Evolution of Data Protection and Privacy: Social Values Interplay

1. Data Protection and Privacy: Changing Interplay among Social Values?Mindaugas Civilka, Vilnius University LEFIS, Rovaniemi meeting 19-20 January, 2007

2. Law and Privacy – where the social background and individual values meet each other (I) • Historically perceived as human right to be left alone, in nowadays society privacy is playing different societal role • Today the concept of privacy is overwhelmingly becoming a sociological rather than a clearly-cut legal concept • Although historically the human right to privacy has given birth to the concept of data protection, now legal regime of personal data protection claims its right to sui generis regime of its own, moving apart from the general concept of privacy • Data protection is more useful and easy-to regulate as it is more legally defined concept • On the other hand, it may pay tribute to non-legal constructs as efficacy, cost-orientation, networking effects and other social/economic perspective based aspects

3. Law and Privacy – where the social background and individual values meet each other (II) • Two regimes differ – data protection is necessary a compromise between principles of market-based economy (or public safety-related concerns), and traditional view to privacy, whereas human right to privacy is embedded on the opinio juris and general principles of international law and human rights • However, one may not treat this approach as an attempt to downgrade privacy and its importance in society. Privacy is and will always remain key value to the democratic society • The concern, which is raised here is how the law should interact with these changes in the way the society perceives its individuals, and vice-versa, individuals perceive each other and the society at large

4. Human right to privacy and personal data protection regimes in the changing legal environment (I) • Why sui generis data protection regime was necessary? • The first data protection law in the world enacted in the Land of Hesse in Germany in 1970 • The Council of Europe's 1981 Convention ETS No. 108; 1981 OECD Guidelines – describe personal information as data which are afforded protection at every step from collection through to storage and dissemination • Data protection regime is about the right of data subject to control what is happening with his/her data. Data protection regime is no longer based on assumption that the personal data may not be collected otherwise than through consent of the individual – the law also presupposes other cases where such collection of personal data may be legitimate

5. Human right to privacy and personal data protection regimes in the changing legal environment (II) • Directive 95/46/EC serves as a regulatory framework for ensuring a balance between a high level of protection for individual privacy and the free movement of personal data within the European Union • Directive 97/66/EC determines the processing of personal data and the protection of privacy in the telecommunications sector. However, it is already outdated • Directive 2002/58/EC concerns the processing of personal data and the protection of privacy in the electronic communications sector replaces the Directive 97/66/EC

6. Human right to privacy in the changing social and technological environment (I) • Technology has changed the way the society perceives the balance between the right to know and the right to privacy • Internet and modern technologies have become (accidentally or coincidentally) instigators for new type of social environment and new type of social rules • New ways and modes of life are inevitably changing the very concept of privacy • The right to information, the right to self-promotion is becoming more and more important

7. Human right to privacy in the changing social and technological environment (II) • Data protection regime is necessary a compromise based on assumption of active data subject, as opposed to passive individual for the purposes of ECHR Article 8, on collection of data as opposed to non-interference with the private life of individual under ECHR Article 8, on transmission of data as opposed to keeping secrecy and preserving autonomy • Privacy is based on non-interference and non-surveillance, whereas pursuant to data protection laws collection of personal data is not necessary unlawful, provided, however, statutory requirements are met • Data protection regime presupposes certain active steps to be made by the individual so that he himself decides whether he will provide the data for those particular purposes and whether he will interact with other society members. Thus, data protection is largely about choices and self-determination of individual himself/herself

8. Data Protection within Third Pillar – new era in modern data protection (I) • Historically, the data protection regime was about the balance between “usual” societal needs and business necessities • However, social, political changes (e.g. the threat of terrorism) and technological changes (e.g. development of electronic communications, including internet and its actors) necessitated the need for the different, brand new type of balance – between higher protection of privacy and security of public interests • Third Pillar of EU may become even more controversial to concerns of privacy • The retention of data as a subsequence of Third Pillar has opened the new page on the history of online privacy

9. Data Protection within Third Third Pillar – new era in modern data protection (II) • Directive 2006/24/EC – controversial piece of legislation • Privacy-relevant aspects of the Directive 2006/24/EC: • operators shall be forced to take expensive measures in order to keep huge amounts of data • higher price for internet and related services • fewer possibilities for self-expression – various requirements for registration, authorisation of users • The combat with terrorism may make the life much less convenient, but what is the real price we are paying for safer society? • Third Pillar of EU reminds us of the price for the very concept of privacy. Unfortunately, in the hands of evil new technologies may become more dangerous to the society as before

10. Big Brother watches you • Nowadays people increasingly feel that someone is keeping a close watch on them. In the words of David Brin, darkness no longer offers even a promise of privacy • The society does not expect absolute privacy anymore - cameras are on each corner of the street • We should know that we are under surveillance, but we should have a possibility to monitor those who monitor us • New social rule is tolerated: today much higher priority may be given to the security of society than to privacy • From the perspective of a data subject the more important thing is to know what will happen with his data than the very fact that his data are collected and used

11. What’s so special about the internet? (I) • Internet content has become vaster than printed era production, or traditional media, audio-visual production. Internet has become the biggest, most powerful and ubiquitous printing, copying, media-creating, disseminating machine. Consumers are contributing to creation of public content to such an extent that traditional media production is relatively low output in comparison with the former • New society is about making choices. The issue that in reality internet provides no real choices – users can’t choose internet without data mining and surveillance - merits a separate paper • Privacy risks inherent in the use of cookies – novel modes of surveillance? • In some cases, cookies may be useful for providing online services or to facilitate the surfing of the Internet user

12. What’s so special about the internet? (II) • “Spam” (unsolicited electronic junk or bulk mail) and related problems from the user’s point of view: • collection of one’s e-mail addresses without one’s consent or knowledge • receipt of large amounts of unwanted advertising • cost of connection time • But is the spam so really different from “physical life” direct marketing?

