Chapter 10 – Compliance with regulations and laws
The Internet is just another environment in the real world where people have to live together and behave decently towards each other. However, because everyone can interpret decent behaviour differently, it was necessary to define it through legislation.
1. Introduction
In every environment where people must live together, mutual decent behaviour must be maintained. However, because everyone can imagine decent behaviour differently, laws, rules, decrees, or recommendations have to be created that we should follow. As we have already learned from the chapter Basic Principles and Motivations, the Internet is just another environment in the real world. Therefore, the same legislation applies to it in the real world. However, it is often expanded to include specific elements of the virtual world, i.e. the Internet environment.
2. Legislation in general
In the Czech legal system, after the Constitution, which is the country’s highest law, there are also a number of other laws that define the limits within which we are allowed to move. If we cross these limits, we can expect punishment. The Internet is an environment of the real world, and the laws from the real world are transferred to it. Therefore, if someone is deceived on the street or cyberspace, it is still a fraud. However, on the Internet, as we have already discussed in the chapter Anonymity on the Internet, traces remain much longer, so it is often not a problem to detect cyber fraudsters.
Each country has its own laws, and sometimes, individual laws can differ in different countries. After applying them to the cyberworld and the Internet, there is sometimes a problem with which law applies. Since the Internet does not have fixed borders, the law must be applied according to the principle of territoriality, i.e. each state on whose territory, which is defined by the borders of the state, the consequences of the act fall, applies its laws. In the following paragraphs, we will discuss some selected laws that we must comply with in the world of computers, especially on the Internet.
3. Copyright law
Authors can be creators of media content, such as films or series, or writers, but also programmers in the case of software development. Each author has the right to choose how their work can be handled. For example, if someone creates software when they publish it, they usually also publish the license terms for using the work, and users must follow them. If the software is not free, users who want to use it buy a license to use it. They do not become the owner.
What is software??
Software, sometimes called an application or program, is software. It is a set of commands that a computer understands and executes as the author has prescribed. For example, if we take an Internet browser, its author has defined how it should look, what the buttons should do when clicked, what other settings it has, etc.
In the real world, decent people do not lie or steal, so they should not commit similar acts in cyberspace. Authors have spent money on creating a work, appreciate it, and usually want to earn a living and other activities. However, we do not have to pay for some licenses, and authors sometimes do not claim royalties.
If an author offers generally known and proven software, he usually sells it with a license for a full version of the software without restrictions, the so-called full version. However, suppose programmers create new software and want it to become known to potential paying users. In that case, they often offer it for free to try while limiting the period of possible use or even some functions. Such licenses are called Shareware, Trial, or Demo. Sometimes, on the contrary, authors want to spread the software among users and do not claim a reward. For example, they create software for their use and do not mind if someone else uses it. These licenses are called GPL, Public domain, or Freeware. A special category of free applications is the so-called open source. Not only can you use such an application for free, but you also have the source codes available. Authors can also choose an Adware license; such software is free for users but contains advertisements from which the author is paid. CC (Creative Commons) licenses are free but require a particular way of handling the work. For example, attributing the author, not creating derivative works, using it only for non-commercial purposes, etc.
4. Act on the Processing of Personal Data
Everyone should treat other people’s data as they would like others to treat theirs. The rule of minimum access also applies to personal data, meaning that everyone should only have access to personal data of others necessary to perform their profession. However, people interpret personal data protection differently, which is why this area is also covered by law. In the Czech Republic, the Act on the Protection of Personal Data has been in force since 2000 and was significantly amended in 2019 to comply with the European Union regulation known as the GDPR (General Data Protection Regulation). This law defined what can be considered personal data and also significantly increased the financial penalties for personal data controllers in the event of their leakage. The law defined some new rights for data subjects, i.e. persons to whom personal data belong. First of all, the data subject has the right to have personal data deleted and must give consent to any processing that is not carried out based on another law.
The law requires some organisations that it defines to establish a mandatory job position of Data Protection Officer (sometimes also known as DPO), whose contact details must be published. The Data Protection Officer monitors personal data processing compliance with organisations’ legal obligations, conducts internal audits, trains employees and generally manages internal data protection agendas. Therefore, contact the Data Protection Officer if you want information about your personal data processed by a given organisation, if there is a leakage, or if someone steals personal data you care about.
5. Cybersecurity Act
Every organisation addresses cybersecurity in some way. The Cybersecurity Act (ZKB) established a recommended minimum cyber security standard. It primarily seeks to protect that part of the infrastructure that is important for the functioning of the state and whose disruption would lead to damage or endangerment of the interests of the Czech Republic. These organisations must comply with the ZKB, and others can at least be inspired by it. The law determines how cyber security should be ensured and how to respond to cyber threats or resolve incidents. The related decree determines details on the method of implementing security measures, communicating with contact points, maintaining security documentation, and categorising cybersecurity incidents.
6. Internal rules of organisations
Everyone in our territory must comply with the laws of the Czech Republic, regardless of nationality and other aspects. But then there are also internal rules of organisations that are binding on members of the organisation (employees, students, etc.) and are issued as directives, decrees, decisions, etc. Internal rules specify or expand laws and relate purely to the organisation.
7. Rules for using a service
A service is something that people in an organisation can or even have to use, such as an email box, data storage, etc. Organisations set rules for using this service or technical parameters, which in the case of an email box can be, for example, a limit on the capacity for storing email messages or the number of messages sent over a certain period. In the case of data storage, the storage capacity can be limited. Users must follow these rules. As a rule, organisations issue guidelines that define these rules.
However, there are also public services that are accessible to everyone, and their operators also create rules for use. These rules are written into a contract that the user accepts by consent. Anyone, not just employees, can enter into a contractual relationship.
8. Where to find more information
This training material is intended to provide the reader with a basic overview of the issue but does not deal with specific legal interpretations or paragraphs. For this purpose, we can recommend the books CyberCrime and CyberSecurity, which are available under the Creative Commons license at https://knihy.nic.cz.
9. Summary
In this chapter, we have repeated that if we want to live together on the Internet, we must behave decently. Everyone perceives decent behaviour differently, which is why there is legislation that defines certain limits. The same legislation applies to the Internet as it does to the real world, but it is expanded by other specific legal norms related to cyberspace.
We learned that copyright law also applies in cyberspace, and the method of use of a work is decided solely by its author. We knew that there is a law on personal data protection and that in case of personal data problems, we should contact the Commissioner for Personal Data Protection.
We also know now that there is a Cybersecurity Act, which organisations that are in some way necessary for the functioning of the state are obliged to follow, and the law can serve as inspiration for other organisations.
However, organisations often have internal rules binding on the organisation’s members. Also, every service, whether internal or public, has its own rules of use and must be followed.