Be Careful For What You Wish For!The Great Data Protection Law Reform Saga of 2012-6

Lilian EdwardsProfessor of E-GovernanceUniversity of Strathclyde

Lilian.edwards@strath.ac.uk@lilianedwards

A. Europe: from the DPD to the GDPR

• Directive 95/46/EC of EU on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Human rights based. Much case law now draws on Charter of Rights and ECtHR as well as European Court of Justice.

• 1998 - intended to address computerisation/databases but NOT the Internet

• DPD extended to deal with technology challenges eg spam, cookies, by Privacy and Electronic Communications Directive 2002/58/EC revised Oct 2009, i’f May 2011 (the “cookie” or E-Privacy Directive)

• Proposed reform as Regulation (GDPR), plus Directive on policing, plus more – draft out, Jan 25 2012;

• Final compromise, Jan 2016; text April 2016

• 2 yrs implementation then DIRECT EFFECT.

Technological challenges to privacy/DP law

• 1995• Volume of personal data processed, and number of data controllers,

enormous • Data flows globally but lack of global harmonisation on DP laws• Lack of public consumer awareness about privacy regulation• Lack of compliant major actors in web 1.0 (SMEs, spammers, scams

etc)• -> huge enforcement problems

• 2000 on• “Consent” as perceived primary protection no longer works well in

web 2.0 click-wrap world (standard terms, privacy policies ) • Post 9/11 politics & low tech costs favour default surveillance and

data retention and mining – if you can do it, why not do it? ->• Snowden revelations, June 2013 of mass extra legal surveillance by

public/private entities – safe harbor, Data Retention Dir struck down• New innovative tech nearly always involves networking and data

collection eg robots; music online services; social media; e-voting• The Cloud – signifies loss of control and visibility as to how/where

data processed=> Public loss of confidence in privacy law

Attitudes to privacy protection - EU

• June 2011 Eurobarometer• Just over a quarter of social network users (26%) and even

fewer online shoppers (18%) feel in complete control [of their PD]

• Less than one-third trust phone companies, mobile phone companies and Internet service providers (32%); and just over one-fifth trust Internet companies such as search engines, social networking sites and e-mail services (22%)

• 70% of Europeans are concerned that their personal data held by companies may be used for a purpose other than that for which it was collected.

• Only one-third of Europeans are aware of the existence of a national public authority responsible for protecting their rights regarding their personal data (33%).

Reform of the DPD? Nov 2010 consultation

• Main aims :– Strengthen Data Subject’s (DS) rights/ trust – eg enhancing

control over PD eg “right to be forgotten”

– Reduce red tape for Data Controllers (DC) -> dump notification; “one stop shop” national DP regulator

– BUT Make DCs more accountable, eg, must have a CPO;

– Give DP more teeth; higher penalties, security breach notification

– Address global flows of data better, eg, to US cloud providers

– Improve harmonisation within EU (binding interpretation across EU DPAs via EU DP Board; Regulation not Directive)

DPD art 2(a)) Personal data is “information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, • ..in particular by reference to an identification number or to

one or more factors specific to his physical, physiological, mental, economic, cultural or social identity + see recital 26 [itals added]

Q. What of IP addresses; cookies, profiled data as collected by FB, Google, police, insurers? Are they PD?• Increasing problem in era of Big Data – reidentification

possibility increases – “mosaic” effect and persistent identifiers like photo icons – tech driven by marketing and surveillance needs

• When is “anonymization” sufficient to make sure NOT PD?

1. Personal data – scope of GDPR

Personal data definition problems

• GDPR Art 4 (1) – almost identical to DPD – adds “by reference to .. location data, an online identifier..”

• But GDPR recital 26: “to determine whether a person is identifiable, account should be taken of all the means reasonable likely to be used, such as singling out either by the controller or any other person to identify the individual” [italics added]

• Nb recital 30 :“traces” left by IP addresses, cookies and RFID tages when “combined with unique identifiers” may create profiles of natural persons and identify them”

• Contextual tests – may depend what DPA gets to decide on it (tho harmonisation will prevail)

• NB Special rules for consent to cookies exist in PECD because in 2002 not clearly regarded as personal data AND felt consent was required, no alternatives.

2. Anonymisation and pseudonymisation

Much “profile data” used to finance the Web – targeted ads – is presented as “anonymous.” Therefore can be used and reused without DP constraint.

