1. 1 Data protection and privacy rights - outline of the e-learning course Council of Europe Help in the 28 Dorota Głowacka Helsinki Foundation for Human Rights University of Lodz Data protection and privacy rights - outline of the e-learning course Council of Europe Help in the 28 Dorota Głowacka Helsinki Foundation for Human Rights University of Lodz

2. INTRODUCTION

3. 3 Main challenges Threats to data protection are linked to the development of new technologies which are always faster than legislation Threats coming from both public authorities as well as private companies Different sources of law, different legal regimes

4. Fundamental Right Agency (FRA) report: „Access to data protection remedies in EU Member States” General conclusion: the effectiveness of data protection and redress mechanisms is considerably low. Main barriers for effective redress mechanisms inter alia: 1) low awareness and lack of education on data protection issues among data subjects 2) limited access to effective legal aid (low awarness among legal professionals) Need for training of legal professionals in the area of data protection and the right to privacy

5. Source: Statistics and reports on the website of the Inspector General for Personal Data Protection, http://www.giodo.gov.pl/138/j/en/

6. Objectives of the course Understanding the key principles of data protection and privacy rights Knowing different legal systems protecting the right to privacy and personal data Understanding the legal framework concerning data protection and privacy rights Understanding the case law of the ECtHR and the CJEU and its domestic implementation Understanding the role of international and national actors Understanding the interplay between law and technology Identifying the source of law which is applicable in a specific case Being able to apply the source of law Understanding the role of legal professionals in protecting personal data in the daily work

7. STRUCTURE OF THE COURSE

8. Structure of the course 10 modules 3 parts: I.Introduction + basic knowledge II.The most problematic areas III.Enforcement

9. Module 1: Introduction Pratcical problems Modules 2-3: Legal framework (CoE and EU law, hard law + soft law, role of European courts and their jurisprudence, main actors) Key concepts: data protection v. privacy Introduction to data protection law (material and territorial scope, terminology, key principles and rules) I. Introduction + basic knowledge

10. European standards EU system: Charter of Fundamental Rights Data Protection Directive CJEU jurisprudence WP29 opinions EDPS opinions CoE system ECHR Convention 108 ECtHR jurisprudence Soft law by CoE institutions

11. II. The most problematic areas Module 4: Data protection/privacy rights and health Protection of medical data as sensitive data (regulatory framework, main principles, jurisprudence) Challenges related to electronic medical records Anonymisation and pseudonymisation in health, clinical trials New technologies, wearables, internet of things in health sector Module 5: Data protection/privacy rights and media Balancing freedom of expression and the right to privacy Special role of media, protection of journalistic sources of information Challenges related to online media (managing online newspapers’ archives, restrictions of access to media content via search engines, liability for the third- party content, journalistic use of unverified Internet sources) Personal data protection and media (journalistic exemption)

12. Module 6: Data protection/privacy rights - e-communications and marketing Confidentiality of on electronic communications Privacy policies, cookies regime Profiling, selling of data Spam Data retention Cybersecurity Module 7: Data protection/privacy rights and disruptive technology Surveillance technology (CCTV, drones, GPS etc.) Internet of things, cloud computing, big data Module 8: Data protection/privacy rights in the work place Notion of privacy in a professional field Surveillance of communication in a workplace, processing employees’ data (consent as a basis for processing?) Protection of whistleblowers Professional secrecy

13. III. Enforcement Modules 9 – 10: Data subjects’ rights Legal remedies available to victims of violations of the right to privacy/data protection (civil, criminal and administrative law regimes) and sanctions for breaches Role of Data Protection Authorities Transboarder data flows (principles of transferring data to third countries, Safe Harbor and other grounds for transferring data)

14. GENERAL CONTENT RULES Excerpts from the course [work in progress] GENERAL CONTENT RULES Excerpts from the course [work in progress]

15. Module Structure: Overview I. Freedom of expression (FoE) and media Scope and limitations of FoE FoE and a special role o media Key ECtHR standards: Article 10 v. Article 8 II. Challenges related to online media Managing online newspapers’ archives Restrictions of access to media content via search engines Liability for the third- party content Journalistic use of unverified Internet sources III. Personal data processing and media Journalistic exemption MODULE: PRIVACY, DATA PROTECTION AND MEDIA

16. Learning Objectives Legal professional will be able to Describe the data protection and privacy issues related to the processing of data in the workplace Understand the relevant case law of the ECtHR and of the CJEU on the rights at issue Interpret and apply rules properly Legal professional will be able to Describe the data protection and privacy issues related to the processing of data in the workplace Understand the relevant case law of the ECtHR and of the CJEU on the rights at issue Interpret and apply rules properly Module: Privacy in a workplace

