Douwe Korff professor of international law London Metropolitan University d.korff@londonmet.ac.uk

1. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges Who’s that?

2. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges SLIDE 1 Data protection – a history in 2 minutes France, Germany, Denmark 1970s; Germany’s Volkszaehlung 1980s Data protection in the EU – another minute Data Protection and the Single market – the EC Directive Data Protection in the Third Pillar – leading to the Framework Decision Lisbon Treaty: the end of the pillars

3. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges SLIDE 2 The main challenges • Technical developments: a global “data tsunami” • Social-legal developments: preventing bad things (terrorism, organised crime, paedophilia, but also obesity, teenage pregnancies, “not fulfilling your potential” - UK in particular) • Faith in the computer (“profiles”, algorithms and the “base-rate fallacy”)

4. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges SLIDE 3 What is being challenged? • Democratic values • European human rights values: ECHR/Charter • European law primacy (the solange issue)

5. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges SLIDE 3 Fine words in the Stockholm Programme • The Union must secure a comprehensive strategy to protect data within the EU and in its relations with other countries. In that context, it should promote the application of the principles set out in relevant EU instruments on data protection and the 1981 Council of Europe Convention on data protection as well as promoting accession to that convention. It must also foresee and regulate the circumstances in which interference by public authorities with the exercise of these rights is justified and also apply data protection principles in the private sphere. • The Union must address the necessity for increased exchange of personal data whilst ensuring the utmost respect for the protection of privacy. The European Council is convinced that the technological developments not only present new challenges to the protection of personal data, but also offer new possibilities to better protect personal data. • Basic principles such as purpose limitation, proportionality, legitimacy of processing, limits on storage time, security and confidentiality as well as respect for the rights of the individual, control by national independent supervisory authorities, and access to effective judicial redress need to be ensured and a comprehensive protection scheme must be established.

6. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges SLIDE 5 How to achieve this; the basic principles • ECHR principles, including “law”, “necessity”, “proportionality” and the need to prevent arbitrariness/need for a proper process/right to a remedy • Data protection principles, including especially “purpose-limitation” “no-one shall be subjected to a fully-automated decision that significantly affects him” • The bottom line: “Informatics must serve mankind” (France) “Respect for human personality” (Germany)

7. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges SLIDE 6 We need a comprehensive EU-wide data protection regime, based on these basic principles – but that will not be easy We will need political will, also at (Inter-)Governmental level; strong democratic input (EP, national parliaments, NGOs); and not least real understanding of the implications and limitations of new technologies

8. Douwe Korffprofessor of international lawLondon Metropolitan Universityd.korff@londonmet.ac.uk Asser Round Table On The Stockholm Programme DATA PROTECTION IN THE EU AFTER LISBON: Fundamental Challenges SLIDE 7 Some references: Douwe Korff & Ian Brown (et al.), Comparative Study on Different Approaches to New Privacy Challenges, in particular in the light of technological developments (November 2009), report on a study commissioned by the European Commission (to be published shortly) Douwe Korff & Ian Brown, Privacy and Law Enforcement (2004), study for the UK Information Commissioner, released on as “Striking the Right Balance: Respecting the Privacy of Individualsand Protecting the Public from Crime”: http://www.informationcommissioner.gov.uk/eventual.aspx?id=6840 Protecting the Right to Privacy in the Fight against Terrorism, Issue paper of the Council of Europe Commissioner for Human Rights (2008): http://www.coe.int/t/commissioner/Activities/IPList_en.asp Martin Scheinin et al., Law and Security – Facing the Dilemmas, EUI (2009), which includes Tuomas Ojanen, Human Rights Dilemmas in Terrorist Profiling: http://cadmus.eui.eu/dspace/bitstream/1814/12233/3/LAW_2009_11.pdf Michele Nino, The protection of personal data in the fight against terrorism: New perspectives of PNR European Union instruments in the light of the Treaty of Lisbon, Utrecht Law Review (2010): http://www.utrechtlawreview.org/publish/articles/000119/article.pdf