CLOUD act agreements from an EU perspective

For many years, transatlantic cooperation between the EU and the US in the area of personal data exchange has been a subject of special interest on the part of lawmakers, courts – including supranational ones – NGOs and the public. When implementing recent reform of data protection law, the European Union decided to further strengthen guarantees of the protection of privacy in cyberspace. At the same time, however, it faced the practical problem of how to ensure compliance with these principles in relation to third countries. The approach proposed in the GDPR, which is based on a newly-defined territorial scope of application, clearly indicates an attempt to apply EU rules extraterritorially in relation to data processors in third countries.Irrespective of EU activity, the United States has also introduced its own regulations addressing the same problem. An example is the federal law adopted in 2018, specifying how to execute national court orders for the transfer of electronic data. The CLOUD Act was established in response to legal doubts raised in the Microsoft v United States case regarding the transfer of electronic data stored in the cloud by US obliged entities to law enforcement authorities, as well as in cases where this data is physically located in another country and its transfer could result in violating the legal norms of a foreign jurisdiction. The CLOUD Act also facilitates bilateral international agreements that enable the cross-border transfer of e-evidence for the purposes of ongoing criminal proceedings. Both the content of the new regulations and the model proposed by the US legislature for future agreements concluded on the basis of the CLOUD Act can be seen as an alternative to regulations arising from EU law.The purpose of this paper is to analyse the CLOUD Act and CLOUD Act Agreements from the perspective of EU law and, in particular, attempt to answer the question as to whether this new legal mechanism brings the EU and the USA closer to finding common ground with regard to a coherent model of exchange and protection of personal data.     

Deletion of regulations pertaining to certain social services programs under the Social Security act: Office of Human Development Services, HHS. Final rule

Pub. L 97-35, the Omnibus Budget Reconciliation Act of 1981, combined the social services programs administered under title XX of the Social Security Act in the States and in the Territories under titles 1, IV-A, X, XIV and XVI (AABD), into a single block grant known as "The Title XX Block Grant to States for Social Services." The block grant program is effective October 1, 1981. Since existing regulations governing those programs do not apply to the block grant program, this rule deletes both entire Parts and references within a Part that apply to the above grant-in-aid programs. These regulations also remove the Department's day care requirements which were issued under statutory authorities that no longer exist as a result of various changes made by Pub. L 97-35.     

The Dutch Euthanasia Act and related issues

In 2002 the Dutch Euthanasia Act came into force. This Act is the result of a lengthy developmental process. It codifies the requirements that have evolved in case law and medical ethics since 1973. Empirical data indicate that the Dutch euthanasia practice is stabilising. Euthanasia and assisted suicide occur in 2.7% of all deaths. Now that the Act has been passed, the focus is on improving the quality of medical decision-making. From an international perspective, the Dutch legislation is exceptional. However, it appears that other countries and international organisations are considering euthanasia legislation as well. It remains to be seen how influential the Dutch model will prove to be.     

The Juvenile Justice and Delinquency Prevention Act: Federal Leadership in State Reform

The policies advanced by the Juvenile Justice and Delinquency Prevention Act, while generally viewed as a success, are seen by some as a failure that may even abet juveniles in the commission of crime. After tracing the evolution of federal juvenile justice legislation and examining arrest and treatment data, the authors confront the criticisms aimed at the Act, and find reason for considerable optimism. Nationwide, the number, proportion, and rate of juvenile arrests have fallen more than the juvenile population, and many states appear to have made substantial progress in improving the processing and treatment of juveniles. The authors conclude that the Act is a continuing source of federal leadership for state innovation.     

Constitutional Principle,the Rule of Law and Political Reality: The European Union (Withdrawal) Act 2018

The European Union (Withdrawal) Act 2018 is the cornerstone of UK legislation designed to accomplish the legal dimension of Brexit. It brings the entire acquis of EU law into UK law in order to avoid regulatory black holes that would otherwise occur. The Act embodies a twofold legislative strategy: EU law brought into UK law thereby is to be made fit for purpose by exit day, with necessary changes being made by statutory instrument; Parliament can then decide at greater leisure thereafter whether it wishes to retain, amend or repeal this legislation. The burden placed on Parliament is unprecedented, all the more so given the exigencies of time in which the changes are to be made. This article explicates the principal provisions of the 2018 Act, and the concerns as to constitutional principle and the rule of law raised by the legislation. The tensions in the drafting process are made apparent, and uncertainties in the resulting text are revealed.     

Privacy Act; implementation. Office of Inspector General (OIG), HHS. Final rule

This final rule exempts the new system of records, the Healthcare Integrity and Protection Data Bank (HIPDB), from certain provisions of the Privacy Act (5 U.S.C. 552a). The establishment of the HIPDB is required by section 1128E of the Social Security Act (the Act), as added by section 221(a) of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Section 1128E of the Act directed the Secretary to establish a national health care fraud and abuse data collection program for the reporting and disclosing of certain final adverse actions taken against health care providers, suppliers or practitioners, and to maintain a data base of final adverse actions taken against health care providers, suppliers and practitioners. Regulations implementing the new HIPDB were published in the Federal Register on October 26, 1999 (64 FR 57740). The exemption being set forth in this rule applies to investigative materials compiled for law enforcement purposes.     

