Data Protection: EU & International

1. Data Protection: EU & International

2. Data Protection: a Human Right • Part of Right to Personal Privacy • Personal Privacy : necessary in a Democratic Society • Not absolute: other necessary Rights on a Democratic Society ( e.g. Freedom of Expression, Rights of Others)

3. Privacy International • UN: Guidelines (1990) - non-binding • OECD: guidelines (1980) - broad agreement on principles, non-binding in practice • APEC: Privacy Framework (2004)

4. European Convention on Human Rights (ECHR) • Explicit Right to Personal Privacy under Article 8 of 1950 European Convention for the Protection of Human Rights & Fundamental Freedoms (ECHR) • Convention ratified by all EU Member States and most other European countries

5. Council of Europe Member States

6. ECHR Article 8: Right to respect for Private and Family Life • (1) Everyone has the right to respect for his private and family life, his home and his correspondence. • (2) There shall be no interference by a public authority with the exercise of this right except as in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others • [tension with Article 10: Freedom of Expression]

7. Council of Europe Data Protection Convention • 1981 Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (in force October 1985) • 2001 Additional Protocol to Convention (in force July 2004)

8. Lisbon Treaty • Article 16 Treaty on the Functioning of the Union • 1. Everyone has the right to the protection of personal data concerning them. • 2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. • Compliance with these rules shall be subject to the control of independent authorities.

9. EU Charter of Fundamental Rights: Article 8 • Protection of personal data • 1. Everyone has the right to the protection of personal data concerning him or her.2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.3. Compliance with these rules shall be subject to control by an independent authority.

10. EU/EEA Directives • Directive 95/46/EC Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of such Data • Directive 2002/58/EC & 2009/136/EC Privacy and Electronic Communications

11. European Union [27 Member States, 3 EEA States, Accession States]

12. EU Directives Member State Law • Directives must be transposed into Member State law – margin of discretion to Member States • Data Protection Rules: 85% (?) in Directive, 15% (?) in Member State law • Disputes: European Court of Justice (ECJ) • “Article 29 Committee” (DP Commissioners): guidance & harmonisation

13. Fair obtaining & processing Consent Specified purpose No disclosure unless “compatible” Safe and secure Accurate, up-to-date Relevant, not excessive Retention period Right of access Independent Supervisory Authority European Data Protection Rules: Free Flow of Personal Data

14. Rights of individuals • to fairness when giving information • to get a copy of personal data • “right of access” • to correct data if it is wrong • or to have data deleted • to opt out of direct marketing • to complain to the D. P. Commissioner

15. Electronic Communications • General DP Principles apply • Telecom-specific: • ‘Cookies’ on PCs • Caller ID (phones) • Location Data (mobiles) • Directories • ‘SPAM’ • Data Retention

16. Role of EU Data Protection Authorities • Ombudsman Role: resolution of disputes between data subjects and data controllers or processors • Enforcer Role: compliance by data controllers & processors • Educational Role: Promote DP rights and good practice • Registration Authority: obligation on major holders of personal data to be placed on public register

17. Transfers EEA International • Emphasis on structured ways of protecting individual’s privacy rights. Data Transfers OK if: • Approved countries: Switzerland, Canada, Argentina, Isle of Man, Guernsey, Jersey, Faroe Islands, USA [“Safe Harborites” & PNR data only] • Covered by Model Contracts or Binding Corporate Rules (BCRs) • Article 26 (1) Exceptions (e.g. individual consent)

18. Preventing Harm Notice Collection Limitation Uses of Personal Information Choice Integrity of Personal Information Security Safeguards Access and Correction Accountability APEC Privacy Principles (2004): Encourage E-Comm. APEC Data Privacy Pathfinder (Sept. 07)

19. Data Quality Purpose Specification Use Limitation Security Safeguard Openness Individual Participation Accountability OECD Guidelines/Principles (1980):Encourage Intl. Data Flows Recommendation on Privacy Law Enforcement (June 07)

20. Further Information: www.coe.int www.europa.eu.int/comm/justice_home/fsj/privacy www.dataprotection.ie