The rights of Swedish residents should override the rights of the data controller

I took this from Panopticon Blog concerning the outcome of the Google order. Now what if the rights of the Swedish citizen was to be escalated to the EU courts, would the outcome be the same?

“The first question for the CJEU was whether Google was a data controller for the purposes of Directive 95/46. Going against the opinion of the Advocate General (see earlier post), the Court held that the collation, retrieval, storage, organisation and disclosure of data undertaken by a search engine when a search is performed amounted to “processing” within the meaning of the Directive; and that as Google determined the purpose and means of that processing, it was indeed the controller. This is so regardless of the fact that such data is already published on the internet and is not altered by Google in any way.

The Court went on to find that the activity of search engines makes it easy for any internet user to obtain a structured overview of the information available about an individual thereby enabling them to establish a detailed profile of that person involving a vast number of aspects of his private life. This entails a significant interference with rights to privacy and to data protection, which could not be justified by the economic interests of the search engine operator. In a further remark that will send shockwaves through many commercial operators providing search services, it was said that as a “general rule” the data subject’s rights in this regard will override “not only the economic interest of the operator of the search engine but also the interest of the general public in finding that information upon a search relating to the data subject’s name” (at paras 81 and 97).”

The Right to be Forgotten is respected by the EU Courts

Google officesI love this, the EU Court has confirmed that we have the right to be forgotten. Google and other internet search engines face a new world where they must remove links to websites containing certain types of personal data when individuals ask them to do so. The European Union says you have “a right to be forgotten” digitally online. This is great news for every citizen of the EU, including our children!

Read more in English and Swedish.

Collection of your data is illegal!

At least that was what the Court of Justice of the European Union in Luxemborg declared yesterday concerning the Data Retention Directive. But what does this really mean for you in practice?

      Firstly, this is about the

collection of your traffic patterns, not the contents

      , from here a traffic analysis can be done to ascertain your online habits from telephone and ISP providers, and this includes location data, i.e. where you are, as well as related data necessary to identify the subscriber or user.

Secondly, this directive was wanted to ensure that the data collected could be used for the prevention, investigation, detection and prosecution of serious crime, such as, in particular, organised crime and terrorism.

However, the directive was flawed because:

      1. The data was collected on ALL of us, not just limited to crime prevention;

 

      2. Anyone could access data collected on you. No court warrant was needed, like for example what is needed to search your home premises;

 

      3. There was nothing forcing the deletion of data collected after the maximum retention period of 24 months;

 

    4. There was nothing stopping the data collected from ending up outside of the EU.

So what next? I believe, just like a ‘bad penny’ this directive will pop-up again later with a new set of clothes, this time with less holes 😉

More reading:
SvD – EU:s datalagringsdirektiv ogiltigt (2014-04-08)
ft.com – European Court of Justice rules EU data collection laws illegal (2014-04-08)
PCWorld – Germany Taken to Court for Failing to Implement Data Retention (2012-05-31)
PCWorld – German Lawmakers Say Data Retention Directive May Be Illegal (2011-04-27)

Simplified and stronger data protection rules in the EU

We are getting some really interesting happening in the EU when it comes to revolutionising the EU Directive on Data Protection. Thanks to the summary provided by Panoticon blog.

The Memo from the European Commission, that has been approved, gives the following reforms that will make doing business simpler for EU companies, and they are significant! So here they come the 4 pillars of reform, or at least a summary of them. If you want to read the full Monty, go here.

Pillar One: One continent one law…
The European Parliament agrees that the new data protection law for the private and public sector should be a Regulation, and no longer a Directive. The Regulation will establish a single, pan-European law for data protection, replacing the current inconsistent patchwork of national laws. Companies will deal with one law, not 28.

Pillar Two: Non-European companies will have to stick to European data protection law if they operate on the European market. What this means is that non-European companies will have to apply the same rules as their European counterparts. European regulators will be equipped with strong powers to enforce this.

Pillar Three: The Right to be Forgotten/ The Right to Erasure
The right to be forgotten builds on already existing rules to better cope with data protection risks online. If an individual no longer wants his or her personal data to be processed or stored by a data controller, and if there is no legitimate reason for keeping it, the data should be removed from their system.

The right to be forgotten is not an absolute right. For example there are cases where there is a legitimate reason to keep data in a data base, e.g. archives of newspapers. In addition the right to be forgotten includes an explicit provision that ensures it does not encroach on the freedom of expression and information.

Pillar Four: A “One-stop-shop” for businesses and citizens
The Regulation will establish a ‘one-stop-shop’ for businesses. What this means is that companies established and operating in several Member States will only have to deal with a single national data protection authority not 28, making it simpler and cheaper for companies to do business in the EU.

Update on revisions to EU directive on Data Protection

I missed this, progress on the new EU directive on data protection and implications on Safe Habor on the excellent Panopticon blog

To summarize seems they need to trash what has already been created and start again. Germany in the driving seat now, I think, which means there should be some action. Nevertheless excepted completion is this year, 2014. Concerns about the alignment of Safe Harbor with this directive, particularly considering the amount of personal data from EU citizens, e.g. Facebook, etc., that is held in the U.S.

Angela pushing for protection of EU data

I really like this. It came out last week just when I was mentally preparing to travel up to Mora for Tjejvasan on Tuesday 😉

Angela wants to try and keep EU data in the EU boundaries, especially personal data.

Concerns voiced by experts talk about the amount of work involved to redo all the router configuration tables, after all networks are configured to get packets from A2B as quickly as possible, it may not always be the most direct route. For example when it is often faster to take the motorway bypass when driving your car, than it is to take the small roads. Packet routing is working exactly the same, depending on traffic congestion, fastest routes are calculated. A redo of router configuration tables would be like removing option to take a faster route if one route is congested.

