A European View of Privacy Protection

1
A European View of Privacy Protection
National Conference on Privacy, Technology
Criminal Justice Information Washington D.C. 31
May - 1 June 2000

• John Woulds
• Director of Operations
• UK Data Protection Commissioner

2
A European View of Privacy Protection

• Information privacy - the European approach
• Some criminal justice case studies
• Relevance to the US
• The SEARCH Task Force
• Conclusion

3
The view from Manchester

• The UK Data Protection Commissioner
• is a statutory regulatory body
• deals with information privacy
• covers both public and private sectors
• is based near Manchester UK

4
The view from Manchester

• The UK Data Protection Commissioner
• is a statutory regulatory body
• deals with information privacy
• covers public and private sectors
• is based near Manchester UK

• Wilmslow

• London

5
The view from Manchester

• Member of the Task Force on Privacy and Criminal
  Justice Information
• Experience with
• general law on information privacy
• its application in the criminal justice sphere
• a proactive supervisory role
• the European approach

6
The European approach to information privacy

• General law to protect personal data
• set of principles
• rules for processing (including transfer
  overseas)
• rights for individuals
• legal remedies
• independent supervision
• enforcement mechanism

7
The European approach to information privacy

• Personal data shall be
• processed fairly and lawfully
• processed only for specified, lawful and
  compatible purposes
• adequate, relevant and not excessive
• accurate and up to date
• kept for no longer than necessary
• processed in accordance with the rights of data
  subjects
• kept secure
• transferred outside the EU only if there is
  adequate protection

• General law to protect personal data
• set of principles
• rules for processing (including transfer
  overseas)
• rights for individuals
• legal remedies
• independent supervision
• enforcement mechanism

8
The European approach to information privacy

• General law to protect personal data
• set of principles
• rules for processing (including transfer
  overseas)
• rights for individuals
• legal remedies
• independent supervision
• enforcement mechanism

9
The European approach to information privacy

• General law to protect personal data
• set of principles
• rules for processing (including transfer
  overseas)
• rights for individuals
• legal remedies
• independent supervision
• enforcement mechanism

Access Correction, blocking, deletion,
destruction Preventing processing and automated
decisions Compensation
10
The European approach to information privacy

• General law to protect personal data
• Underpins the approach to information privacy
  across all sectors

11
The European approach to information privacy

• General law to protect personal data
• Underpins the approach to information privacy
  across all sectors

Business Commerce Finance Marketing Employment
Taxation Social security Health Police Criminal
Justice
12
The European approach to information privacy

• The EU Data Protection Directive
• applies to processing of personal data
• establishes individual rights and legal remedies
• sets out rules for legitimacy of processing,
  transfers to third countries, data quality,
  confidentiality and security
• requires independent supervision

13
Balancing rights

• Individuals rights
• to private life
• to know
• to freedom of expression
• Rights of others (other individuals, business,
  the state)
• Interests of society

14
Privacy and criminal justice - case studies

• Retention of criminal records
• Disclosures to the media
• Accuracy of criminal records
• HIV warning signals
• DNA database
• AFR fingerprint database

15
Information privacy protection

• Europe
• omnibus law
• harmonisation across the EU
• sector specific codes
• powerful supervisory authority
• human rights issue

• US
• sector specific law
• federal and state initiatives
• industry self-regulation
• private right of action
• commercial free speech issue

16
The practical questions

• What level of protection can I expect?
• How can I find out?
• Do I have any choice?
• Can I secure change?
• What remedies do I have?
• Can I safeguard my private life?

17
European approach - relevance to the US

• Globalisation
• International cooperation
• EU restriction on transfers of data
• adequacy of protection
• safe harbors?

18
The SEARCH Task Force

• Benefits from
• mix of interests
• privacy advocates
• privacy regulators
• international participation
• A different perspective on the issues

19
Why does Europe not want to exchange records with
the US?
20
Why does Europe not want to exchange records with
the US?

• This is a free country, madam. We have a right
  to share your privacy in a public place.
• Peter Ustinov

21

• This is a free country, madam. We have a right
  to share your privacy in a public place.
• Peter Ustinov
• Not under European law!