Introduction

Contextualizing emerging risks in personal data management

The extensive digitalization of contemporary society has radically transformed human interaction, the economy, and public administration. This process has led to an unprecedented proliferation in the collection, processing, and storage of personal information, which presents a series of novel challenges for individual privacy and security. The vast amount of data generated and shared, often unconsciously by users, creates an environment where information protection has become a central concern (Porcelli, 2019) and Vera Saltos & Vivero Andrade, 2019.

Importance of good practices in the protection of individual privacy

The protection of personal data is internationally recognized as a fundamental right, derived from the right to informational self-determination (Murillo de la Cueva, 2011) and Polo Roca, 2020. Its exercise allows individuals to control the dissemination and use of their private information, thus preserving their dignity and freedom (Arellano López, 2020). The adoption of appropriate practices by everyday users is essential to mitigate the risks associated with the processing of their data, contributing to a more secure and privacy-respecting digital ecosystem (Paluma & De Moura Faleiros Júnior, 2019).

Objectives and structure of the analysis

This analysis examines the complexities of personal data protection from a user perspective. Current risks are identified, and effective strategies for safeguarding personal information are proposed. The review covers regulatory developments, prevalent threats in the digital environment, and the implications of emerging technologies. It then addresses the consequences of inadequate information management and the barriers users face in implementing security measures. Finally, it presents concrete recommendations for the proactive protection of personal data and outlines future prospects.

Thematic overview: review and analysis of the contemporary environment

Regulatory evolution and international standards for the protection of personal data

The need to protect personal information has driven the development of robust regulatory frameworks globally. The European Union’s General Data Protection Regulation (GDPR) is a fundamental reference, which has introduced principles such as privacy by design and privacy by default, and has strengthened the rights of data subjects (Balbuena Torezano, 2019) and Polo Roca, 2020). In Latin America, several countries have incorporated data protection as a constitutional right, demonstrating a growing consensus on its importance (Olivos, 2020) and Álvarez-Valenzuela, 2020). These regulations seek to harmonize protection with the cross-border flow of data, a constant challenge (Sobrino García, 2020).

Main current threats to privacy in digital environments

Technical and social vulnerabilities

Vulnerabilities that compromise the privacy of personal data are twofold. On the one hand, technical deficiencies in software and hardware, as well as in the configuration of online services, can create entry points for unauthorized access. On the other hand, social vulnerabilities, such as social engineering, exploit users’ trust or ignorance to trick them into revealing sensitive information (Mubarak Aguad, 2017). A lack of understanding of the risks or the complexity of privacy policies contributes to exposure (De Barrón Arniches, 2019).

Insights into common attacks and security breaches

Cyberattacks vary in sophistication, but all seek to obtain, modify, or destroy personal data. Phishing, which impersonates people to deceive victims, and malware, malicious software installed without consent, are common methods. Security breaches, often the result of these attacks or internal errors, expose large volumes of data, requiring organizations to notify the relevant authorities (Reyes Kahansky, 2019). Geolocation, if not properly managed, also represents a latent risk to privacy (Batuecas Caletrío, 2015).

User responsibility for the processing of personal data

While organizations that process data assume significant responsibility, users also play an active role in their own protection (Vera Saltos & Vivero Andrade, 2019). Informational autonomy empowers individuals to make informed decisions about who uses their information and how (Murillo de la Cueva, 2011). This includes carefully reading terms of service, adjusting privacy settings on apps and devices, and exercising discretion when sharing information online.

Differentiation between user obligations and platform obligations

Platforms and data controllers have strict legal obligations, such as obtaining informed consent, ensuring data security, and allowing the exercise of ARCO (Access, Rectification, Cancellation, and Opposition) rights (2020) (García-Murillo, 2019). Failure to comply can lead to severe penalties. Users, for their part, are responsible for understanding the risks, managing their privacy settings, and adopting safe behaviors. The interaction between both parties defines the effective level of protection (LINARES GUTIÉRREZ, 2019).

