Legal base for harmonized data protection Stefan Jenner Meeting of IALA LAP 12 March 7-8, 2013

Stefan Jenner S2S2 Actual situation: Need to Know – Need to Share Initiative of maritiem data exchange – Examples: CISE (IMP) -MARSUNO -BMM -CoopP -POV SUCBAS (Surveilance Cooperation Baltic Sea) HELCOM North Sea Data Exchange SSN (SafeSeaNet) driven by EMSA EUROSUR driven by FFRONTEX MARSUR driven by EDA

Stefan Jenner S3S3 Actual situation: Need to Know – Need to Share E-Navigation E-Navigation is an overarching concept developed under the patronage of the IMO to crease safety and security in maritime shipping by better organization of information flow on ships and on shore, and better data exchange and communication between the two sides. IMO- and IALA-definition: E-Navigation is the harmonized collection, integration, exchange and presentation and analysis of maritime information onboard and ashore by electronic means to enhance berth to berth navigation and related services, for safety and security at sea and protection of the marine environment. Actual projects -examples: -Mona Lisa -ACCSEAS

Stefan Jenner S4S4 Actual situation: Need to Know – Need to Share e-maritime The EU e-Maritime initiative aims to promote coherent, transparent, efficient and simplified solutions based on advanced information technologies. (EU-Commission) Maritime transport data to enhance the transport chain in a whole.

Stefan Jenner S5S5 Actual situation: Need to Know – Need to Share Need to share shipping data intersectoral and international

Stefan Jenner S6S6 Shipping data sources ? VMS (common fisheries policy) Regulation (EC) 1489/97 and 2244/2003 LRIT (Long Range indetifications an Tracking of Ship SOLAS V 19-1 IMO Resulotion MSC.202(81) Ship Reporting Systems SOLAS V 11 Notification of dangerous goods aboard ships VTM Directive 2002/59/EC Port security notification Regulation (EC) 725/2004 SOLAS XI-2 ISPS-Code AIS Automatic Identification System SOLAS V

Stefan Jenner S7S7 Legal restraints for data exchange Legal Base for AIS: -SOLAS -VTM Directive -National Law Legal Restraints for data proceessing: EU Data Protection Directive 95/46/EC National Data Protection Law

Stefan Jenner S8S8 Legal restraints for data exchange Are AIS Data personal data ? Definition of personal data, Art. 1 EU Directive 95/46/EC Content of AIS data: - MMSI/IMO Number. - Navigation status - Speed over ground – 0.1-knot (0.19 km/h) resolution from 0 to 102 knots (189 km/h) ……. Conclusion: - With other informations (crew list, passenger notificaton, vessel owner) it is possible to connect AIS Data with a natural person. AIS data are to be regardes as personal data.

Stefan Jenner S9S9 AIS Data as Open data ? AIS Data are not encrypted and are provided on open frequencies Anyone who has an appropriate receiver can perceive the information. Pro: Paper of the EU commission: Legal aspects of maritime monitoring & surveillance data Contra: -Position of the USA: MSC 79th session -Encryption is no requirement for data protection -free accseas means not no legal restraints (see copyriht of pics in the internet) -national law (Germany and Austria as example) -Commercial intrests (identification of patterns in the flow of goods=business secret)

Stefan Jenner S10 AIS Data as personal data - Consequences Consequences: Processing of AIS data needs to be legitimate Principle of purpose-limitaion Deletion of data when purpose is fullfield Exchange only if purpose does not change or other legal base Principle of proportionality security measures

Stefan Jenner S11 AIS Data as personal data - Consequences Intersectoral exchange = change of the purpose of data processing international exchange = adequate level of protection ensured ? Legal framework requierd -to ensure that purpose of data proceeding has a legal legitimation in the national law - to ensure that the principle of data prtection are obtained

Stefan Jenner S12 Solution suggestions Legaslation Level International Law -SOLAS ???? Bi-/Multilateral Conventions -EU Law - Directive/Regulation -Conventions of Nations that intend to build up data exchange systems

Stefan Jenner S13 Solution suggestions Minimum Requierements for framework Regulations -purpose of limitation after exchange -Claryfy Data owner -Clarify Data User - adaquaete level of data protection and security -Transfer to third states with adaequate level of data protection