natgillin/translations-raw huggingface dataset:
Der er yderligere oplysninger om den amerikanske lovgivning om beskyttelse af personoplysninger på forbunds- og delstatsniveau i bilag A og en sammenfatning af vores nylige håndhævelsessager til beskyttelse af privatlivets fred og datasikkerheden på FTC's websted på adressen: https://www.ftc.gov/reports/privacy-data-security-update-2015.
If the FTC concludes that it has reason to believe Section 5 has been violated, it may resolve the matter by seeking an administrative cease and desist order prohibiting the challenged practices or by filing a complaint in a federal district court, which if successful could result in a federal court order to same effect.
Se FTC Policy Statement on Deception, knyttet som bilag til Cliffdale Assocs., Inc., 103 F.T.C.
This includes false claims of adherence to the Privacy Shield Principles or participation in the Privacy Shield by organizations, which either are no longer on the Privacy Shield List or have never self-certified to the Department.
110, 174 (1984), tilgængelig på adressen: https://www.ftc.gov/public-statements/1983/10/ftc-policy-statement-deception.
The FTC may obtain civil penalties for violations of an administrative cease and desist order and may pursue civil or criminal contempt for violation of a federal court order.
Se 15 U.S.C § 45(n), FTC Policy Statement on Unfairness, knyttet som bilag til Int'l Harvester Co., 104 F.T.C.
The FTC will notify the Department of any such actions it takes.
949, 1070 (1984), tilgængelig på adressen: https://www.ftc.gov/public-statements/1980/12/ftc-policy-statement-unfairness.
The Department encourages other government bodies to notify it of the final disposition of any such referrals or other rulings determining adherence to the Privacy Shield Principles.
Se California Dental Ass'n v. FTC, 526 U.S.
g.
Se Office of the Privacy Commissioner of Canada, Complaint under PIPEDA against Accusearch, Inc., doing business as Abika.com, https://www.priv.gc.ca/cf-dc/2009/2009_009_0731_e.asp.
Persistent Failure to Comply
Office of the Privacy Commissioner of Canada indgav et amicus curiae-indlæg i forbindelse med appellen af FTC-sagen og foretog sin egen undersøgelse, hvor konklusionen var, at Accusearchs praksis ligeledes var en overtrædelse af canadisk ret.
i.
Se FTC v. Accusearch, Inc., No. 06CV015D (D. Wyo.
If an organization persistently fails to comply with the Principles, it is no longer entitled to benefit from the Privacy Shield.
Dec. 20, 2007), aff'd 570 F.3d 1187 (10th Cir.
Organizations that have persistently failed to comply with the Principles will be removed from the Privacy Shield List by the Department and must return or delete the personal information they received under the Privacy Shield.
2009).
Persistent failure to comply arises where an organization that has self-certified to the Department refuses to comply with a final determination by any privacy self-regulatory, independent dispute resolution, or government body, or where such a body determines that an organization frequently fails to comply with the Principles to the point where its claim to comply is no longer credible.
Se In the Matter of True Ultimate Standards Everywhere, Inc., No. C-4512 (F.T.C. Mar. 12, 2015) (afgørelse og kendelse), tilgængelig på adressen: https://www ftc.gov/system/files/documents/cases/150318trust-edo.pdf.
In these cases, the organization must promptly notify the Department of such facts.
Se In the Matter of Google, Inc., No. C-4336 (F.T.C. Oct.
Failure to do so may be actionable under the False Statements Act (18 U.S.C. § 1001).
13 2011) (afgørelse og kendelse), tilgængelig på adressen: https://www ftc.gov/news-events/press-releases/2011/03/ftc-charges-deceptive-privacy-practices-googles-rollout-its-buzz, In the Matter of Facebook, Inc., No. C-4365 (F.T.C. July 27, 2012) (afgørelse og kendelse), tilgængelig på adressen: https://www ftc.gov/news-events/press-releases/2012/08/ftc-approves-final-settlement-facebook, In the Matter of Myspace LLC, No. C-4369 (F.T.C. Aug. 30, 2012) (afgørelse og kendelse), tilgængelig på adressen: https://www.ftc.gov/news-events/press-releases/2012/09/ftc-finalizes-privacy-settlement-myspace.
An organization's withdrawal from a private-sector privacy self-regulatory program or independent dispute resolution mechanism does not relieve it of its obligation to comply with the Principles and would constitute a persistent failure to comply.
Se FTC v. Karnani, No. 2:09-cv-05276 (C.D. Cal.
