#eudataprotection

[omalleyprivacy]

CNIL, the French regulator, is now involved in technical testing of mobile applications, including the data they access while in use.  This is an indication that they are likely to take an EU lead on mobile privacy enforcement.  The PC World article includes interesting technical details.

The French National Commission on Computing and Liberty (CNIL) studied the behavior of 189 apps on six iPhones equipped with monitoring software and analysis tools developed by the French National Institute for Research in Computer Science and Control (INRIA).

To monitor how the apps accessed private information, INRIA had to jailbreak the iPhones and install a special app to intercept the Apple APIs through which apps request access to private information, said INRIA researcher Vincent Roca. The researchers chose to work on iPhones because they already had experience developing for iOS. They are now developing an app with similar capabilities for Android phones, which they have to root in order to install it.

[omalleyprivacy]

The Article 29 WP in Europe has issued a detailed opinion outlining explicit consent requirements for big data applications that will have a direct impact on individuals, including advertising and market research related uses.

"Such consent should be required, for example, for tracking and profiling for purposes of direct marketing, behavioural advertisement, data-brokering, location-based advertising or tracking-based digital market research," the Working Party said in a new opinion.

In its opinion, the Working Party said that where businesses engage in big data projects that involve trying to "detect trends and correlations" from personal information, they may not require individuals' consent to process their data for that purpose providing they put in place certain safeguards. 

It said that if firms intending to use personal data for that purpose can ensure that the information is not used to "support measures or decisions ... taken with regard to the individual data subjects concerned" – such as through anonymisation measures – they may not require individuals' consent to engage in the activity.

"Although there is not, strictly speaking, new material in the opinion, the fact that several pages are devoted to the European Convention on Human Rights and the EU's Charter of Fundamental Rights indicates a hardening of attitude," Information law specialist Marc Dautlich of Pinsent Masons, the law firm behind Out-Law.com, said. "The Working Party has obviously seen fit to rehearse the arguments in full technicolour detail, complete with 22 examples at the end of the opinion to provide specific context, and indirectly demonstrate that effort has been made to anchor the guidance in real world business models."

"Expect to spend time looking at your purposes and consents much more closely before you embark on your next big data project," he added. "As one practitioner put it to me 'we are all brand advisers now, this is no longer about ‘just data protection stuff’ and it hasn’t been for some time – this is about your organisation’s reputation'."

[omalleyprivacy]

Next week, data protection regulations come into effect in Mexico that look very similar in scope and requirements to the ePrivacy Directive in Europe.

On April 17, 2013, Mexico's new Privacy Notice Guidelines will go into effect. The Guidelines impose extensive requirements for furnishing adequate data privacy notices and obtaining consent before personal data is collected directly from a person or electronically via "cookies," "web beacons" or other automated means. The Guidelines are mandatory and particularly important to employers that regularly collect, process, and/or transfer personal data about employees or job applicants, and to companies operating or advertising in Mexico that use cookies, web beacons, and similar media technology that automatically collects personal data online. As shown in a recent decision by the Federal Institute for Access to Information and Data Protection ("IFAI" for "Instituto Federal de Acceso a la Información y Protección de Datos"), sanctions may be imposed for noncompliance.

These privacy rights are a constitutional cornerstone found in Article 16 of Mexico's Magna Carta.

The Guidelines establish that before the "responsible party," or the party handling an individual's personal data (including data controllers and data processors), can collect, process, or transfer personal data, the data owner must receive a privacy notice and be afforded the opportunity to consent to his or her personal data being processed. If the responsible party collects personal data automatically through electronic means (e.g., using cookies or web beacons to track website visitors), the responsible party must provide the user a privacy notice and the opportunity to disable cookies or web beacons to prevent data collection, unless such technology is necessary for the electronic platform to properly function.

[omalleyprivacy]

It looks as though the ePrivacy Directive is taking hold in Poland, where notice systems are deploying that use a similar model to what we've seen in the UK.  Note that the Polish regulation includes fining authority of up to 3% of a year's profit, which is far higher than in the UK ... assuming that you have profits.

