Glossary

is the process of verifying whether the software adheres to all the terms and restrictions set forth in open-source software license agreements.

under Article 4(7) of the GDPR, is a natural or legal person, public authority, or other body that determines the purposes and means of processing personal data: that is, it decides why the data is needed and how it is processed. This is what distinguishes a controller from a processor, which processes data only on the controller’s instructions and within their scope. Where several parties jointly determine the purposes and means of processing, they are considered joint controllers under Article 26 of the GDPR.

one of the fundamental principles of the GDPR, requiring that personal data be collected, processed and stored only to the extent necessary for a specific purpose. This helps to reduce risks to data subjects in case of a data breach, unauthorized access or other misuse of data.

is an agreement that sets out the rights and obligations of the parties in relation to the processing of personal data and governs other matters relating to such processing. In practice, DPAs are most commonly concluded between a controller and a processor. Under the GDPR, such an agreement must include all the mandatory elements specified in Article 28 of the GDPR.

is a documented assessment of how a planned processing of personal data may affect individuals’ rights and freedoms and whether the measures in place are sufficient to prevent or mitigate the relevant risks. A DPIA covers the nature, scope, context, and purposes of the processing, its necessity and proportionality, as well as the risks that such processing may pose to data subjects. Under the GDPR, such an assessment is mandatory where processing is likely to result in a high risk to the rights and freedoms of individuals, including where new technologies are involved.

is a specialist responsible for ensuring compliance with personal data protection legislation in the activities of a controller or processor: they advise management and staff, monitor the proper processing of data within the organisation, participate in data protection impact assessments, and act as a point of contact for supervisory authorities and data subjects. The appointment of a DPO is mandatory for public authorities, as well as for organisations whose core activities involve regular and systematic large-scale monitoring of data or the processing of special categories of data. A DPO does not necessarily have to be a staff member, as this function can also be performed by an external specialist engaged under a contract. The activities of the DPO are governed by Articles 37-39 of the GDPR.

one of the data protection measures provided for under the GDPR, whereby personal data is processed so that it cannot be attributed to a specific individual without the use of additional information. This may involve replacing identifying information with codes, numbers or other identifiers, while the additional information is typically stored separately and protected from unauthorized access.

is a dynamic state of a company’s or organization’s adherence to the requirements of the General Data Protection Regulation. It is achieved through the implementation and maintenance of organizational and technical measures that collectively ensure the security, lawfulness, and transparency of personal data processing while enabling data subjects to exercise their rights.

is an act of the European Parliament and the European Commission that establishes uniform rules for processing personal data across EU countries (and beyond). It is a regulation – that is, an act equal in force to the national laws of each EU member state; at the local level, the GDPR may be supplemented by national data protection laws in specific sectors or legal relationships (healthcare, child protection, telecommunications, security and public order, and so on), but national legislation must not contradict the GDPR. The Regulation creates additional rights for individuals – data subjects – to control their own data, and imposes additional obligations on any organisations (and other persons) that collect such data and process it on request (including non-profit organisations, homeowners’/residents’ associations, or even other natural persons). A breach of the GDPR serves directly as grounds for administrative fines and legal proceedings.

one of six legal bases for the processing of personal data under the GDPR. It is a stake or benefit that a controller or third party may have in engaging in a specific processing activity. To rely on this legal basis, interest should not contradict EU and its Member States legislation, be necessary and take precedence over the interests, rights and freedoms of data subjects.

is the process of training or adjusting artificial intelligence model parameters (AI model parameters) through the use of copyrighted items to improve the model’s query processing results. It may take place based on agreements with the respective authors. In certain cases, it may occur under fair use or fair dealing, depending on the jurisdiction and the factual context. Relevant case law is currently evolving.

a concept set out in Article 25 of the GDPR, under which a company configures a product (system or service) so that, by default, only the personal data necessary for a specific purpose is processed. This applies not only to the personal data collected, but also to the extent of its processing, the period for which it is stored, and its accessibility to others. In particular, personal data should not, by default, be made accessible to an indefinite number of individuals without the user’s intervention. Thus, users do not need to change any settings or take additional steps to ensure an appropriate level of data protection, as the product is configured to provide such protection by default.

 a bilateral agreement entered into between a service provider and a customer for the purpose of defining the key qualitative, quantitative, and other essential characteristics of the services and establishing the parties’ rights and obligations regarding their provision in the course of cooperation under the main agreement. It provides for a clear list of conditions under which the services are deemed to have been provided at the appropriate level of quality, often establishes methods for verifying and monitoring the provision of services, the procedure for submitting requests by the customer, specific timeframes for the service provider’s response, and the consequences of a breach of the agreement.

is a sample or proof of the trademark’s use in commerce within the United States. Such evidence may include a screenshot from a website through which services are provided or goods are sold (for example, Amazon); a screenshot from the App Store or Google Play (relevant for mobile apps); marketing materials; photos of product packaging; and so on.

is the transfer by the author or copyright owner of the software of the right to use the work and/or the exclusive right to authorize its use and/or the right to prevent unauthorized use of the work, and/or other economic rights. The assignment of economic copyrights may involve the transfer of all rights held by the author or copyright owner of the software (ownership, use, and disposal) or the transfer of only one of these rights—the right of use.

refer to 45 categories of goods and services, divided in accordance with the International Classification of Goods and Services (ICGS), which was adopted by the Nice Agreement of June 15, 1957. Under the Nice Classification, classes 1 through 34 cover goods, while classes 35 through 45 cover services.

is  a situation in which trademarks of different rightholders are so similar or identical to each other that there is a risk of confusion between them by the average consumer. In addition to visual and phonetic similarity, the risk of confusion is additionally determined, in particular, by the intersection of goods and services in the relevant classes. The risk of confusion may lead to opposition from rightholders of previously filed TM registrations, refusal to register, or cancellation of an already registered trademark.