Emerging technologies and their impact on personal data management

Big data, artificial intelligence, and their relationship with privacy

The rise of big data and artificial intelligence (AI) has enabled the analysis of enormous volumes of data to extract patterns and predict behaviors (Porcelli, 2019). While these technologies offer benefits, they pose substantial challenges to privacy. The inference of sensitive data from seemingly harmless information, the opacity of algorithms, and the potential for algorithmic discrimination are growing concerns. The Internet of Things (IoT), with the interconnectedness of multiple devices, also amplifies attack surfaces and data collection, generating additional challenges for individual privacy (Jervis, 2016).

Analysis: Impacts, challenges, and best practices for everyday users

Consequences of inadequate management of personal data

Legal, social and psychological repercussions

Negligent management of personal data can have various consequences. Legally, identity theft is a tangible risk, which can lead to financial fraud or identity theft (Guerrero Guerrero, 2020). Socially, the exposure of sensitive information, such as political orientation, can lead to discrimination or stigmatization (Arenas Ramiro, 2019). Psychologically, the violation of privacy can generate stress, anxiety, and a loss of trust in the digital environment. The impact on personal and family privacy is a fundamental concern, even in contexts such as judicial proceedings (Guerrero Guerrero, 2020) and Cuadrado Gamarra, 2011).

Barriers to the adoption of safe practices by the average user

Technical, educational and awareness limitations

The widespread adoption of security practices is hampered by multiple factors. Technical limitations include the complexity of privacy settings across various services and the learning curve associated with new tools. In the educational field, there is a significant gap in digital literacy and understanding of the risks associated with using technology. Many users are unaware of the implications of sharing certain types of data or the existence of their rights (Mubarak Aguad, 2017). A lack of awareness about the value of their own personal data and the perception that security is a distant concern or the exclusive preserve of experts are also notable impediments.

Effective strategies for the individual protection of personal data

Secure configuration of digital devices and services

The default settings of many devices and apps prioritize convenience over privacy. It is essential that users manually review and adjust privacy options. This includes disabling geolocation for apps that don’t require it (Batuecas Caletrío, 2015), limiting apps’ access to contacts and photos, and configuring the visibility of social media profiles. Keeping software up-to-date is also crucial to applying security patches that address vulnerabilities (Benussi Díaz, 2020).

Responsible password management and multifactor authentication

Strong password management is a cornerstone of digital security. It’s recommended to use unique, complex, and long passwords for each service, avoiding obvious personal information. Password managers are valuable tools that facilitate this practice. Furthermore, multi-factor authentication (MFA), which requires a second form of verification (such as a code sent to your phone), adds a substantial layer of security, making unauthorized access difficult even if your password is compromised.

Critical evaluation of permissions and privacy policies in applications

Before installing an app or service, users should carefully examine the requested permissions and privacy policies (De Barrón Arniches, 2019). Questioning why a flashlight app needs access to the camera or contacts is an example of critical thinking. If the permissions seem excessive or unrelated to the app’s core functionality, its installation should be reconsidered. Understanding how data is collected, used, and shared is essential for informed consent (LINARES GUTIÉRREZ, 2019).

Tools and resources for proactive protection

There are various tools that empower users to protect their data. The use of virtual private networks (VPNs) encrypts internet traffic, protecting browsing on public networks. Privacy-focused web browsers and search engines that don’t track user activity minimize digital footprints. Additionally, browser extensions that block trackers and ads contribute to a more private online experience. Ongoing education about emerging threats and available solutions is an invaluable resource for users (Vera Saltos & Vivero Andrade, 2019).

Conclusions and prospective recommendations

Summary of key findings

The protection of personal data in the digital environment demands a multifaceted approach that involves both data controllers and end users. It has been established that, while international and national regulatory frameworks exist that seek to safeguard privacy (Balbuena Torezano, 2019) and Olivos, 2020), threats persist and evolve with technology. Technical vulnerabilities and social engineering facilitate security breaches with legal, social, and psychological repercussions. User adoption of good practices is limited by a lack of knowledge and the complexity of interfaces, underscoring the importance of education and awareness.