Is that a startup immunity clause?  ;0)  

Joanna Tomaszewska, an expert in privacy laws at Polish law firm SSW, told Out-Law.com that if users do not alter browser settings that as default enable cookies, website operators, or third parties such as advertising networks, could serve cookies providing they have complied with new rules relating to the quality of information about cookies that should be made available to users. In such cases the inaction of a properly informed user will be sufficient to constitute acceptance of cookies, she said.

"The new amendment imposes a very strict information duty that requires businesses to clearly inform website users, through easily accessible and comprehensible information, about the purposes that cookies will be served as well as detailing that users can define the conditions of processing of their data through specific software or browser settings, or by service configuration," she said. 

"The practical result has been that lots of Polish websites are now displaying banners that contain text that link through to an amended cookies policy that sets out all the information required to be provided under the revised law," she added.

This is in light of the fact that the maximum penalty for infringement is fine of up to 3% of firms' annual profits gained in the preceding calendar year.

 "Right now, because no guidance has been given, it is difficult to say how the OEC will tackle infringements involving loss-making firms," she said. 

[omalleyprivacy]

The EU is launching the first major upgrade of its centralized system for sharing security information.  Concerns are already emerging about how the data will be combined and how broadly it will be used.

"It's important for member states to exchange data among one another more closely and join forces in fighting crime - as a counterbalance to the absence of border controls," said Markus Beyer-Pollock, spokesman for Germany's Federal Ministry of the Interior.

He criticizes the fact that SIS, including in its second generation, is intended to be a way to search for people and things, but it could be coupled with other, brand new registries. For example, a new European registry records all travels in and out from the Schengen zone. A visa information system is in the works, and the European Commission recently granted the European police force EUROPOL access to SIS II.

"A situation is developing in which information about not just suspected criminals or criminal deeds is being collected, but simply everyday behavior," Peter Schaar said.

[omalleyprivacy]

BREAKING: Viviane Reding and Eric Holder meet in Washington and niceties are exchanged.  Several paragraphs of fluff behind the jump.

European Commission Vice-President Viviane Reding and United States Attorney General Eric Holder met today in Washington in order to discuss various issues regarding the collaboration between the Department of Justice and the European Commission.

The meeting concluded with talks on the ongoing negotiations for a data protection agreement covering police and judicial information. Both the Attorney General and Vice-President Reding underlined the need to provide a high level of personal data and privacy protection for all individuals in the EU and the US.

Finally, they welcomed the ongoing and positive discussion by U.S. and EU experts on protecting and sharing data on the basis of a commonly agreed framework and noted the importance of finalizing negotiations as soon as possible.

[omalleyprivacy]

Google's task with EU regulators just got a lot more complicated.  You want to avoid a multi-DPA discussion on a single issue whenever you can.

So, what now? Additional investigations and inspections by the Europeans, but this time they’re being called “enforcement actions,” and they’re being conducted by each country individually.

Six countries — France, Germany, Italy, the Netherlands, Spain, and the United Kingdom — launched actions today based on their own laws. The investigations and inspections could result in fines and restrictions, but it’s not yet clear that those would be significant.

Coincidentally, Google’s director of privacy for product and engineering, Alma Whitten, just retired. She’ll be replaced by another longtime Google engineer, Lawrence You.

[omalleyprivacy]

The NY Times Bits blog covers the slow progress of baseline privacy legislation in the United States, observing the the EU is moving swiftly by comparison.  The EU expects to pass their revised data protection directive next spring, while it is difficult to envision legislative progress in the US any time in the foreseeable future.

In the United States, by contrast, a year after the Obama administration introduced the notion of a consumer privacy bill of rights, a draft has yet to be completed, let alone made public.

“We either have to enact our own law or we are going to have to comply with other countries’ laws,” Ms. Harris says. “But doing nothing may no longer be the answer.”