Medicare program; hospital inpatient value-based purchasing program. Final rule

This final rule implements a Hospital Inpatient Value-Based Purchasing program (Hospital VBP program or the program) under section 1886(o) of the Social Security Act (the Act), under which value-based incentive payments will be made in a fiscal year to hospitals that meet performance standards with respect to a performance period for the fiscal year involved. The program will apply to payments for discharges occurring on or after October 1, 2012, in accordance with section 1886(o) (as added by section 3001(a) of the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively known as the Affordable Care Act)). Scoring in the Hospital VBP program will be based on whether a hospital meets or exceeds the performance standards established with respect to the measures. By adopting this program, we will reward hospitals based on actual quality performance on measures, rather than simply reporting data for those measures.     

Medicaid program; deadline for submitting moratorium state plan amendments--HCFA. Notice

This notice announces the deadline for Medicaid State agencies to submit State plan amendments requesting moratorium protection under section 2373(c) of the Deficit Reduction Act of 1984, as amended by the Medicare and Medicaid Patient and Program Protection Act of 1987. Section 2373(c) initiated a moratorium period during which HCFA cannot take any compliance, disallowance, penalty or other regulatory action against a State agency whose State plan contains an income or resource methodology or standard for determining eligibility for medically needy and certain categorically needy groups that is less restrictive than the required standard or methodology. This notice provides formal notification to States that plan amendments requesting moratorium protection will not be accepted after the last day of the first full calendar quarter following publication of this notice in the Federal Register.     

Regulatory Science and the Data Quality Act

The importance of data quality was highlighted in an amendment attached to a 2000 law enacted by the 106th U.S. Congress. The law known as the “Data Quality Act” or the “Information Quality Act,” mandated that the Office of Management and Budget (OMB) issue guidance to federal agencies for “ensuring and maximizing the quality, objectivity, utilility, and integrity of information (including statistical information) disseminated by federal agencies.” In turn, OMB required more than 90 federal agencies such as the United States Environmental Protection Agency (EPA) to implement data quality guidelines. These guidelines have created a rigorous, if not rancorous, debate within the regulated community. This paper will provide a brief synopsis of the evolution of the Act, discuss how the Act and scientific uncertainty interrelate, and review the status of the Act's petition process for correcting government disseminated information.     

Medicare program, fiscal year 1990; mid-year changes to the inpatient hospital prospective payment system--HCFA. Final rule with comment period

This final rule with comment implements several provisions of the Omnibus Budget Reconciliation Act of 1989 that affect Medicare payment for inpatient hospitals and that, in general, take effect on April 1, 1990. This final rule also responds to comments received concerning the changes we made in 1989 in implementing provisions of the Medicare Catastrophic Coverage Act of 1988 concerning adjustments applicable to prospective payment hospitals and to the target amounts of hospitals and units excluded from the prospective payment system due to the elimination of the day limitation on covered inpatient hospital days. We are making additional changes in these provisions to take into account the Medicare Catastrophic Coverage Repeal Act of 1989, and changes in the law made by the Family Support Act of 1988, which clarified the criteria for adjusting target amounts and changed the date for implementing that provision.     

Organ Procurement and Transplantation Network--HRSA. Final rule with comment period

This document sets forth the final rule governing the operation of the Organ Procurement and Transplantation Network (OPTN), which performs a variety of functions related to organ transplantation under contract with HHS. The document also offers a 60 day period for additional public comment. The rule will become effective 30 days following the close of the comment period. If the Department believes that additional time is required to review the comments, we will consider delaying the effective date. In combination with a new National Organ and Tissue Donation Initiative, this rule is intended to improve the effectiveness and equity of the Nation's transplantation system and to further the purposes of the National Organ Transplant Act of 1984, as amended. These purposes include: encouraging organ donation; developing an organ allocation system that functions as much as technologically feasible on a nationwide basis; providing the bases for effective Federal oversight of the OPTN (as well as for implementing related provisions in the Social Security Act); and, providing better information about transplantation to patients, families and health care providers.     

Revoking consent: A ‘blind spot’ in data protection law?

The flow of personal data throughout the public and private sectors is central to the functioning of modern society. The processing of these data is, however, increasingly being viewed as a major concern, particularly in light of many recent high profile data losses. It is generally assumed that individuals have a right to withdraw, or revoke, their consent to the processing of their personal data by others; however this may not be straightforward in practice, or addressed adequately by the law. Examination of the creation of data protection legislation in Europe and the UK, and its relationship with human rights law, suggests that such a general right to withdraw consent was assumed to be inbuilt, despite the lack of express provisions in both the European Data Protection Directive and UK Data Protection Act. In this article we highlight potential shortcomings in the provisions that most closely relate to this right in the UK Act. These raise questions as to the extent of meaningful rights of revocation, and thus rights of informational privacy, afforded to individuals in a democratic society.     

