1. Bart van der Sloot http://www.ivir.nl/medewerkers/vandersloot.html
Data Protection 2.0 The proposal for a General Data Protection Regulation
Bart van der Sloot

2. Overzicht Privacy and Data Protection Data Protection 1.0
Theses

3. (1) Privacy and Data Protection
Charter of Fundamental Rights of the European Union
Article 7 Respect for private and family life
Everyone has the right to respect for his or her private and family life, home and communications.
2. Article 8 Protection of personal data
1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.

4. (1) Privacy and data protection
Domain
Relations
Background
Character
Privacy
Primarily regards the private sphere
Primarily regards vertical relationships (citizen – state)
Rise of nation states
Control on the use of power & duties of care
Or…..
Data Protection
Regards both the private and the public sphere
Primarily regards horizontal relationships (citizen -business)
Technological developments

5. (2) Data protection 1.0
Data protection Directive (EU) > Wet bescherming persoonsgegevens (NL)
No specific duties, but general standards of care
Data collection, use and proecessing should be necessary and propotioniate, should have a clear and legitimate goal
Technical and organisational measures
Personal data should be correct, complete and up to date

6. (2) Data Protection 1.0 Only three marginal ‘subjective rights’
Right to acces
Transparancy duty
Right to rectification if data are not processed according to the data protection rules.
Richt to object
at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him
Automated individual decisions
which produces legal effects concerning him or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him

7. (2) Data Protection 1.0 Only a marginal role for supervisory authority
Limmited possibilities for remedies, liability and sanctions
Notification requirement is mosly ignored
Sector specific codes of conduct are very few and far between
European collection of CBP’s, the Working Party 29, may only adopt non-binding advisory opinions

8. (3) Data protection 2.0 - General Data Protection Regulation
Duties
Accountability duty (Documentation, risk assessments, Data protection officer, privacy by design / by default)
Reversal of the burden of proof for consent
Verification duty for consent of children

9. (3) Data Protection 2.0 Rights Data portability Right to be forgotten
Protection against profiling

10. (3) Data Protection 2.0 Enforcement Harmonization of the rules:
Regulation
Commission
Working Party 29
Harmonization of enforcement: One stop shop
Sanctions and liability widened

11. (4) Theses
Companies are resourceful and technological developments rapidly succeed each other – specific rights and obligations will become obsolete quickly
To require of citizens to protect their own personal data (through the use of their subjective rights) is unrealistic
Governmental authorities should not to interfere in the freedom of contract between citizens and businesses