The Department will remove an organization from the Privacy Shield List in response to any notification it receives of persistent failure to comply, whether it is received from the organization itself, from a privacy self-regulatory body or another independent dispute resolution body, or from a government body, but only after first providing 30 days' notice and an opportunity to respond to the organization that has failed to comply.
May 20, 2011) (endelig kendelse — stipulated final order), tilgængelig på adressen: https://www ftc.gov/sites/default/files/documents/cases/2011/06/110609karnanistip.pdf, se også Lesley Fair, FTC Business Center Blog, Around the World in Shady Ways, http://www.business.ftc.gov/blog/2011/06/around-world-shady-ways (June 9, 2011).
Accordingly, the Privacy Shield List maintained by the Department will make clear which organizations are assured and which organizations are no longer assured of Privacy Shield benefits.
Brev fra Ken Hyatt, fungerende viceminister for international handel, International Trade Administration, til Věra Jourová, kommissær for retlige anliggender, forbrugere og ligestilling mellem mænd og kvinder.
An organization applying to participate in a self-regulatory body for the purposes of requalifying for the Privacy Shield must provide that body with full information about its prior participation in the Privacy Shield.
Denne bemyndigelse omfatter ikke håndhævelse af konkurrenceregler.
Choice — Timing of Opt Out
Selv om FTC ikke behandler eller mægler i sager om individuelle forbrugerklager, bekræfter FTC, at handelskommissionen vil prioritere henviste sager under værnet om privatlivets fred fra EU's databeskyttelsesmyndigheder.
a.
FTC anvender desuden klager i sin Consumer Sentinel-database, som mange andre retshåndhævende organer har adgang til, til at kortlægge tendenser, fastlægge prioriteter for håndhævelsen og identificere potentielle foretagender, der skal undersøges.
Generally, the purpose of the Choice Principle is to ensure that personal information is used and disclosed in ways that are consistent with the individual's expectations and choices.
Privatpersoner i EU kan anvende det samme klagesystem som amerikanske statsborgere til indgivelse af en klage til FTC, og det er tilgængeligt på adressen: www.ftc.gov/complaint.
Accordingly, an individual should be able to exercise ‘opt out’ choice of having personal information used for direct marketing at any time subject to reasonable limits established by the organization, such as giving the organization time to make the opt out effective.
I forbindelse med individuelle klager over krænkelser af privatlivets fred kan det imidlertid være mest hensigtsmæssigt, hvis privatpersoner i EU indgiver deres klager til databeskyttelsesmyndigheden i deres respektive medlemsstater eller til en alternativ tvistbilæggelsesinstans.
An organization may also require sufficient information to confirm the identity of the individual requesting the ‘opt out’.
Se FTC, Business Center, Legal Resources, https://www.ftc.gov/tips-advice/business-center/legal-resources?type=case&field-consumer-protection-topics-tid=251.
In the United States, individuals may be able to exercise this option through the use of a central ‘opt out’ program such as the Direct Marketing Association's Mail Preference Service.
Tillæg A
Organizations that participate in the Direct Marketing Association's Mail Preference Service should promote its availability to consumers who do not wish to receive commercial information.
Konteksten for ordningen for EU's og USA's værn om privatlivets fred: et overblik over rammerne for EU's og USA's værn om privatlivets fred
In any event, an individual should be given a readily available and affordable mechanism to exercise this option.
Den beskyttelse, der opnås ved hjælp af EU's og USA's værn om privatlivets fred (»ordningen«), indebærer en del af den bredere beskyttelse af privatlivets fred, som ydes af det amerikanske retsvæsen som helhed.
b.
For det første har USA's føderale handelskommission Federal Trade Commission (»FTC«) i forbindelse med amerikansk handelspraksis et robust program for privatlivets fred og datasikkerhed, som beskytter forbrugere i hele verden.
Similarly, an organization may use information for certain direct marketing purposes when it is impracticable to provide the individual with an opportunity to opt out before using the information, if the organization promptly gives the individual such opportunity at the same time (and upon request at any time) to decline (at no cost to the individual) to receive any further direct marketing communications and the organization complies with the individual's wishes.
For det andet har rammerne for beskyttelsen af forbrugernes privatliv og sikkerhed i USA udviklet sig i væsentlig grad siden 2000, da det oprindelige safe harbor-program mellem USA og EU blev vedtaget.
Travel Information
Siden da er der på forbunds- og delstatsniveau blevet vedtaget mange love om beskyttelse af privatlivets fred og sikkerhed, og antallet af offentlige og private søgsmål, der er anlagt med hensyn til beskyttelse af privatlivet, er steget betydeligt.
a.
Den omfattende amerikanske retsbeskyttelse af forbrugernes privatliv og sikkerhed i forbindelse med kommerciel datapraksis supplerer den beskyttelse, der ydes privatpersoner i EU inden for rammerne af den nye ordning.
