Public Voice Symposium "Privacy in a New Era: Challenges, Opportunities and Partnerships" September 13, 2004 Wroclaw, Poland Poland : reducing the gap in privacy protection Andrzej Adamski Nicolaus Copernicus University in Toruń

Wroclaw, 13 September Agenda An overview: from the Martial Law to the Digital Age, Privacy vs. security – some recent developments: –police databases, –retention of traffic data, –interception of communications. The role of institutional controllers and civil society groups.

Wroclaw, 13 September The 80 The Martial Law period (31 Dec to 22 July 1983) –General suspension of civil liberties, –your conversation is under monitoring, –first wiretapping provisions in the Criminal Procedure Code (1982). The Constitutional Tribunal (1985), The Ombudsmen (1987), Shortages in privacy protection laws.

Wroclaw, 13 September Legal framework for privacy Implementation of the European and international standards in privacy protection : ECHR ratified in 1993, Constitution of 1997 ( articles 31,47,49 and 51), Data Protection Act of 1997, Code of Criminal Procedure of 1997, CoE Convention no. 108 signed in 1999, ratified in 2002, The Telecommunication Act of 2000.

Wroclaw, 13 September Legal framework for security The Classified Information Protection Act of 1999, The Police Act amendments of 2000 and 2001, The Criminal Information Act of 2001, The Telecommunication Act of 2004.

Wroclaw, 13 September Balancing Security and Privacy Current problems in privacy & personal data protection: –POLICE DATABASES: no right of individual access, excessive collection and storage of data; –INTERCEPTION OF COMMUNICATIONS: limited judicial oversight, deprivation of the right to judicial remedy; – TRAFFIC DATA RETENTION: insufficient regulations. Main actors: –the Ombudsman, –the Constitutional Tribunal

Wroclaw, 13 September POLICE DATABASES the 2001 Act on the Gathering, Processing and Transmission of criminal information : –database under control of DPIG, –data subjects access to their own files (article 32 sec. 3 DPA) is excluded. NOT COMPATIBLE with: –CoE Convention no. 108, and the Recommendation No.R (87) 15 on the use of personal data in the police sector.

Wroclaw, 13 September POLICE DATABASES (2) Fingerprints and photographs of suspects, found unguilty, are kept in LE databases ( the right to oblivion, purpose specification principle) Ombudsman: not compatible with the CoE Recommendation No.R (87) 15 Government: compatible with the 1990 Police Act ( the time of storage is not specified, as long as data are useful for LE ) Ombudsman – motion to the Constitutional Tribunal ( art. 51 sec.2, art.31 sec.3 of the Constitution )

Wroclaw, 13 September Constitutional approach Hierarchy of legal norms, Adherence to general constitutional principles in any legal regulations concerning human rights, Specific requirements: any rules which limit fundamental rights must be: published, in a precise terms (be foreseeable), in a formal statute, and – may not affect the untouchable core of the right concerned, –must be in accordance with the principles of necessity and proportionality (ECHR art. 8, Polish Constitution, art. 31 sec. 3)

Wroclaw, 13 September Tax amnesty" and property declarations law (2002), Governments bill on mandatory property statements for citizens, Parliament passed the law, Ombudsman: law is contradictory to the Constitution (art. 51 sec.2), excessive collection of information regarding citizens Presidents refusal to sign up the law, Referral of the law to the Constitutional Tribunal, Tribunals judgement : the law is unconstitutional.

Wroclaw, 13 September Interception of communications Monitoring of communications of persons suspected of a commission of crime, No formal status of a defendant, no rights, If not accused, they are: unaware about being under monitoring, not able to exercise the right to judicial remedy. Ombudsman: Articles: 7, 51 sec.4, and 31 sec. 3 of the Constitution at stake.

Wroclaw, 13 September DATA RETENTION electronic fingerprints, traces Ministerial draft regulation of 2001– mandatory monitoring of traffic by ISPs Strong criticism of The Polish Chamber of Information Technology and Telecommunications (PIIT) on constitutional grounds Ministry of Infrastructure regulation of 2003,went into force, not in compliance with the Law on the performance of electronic services from 2002, The Telecommunication Act of 2004 (article 165 – mandatory retention of traffic data for 12 months).

Wroclaw, 13 September Concluding remarks The need for balance between civil rights and the efficiency in government, The legal tools: human rights instruments and data protection legislation, The main actors: Ombudsman, Constitutional Tribunal, The role of civil society organisations. Effects: reduced gap in privacy protection – clearly visible from the historical perspective.