Difference between revisions of "Privacy: Legal European Framework"

From YobiWiki
Jump to navigation Jump to search
Line 2: Line 2:
 
with some accents on [[RFID]]
 
with some accents on [[RFID]]
   
* European Convention for Human Rights (ECHR), 1953:
+
* '''European Convention for Human Rights (ECHR)''', 1953:
** Art 8: right to private life
+
** '''Art 8''': right to private life
 
** by Lisbon Treaty: EU is now also member of it, not only the MS (Member States).
 
** by Lisbon Treaty: EU is now also member of it, not only the MS (Member States).
* OECD Organization for Economic Cooperation & Development published in 1980:
+
* '''OECD''' Organization for Economic Cooperation & Development published in 1980:
** ''Recommendations of the Council Concerning Guidelines Governing the Protection of Privacy and Trans-Border Flows of Personal Data''
+
** ''Recommendations of the Council Concerning '''Guidelines''' Governing the Protection of Privacy and Trans-Border Flows of Personal Data''
* ''The Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data'' (Convention 108), 1981
+
* ''The Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data'' ('''Convention 108'''), 1981
* ''Data Protection'' Directive (95/46/EC) & Regulation (EC) Nr. 45/2001 (~same as directive but for EU bodies)
+
* '''''Data Protection'' Directive (95/46/EC) & Regulation (EC) Nr. 45/2001''' (~same as directive but for EU bodies)
* ''ePrivacy'' Directive (2002/58/EC)
+
* '''''ePrivacy'' Directive (2002/58/EC)'''
 
** replaces 97/66/EC
 
** replaces 97/66/EC
 
** amended by 2009/136/EC, see below
 
** amended by 2009/136/EC, see below
* ''Data Retention'' Directive (2006/24/EC)
+
* '''''Data Retention'' Directive (2006/24/EC)'''
 
** MS can choose mandatory retention between 6 to 24 months
 
** MS can choose mandatory retention between 6 to 24 months
 
** to be implemented by 15/9/2007 (internet 15/3/2009) but still some MS fail
 
** to be implemented by 15/9/2007 (internet 15/3/2009) but still some MS fail
 
** Romania constitutional court declared it unconstitutional (8/10/2009) <> privacy rights & secrecy of correspondence
 
** Romania constitutional court declared it unconstitutional (8/10/2009) <> privacy rights & secrecy of correspondence
* Framework decision 2008/977/JHA of the Council
+
* '''Framework decision 2008/977/JHA''' of the Council
 
** data protection for police & judicial cooperation in criminal matters (only cross-border)
 
** data protection for police & judicial cooperation in criminal matters (only cross-border)
 
** former third pillar
 
** former third pillar
 
* 31st annual International conference of data protection and privacy commissioners
 
* 31st annual International conference of data protection and privacy commissioners
** The ''Madrid Privacy Declaration'', 3 November 2009, by Civil Society
+
** The '''''Madrid Privacy Declaration''''', 3 November 2009, by Civil Society
 
*** Urges for a data breach legal framework
 
*** Urges for a data breach legal framework
 
*** Recommends research on PETs (Privacy Enhancing Technique) such as anonymization
 
*** Recommends research on PETs (Privacy Enhancing Technique) such as anonymization
 
*** Calls for moratorium on development of new systems of mass surveillance such as facial recognition, whole body scanners, biometric identifiers and '''embedded RFID tags'''
 
*** Calls for moratorium on development of new systems of mass surveillance such as facial recognition, whole body scanners, biometric identifiers and '''embedded RFID tags'''
** The ''Madrid Resolution'', 5 November 2009
+
** The '''''Madrid Resolution''''', 5 November 2009
*** ''Joint proposal for a draft of international standards on the protection of privacy with regards to the processing of personal data''
+
*** '''''Joint proposal for a draft of international standards on the protection of privacy with regards to the processing of personal data'''''
 
