Privacy: Legal European Framework

From YobiWiki
Jump to navigation Jump to search

Data Protection related European legislation and initiatives

with some accents on RFID

  • European Convention for Human Rights (ECHR), 1953:
    • Art 8: right to private life
    • by Lisbon Treaty: EU is now also member of it, not only the MS (Member States).
  • OECD Organization for Economic Cooperation & Development published in 1980:
    • Recommendations of the Council Concerning Guidelines Governing the Protection of Privacy and Trans-Border Flows of Personal Data
  • The Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (Convention 108), 1981
  • Data Protection Directive (95/46/EC) & Regulation (EC) Nr. 45/2001 (~same as directive but for EU bodies)
  • ePrivacy Directive (2002/58/EC)
    • replaces 97/66/EC
    • amended by 2009/136/EC, see below
  • Data Retention Directive (2006/24/EC)
    • MS can choose mandatory retention between 6 to 24 months
    • to be implemented by 15/9/2007 (internet 15/3/2009) but still some MS fail
    • Romania constitutional court declared it unconstitutional (8/10/2009) <> privacy rights & secrecy of correspondence
    • German High Court rejected the transposition law (2/3/2010): The court said the law went far beyond the requirements of the EU directive.
  • Framework decision 2008/977/JHA of the Council
    • data protection for police & judicial cooperation in criminal matters (only cross-border)
    • former third pillar
  • 31st annual International conference of data protection and privacy commissioners
    • The Madrid Privacy Declaration, 3 November 2009, by Civil Society
      • Urges for a data breach legal framework
      • Recommends research on PETs (Privacy Enhancing Technique) such as anonymization
      • Calls for moratorium on development of new systems of mass surveillance such as facial recognition, whole body scanners, biometric identifiers and embedded RFID tags
    • The Madrid Resolution, 5 November 2009
      • Joint proposal for a draft of international standards on the protection of privacy with regards to the processing of personal data
      • Largely similar to main principles & rights of 95/46/EC + accountability principle
  • Directive 2009/136/EC, 25 November 2009, to be transposed before May 2011
    • amending, among others, the ePrivacy directive 2002/58/EC
      • urges for a data breach principle regardless of the sector, or the type, of data concerned (recital 59)
      • mentions the directive is applicable also to RFID when such devices are connected to publicly available electronic communications networks or make use of electronic communication services as a basic infrastructure (recital 56)
    • personal data breach notification principle
      • if in connection with the provision of publicly available electronic communications service)
      • covers also accidental destruction/loss/deterioration, not only unauthorized disclosure/access
      • obligation without undue delay, to DPA, and to subjects if likely to adversely affect the personal data or privacy of a subject, unless security measures were properly implemented (=encryption)
    • covers spam, cookies, malwares & viruses
  • Treaty of Lisbon, entered into force on 1 december 2009
    • Article 16 of the TFEU (Treaty on the Functioning of the European Union)
      • Everyone has the right to the protection of personal data concerning him
      • covers also justice/policy & EU bodies, only provisions are in Art 39 of the TEU (Treaty on the European Union): concerning CFSP (Common Foreign & Security Policy)
      • was Art 286 in the former Treaty establishing the European Community
    • Charter of Fundamental Rights of the European Union becomes binding (opt-out UK & Poland)
    • Art 8 on protection of personal data
      • Everyone has the right to the protection of personal data concerning him
      • fairly, for specified purposes, on basis of consent or some legitimate basis
      • right of access, right of rectification
      • control by authority
  • Stockolm Program
    • sets framework 2010-2014 for cooperation in the area of justice & home affairs
    • data protection principles are present
  • New Commission
    • now 2 commissioners for the former justice, freedom and security post:
      • justice freedom & citizenship (Viviane Reding)
      • foreign affairs & security (Catherine Ashton)
    • Commission consultation on 95/46/EC
      • general principles are still valid but we need clarification on consent, transparency and introduction of data breach & accountability principles
      • 1/12/2009 WP168 by Art.29 WP + WPPJ (Working Party on Police and Justice) publish a joint contribution to the consultation of the Commission on the legal framework for the fundamental right to protection of personal data: The Future of Privacy (pdf)

Data Protection related bodies


See also