#article 29 wp

[omalleyprivacy]

The details of the story are less important than the fact that the EU Article 29 WP appears to be gaining leverage with Google.  Does Google believe that a strict version of the revised directive will pass after all?

Following mounting pressure from data protection agencies (DPAs) in different European countries, Google has started offering so-called data processing agreements to websites using its Google Analytics suite in the European Union, Iceland, Norway or Switzerland.

Up to now Google did not provide such contracts because it maintains that it does not process personal data. Since 2011 it has offered such agreements only in Germany, after demands from the German DPA.

In October last year the European Union's council of DPAs, the so-called Article 29 Working Party, asked Google to make the agreements available E.U.-wide. The issue is part of a wider ongoing investigation into Google's privacy policies by DPAs in France, Germany, Italy, the Netherlands, Spain and the U.K.

Google has until now refused the working party's request, but in a surprise turnaround the company will roll out these modifications after all, it revealed to Dutch IT news site Webwereld.

[omalleyprivacy]

Eduardo Ustaran from FFW writes on the Article 29 WP's encouraging paper on the valuable cover Binding Corporate Rules will provide, even under a revised EU directive.

The prospect of the forthcoming EU data protection framework specifically recognising both flavours of BCR is obviously encouraging but right now, the support provided by the Working Party is invaluable. The benefits of BSPR are well documented – easier contractual arrangements for customers and suppliers, one stop shop in terms of data transfers compliance for cloud customers, no need for cumbersome model clauses… It sounds like a much needed panacea to overcome the tough EU restrictions on international data transfers affecting global outsourcing and data processing operations. But as in the early days of the traditional BCR, potential suitors need to know that the idea is workable and regulators will value the efforts made to achieve safe processor status.

[omalleyprivacy]

The Article 29 WP in Europe has issued a detailed opinion outlining explicit consent requirements for big data applications that will have a direct impact on individuals, including advertising and market research related uses.

"Such consent should be required, for example, for tracking and profiling for purposes of direct marketing, behavioural advertisement, data-brokering, location-based advertising or tracking-based digital market research," the Working Party said in a new opinion.

In its opinion, the Working Party said that where businesses engage in big data projects that involve trying to "detect trends and correlations" from personal information, they may not require individuals' consent to process their data for that purpose providing they put in place certain safeguards. 

It said that if firms intending to use personal data for that purpose can ensure that the information is not used to "support measures or decisions ... taken with regard to the individual data subjects concerned" – such as through anonymisation measures – they may not require individuals' consent to engage in the activity.

"Although there is not, strictly speaking, new material in the opinion, the fact that several pages are devoted to the European Convention on Human Rights and the EU's Charter of Fundamental Rights indicates a hardening of attitude," Information law specialist Marc Dautlich of Pinsent Masons, the law firm behind Out-Law.com, said. "The Working Party has obviously seen fit to rehearse the arguments in full technicolour detail, complete with 22 examples at the end of the opinion to provide specific context, and indirectly demonstrate that effort has been made to anchor the guidance in real world business models."

"Expect to spend time looking at your purposes and consents much more closely before you embark on your next big data project," he added. "As one practitioner put it to me 'we are all brand advisers now, this is no longer about ‘just data protection stuff’ and it hasn’t been for some time – this is about your organisation’s reputation'."