/2020 and UIDP/00690/2020) and SusTEC (LA/P/0007/2020).The authors are grateful to the UNIAG, R&D unit funded by the FCT— Portuguese Foundationfor the Development of Science and Technology, Ministry of Science, Technology and HigherEducation. “Project Code Reference: UIDB/04752/2020 e UIDP/04752/2020”.References1. Regulamento (UE) 2016/679, Jornal Oficial das Comunidades Europeias 1 (2016). https://eur-lex.europa.eu/legal-content/PT/TXT/PDF/?uri=CELEX:32016R06792. Conselho Europeu. Proteção de dados na UE (2022). https://www.consilium.europa.eu/pt/infographics/data-protection-regulation-infographics/3. Coutinho, C.P., Chaves, J.H.: O estudo de caso na investigação em Tecnologia Educativa emPortugal. Rev. Portuguesa de Educação 15(1), 221–243 (2002)4. Yin, R.K.: Case Study Research: Design and Methods (5th ed.). Sage (2014)5. Stake, R.: The Art of Case Study Research. Sage Publications (1995)6. Lambelho, A., Mendes, J.B.: O RGPD e o impacto nas organizações: 6 meses depois. Atas(IPL, Ed.; pp. 1–154). X Congresso Internacional de Ciências Jur́dico-Empresariais (2019).www.cicje.ipleiria.pt

Implementation of the general regulation  on data protection– In the intermunicipal  community of Douro, Portugal

https://bibliotecadigital.ipb.pt/bitstream/10198/29143/1/Management%2c%20Tourism%20and%20Smart%20Technologies%20-%20Proceedings%20ICMTT%2723%20-%20Vol%201.pdf

Implementation of the general regulation on data protection– In the intermunicipal community of Douro, Portugal

Abstract

Similar works

Full text

Available Versions

Biblioteca Digital do IPB