Recommendations to strengthen the protection of personal data

To improve the protection of everyday users’ personal data, several lines of action are suggested:

• Continuing Education: Develop accessible digital literacy programs that explain security risks and strategies in clear and practical ways.
• Privacy-Centered Design: Encourage software and hardware developers to implement robust and easily understandable default privacy settings.
• Intuitive tools: Promote the development and dissemination of easy-to-use security tools, such as password managers and multi-factor authentication applications.
• Transparency: Demand that platforms provide greater clarity in their privacy policies and permission requests, using simple and accessible language.
• Adaptive legislation: Update regulations to address the challenges posed by emerging technologies, such as big data and artificial intelligence, while ensuring the protection of individual rights in the face of innovation.

Future prospects and emerging challenges in private data management

The data protection landscape will continue to transform, driven by technological advancement and growing public awareness. Global regulatory harmonization, data management in the context of cloud computing (Novoa, 2020), and artificial intelligence will be central challenges. A greater need is anticipated for solutions that enable users to exercise their right to informational self-determination more effectively, in a context where information is becoming an increasingly valuable asset (Cerda Silva, 2011) and Mendoza Enríquez, 2018. Collaboration between regulators, companies, and users will be crucial to building a secure and privacy-respecting digital environment.

References

Porcelli, A.M. (2019). The Protection of Personal Data in the Digital Environment. Data Protection Standards in Ibero-American Countries. In QUAESTIO IURIS JOURNAL (Vol. 12, Issue 2). Rio de Janeiro State University. https://doi.org/10.12957/rqi.2019.40175

Vera Saltos, MA, & Vivero Andrade, MB (2019). Private life or death to privacy? In USFQ Law Review (Vol. 6, Issue 1, pp. 233–256). Universidad San Francisco de Quito. https://doi.org/10.18272/lr.v6i1.1397

Murillo de la Cueva, P.L. (2011). Computer Science and Personal Data Protection. In Chilean Journal of Computer Law (Vol. 0, Issue 2). University of Chile. https://doi.org/10.5354/0717-9162.2003.10656

Polo Roca, A. (2020). The right to the protection of personal data and its reflection in the consent of the interested party. In Journal of Political Law (Issue 108, pp. 165–194). UNED – National University of Distance Education. https://doi.org/10.5944/rdp.108.2020.27998

Arellano López, CA (2020). The Right to Personal Data Protection. In BIOLEX LEGAL JOURNAL OF THE DEPARTMENT OF LAW (Vol. 12, Issue 23 Jul-Dec, pp. 127–136). University of Sonora. https://doi.org/10.36796/biolex.v0i23.194

Paluma, T., & De Moura Faleiros Júnior, J.L. (2019). Regulatory aspects of the legal protection of privacy and personal data in Brazil. In Justice & Law (pp. 69–84). Autonomous University of Chile. https://doi.org/10.32457/rjyd.v2i1.269

Balbuena Torezano, M. del C. (2019). The protection of personal data: A terminological and legal analysis based on translation assumptions (German-Spanish). In Quaderns de Filologia – Estudis Lingüístics (Vol. 24, pp. 247–265). University of Valencia. https://doi.org/10.7203/qf.24.16309

Olivos, M. (2020). THE RIGHT TO PERSONAL DATA PROTECTION IN PERU. In IUS: Research Journal of the Faculty of Law (Vol. 9, Issue 1, pp. 83–100). Santo Toribio de Mogrovejo Catholic University. https://doi.org/10.35383/ius-usat.v9i1.338

Álvarez-Valenzuela, D. (2020). The protection of personal data in pandemic contexts and the constitutionalization of the right to informational self-determination. In Chilean Journal of Law and Technology (Vol. 9, Issue 1, p. 1). University of Chile. https://doi.org/10.5354/0719-2584.2020.57777

