1. The activity of Art. 29. Working Party György Halmos
data protection expert
Office of the Commissioner for Data Protection and Freedom of Information
ICTtrain Training Session, 7 January 2009

2. Art. 29. Working Party Content:
1.) Starting point: A 95/46 EC Directive
2.) A 95/46 EK Directive: Art. 29. and Art. 30.
3.) Members of the working party
4.) The activity of the Working Party
5.) The rules of procedure
6.) The CIRCA
7.) The website of the Working Party
8.) The subgroups
9.) The work program of the Working Party
10.) 1/2008 opinion on the search engines - WP 148.

3. Starting point: 95/46 EC Directive
DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

4. 95/46 EC Directive: Art 29. and Art. 30.
Art setting up
A Working Party on the Protection of Individuals with regard to the Processing of Personal Data, hereinafter referred to as 'the Working Party',
is hereby set up. It shall have advisory status and act independently.
Art tasks, field of activity

5. The members of the Working Party
95/46/EC Art. 29. (2)
„The Working Party shall be composed of
a representative of the supervisory authority or authorities designated by each Member State
and of a representative of the authority or authorities established for the Community institutions and bodies,
and of a representative of the Commission.”
Members:

6. The activity of the Working Party I.
95/46/EC Directive Art. 30.
1. The Working Party shall:
(a) examine any question covering the application of the national measures adopted under this Directive in order to contribute to the uniform application of such measures;
(b) give the Commission an opinion on the level of protection in the Community and in third countries;
(c) advise the Commission on any proposed amendment of this Directive, on any additional or specific measures to safeguard the rights and freedoms of natural persons with
regard to the processing of personal data and on any other proposed Community measures affecting such rights and freedoms;
(d) give an opinion on codes of conduct drawn up at Community level.

7. The activity of the Working Party II.
A 95/46/ EC Directive Art 30.
2. If the Working Party finds that divergences likely to affect the equivalence of protection for persons with regard to the processing of personal data in the Community are arising between the laws or practices of Member States, it shall inform the Commission accordingly.
3. The Working Party may, on its own initiative, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the Community.
4. The Working Party's opinions and recommendations shall be forwarded to the Commission and to the committee referred to in Article 31.

8. The activity of the Working Party III.
A 95/46/ EC Directive Art. 30.
5. The Commission shall inform the Working Party of the action it has taken in response to its opinions and recommendations. It shall do so in a report which shall also be forwarded to the European Parliament and the Council. The report shall be made public.
6. The Working Party shall draw up an annual report on the situation regarding the protection of natural persons with regard to the processing of personal data in the Community and in third countries, which it shall transmit to the Commission, the European Parliament and the Council.
The report shall be made public.”

9. The activity of the Working Party IV.
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector
(Directive on privacy and electronic communications)
Article 15
Application of certain provisions of Directive 95/46/EC
3. The Working Party on the Protection of Individuals with regard to the Processing of Personal Data instituted by Article 29 of Directive 95/46/EC shall also carry out the tasks laid down in Article 30 of that Directive with regard to matters covered by this Directive, namely the protection of fundamental rights and freedoms and of legitimate interests in the electronic communications sector.

10. The rules of procedure Art. 3 - the Chairmanship of the Working Party
Art the Convening of the Working Party and venue
Art the Agenda
Art the Quorum
Art the decisions of the Working Party
Art Annual Report
Art Subgroups
Art Voting rights
Rules of procedure:

11. The CIRCA

12. The website of the Working Party http://ec. europa

13. The subgroups of the Working Party

14. The working programme of the Working Party 2008 – 2009
The Working Party has to face three major challenges for the years , in particular:
i) How to improve the impact of Directive 95/46/EC and the role of the Working Party.
ii) The impact of the new technologies.
iii) The global environment (international transfer of data, global privacy and jurisdiction.
The relevant issues are therefore:
I. Better implementation of Directive 95/46/EC
II. Ensuring data protection in international transfers
III. Ensuring data protection in relation to new technologies
IV. Making the Article 29 Working Party more effective
V. Topical issues

15. Opinion 1/2008 on data protection issues related to search engines - (the definition of search engines)
In the context of the Directive on Electronic Commerce (2000/31/EC) search engines have been denoted as a type of information society service6, namely information location tools7. The Working Party is using this categorisation as the point of departure.
The primary focus of the Working Party in this Opinion is on search engine providers who follow the dominant search engine business model based on advertising. This focus includes all the major well known search engines, in addition to specialised search engines such as search engines which focus on personal profiling, and meta search engines that present and possibly regroup the results of other existing search engines. This Opinion does not address search functions embedded on websites for the purpose of searching only the website’s own domain.

16. Opinion 1/2008 on data protection issues related to search engines - (What kind of data?)
Query Logs Content offered User Navigation
Search query Links Operational Data
IP-address Advertisements Data on registered users
Date and time - Data of other services
Cookie
Flash Cookie
Referring URL
Preferences
Browser
Operating system
Language

17. Opinion 1/2008 on data protection issues related to search engines - (Legal framework)
Controllers of user data
The fundamental right - respect for private life
Applicability of Directive 95/46/EC (Data Protection Directive)
Applicability of Directive 2002/58/EC (e-Privacy Directive) and
Directive 2006/24/EC (Data Retention Directive)
Content providers
Freedom of expression and right to private life
Data Protection Directive

18. Opinion 1/2008 on data protection issues related to search engines - (The lawfulness of processing)
Purposes/grounds mentioned by search engine providers:
Improving the service
Securing the system
Fraud prevention
Accounting requirements
Personalised advertising
Statistics
Law enforcement

19. Opinion 1/2008 on data protection issues related to search engines - (The lawfulness of processing)
Analysis of purposes and grounds by the Working Party
Consent - Article 7 (a) of the Data Protection Directive
Necessary for the performance of a contract - Article 7 (b) of the Data Protection
Directive
Necessary for the purposes of a legitimate interest pursued by the controller - Article 7
(f) of the Data Protection Directive
Service improvements
System security
Fraud prevention
Accounting
Personalised advertising
Law enforcement and legal requests

20. Opinion 1/2008 on data protection issues related to search engines
Some issues to be solved by industry
Data retention
Further processing for different purposes
Cookies
Anonymisation
Data correlation across services

21. Opinion 1/2008 on data protection issues related to search engines - (Obligations)
Obligation to inform data subjects:
- the identity of the controller and of his representative, if any;
- the purposes of the processing for which the data are intended;
- any further information such as
- the recipients or categories of recipients of the data;
- whether replies to the questions are obligatory or voluntary, as well as the
possible consequences of failure to reply;
- the existence of the right of access to and the right to rectify the data
concerning him.
Importance on the privacy policy!!!

22. Opinion 1/2008 on data protection issues related to search engines - (Rights)
Rights of the data subjects
Right to access data
Correction
Deletion

23. I.) Applicability of EC Directives
Opinion 1/2008 on data protection issues related to search engines – Summary
I.) Applicability of EC Directives
II.) Obligations on search engine providers
III.) Rights of users

24. Thank you for your attention!