Data Protection Day 2011 JOINT HIGH LEVEL MEETING THE COUNCIL OF EUROPE & THE EUROPEAN COMMISSION Domenico Romanazzi Brussels, January 28, 2011

From European to international standards on data protection (1/2) ICC ICC Data Protection Task Force has been working for more than 20 years to improve the international legal framework for data protection: 1990s to present: participation as sole business organization as an observer in the Council of Europe T-PD group 1992: Joint adoption (by ICC, CoE, and European Commission) of standard contractual clauses for international data transfers 2002-present: Participation by ICC in drafting of APEC Privacy Working Group 2004 and 2010: Adoption by European Commission of standard contractual clauses for data processors originally proposed by ICC Rationale for International Standards on Data Protection Bridging divergences in data protection Facilitation of global data flows 4/19/2017 2010 DB Blue template

From European to international standards on data protection (2/2) Various Options Legally binding instrument or framework / model law Convention Guideline Potential timeline Current Environment Substantial differences in data protection culture Evolving regional treaties Rapid technological development The Bottom Line Greater harmonisation would not only help business, but also individuals A binding solution is hard to achieve, while a non-binding approach would not resolve the issues Boost harmonisation on regional level, and intensify dialogue between regional data protection systems and associated steps of convergence ICC is looking forward to working with the Commission and other related authorities to transfer effective data protection into corporate practice 4/19/2017 6:39:41 PM 2010 DB Blue template

Significant Issues concerning Harmonisation Transparency Avoid information overload via balanced and concise information / notices Security breach notification aligned with underlying peril / risk for data subject Clear and unified criteria for informed and free consent by data subject Enhancing Internal Market Dimension Stengthen harmonisation and clarity of implementation of the EU Data Protection Directive Reduce administrative burdens where these do not contribute to effective data protection, e.g. Registration / notification requirements for personal data processing and Prior notification / approval requirements of third country data transfers Avoid contradiction with sectoral requirements (e.g. anti money-laundering) Global Dimension of Data Protection Current set of rules for international data transfers does not allow for a reasonable handling of data within a corporate group Consider that today’s information flows are global and less defined by point to point communication Consider technological trends, so that regulations apply to new technologies as well 4/19/2017 2010 DB Blue template