• Arguments over “effective” anonymization– Privacy fundamentalist – everything can be re-identified with enough

data and time – High degree of diligence – EU A29 WP– “risk assessment” – UK approach – ICO Code

• Which won in GDPR?– No defn anonymous data but pseudonymous data is encouraged

(GDPR art 4(5) and recitals 23-23a)– “pseudonymisation” means processing such that the data can no

longer be attributed to a specific data subject without the use of additional information so long as such info is “kept separately” and held securely to ensure this

– Still personal data – but relaxed rules eg no security breach notifnnecc; POSSIBLY easier to re-use for “compatible” purposes(art 6(4 (e) ); and a plus for “privacy by design”

3. Consent DPD , Art 2 “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.”GDPR art 4 (11) adds unambiguousAnd revocability as key aspect of valid consent (GDPR art 7(3)).And “a clear affirmative action” ie silence is not acceptance

Arguably new(er) requirements in GDPR (art 7(2) and (4))– written consent to processing should not be “bundled” ie one consent to everything at once- consent not free if tied to providing a service but the processing not necessary for that service(cf FB etc)BUTNOT required all consent be “explicit” – sensitive PD onlyNOT explicit that consent void if “significant imbalance of power”Children’s consent – 13 lowest, 16 highest, depending EU state – is messyPrivacy icons NOT required for policies but are encouraged

4. New user rights – the “Right to Be Forgotten”

• Right to be forgotten (RTBF) – GDPR, art 17. Right of DS to “obtain from the DC the erasure of personal data” if– data no longer necessary for original purpose

– DS withdraws consent

– DS objects to their PD being used for profiling

– They have been “unlawfully processed”

• Aimed at hosts/publishers, esp social networks. Intended to protect children from own folly! NOT JUST SEARCH ENGINES – see G Spain v Costeja.

• DC also has further duties when data passed to 3rd parties to process: “shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure” (GDPR art 17(2a))

• Implications for cloud service providers?? Not always controllers.

• Exceptions – see art 17(3). – Freedom of expression

– Archives, historical, statistical and scientific research? (cf Wikipedia on criminal convictions)

– For proof in legal claims

Right to data portability

• Right to data portability, ie, for DS to get a copy of their data to take elsewhere (GDPR art 20) - “in in a structured, commonly used and machine-readable format”

• Also right to have such data transmitted directly from co A to B “where technically feasible”

– Aimed at breaking “lock in” to sites like Facebook – network effects

– But some see as additional burden for service providers OR as new market opportunity for infomediaries

– UK MiData initiative has already kicked off – mainly re energy cos, also banks, mobile phone cos – see Enterprise & Regulatory Reform Act 2013 – powers in reserve, not yet implemented

– Not a right to interoperability

5. Increased enforcement - 1• Mandatory security breach notification (GDPR art 33-34). • Already introduced for telcos/ISPs in PECD art 17(1)• Aim is naming and shaming to prevent breaches; also notice

to public enables them to get remedies, take protective steps• Devil in the details:

– what triggers (all PD breaches “unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons – data encrypted or pseudonymised?);

– Tell DPA – for UK, ICO– communication to individual DSs only if “high risk” of above– Public announcement only necc if too hard to notify individuals in high

risk cases– how long to fix before notifying (within 72 hours if feasible) – Parallel notification under EU Network Information Security Directive (NIS)

likely (affects non PD breaches as well)

• How effective? US, Japanese experience found SBN not that helpful. Lack of US style class action rules.

• In UK Vidal-Hall v Google may help DSs in collective claims in allowing action for DP breach even where harm not economic

Heavier penalties

• GDPR originally suggested penalties of up to €1 million or up to 2% of the global annual turnover of a company. EU Parl suggested 5% turnover, up to 100 mn Euros.

• Final GDPR – two levels– Up to 10 mn Euros or 2% annual global turnover– Up to 20 mn Euros or 4% global turnover for more severe

infringements

• Cf USA –big privacy breach cases, FTC large fines – 2012, Google fined $22.5m (but < 1 day’s profit) ; FB, 2012, no fine but $16,000/day per violation of agreed privacy settlements & 20 years audit

• Small more effective remedies? Disqualification from company directorship??

• Competition remedies to break up infomonopoloies??

Preventing breaches?• More guidance on security obligation, art 32, inc using

pseudonymisation and encryption, restoring access in timely fashion, adhering to codes of conduct or certificates/seals

• “Privacy by design and default”

• Mandatory! “the controller shall.. having regard to the state of the art and the cost of implementation” (art 25)– Implement “technical and organisational” measures to implement DP

principles

– Pseudonymisation and data minimisation specially mentioned

– “privacy by default” – only collect the data necc for each specific purpose

– Art 35; DP impact assessments – if “high risk” processing, esp using “new technologies”, DPIA to be carried out before processing

– Esp likely for automated profiling systems, or “systematic monitoring of public areas”

– UK ICO has much guidance on PIAs but little use in private sector

– Lists of likely systems needing DPIAs to be issued by DPAs