13. Location data – one of the most sensitive areas of data protection • A service provider should regularly remind individual that his terminal equipment has been, will be or can be located • Processing location data cannot be justified where it is done for the purpose of surveillance • Working Party Article 29 - the surveillance of employees may be justified for the purposes of planning operations in real time, or where a security objective is being pursued in relation to the employee himself or to the goods or vehicles in his charge

14. Interplay with intellectual property • Once again, we are talking about the balance - combat against illegal content vs. right to internet privacy • Is Directive 2004/48/ECstriking the right balance? • Individuals are not protected from illegal internet content (starting from intellectual property right’s violations and ending with criminal offences) and illegal data surveillance • A balance between the protection of privacy of society and protection of intellectual rightsmust be reached once again • Whether our society in all cases justifies disclosure of personal data in order to protect the rights of intellectual rights holders?

15. Do the surveys of public opinion reflect social reality? (I) • Public research for “Infobalt2000”: convenience and quick search as well as comfortable navigation in the internet was valued most by Lithuanian consumers by the end of 2000 (60%). While the anonymity and security of personal data was deemed as a matter-of-course (54%) • However, quite a big part of consumers (60%) was ready to choose convenience and quick searching services rather than privacy and personal data security. In addition, only few respondents determined privacy as a problematic aspect of the internet (7%) • Two years later, in 2002, the majority of the respondents assumed that their personal data should not be public, however, less than 10% of respondents could determine who has a right to collect their personal data • Thus, lack of information and public knowledge about data protection seemed to be the biggest problem in Lithuania in those days, although situation changes to the better now

16. Do the surveys of public opinion reflect social reality (II)? • Eurobarometer survey (Special Eurobarometer 196): • Around 64% of EU15 citizens polled tended to agree that they were worried about leaving personal information, such as their name, address, date of birth on the Internet. In a technological extension to the telephone monitoring question, the issue of monitoring Internet use was reviewed. The main response from 40% of polled was that monitoring should only take place on those suspected of terrorist activities. • There was less support for the rights of the individual when related to the Internet than the telephone and, accordingly, only 25% of the EU15 considered this to be the stance that should be taken • May we say that the public polls may imply that new technologies (internet) bring more possibilities to society, and expectations of society are changing? May it be suggested that the right to information, right to self–promotion is becoming more important than privacy? May the results show that people do not refuse to stay anonymous, but they do not expect privacy anymore?

17. Direct marketing – different perspective • Business perceives the personal data on consumers as the tool for business activities or as economic good/commodity • Most of consumers treat their data as belonging to them, although in case of economic benefit gain most of the users may tend to disclose their data or relinquish of their rights to privacy. Bonuses, promotion, offers, individualized or customized solutions may not be effectively conveyed without the knowledge of the customers and its data • Thus, why it should be anybody else than the consumer, who shall decide which value is more important and valuable for him/her – bonus, discount, information about the new product, or his right to be left alone? • Using of personal data may in the end mean that the consumers are better served, provided with more new, individualized and better quality products, new opportunities to participate in the consumption?

18. Conclusions (I) • New technologies have vested the society with new instruments and made individuals’ lives more convenient. The society has happily accepted those. Evolution of technologies and social life enhanced individuals to access to information and knowledge; thus it constantly leads to a situation when members of society recognize the right to know, right to communicate, right to express views and contribute to the society as a more vital and valuable than the right to be let alone • Of course, in the hands of evil new technologies may become more dangerous to the society as before. That’s why the price we are paying is, inter alia, our privacy (Third Pillar of EU)

19. Conclusions (II) • New technologies are transforming our lives and even the concept of the right to have or expect privacy. Personal data protection regime implies more active participation of the data subject in the societal relationships • Modern life is about preferences, choices and self-determination, therefore if the individual does not want to be disturbed or interfered or otherwise approached, he is free to choose or opt out of such intrusive events • Individual is already required to MAKE A CHOICE. Thus, individuals, no more expect the absolute privacy on the internet; what they are concerned is what will happen with their data collected on the internet (cookies, financial information, etc.)

20. Conclusions (III) • At least conceptually data protection regime is more tailor-made and more suitable for internet and other technologies, which also reside on the premise of self-determination and choice, rather than on isolation • Of course, we may not place efficacy ahead of justice, economy ahead of human rights. Privacy was always about the carefully sought balance. Privacy will always remain key value in democratic society • However, the very idea of privacy resembles the ever-green vitality of each democratic society. Legally speaking, it is hardly possible to enforce the system which is difficult to define. Furthermore, the idea of privacy, as a very general idea, may act as a paramount check and balance mechanism, ready for action in those cases, where rule of law (data protection regime, etc.) is at flaw

21. Thank you for your attention!