1 Prof. Dr. Artemi Rallo PROTECTION OF PRIVACY ON THE INTERNET AGE

2 SEPTEMBER 2009 CIS SURVEY The survey shows the very low level of trust Spanish citizens place in the safety of their data on the Internet. The survey shows the very low level of trust Spanish citizens place in the safety of their data on the Internet. The survey shows the urgent need for service providers to improve The survey shows the urgent need for service providers to improve their information and privacy policies and to strengthen the guarantees they offer to their users.

3 PROTECTION OF PRIVACY ON THE INTERNET AGE “ Do you know if you leave any trace or personal data behind when you surf the Internet?” PUBLIC AWARENESS 45.2% 9.4% 45.4%

4 INTERNET USEINTERNET USE PROTECTION OF PRIVACY ON THE INTERNET AGE Main uses of the Internet by the public Search engines Browsing without clear objectives Newsgroups, chat room, messaging

5 Strongly agree Quite agree Hardly agree Disagree N/A PROTECTION OF PRIVACY ON THE INTERNET AGE CITIZENS’ OPINION ABOUT THE INTERNETCITIZENS’ OPINION ABOUT THE INTERNET 11.7% 13.9% 3.9% “ The Use of the Internet promotes interference in people's privacy”. * 7% of respondents who do not use the Internet attribute it to the lack of privacy it entails. 24.8% 45.8%

Pay with credit card in an establishment Provide credit card details via the Internet File income tax return via the Internet Post photos or videos on the Internet Enter data to participate in a competition Low or no security High/Fairly high PROTECTION OF PRIVACY ON THE INTERNET AGE THE PERCEPTION OF SECURITY 60.7% 33.6% 15.4% 76.9% 44.4% 39.7% 10.5% 75.7% 8.8% 84.2%

Banks Retailers Utility companies Pub. Admin. Internet Low or very low High or very high PROTECTION OF PRIVACY ON THE INTERNET AGE THE PERCEPTION OF SECURITY 61.2% 20.6% 35.1% 34.4% 34.9% 42.1% 67.5% 13.4% 11.4% 56.6%

% 46% 28% high or very highneither high nor lowlow or very low Level of security offered on the Internet in relation to personal data PROTECTION OF PRIVACY ON THE INTERNET AGE DATA SECURITY ON THE INTERNETDATA SECURITY ON THE INTERNET Public mistrust.

9 DATA SECURITY ON THE INTERNETDATA SECURITY ON THE INTERNET PROTECTION OF PRIVACY ON THE INTERNET AGE The frequency with which citizens read privacy policies of the websites visited: Inefficient means? 62% 4% 21.7% 11.8% Always or nearly always SometimesRarely or never Don't know how to do it

10 They shouldn't have restricted access They should have few restrictions They should have quite a few restrictions They should have access totally restricted N/A PROTECTION OF PRIVACY ON THE INTERNET AGE Opinion of respondents on the access of minors to the Internet 20.9% 60.5% 10.4% 3.1% 5% MINORS AND THE INTERNET

11 PROTECTION OF PRIVACY ON THE INTERNET AGE type of control Classification of respondents depending on the type of control applied to their children. * 77.6% of those who do not apply controls say they do not consider it necessary. MINORS AND THE INTERNET Time limits Type of website Must be accompanied Others

12 PROTECTION OF PRIVACY ON THE INTERNET AGE 1.Search engines 1. Search engines MAIN SUBJECTS TACKLED BY THE AEPD Definition of Opinion GT29 1/2008: services that allow users to find information on the Internet. Retention period: never more than six months.

13 PROTECTION OF PRIVACY ON THE INTERNET AGE

14 PROTECTION OF PRIVACY ON THE INTERNET AGE

15 2. YouTube PROTECTION OF PRIVACY ON THE INTERNET AGE Assumptions: a) Image as personal data. b) Taking images of people, if the images can be used to identify people, falls under the Spanish data Protection Act (LOPD) and requires the subject's consent. c) The subscriber of the telephone line with the allocated IP address from where the images where uploaded shall be the responsible one.

