1 INTERNATIONAL STANDARDS on data protection & privacy Artemi Rallo Lombarte Director Agencia Española de Protección de Datos

2 There are different regional approaches to privacy and data protection all around the world: Directive 95/46/EC OECD Guidelines on the Protection of Privacy APEC Privacy Framework Convention 108 of the Council of Europe… It entails State of Play Less protection for individuals More complexity for business

3 The 30 th International Conference of Data Protection and Privacy Commissioners adopted unanimously a draft resolution proposed by Switzerland and Spain that… supports the efforts of the Council of Europe, and the action taken within OECD, APEC...; mandates the establishment of a working group (…), to draft and submit to its closed session a Joint Proposal for setting international standards on privacy and personal data protection. International Standards

4 The adopted resolution also set the main criteria for the drafting process: To elaborate a set of principles and rights aimed to achieve the maximum degree of international acceptance, ensuring at once a high level of protection. To formulate the essential guarantees for better international transfers of data. To examine the role of self-regulation. To obtain the broadest institutional and social consensus. Criteria to be followed

5 Launched the drafting process Academics: Prf. Poullet, Benyekhlef, Cottier, Korff… DPA: CA, CH, CZ, DE, ES, FR, IE, NL, PT, SI, UK + EDPS Industry: Accenture, Google, Intel, ISO, Oracle… International Organizations: CoE, OECD, UE NGO: EDRi, FPF, Privacy International… Professional associations: EPON, IAPP Public bodies: FTC, DHS Set up the major guidelines of the Joint Proposal and the working methodology First step: Barcelona meeting

6 The first version was structured in 6 parts General provisions (purpose, definitions, scope) Basic principles Legitimacy for processing Rights of the data subject Security Compliance and monitoring 1 st Draft Version

7 We have received reactions: DPAs America: CA, MX, UY Asia: HK Europe: CH, CY, CZ, DE, ES, HR, IE, IT, PT + EDPS + UE Oceania: AU, NZ Industry Accenture, Atradius, Bird & Bird, CIPP, Écija, FFW, Garrigues, HP-EDS, Hunton & Williams, Microsoft, Procter & Gamble… Academics, Judges, NGOs… 1 st Draft Version

8 At this moment, we have just sent to the members of the Working Group a new draft version. We look forward for receiving all your remarks, in order to include them in the third draft version, which will be discussed next 11 June in Bilbao. The final draft should result of this meeting 2 nd Draft Version

9 To clarify the role of the Document …as a way for facilitating international data flows To review the controller/processor notions The responsible person decides on the existence of the processing. To consider the definition of filing system …an obsolete concept? To reduce bureaucratic requirements …that in practice do not improve data protection Some Main Innovations

10 To set an accountability principle …that imposes duties on the responsible person To adapt the concept of sensitive data …because every country has a different culture To promote international data transfers …if the recipient offers a similar level of protection to that provided by the International Standards To inform individuals of security breaches …when they could be seriously impaired Some Main Innovations

11 Some Main Innovations To broaden the Supervisory Authority idea …that, for instance, may be an arbitration institution or a consumer authority. To enhance international co-operation …among supervisory authorities, including coordinated enforcement actions. To encourage proactive measures …as a way for reducing liability in case of infraction To analyze the relevant law …on the Internet age.

12 The final draft proposal will be submitted to the 31 st Privacy Conference, that is being organized by the Agencia. If approved, the next step has to be defined: towards a binding instrument? 31 st Privacy Conference

13