Cryptography expert states that it would be much more effective to encrypt packets, that way it would not matter where they go, even over hostile territory. Some issues here are that: 1) Cryptography has some overhead cost, this is like adding additional packaging for post, it makes the package larger and heavier; 2) How does a non-technical person know when to encrypt? After all it doesn’t make sense to send everything encrypted? 3) I love the evolutions with quantum computing, as it can solves many problems simultaneously, although each quantum processor must be designed with a purpose in mine…e.g. for security it could be the decryption of a specific algorithm. It’s extremely expensive, but imagine when NSA or criminal networks that have this kind of money start using quantum computing for intelligence and data-mining purposes?

I believe that we have enough networks in EU to route packets within the EU before they are sent outside of the EU. This also prepares us for the future when it will be much easier to decrypt even the most secure algorithms used today. So yes, it requires some work, but just as we in the EU would like to keep our cloud services in the EU, so would we like to keep our personal information, encrypted or not!

Rights of the Data Subject – Data Protection

Panopticon blog have given a really clear/concise description on the changes to the Subject Code of Practice. The Information Commissioner (.ico) published his new ‘Subject Access Code of Practice’ only yesterday.

What I was delighted to find were rights of data-subjects when in social media context to know how/if their data is being used outside of its original intention. Also that social networking sites need to provide some means for the data subject to request for this information. I was really pleased to find the rights of children included to demand the right of access…. read below that I’ve cut&paste from Panopticon blog.

“a child’s right of access – Data about a child belongs to that child, rather than to any parent or guardian. It is therefore the child which enjoys the right of access to their data, albeit that that right may be exercised on their behalf by their parent or guardian. A variety of considerations come into play when a data controller is asked to respond to a request made by a child directly”

More on wire-tapping worldwide!

I thought given the wire-tapping excitement going on now, that I’d post some of the practices going on world-wide that maybe you are not aware of, all excepts from Virtual Shadows (2009), so there could be some updates since, I haven’t checked. If there are updates it will surely include social media as per USA with PRISM.

ILETS
Many of the international laws on wiretapping date back to a series of seminars hosted by the FBI in the United States in 1993 at its research facility in Quantico, Virginia, called the International Law Enforcement Telecommunications Seminar (ILETS) together with representatives from Canada, Hong Kong, Australia and the EU. The product of these meetings was the adoption of an international standard called the International Requirements for Interception that possessed similar characteristics to CALEA from the United States. In 1995 the Council of the European Union approved a secret resolution adopting the ILETS. Following its adoption and without revealing the role of the FBI in developing the standard, many countries have adopted laws to this effect. Following adoption of the standard the European Union and the United States offered a Memorandum of Understanding (MoU) for other countries to sign to commit to the standards. All participating countries were encouraged to adopt the standards so it was natural that international standards organisations, such as the International Telecommunications Union (ITU) and the European Telecommunication Standardization Institute (ETSI), would adopt the standards.

Adoption of wire-tapping laws
Australia was one of the first countries to sign the MoU along with Canada. In Australia the Telecommunications Act expects the telecommunications operators to proactively assist law enforcement by providing an interception capability.

In the UK RIPA requires that telecommunications operators maintain a ‘reasonable interception capability’ in their systems and be able to provide on notice certain ‘traffic data’.
In the Netherlands all ISPs have to have the capability to intercept all traffic with a court order and maintain users’ logs for three months.

In New Zealand the Telecommunications (Interception Capabilities) Act 2004 obliges telecommunications companies and ISPs to intercept phone calls and emails on the request of the police and security services.
In Switzerland ISPs are required to take all necessary measures to allow for the interception of mail and telecommunications.

In June 2008 Sweden’s parliament approved controversial new laws (FRA-lagen) allowing authorities to spy on cross-border email and telephone traffic. The Swedish press claim that this will make Sweden the most surveyed country in Europe. This wiretapping law enables the intelligence authorities to ‘listen’ to all traffic, Hotmail, MSN, SMS etc., across Sweden’s borders. The law becomes effective at the end of 2009. Given Sweden’s stance on human rights the passing of this law is quite remarkable. It was following some pretty heated dis- cussions in parliament that the law was passed on a very fine majority (47 against and 52 for). The argument for tapping of international lines is ‘terrorism’. Of course any ‘terrorists’ will encrypt their communications and there is nothing that the Swedish authorities can do about this. Of course one can always monitor ‘traffic patterns’ on identified suspect com- munication which can be as revealing as the communications’ contents themselves in certain situations. However the use of the contents of such communications in a court of law will be impossible without the decryption key and they cannot obtain this unless there is a law enacted similar to the RIPA in the UK, which forces the key-holder to give the encryption or decryption key to the authorities on request and if they refuse they can be convicted for concealing evidence.

There was also a telecommunications driven incentive in 2008 called Phorm. I have not checked out the present status in 2013.

Anonymization of data as the future for data privacy?

There is significant debate going on concerning the use of personal data outside of that which it was collected for in the EU data protection reforms. This follows on from my previous post on the future of data protection. One of the ways seen as mitigating the risks is by anonymization of personal data. So you remove all PII, and make it anonymous so it can be used for whatever purpose. Sounds easy, but it’s not. Other data in public domain could be what was anonymised data invalid. There have been many cases of so called anonymous data becoming de-anonmynised. May Yee posted something in May 2010 on Virtual Shadows.

Clearly the anonymisation of data has enormous value in medical research for example, as it saves lives. However, when it comes to collecting personal information to be anonymised and used for making money, i.e. marketing, I’m a little less enthusiastic. If my personal data is to be used for purposes outside of what it was collected for, anonymised or not, I want to be informed of this, and be given the option to opt-in, not opt-out. It is up to the marketeer to sell to me the value in opting in.