*** Largely similar to main principles & rights of 95/46/EC + accountability principle
 
*** Largely similar to main principles & rights of 95/46/EC + accountability principle
* Directive 2009/136/EC, 25 November 2009, to be transposed before May 2011
+
* '''Directive 2009/136/EC''', 25 November 2009, to be transposed before May 2011
** modifying among others the ePrivacy directive 2002/58/EC
+
** amending, among others, the ePrivacy directive 2002/58/EC
 
*** urges for a data breach principle regardless of the sector, or the type, of data concerned (recital 59)
 
*** urges for a data breach principle regardless of the sector, or the type, of data concerned (recital 59)
 
*** mentions the directive is applicable also '''to RFID''' ''when such devices are connected to publicly available electronic communications networks or make use of electronic communication services as a basic infrastructure'' (recital 56)
 
*** mentions the directive is applicable also '''to RFID''' ''when such devices are connected to publicly available electronic communications networks or make use of electronic communication services as a basic infrastructure'' (recital 56)
Line 35: Line 35:
 
*** covers also accidental destruction/loss/deterioration, not only unauthorized disclosure/access
 
*** covers also accidental destruction/loss/deterioration, not only unauthorized disclosure/access
 
*** obligation without undue delay, to DPA, and to subjects if likely to adversely affect the personal data or privacy of a subject, unless security measures were properly implemented (=encryption)
 
*** obligation without undue delay, to DPA, and to subjects if likely to adversely affect the personal data or privacy of a subject, unless security measures were properly implemented (=encryption)
  +
** covers spam, cookies, malwares & viruses
** spam
 
* Treaty of Lisbon, entered into force on 1 december 2009
+
* '''Treaty of Lisbon''', entered into force on 1 december 2009
** Article 16 of the TFEU (Treaty on the Functioning of the European Union)
+
** '''Article 16 of the TFEU''' (Treaty on the Functioning of the European Union)
 
*** ''Everyone has the right to the protection of personal data concerning him''
 
*** ''Everyone has the right to the protection of personal data concerning him''
 
*** covers also justice/policy & EU bodies, only provisions are in Art 39 of the TEU (Treaty on the European Union): concerning CFSP (Common Foreign & Security Policy)
 
*** covers also justice/policy & EU bodies, only provisions are in Art 39 of the TEU (Treaty on the European Union): concerning CFSP (Common Foreign & Security Policy)
 
*** was Art 286 in the former ''Treaty establishing the European Community''
 
*** was Art 286 in the former ''Treaty establishing the European Community''
** Charter of Fundamental Rights of the European Union becomes binding (opt-out UK & Poland)
+
** '''Charter of Fundamental Rights of the European Union''' becomes binding (opt-out UK & Poland)
** Art 8 on protection of personal data
+
** '''Art 8''' on protection of personal data
 