Airline passenger reservation and other travel information, such as frequent flyer or hotel reservation information and special handling needs, such as meals to meet religious requirements or physical assistance, may be transferred to organizations located outside the EU in several different circumstances.
I. FTC'S OVERORDNEDE HÅNDHÆVELSESPROGRAM FOR BESKYTTELSE AF PRIVATLIVETS FRED OG SIKKERHED
Under Article 26 of the Directive, personal data may be transferred ‘to a third country which does not ensure an adequate level of protection within the meaning of Article 25(2)’ on the condition that it (i) is necessary to provide the services requested by the consumer or to fulfill the terms of an agreement, such as a ‘frequent flyer’ agreement; or (ii) has been unambiguously consented to by the consumer.
FTC er USA's førende forbrugerbeskyttelsesagentur med fokus på beskyttelse af privatlivets fred i erhvervssektoren.
U.S. organizations subscribing to the Privacy Shield provide adequate protection for personal data and may therefore receive data transfers from the EU without meeting these conditions or other conditions set out in Article 26 of the Directive.
FTC har beføjelse til at skride ind over for illoyal og vildledende adfærd eller praksis, der krænker forbrugernes privatliv, samt til at håndhæve mere målrettede love om privatlivets fred, der har til formål at beskytte visse finansielle og sundhedsmæssige oplysninger, oplysninger om børn og oplysninger, som anvendes til at træffe visse afgørelser om klassificering af forbrugerne.
Since the Privacy Shield includes specific rules for sensitive information, such information (which may need to be collected, for example, in connection with customers' needs for physical assistance) may be included in transfers to Privacy Shield participants.
FTC's erfaring er uden lige, når det gælder om at håndhæve beskyttelsen af forbrugernes privatliv.
In all cases, however, the organization transferring the information has to respect the law in the EU Member State in which it is operating, which may, inter alia, impose special conditions for the handling of sensitive data.
Med FTC's håndhævelsesforstaltninger er der blevet taget hånd om ulovlig praksis inden for offline- og onlinemiljøer.
Pharmaceutical and Medical Products
FTC har f.eks. indledt håndhævelsessager mod kendte virksomheder som f.eks. Google, Facebook, Twitter, Microsoft, Wyndham, Oracle, HTC og Snapchat samt mod mindre kendte virksomheder.
a.
FTC har anlagt sag mod virksomheder, som angiveligt havde spammet forbrugere, installeret spyware på computere, undladt at sikre forbrugeres personoplysninger, sporet forbrugere online på ulovlig vis, krænket børns privatliv, ulovligt indsamlet oplysninger på forbrugeres mobilenheder og undladt at sikre internetforbundne enheder, der anvendes til at lagre personoplysninger.
Application of EU Member State Laws or the Privacy Shield Principles
De afgørelser, der er truffet i disse sager, har typisk medført løbende overvågning af FTC for en periode på 20 år, forhindret yderligere lovovertrædelser og pålagt virksomheder betydelige finansielle sanktioner for ikke at have efterkommet afgørelsen [1].
EU Member State law applies to the collection of the personal data and to any processing that takes place prior to the transfer to the United States.
Det skal understreges, at FTC's afgørelser ikke kun beskytter de personer, der kan have klaget over et problem.
The Privacy Shield Principles apply to the data once they have been transferred to the United States.
De beskytter snarere alle forbrugere, der fremover vil have med virksomheden at gøre.
Data used for pharmaceutical research and other purposes should be anonymized when appropriate.
Uden for USA's grænser har FTC beføjelse til at beskytte forbrugere i hele verden mod praksis, der foregår i USA [2].FTC har indtil videre anlagt over 130 spam- og spywaresager, over 120 »Do Not Call«-telemarketingsager, over 100 sager i forbindelse med Fair Credit Reporting Act, næsten 60 datasikkerhedssager, mere end 50 generelle sager om privatlivets fred, næsten 30 sager om overtrædelse af Gramm-Leach-Bliley Act og over 20 sager om håndhævelse af Children's Online Privacy Protection Act (»COPPA«) [3].
b.
Ud over disse sager har FTC også udstedt og offentliggjort varslingsskrivelser [4].FTC har som vigtig håndhævelsesmyndighed for så vidt angår beskyttelse af privatlivets fred gennem tiden også regelmæssigt undersøgt eventuelle overtrædelser af safe harbor-programmet.
Future Scientific Research
Siden safe harbor-programmets vedtagelse har FTC på eget initiativ iværksat adskillige undersøgelser om overholdelsen af safe harbor-programmet, hvilket har ført til 39 sager mod amerikanske virksomheder, der havde overtrådt programmet.
i.