Sobrino García, I. (2020). Data protection and privacy. A comparative study of the concept and its development between the European Union and the United States. In UNED Law Review (RDUNED) (Issue 25, p. 687). UNED – National University of Distance Education. https://doi.org/10.5944/rduned.25.2019.27017

Mubarak Aguad, L. (2017). The Internet, Big Data, and the Processing of Personal Data. In Advocatus (Issue 036, pp. 205–223). University of Lima. https://doi.org/10.26439/advocatus2018.n036.4753

De Barrón Arniches, P. (2019). The loss of privacy in e-procurement (between the Data Protection Regulation and the new Digital Content Supply Directive). In Cuadernos Europeos de Deusto (Issue 61, pp. 29–65). University of Deusto. https://doi.org/10.18543/ced-61-2019pp29-65

Reyes Kahansky, C.M. (2019). The duty to notify and the right against self-incrimination in personal data protection. In UNED Law Review (RDUNED) (Issue 24, p. 281). UNED – National University of Distance Education. https://doi.org/10.5944/rduned.24.2019.25436

Batuecas Caletrío, A. (2015). Personal privacy, personal data protection, and geolocation. In Private Law and the Constitution (Issue 29, pp. 47–82). Center for Political and Constitutional Studies. https://doi.org/10.18042/cepc/dpc.29.02

(2020). Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights. In Personal Data Protection (1st ed., pp. 145–252). Dykinson. https://doi.org/10.2307/j.ctv17hm980.5

García-Murillo, J.G. (2019). Personal Data Turbulence: Between the Public and the Private. In Politics, Globality, and Citizenship (Vol. 4, Issue 7, p. 68). Autonomous University of Nuevo Leon. https://doi.org/10.29105/pgc4.7-5

Linares Gutierrez, A. (2019). Consent in telephone contracts for the provision of communications services in the light of the new regulations on personal data protection. In International Journal of Law and Business (Issue 2, pp. 139–147). UFV Publishing House. https://doi.org/10.32466/eufv-rije2019.2.541.139-147

Jervis, P. (2016). The Internet of Things and Personal Data Protection. In Chilean Journal of Law and Technology (Vol. 4, Issue 2). University of Chile. https://doi.org/10.5354/0719-2584.2015.37509

Guerrero Guerrero, B. (2020). Personal data protection in the judiciary: In Chilean Journal of Law and Technology (Vol. 9, Issue 2, p. 33). University of Chile. https://doi.org/10.5354/0719-2584.2020.54372

Arenas Ramiro, M. (2019). Political parties, political opinions, and the Internet: the violation of the right to personal data protection. In Constitutional Theory and Reality (Issue 44, p. 341). UNED – National University of Distance Education. https://doi.org/10.5944/trc.44.2019.26005

Cuadrado Gamarra, N. (2011). Data protection of minors. In Chilean Journal of Information Technology Law (Vol. 0, Issue 5). University of Chile. https://doi.org/10.5354/0717-9162.2004.10740

Benussi Díaz, C. (2020). Security obligations in the processing of personal data in Chile: current scenario and pending regulatory challenges. In Chilean Journal of Law and Technology (Vol. 9, Issue 1, p. 227). University of Chile. https://doi.org/10.5354/0719-2584.2020.56660

Novoa, E. (2020). The right to the protection of personal data in the provision of cloud computing services. In Journal of Law (Issue 22, pp. 64–89). Catholic University of Uruguay. https://doi.org/10.22235/rd22.2239

Cerda Silva, A. (2011). Informational Self-Determination and Data Protection Laws. In Chilean Journal of Information Technology Law (Vol. 0, Issue 3). University of Chile. https://doi.org/10.5354/0717-9162.2003.10661

Mendoza Enríquez, OA (2018). Legal framework for the protection of personal data in service companies established in Mexico: challenges and compliance. In IUS Journal (Vol. 12, Issue 41). Institute of Legal Sciences of Puebla. https://doi.org/10.35487/rius.v12i41.2018.355