The activity of Art. 29. Working Party György Halmos data protection expert Office of the Commissioner for Data Protection and Freedom of Information ICTtrain Training Session, 7 January 2009 2019.01.17.

Art. 29. Working Party Content: 1.) Starting point: A 95/46 EC Directive 2.) A 95/46 EK Directive: Art. 29. and Art. 30. 3.) Members of the working party 4.) The activity of the Working Party 5.) The rules of procedure 6.) The CIRCA 7.) The website of the Working Party 8.) The subgroups 9.) The work program of the Working Party 2008 - 2009 10.) 1/2008 opinion on the search engines - WP 148. 2019.01.17.

Starting point: 95/46 EC Directive DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=DD:13:15:31995L0046:HU:PDF 2019.01.17.

95/46 EC Directive: Art 29. and Art. 30. Art. 29. - setting up   A Working Party on the Protection of Individuals with regard to the Processing of Personal Data, hereinafter referred to as 'the Working Party', is hereby set up. It shall have advisory status and act independently. Art. 30. - tasks, field of activity 2019.01.17.

The members of the Working Party 95/46/EC Art. 29. (2) „The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State and of a representative of the authority or authorities established for the Community institutions and bodies, and of a representative of the Commission.” Members: http://ec.europa.eu/justice_home/fsj/privacy/workinggroup/members_en.htm 2019.01.17.

The activity of the Working Party I. 95/46/EC Directive Art. 30. 1. The Working Party shall: (a) examine any question covering the application of the national measures adopted under this Directive in order to contribute to the uniform application of such measures; (b) give the Commission an opinion on the level of protection in the Community and in third countries; (c) advise the Commission on any proposed amendment of this Directive, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data and on any other proposed Community measures affecting such rights and freedoms; (d) give an opinion on codes of conduct drawn up at Community level. 2019.01.17.

The activity of the Working Party II. A 95/46/ EC Directive Art 30. 2. If the Working Party finds that divergences likely to affect the equivalence of protection for persons with regard to the processing of personal data in the Community are arising between the laws or practices of Member States, it shall inform the Commission accordingly. 3. The Working Party may, on its own initiative, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the Community. 4. The Working Party's opinions and recommendations shall be forwarded to the Commission and to the committee referred to in Article 31. 2019.01.17.

The activity of the Working Party III. A 95/46/ EC Directive Art. 30. 5. The Commission shall inform the Working Party of the action it has taken in response to its opinions and recommendations. It shall do so in a report which shall also be forwarded to the European Parliament and the Council. The report shall be made public. 6. The Working Party shall draw up an annual report on the situation regarding the protection of natural persons with regard to the processing of personal data in the Community and in third countries, which it shall transmit to the Commission, the European Parliament and the Council. The report shall be made public.”   2019.01.17.

The activity of the Working Party IV. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) Article 15 Application of certain provisions of Directive 95/46/EC 3. The Working Party on the Protection of Individuals with regard to the Processing of Personal Data instituted by Article 29 of Directive 95/46/EC shall also carry out the tasks laid down in Article 30 of that Directive with regard to matters covered by this Directive, namely the protection of fundamental rights and freedoms and of legitimate interests in the electronic communications sector. 2019.01.17.

The rules of procedure Art. 3 - the Chairmanship of the Working Party Art. 5 - 6. the Convening of the Working Party and venue Art. 7. - the Agenda Art. 10. - the Quorum Art. 12. - the decisions of the Working Party Art. 15. - Annual Report Art. 16. - Subgroups Art. 17. - Voting rights Rules of procedure: http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/rules-art-29_en.pdf 2019.01.17.

The CIRCA 2019.01.17.

The website of the Working Party http://ec. europa 2019.01.17.

The subgroups of the Working Party 2019.01.17.

The working programme of the Working Party 2008 – 2009 The Working Party has to face three major challenges for the years 2008-2009, in particular: i) How to improve the impact of Directive 95/46/EC and the role of the Working Party. ii) The impact of the new technologies. iii) The global environment (international transfer of data, global privacy and jurisdiction. The relevant issues are therefore: I. Better implementation of Directive 95/46/EC II. Ensuring data protection in international transfers III. Ensuring data protection in relation to new technologies IV. Making the Article 29 Working Party more effective V. Topical issues 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines - (the definition of search engines) In the context of the Directive on Electronic Commerce (2000/31/EC) search engines have been denoted as a type of information society service6, namely information location tools7. The Working Party is using this categorisation as the point of departure. The primary focus of the Working Party in this Opinion is on search engine providers who follow the dominant search engine business model based on advertising. This focus includes all the major well known search engines, in addition to specialised search engines such as search engines which focus on personal profiling, and meta search engines that present and possibly regroup the results of other existing search engines. This Opinion does not address search functions embedded on websites for the purpose of searching only the website’s own domain. 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines - (What kind of data?) Query Logs Content offered - User Navigation Search query Links - Operational Data IP-address Advertisements - Data on registered users Date and time - Data of other services Cookie Flash Cookie Referring URL Preferences Browser Operating system Language 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines - (Legal framework) Controllers of user data The fundamental right - respect for private life Applicability of Directive 95/46/EC (Data Protection Directive) Applicability of Directive 2002/58/EC (e-Privacy Directive) and Directive 2006/24/EC (Data Retention Directive) Content providers Freedom of expression and right to private life Data Protection Directive 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines - (The lawfulness of processing) Purposes/grounds mentioned by search engine providers: Improving the service Securing the system Fraud prevention Accounting requirements Personalised advertising Statistics Law enforcement 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines - (The lawfulness of processing) Analysis of purposes and grounds by the Working Party Consent - Article 7 (a) of the Data Protection Directive Necessary for the performance of a contract - Article 7 (b) of the Data Protection Directive Necessary for the purposes of a legitimate interest pursued by the controller - Article 7 (f) of the Data Protection Directive Service improvements System security Fraud prevention Accounting Personalised advertising Law enforcement and legal requests 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines Some issues to be solved by industry Data retention Further processing for different purposes Cookies Anonymisation Data correlation across services 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines - (Obligations) Obligation to inform data subjects: - the identity of the controller and of his representative, if any; - the purposes of the processing for which the data are intended; - any further information such as - the recipients or categories of recipients of the data; - whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply; - the existence of the right of access to and the right to rectify the data concerning him. Importance on the privacy policy!!! 2019.01.17.

Opinion 1/2008 on data protection issues related to search engines - (Rights) Rights of the data subjects Right to access data Correction Deletion 2019.01.17.

I.) Applicability of EC Directives Opinion 1/2008 on data protection issues related to search engines – Summary I.) Applicability of EC Directives II.) Obligations on search engine providers III.) Rights of users http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2008/wp148_hu.pdf 2019.01.17.

Thank you for your attention! halmos@obh.hu 2019.01.17.