FTC vil fortsætte sin proaktive strategi ved at prioritere håndhævelsen af den nye ordning højt.
Personal data developed in specific medical or pharmaceutical research studies often play a valuable role in future scientific research.
BESKYTTELSE AF FORBRUGERNES PRIVATLIV PÅ FORBUNDS- OG DELSTATSNIVEAU
Where personal data collected for one research study are transferred to a U.S. organization in the Privacy Shield, the organization may use the data for a new scientific research activity if appropriate notice and choice have been provided in the first instance.
Oversigten over håndhævelsen af safe harbor-principperne, der findes som bilag til Europa-Kommissionens beslutning om tilstrækkeligheden af safe harbor-principperne, indeholder en sammenfatning af de mange love om privatlivets fred på forbunds- og delstatsniveau, der var gældende på tidspunktet for safe harbor-programmets vedtagelse i 2000 [5].
Such notice should provide information about any future specific uses of the data, such as periodic follow-up, related studies, or marketing.
Siden 2000 er der sket meget på både forbunds- og delstatsniveau, hvilket har medført yderligere beskyttelse af forbrugernes privatliv [6].
It is understood that not all future uses of the data can be specified, since a new research use could arise from new insights on the original data, new medical discoveries and advances, and public health and regulatory developments.
FTC udstedte også to regler for gennemførelse af Gramm-Leach-Bliley Act, nemlig Privacy Rule og Safeguards Rule, som pålægger finansielle institutioner [7] at offentliggøre deres praksis for deling af oplysninger og gennemføre et omfattende informationssikkerhedsprogram for at beskytte forbrugeroplysninger [8].
If the use is not consistent with the general research purpose(s) for which the personal data were originally collected, or to which the individual has consented subsequently, new consent must be obtained.
Tilsvarende supplerer Fair and Accurate Credit Transactions Act ( »FACTA«), der blev vedtaget i 2003, den mangeårige amerikanske lovgivning på kreditområdet med det formål at fastsætte kriterier for maskering, deling og sletning af visse følsomme finansielle oplysninger.
c.
Derudover blev de regler, der blev genneført som led i Health Insurance Portability and Accountability Act, taget op til fornyet revision i 2013, hvilket medførte yderligere beskyttelse af privatlivets fred og sikkerheden af sundhedsrelaterede personoplysninger [10].
Participants may decide or be asked to withdraw from a clinical trial at any time.
Regler vedrørende beskyttelse af forbrugere mod uønskede telemarketingsopkald, automatiske opkald (robocalls) og spam er også trådt i kraft.
Any personal data collected previous to withdrawal may still be processed along with other data collected as part of the clinical trial, however, if this was made clear to the participant in the notice at the time he or she agreed to participate.
Siden 2000 har 47 delstater, District of Columbia, Guam, Puerto Rico og De Amerikanske Jomfruøer vedtaget love, der pålægger virksomheder at underrette personer om brud på sikkerheden af personoplysninger [12].
d.
Mindst 32 delstater samt Puerto Rico har indført love om sletning af oplysninger, hvori der fastsættes krav om fjernelse eller sletning af personoplysninger [13].
Transfers for Regulatory and Supervision Purposes
En række delstater har også vedtaget overordnede love om datasikkerhed.
Pharmaceutical and medical device companies are allowed to provide personal data from clinical trials conducted in the EU to regulators in the United States for regulatory and supervision purposes.
I 2015 gik TARGET f.eks. med til at betale 10 mio. USD som led i et forlig med kunder, der hævdede, at deres personlige finansielle oplysninger var blevet bragt i fare som følge af et omfattende brud på datasikkerheden.
Similar transfers are allowed to parties other than regulators, such as company locations and other researchers, consistent with the Principles of Notice and Choice.
I 2013 indvilligede AOL i at betale 5 mio. USD som led i et forlig med henblik på at bilægge et kollektivt søgsmål med påstand om utilstrækkelig anonymisering i forbindelse med udgivelsen af hundrede tusinde AOL-medlemmers søgninger.
e.
Herudover afgjorde en forbundsdomstol, at Netflix skulle betale 9 mio. USD for angiveligt at have opbevaret udlejningsoplysninger i strid med Video Privacy Protection Act fra 1988.
‘Blinded’ Studies
Forbundsdomstole i Californien godkendte to forskellige forlig med Facebook, et forlig, der gik ud på betaling af 20 mio. USD, og et andet på 9,5 mio. USD, der vedrørte virksomhedens indsamling, anvendelse og deling af brugernes personoplysninger.
i.