*** ''Everyone has the right to the protection of personal data concerning him''
 
*** ''Everyone has the right to the protection of personal data concerning him''
 
*** fairly, for specified purposes, on basis of consent or some legitimate basis
 
*** fairly, for specified purposes, on basis of consent or some legitimate basis
 
*** right of access, right of rectification
 
*** right of access, right of rectification
 
*** control by authority
 
*** control by authority
* Stockolm Program
+
* '''Stockolm Program'''
 
** sets framework 2010-2014 for cooperation in the area of justice & home affairs
 
** sets framework 2010-2014 for cooperation in the area of justice & home affairs
 
** data protection principles are present
 
** data protection principles are present
* New Commission
+
* '''New Commission'''
 
** now 2 commissioners for the former ''justice, freedom and security'' post:
 
** now 2 commissioners for the former ''justice, freedom and security'' post:
 
*** justice freedom & citizenship (Viviane Reding)
 
*** justice freedom & citizenship (Viviane Reding)

Revision as of 16:02, 11 February 2010

Data Protection related European legislation and initiatives

with some accents on RFID

  • European Convention for Human Rights (ECHR), 1953:
    • Art 8: right to private life
    • by Lisbon Treaty: EU is now also member of it, not only the MS (Member States).
  • OECD Organization for Economic Cooperation & Development published in 1980:
    • Recommendations of the Council Concerning Guidelines Governing the Protection of Privacy and Trans-Border Flows of Personal Data
  • The Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (Convention 108), 1981
  • Data Protection Directive (95/46/EC) & Regulation (EC) Nr. 45/2001 (~same as directive but for EU bodies)
  • ePrivacy Directive (2002/58/EC)
    • replaces 97/66/EC
    • amended by 2009/136/EC, see below
  • Data Retention Directive (2006/24/EC)
    • MS can choose mandatory retention between 6 to 24 months
    • to be implemented by 15/9/2007 (internet 15/3/2009) but still some MS fail
    • Romania constitutional court declared it unconstitutional (8/10/2009) <> privacy rights & secrecy of correspondence
  • Framework decision 2008/977/JHA of the Council
    • data protection for police & judicial cooperation in criminal matters (only cross-border)
    • former third pillar
  • 31st annual International conference of data protection and privacy commissioners
    • The Madrid Privacy Declaration, 3 November 2009, by Civil Society
      • Urges for a data breach legal framework
      • Recommends research on PETs (Privacy Enhancing Technique) such as anonymization
      • Calls for moratorium on development of new systems of mass surveillance such as facial recognition, whole body scanners, biometric identifiers and embedded RFID tags
    • The Madrid Resolution, 5 November 2009
      • Joint proposal for a draft of international standards on the protection of privacy with regards to the processing of personal data
      • Largely similar to main principles & rights of 95/46/EC + accountability principle
  • Directive 2009/136/EC, 25 November 2009, to be transposed before May 2011
    • amending, among others, the ePrivacy directive 2002/58/EC
      • urges for a data breach principle regardless of the sector, or the type, of data concerned (recital 59)
      • mentions the directive is applicable also to RFID when such devices are connected to publicly available electronic communications networks or make use of electronic communication services as a basic infrastructure (recital 56)
    • personal data breach notification principle
      • if in connection with the provision of publicly available electronic communications service)
      • covers also accidental destruction/loss/deterioration, not only unauthorized disclosure/access
      • obligation without undue delay, to DPA, and to subjects if likely to adversely affect the personal data or privacy of a subject, unless security measures were properly implemented (=encryption)
    • covers spam, cookies, malwares & viruses
  • Treaty of Lisbon, entered into force on 1 december 2009
    • Article 16 of the TFEU (Treaty on the Functioning of the European Union)
      • Everyone has the right to the protection of personal data concerning him
      • covers also justice/policy & EU bodies, only provisions are in Art 39 of the TEU (Treaty on the European Union): concerning CFSP (Common Foreign & Security Policy)
      • was Art 286 in the former Treaty establishing the European Community
    • Charter of Fundamental Rights of the European Union becomes binding (opt-out UK & Poland)
    • Art 8 on protection of personal data
      • Everyone has the right to the protection of personal data concerning him
      • fairly, for specified purposes, on basis of consent or some legitimate basis
      • right of access, right of rectification
      • control by authority
  • Stockolm Program
    • sets framework 2010-2014 for cooperation in the area of justice & home affairs
    • data protection principles are present
  • New Commission
    • now 2 commissioners for the former justice, freedom and security post:
      • justice freedom & citizenship (Viviane Reding)
      • foreign affairs & security (Catherine Ashton)
    • Commission consultation on 95/46/EC
      • general principles are still valid but we need clarification on consent, transparency and introduction of data breach & accountability principles
      • 1/12/2009 WP168 by Art.29 WP + WPPJ (Working Party on Police and Justice) publish a joint contribution to the consultation of the Commission on the legal framework for the fundamental right to protection of personal data: The Future of Privacy (pdf)

Data Protection related bodies

RFID-related

See also