Data Protection Compliance Professor Ian Walden Institute of Computer and Communications Law, Centre for Commercial Law Studies, Queen Mary, University of London

Introductory Remarks u u Personal data – –‘processing’: collecting, using, disclosing & transferring personal data u u Compliance – –data controller ‘determines purpose and means’ – –e.g. SWIFT case – –data processor e.g. Web host –” (art. 17(4)) –“shall be in writing or in another equivalent form” (art. 17(4))

Transparency u u Obligation – –fair processing (art. 6(1)) – –when using networks to store information or gain access to information stored on users terminal equipment (02/58/EC, art. 5(3)) e.g. ‘cookies’ ‘provided with clear and comprehensive information’ u u Timing – –when collected from data subject (art. 10) – –when not obtained from data subject (art. 11) unless already has it

Transparency u u Content of notification – –identity, purposes, recipients, consequences, right of access u u Right of access (art. 12) – –personal data – –meta-data purposes, disclosures, source – –right of rectification, erasure, blocking notification of third parties u u Notification to national authority (art. 18)

Transparency u u Related legislation – –Distance-selling Directive 97/7/EC: art. 4 (prior information), art. 5 (written confirmation) Distance-selling of financial services Directive 02/65/EC: art. 3 (prior information), art. 4 (additional requirements), art. 5 (communication of terms & information) – –eCommerce Directive 00/31/EC: art. 5 (general), art. 6 (commercial communications), art. 10 (contract process) u u Form – –‘durable medium’ “which enables the consumer to store information addressed personally to him in a way accessible for future reference” (02/65/EC, at art. 2(f)) – –‘easily, directly and permanently accessible to the recipients of the service’

Processing Personal Data u Consent –“freely given, specific and informed” u Ex ante –as one ground for legitimising processing –as sole ground for legitimising processing use of traffic data for ‘marketing’ or ‘provision of value added services’ (02/58/EC, art. 6(3)) use of traffic data for ‘marketing’ or ‘provision of value added services’ (02/58/EC, art. 6(3)) u Ex post –right to object to processing for the purposes of ‘direct marketing’ (art. 14(b))

Processing Personal Data –nature implied (opt-out) & explicit (opt-in) implied (opt-out) & explicit (opt-in) –‘unambiguously’ ‘special categories of data’ (art. 8) ‘special categories of data’ (art. 8) Directive 99/93/EC, art. 8(2) re: certification service providers Directive 99/93/EC, art. 8(2) re: certification service providers –timing prior prior –Directive 02/58/EC, art. 13(1): unsolicited communications u Alternative grounds –performance of a contract (transactional) –compliance with a legal obligation (regulatory)

Problem of Children u u From marketing to social networking sites, e.g. Bebo, Facebook u u When is a child independent? – –OIC: 12 yrs; FEDMA: 14 yrs u u Children’s Online Privacy Protection Act of 1998 – –directed at children under 13, or knowingly collects – –otherwise, not under a duty to investigate age of visitors – –‘verifiable parental consent’ e.g. with digital signature – –enforcement UMG Recordings $400,000 and Bonzi Software $75,000

Transferring Data u Question of applicable law (art. 4) –“..for purposes of processing personal data makes use of equipment..” transit exception transit exception web-based forms web-based forms –Lindqvist (2003) uploading to web does not mean ‘transfer’ (para. 68) uploading to web does not mean ‘transfer’ (para. 68) u ‘Adequate level of protection’ (art. 25) –‘in the light of all the circumstances’ –Community findings (art. 25(6)) of adequacy Switzerland, Hungary, Canada, Argentina, US ‘Safe Harbor’ Switzerland, Hungary, Canada, Argentina, US ‘Safe Harbor’

Transferring Data u u Derogations (art. 26) – –consent – –specified need, e.g. “on important public interest grounds, or for the establishment, exercise or defence of legal claims;” But SWIFT case: “only important public interests identified as such by the national legislation applicable to data controllers established in the EU are valid in this connection.” (WP 128) – –authorised by national authority e.g. contractual provisions, binding corporate rules