I 2008 godkendte en delstatsdomstol i Californien et forlig, der indebar, at LensCrafters skulle betale 20 mio. USD efter at have videreformidlet forbrugernes medicinske oplysninger på ulovlig vis.
To ensure objectivity in many clinical trials, participants, and often investigators as well, cannot be given access to information about which treatment each participant may be receiving.
Kort sagt yder USA betydelig retsbeskyttelse for så vidt angår forbrugernes privatliv og sikkerhed, hvilket også fremgår af denne sammenfatning.
Doing so would jeopardize the validity of the research study and results.
Den nye ordning for værnet om privatlivets fred, der sikrer privatpersoner i EU en meningsfuld beskyttelse, vil indgå i en større sammenhæng, hvor beskyttelsen af forbrugernes privatliv og sikkerhed fortsat udgør en vigtig prioritet.
Participants in such clinical trials (referred to as ‘blinded’ studies) do not have to be provided access to the data on their treatment during the trial if this restriction has been explained when the participant entered the trial and the disclosure of such information would jeopardize the integrity of the research effort.
Enhver enhed, der ikke overholder en FTC-afgørelse, idømmes en bøde på op til 16000 USD pr. overtrædelse eller 16000 USD pr. dag, hvis overtrædelsen fortsætter.
Agreement to participate in the trial under these conditions is a reasonable forgoing of the right of access.
Se 15 U.S.C.
Following the conclusion of the trial and analysis of the results, participants should have access to their data if they request it.
Den amerikanske kongres har udtrykkeligt fastlagt FTC's beføjelse til at gøre brug af retsmidler, herunder genoprejsning (restitution), i forbindelse med enhver adfærd eller praksis, som involverer udenlandske foretagender, der 1) forårsager eller vil kunne forårsage skade i USA, som med rimelighed kan forudses, eller 2) involverer den faktiske adfærd i USA.
They should seek it primarily from the physician or other health care provider from whom they received treatment within the clinical trial, or secondarily from the sponsoring organization.
I visse tilfælde er det i FTC's sager om privatlivets fred og datasikkerhed blevet gjort gældende, at en virksomhed var involveret i både illoyal og vildledende praksis; disse sager omfattede af og til også angivelige overtrædelser af flere lovbestemmelser som f.eks. Fair Credit Reporting Act, Gramm-Leach-Bliley Act og COPPA.
f.
Se f.eks. Press Release, Fed.
Product Safety and Efficacy Monitoring
Trade Comm'n, FTC Warns Children's App Maker BabyBus About Potential COPPA Violations (Dec. 22, 2014), https://www.ftc.gov/news-events/press- releases/2014/12/ftc-warns-childrens-app-maker-babybus-about-potential-coppa, Press Release, Fed.
A pharmaceutical or medical device company does not have to apply the Privacy Shield Principles with respect to the Notice, Choice, Accountability for Onward Transfer, and Access Principles in its product safety and efficacy monitoring activities, including the reporting of adverse events and the tracking of patients/subjects using certain medicines or medical devices, to the extent that adherence to the Principles interferes with compliance with regulatory requirements.
Trade Comm'n, FTC Warns Data Broker Operations of Possible Privacy Violations (May 7, 2013), https://www.ftc.gov/news-events/press-releases/2013/05/ftc-warns-data-broker-operations-possible-privacy-violations og Press Release, Fed.
This is true both with respect to reports by, for example, health care providers to pharmaceutical and medical device companies, and with respect to reports by pharmaceutical and medical device companies to government agencies like the Food and Drug Administration.
Trade Comm'n, FTC Warns Data Brokers That Provide Tenant Rental Histories They May Be Subject to Fair Credit Reporting Act (Apr. 3, 2013), https://www.ftc.gov/news-events/press-releases/2013/04/ftc-warns-data-brokers-provide-tenant-rental-histories-they-may.
g.
Se USA's handelsministeriums oversigt over håndhævelsen af safe harbor-principperne over på adressen: https://build.export.gov/main/safeharbor/eu/eg_ main _018476.
Key-coded Data
Se Daniel J. Solove & Paul Schwartz, Information Privacy Law (5th ed.
Invariably, research data are uniquely key-coded at their origin by the principal investigator so as not to reveal the identity of individual data subjects.
2015), for en mere omfattende sammenfatning af retsbeskyttelsen i USA.
Pharmaceutical companies sponsoring such research do not receive the key.
Som led i Consumer Financial Protection Act of 2010 (»CFPA«), Title X of Pub.
The unique key code is held only by the researcher, so that he or she can identify the research subject under special circumstances (e.g., if follow-up medical attention is required).