16 PROTECTION OF PRIVACY ON THE INTERNET AGE

17 PROTECTION OF PRIVACY ON THE INTERNET AGE

18 PROTECTION OF PRIVACY ON THE INTERNET AGE CASE: (PS/00479/2008). Recording and dissemination of images of a disabled person It was the second penalty applied by the AEPD for recording and disseminating images without consent on YouTube. The images showed several young people making fun of a mentally disabled person. The AEPD ruled it was a serious breach of the Organic Law on Personal Data and imposed a fine of €1,500 on those responsible for the recording and dissemination of the images on YouTube. The AEPD decided that there had been an infringement of the principle of consent established in Section 6 of the Spanish Data Protection Act (LOPD).

19 PROTECTION OF PRIVACY ON THE INTERNET AGE 3. Problems with the protection of data derived from P2P networks The dissemination of files containing personal data over P2P networks using work tools, normally using the program e-mule, is one of the Agency's greatest concerns. Main cause: the downloading of all kinds of material (films, music, etc.) by employees during work hours.

20 PROTECTION OF PRIVACY ON THE INTERNET AGE

21 PROTECTION OF PRIVACY ON THE INTERNET AGE

22 PROTECTION OF PRIVACY ON THE INTERNET AGE 28 October 2008: The Google Maps application gives users street level images of certain cities. Occasionally it was possible to identify a person on the street with Street View. The AEPD set up a meeting with the privacy counsels for Google to ensure that the company treated a person's image as personal data. The AEPD's recommendation was adopted by Google.The AEPD's recommendation was adopted by Google. Then, Google blurs images where people’s faces or license plates can be recognised. 4. Google Street View

23 PROTECTION OF PRIVACY ON THE INTERNET AGE

24 PROTECTION OF PRIVACY ON THE INTERNET AGE There is a high level of potential risk to privacy and data protection for users of social networks, especially to young people and teenagers. A series of recommendations were given to all parties to increase the level of protection to users, including: - improve the legal information available. - raise awareness among users. - control the indexing and storage of profiles. - implementation of systems to identify the age of users. - establish systems for remote identification of users through the use of an established electronic signature. 5. Social networks

25 PROTECTION OF PRIVACY ON THE INTERNET AGE

26 PROTECTION OF PRIVACY ON THE INTERNET AGE

27 PROTECTION OF PRIVACY ON THE INTERNET AGE

28 PROTECTION OF PRIVACY ON THE INTERNET AGE

29 PROTECTION OF PRIVACY ON THE INTERNET AGE

30 PROTECTION OF PRIVACY ON THE INTERNET AGE

31 PROTECTION OF PRIVACY ON THE INTERNET AGE

32 PROTECTION OF PRIVACY ON THE INTERNET AGE The AEPD has warned about the danger of using videosurveillance cameras broadcasting on the Internet without restricting access, allowing them to be viewed in real time. It has been discovered that a large number of these cameras do not have restricted access and that they record and broadcast identifiable images of people on public thoroughfares. The existence of search engines that periodically trawl the Internet can provide more efficient search mechanisms and as a result, access by third parties to these images Videosurveillance and the Internet

33 PROTECTION OF PRIVACY ON THE INTERNET AGE

34 PROTECTION OF PRIVACY ON THE INTERNET AGE 8. Minors Subject of special interest to the AEPD. The Implementing Regulation of the Spanish Data Protection Act (LOPD) has already established age checking as being a special duty of diligence. Verification systems not used by the social networks. The AEPD has stated the need for social networks to develop and implement age verification systems.

35 PROTECTION OF PRIVACY ON THE INTERNET AGE

36 PROTECTION OF PRIVACY ON THE INTERNET AGE 9.3 Advertising (“Send to a friend”) /00183/2009 CASE: (PS/00183/2009). Use of a prize draw to gather 40,000 addresses and send them Spam s The penalised company that sold tickets to events and shows on the Internet, promoted a competition in which it was necessary to fill in a form. The company sent messages without the consent of the owners of accounts, without a contractual relationship, or without offering means to object to the use of the data for commercial means. The AEPD warned that obtaining the addresses of the contacts of individuals in order to send these contacts commercial communications, without their consent, is illegal. It classified it as a serious infringement and fined the company €30,001.

37