Evaluation of the Implementation of the General Data Protection Regulation in Health Clinics

Abstract

The new General Data Protection Regulation (GDPR) was approved on April 27 2016. The GDPR 2016/679 aims to ensure the coherence of natural persons' protection within the European Union (EU), comprising very important innovative rules that will be applied across the EU and will directly affect every Member State. Furthermore, it aims to overcome the existing fragmented regulations and to modernise the principles of privacy in the EU. This regulation will come into force in May 2018, bringing along several challenges for citizens, companies and other private and public organisations. The protection of personal data is a fundamental right. The GDPR considers a 'special category of personal data', which includes data regarding health, since this is sensitive data and is therefore subject to special conditions regarding treatment and access by third parties. This premise provides the focus of this research work, where the implementation of the GDPR in health clinics in Portugal is analysed. The results are discussed in light of the data collected in the survey and possible future works are identified.

A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises

“…Most problem with compliance are found in SMEs (with the exception of companies with an existing security focus), since they have more limited resources (Lindqvist 2018;Sirur et al 2018). Some researchers focus on a specific article in GDPR, for instance data portability, certification and privacy (Ataei et al 2018b;Bu-pasha 2017;De Hert et al 2017;Graef et al 2018;Lindqvist 2018;Rodrigues et al 2016;Urquhart et al 2018;Vanberg and Ünver 2017) or a specific sector/business (Erdos 2016;Grundstrom et al 2019;Lopes and Oliveira 2018;Stanciu and Rîndașu 2018).…”