## 2 Background
### Legislation  
Dozens of countries in the world already have specific legislation for data protection. In May 2018, the GDPR (General Data Protection Regulation), a data protection law approved since 2016 [16], became applicable in the European Union (EU). In the United States, data protection takes place through a set of federal and state laws, making the handling of data privacy issues vary from state to state. The European Parliament adopted the GDPR in April 2016. The law is an evolution of the 1995 European Directive (Directive 95/46/EC) and came into force after a transitional period of two years, on 25 May 2018 [16]. The law applies not only to organizations located within the EU but also to all companies which process and hold the personal data of data holders residing in the EU irrespective of the location of the company. Organizations can befined up to 4% of their annual global turnover for violating GDPR, and the fine can be up to 20 million euros. This fine is the maximum penalty that can be imposed for more serious infringements, such as not having sufficient consent of a customer to process his/her data. The new European law reinforced the conditions of consent. The request for consent must be filled out in an intelligible and easily accessible form, and the purpose of processing the personal data of a client must be attached to that request. Consent should be explicit and distinguishable from other subjects, using language that is easy to understand. Moreover, it should also be easy for the client to withdraw their consent at any time. Explicit consent is required for the processing of confidential personal data. The client must register his/her option for the consent of the use of his/her data. However, for non-sensitive data, \"unambiguous\" consent is sufficient. In other words, the provision of data is enough to be considered that the consent is implied, even whether the client does not register the consent option explicitly. An example of \"unambiguous\" consent is providing an email address for receiving news from a website. GDPR provides some exceptions to the need for consent to personal data, such as in matters relating to national security, defense, and public safety [17]. In addition to these exceptions, we should highlight the provision in the law of excluding the need for consent in cases involving the prevention, investigation, detection or prosecution of criminal offenses, or the execution of criminal sanctions aimed at safeguarding against threats to public security and prevention. Unlike the EU, the United States follows a sector-wide approach to data privacy protection. There is no comprehensive federal law that guarantees the privacy and protection of personal data. Instead, legislation at the federal level primarily protects data within industry-specific contexts. Personal data protection in the country depends on federal and state laws, administrative regulations, and specific self-regulatory guidelines. The privacy protection guarantees are specific for each state and are located in a wide range of legislative instruments and jurisprudence [18]. Many statewide laws regulate the collection and use of personal data in the United States, and the number grows each year. On 28 March 2018, all 50 states and the District of Columbia, Puerto Rico, and the US Virgin Islands enacted laws requiring notification of security breaches involving personal information. As technological threats evolve, US legislation is progressing, and soon it is likely to establish more comprehensive legislation at the federal level, such as the European GDPR. In one case in the state of Virginia, USA, a citizen contested the collection of his data at the LPR system of the Fairfax County Police Department (FCPD) [19]. The claim was based on a state privacy law called the \"Government Data Collection and Dissemination Act\", which states that personal information \"will not be collected\" by state agencies \"unless the need has been clearly established in advance\".