Implementation of Pro-Children Act of 1994--HHS. Notice to prohibit smoking in certain facilities

The Department of Health and Human Services announces the implementation of the Pro-Children Act of 1994, which prohibits smoking in certain facilities in which education, library, day care, health care and early childhood development (including WIC and Head Start) services are provided to children. In accordance with section 1043(d) of the Act, the Secretary of Health and Human Services is publishing the prohibitions which restrict smoking in certain indoor facilities.     

The Data Protection (Amendment) Act, 2003: the Data Protection Directive and its implications for medical research in Ireland

Directive 95/46/EC on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data has been transposed into national law and is now the Data Protection (Amendment) Act, 2003. The Directive and the transposing Act provide for new obligations to those processing data. The new obligation of primary concern is the necessity to obtain consent prior to the processing of data (Article 7, Directive 95/46/EC). This has caused much concern especially in relation to 'secondary data' or 'archived data'. There exist, what seem to be in the minds of the medical research community, two competing interests: (i) that of the need to obtain consent prior to processing data and (ii) the need to protect and foster medical research. At the same time as the introduction of the Act, other prior legislation, i.e. the Freedom of Information Act, 1997-2003, has encouraged candour within the doctor-patient relationship and the High Court in Ireland, in the case of Geoghegan v. Harris, has promulgated the 'reasonable-patient test' as being the correct law in relation to the disclosure of risks to patients. The court stated that doctors have a duty to disclose all material risks to patients. The case demonstrates an example of a move toward a more open medical relationship. An example of this rationale was also recently seen in the United Kingdom in the House of Lords decision in Chester v. Afshar. Within the medical research community in Ireland, the need to respect the autonomy of patients and research participants by providing information to such parties has also been observed (Sheikh A. A., 2000 and Irish Council for Bioethics, 2005). Disquiet has been expressed in Ireland and other jurisdictions by the medical research communities in relation to the exact working and meaning of the Directive and therefore the transposing Acts (Strobl et al). This may be due to the fact that, as observed by Beyleveld "The Directive makes no specific mention of medical research and, consequently, it contains no provisions for medical research as an explicitly delineated category." (Beyleveld D., 2004) This paper examines the Irish Act and discusses whether the concerns expressed are well-founded and if the Act is open to interpretation such that it would not hamper medical research and public health work.     

Postmarket surveillance. Final rule

The Food and Drug Administration (FDA) is implementing the postmarket surveillance (PS) provisions of the Federal Food, Drug, and Cosmetic Act (the act), as amended by the Food and Drug Administration Modernization Act of 1997 (FDAMA). The purpose of this rule is to provide for the collection of useful data about devices that can reveal unforeseen adverse events or other information necessary to protect the public health.     

Medicare and Medicaid Programs; new payment methodology for routine extended care services provided in a swing-bed hospital--HCFA

The final rule revises the regulations governing the methodology for payment of routine extended care services furnished in a swing-bed hospital. Medicare payment for these services is determined based on the average rate per patient day paid by Medicare for these same services provided in freestanding skilled nursing facilities (SNFs) in the region in which the hospital is located. The reasonable cost for these services is the higher of the reasonable cost rates in effect for the current calendar year or for the previous calendar year. In addition, this final rule revises the regulations concerning the method used to allocate hospital general routine inpatient service costs for purposes of determining payments to swing-bed hospitals. These changes are necessary to conform the regulations to section 1883 of the Social Security Act (the Act), and section 4008(j) of the Omnibus Budget Reconciliation Act of 1990.     

Child and Adult Care Food Program: improved targeting of day care home reimbursements--Food and Consumer Service, USDA. Final rule

This final rule amends the Child and Adult Care Food Program regulations governing reimbursement for meals served in family day care homes by incorporating changes resulting from the Department's review of comments received on a January 7, 1997, interim rule. These changes and clarifications involve: The appropriate use of school and census data for making tier I day care home determinations; documentation requirements for tier I classifications; tier II day care home options for reimbursement, including use of child care vouchers; calculating claiming percentages/blended rates using attendance and enrollment lists; and procedures for verifying household applications of children enrolled in day care homes. This final rule also amends the National School Lunch Program regulations to facilitate tier I day care home determinations by requiring school food authorities to provide elementary school attendance area information to sponsoring organizations. These revisions implement in final form the provisions of the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 to target higher CACFP reimbursements to low-income children and providers.     

Medicare and Medicaid programs; recognition of the American Association for Accreditation of Ambulatory Surgery Facilities, Inc. for Ambulatory Surgical Centers Program--HCFA. Proposed notice

In this notice we announce the receipt of an application from the American Association for Accreditation of Ambulatory Surgery Facilities, Inc. (AAAASF) for recognition as a national accreditation program for ambulatory surgical centers that wish to participate in the Medicare or Medicaid programs. The Social Security Act requires that the Secretary publish a notice identifying the national accreditation body making the request, describing the nature of the request, and providing a 30 day public comment period.