1. Data Protection: EU & International

2. Data Protection: a Human Right
Part of Right to Personal Privacy
Personal Privacy : necessary in a Democratic Society
Not absolute: other necessary Rights on a Democratic Society ( e.g. Freedom of Expression, Rights of Others)

3. Privacy International
UN: Guidelines (1990) - non-binding
OECD: guidelines (1980) - broad agreement on principles, non-binding in practice
APEC: Privacy Framework (2004)

4. European Convention on Human Rights (ECHR)
Explicit Right to Personal Privacy under Article 8 of European Convention for the Protection of Human Rights & Fundamental Freedoms (ECHR)
Convention ratified by all EU Member States and most other European countries

5. Council of Europe Member States

6. ECHR Article 8: Right to respect for Private and Family Life
(1) Everyone has the right to respect for his private and family life, his home and his correspondence.
(2) There shall be no interference by a public authority with the exercise of this right except as in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others
[tension with Article 10: Freedom of Expression]

7. Council of Europe Data Protection Convention
1981 Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (in force October 1985)
2001 Additional Protocol to Convention (in force July 2004)

8. Lisbon Treaty Article 16 Treaty on the Functioning of the Union
1. Everyone has the right to the protection of personal data concerning them.
2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data.
Compliance with these rules shall be subject to the control of independent authorities.

9. EU Charter of Fundamental Rights: Article 8
Protection of personal data
1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority.

10. EU/EEA Directives
Directive 95/46/EC Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of such Data
Directive 2002/58/EC & 2009/136/EC Privacy and Electronic Communications

11. European Union [27 Member States, 3 EEA States, Accession States]

12. EU Directives Member State Law
Directives must be transposed into Member State law – margin of discretion to Member States
Data Protection Rules: 85% (?) in Directive, 15% (?) in Member State law
Disputes: European Court of Justice (ECJ)
“Article 29 Committee” (DP Commissioners): guidance & harmonisation

13. European Data Protection Rules: Free Flow of Personal Data
Fair obtaining & processing
Consent
Specified purpose
No disclosure
unless “compatible”
Safe and secure
Accurate, up-to-date
Relevant, not excessive
Retention period
Right of access
Independent Supervisory Authority

14. Rights of individuals to fairness when giving information
to get a copy of personal data
“right of access”
to correct data if it is wrong
or to have data deleted
to opt out of direct marketing
to complain to the D. P. Commissioner

15. Electronic Communications
General DP Principles apply
Telecom-specific:
‘Cookies’ on PCs
Caller ID (phones)
Location Data (mobiles)
Directories
‘SPAM’
Data Retention

16. Role of EU Data Protection Authorities
Ombudsman Role: resolution of disputes between data subjects and data controllers or processors
Enforcer Role: compliance by data controllers & processors
Educational Role: Promote DP rights and good practice
Registration Authority: obligation on major holders of personal data to be placed on public register

17. Transfers EEA International
Emphasis on structured ways of protecting individual’s privacy rights. Data Transfers OK if:
Approved countries: Switzerland, Canada, Argentina, Isle of Man, Guernsey, Jersey, Faroe Islands, USA [“Safe Harborites” & PNR data only]
Covered by Model Contracts or Binding Corporate Rules (BCRs)
Article 26 (1) Exceptions (e.g. individual consent)

18. APEC Privacy Principles (2004): Encourage E-Comm.
Preventing Harm
Notice
Collection Limitation
Uses of Personal Information
Choice
Integrity of Personal Information
Security Safeguards
Access and Correction
Accountability
APEC Data Privacy Pathfinder (Sept. 07)

19. OECD Guidelines/Principles (1980):Encourage Intl. Data Flows
Data Quality
Purpose Specification
Use Limitation
Security Safeguard
Openness
Individual Participation
Accountability
Recommendation on Privacy Law Enforcement (June 07)

20. Further Information: www.coe.int