17. I. FREEDOM OF EXPRESSION AND MEDIA Module: Privacy, data protection and media

18. I. Freedom of expression (FoE) and media Art. 10 ECHR Art. 11 ChFR One of the rights likely to come into conflict with the right to data protection is freedom of expression which is protected both by ECHR (Article 10) and the Charter of Fundamental Rights (Article 11). When such conflict occurs, courts need to strikes a right balance in order to establish the pre-eminence of one right over the other. Module: Privacy, data protection and media

19. I. Freedom of expression (FoE) and media Art. 10 ECHR Art. 11 ChFR One of the rights likely to come into conflict with the right to data protection is freedom of expression which is protected both by ECHR (Article 10) and the Charter of Fundamental Rights (Article 11). When such conflict occurs, courts need to strikes a right balance in order to establish the pre-eminence of one right over the other. 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary Module: Privacy, data protection and media

20. I. Freedom of expression (FoE) and media Art. 10 ECHR Art. 11 ChFR One of the rights likely to come into conflict with the right to data protection is freedom of expression which is protected both by ECHR (Article 10) and the Charter of Fundamental Rights (Article 11). When such conflict occurs, courts need to strikes a right balance in order to establish the pre-eminence of one right over the other. 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. 2. The freedom and pluralism of the media shall be respected. 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. 2. The freedom and pluralism of the media shall be respected. Module: Privacy, data protection and media

21. I. Freedom of expression (FoE) and media o FoE includes the freedom to 1) hold opinions and to 2) receive and 3) impart information and ideas. o As a matter of principle, the protection of FoE extends to all forms of expression (through written statements, paintings, films or photographs), disseminated by any individual, group or type of media. Click on the buttons below to find out more about the scope of the FoE in the light of the ECtHR jurisprudence. o FoE includes the freedom to 1) hold opinions and to 2) receive and 3) impart information and ideas. o As a matter of principle, the protection of FoE extends to all forms of expression (through written statements, paintings, films or photographs), disseminated by any individual, group or type of media. Click on the buttons below to find out more about the scope of the FoE in the light of the ECtHR jurisprudence. Scope of FoELimitations of FoE Political, comercial and artistic expression Extreme expression Freedom of information Module: Privacy, data protection and media

22. Political, comercial and artistic expression Article 10 protects to the grate extent political expression and expression in matter of legitimate public interest (Lingens v. Austria).Lingens v. Austria The artistic expression (Müller and Others v. Switzerland) and commercial speech (Markt Intern Verlag GmbH v. Germany) are also guaranteed under Article 10. However, according to the ECtHR, with regard to these matters domestic authorities enjoy a broader margin of appreciation. The ECtHR’s scrutiny is therefore less strict than with regard to the political speech.Müller and Others v. SwitzerlandMarkt Intern Verlag GmbH v. Germany Article 10 protects to the grate extent political expression and expression in matter of legitimate public interest (Lingens v. Austria).Lingens v. Austria The artistic expression (Müller and Others v. Switzerland) and commercial speech (Markt Intern Verlag GmbH v. Germany) are also guaranteed under Article 10. However, according to the ECtHR, with regard to these matters domestic authorities enjoy a broader margin of appreciation. The ECtHR’s scrutiny is therefore less strict than with regard to the political speech.Müller and Others v. SwitzerlandMarkt Intern Verlag GmbH v. Germany Module: Privacy, data protection and media

23. II. Challenges related to online media 1.Managing online newspapers’ archives In this part you will find the key human rights standards in the area of online media developed in the ECtHR and CJEU jurisprudences. Go through all the sections by clicking „Next” or review a specific problem by clicking on one of the buttons below. In this part you will find the key human rights standards in the area of online media developed in the ECtHR and CJEU jurisprudences. Go through all the sections by clicking „Next” or review a specific problem by clicking on one of the buttons below. 4. Journalistic use of unverified Internet sources 3. Liability for the third-party content 2.Restrictions of access to media content via search engines Module: Privacy, data protection and media

24. 2. Restrictions of access to media content via search engines In the case Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González CJEU found that the accessibility of irrelevant or outdated information concerning an individual on the internet may be – under certain conditions – restricted by delisting it from the search results.Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González In the case Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González CJEU found that the accessibility of irrelevant or outdated information concerning an individual on the internet may be – under certain conditions – restricted by delisting it from the search results.Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González Facts ECtHR’s judgment The case concerned removal from the Google’s search results references to information available in the internet archives of one of the Spanish newspapers. The information regarded outdated financial liabilities of Mr. Gonzales and was published at the request of Spanish authorities in 1998. The newspaper refused to remove the information from its website even though Mr. Gonzales claimed the debt was not valid anymore and the information was no longer relevant. The individual then redirected his request for erasure to Google asking it not to show links to the newspaper in its search results when his name was entered as a search term in the search engine. Google refused. Eventually the case went to the Spanish court which asked the CJEU for a preliminary ruling on the matter. Main concepts Implications Module: Privacy, data protection and media

25. Key ECtHR standards: Article 10 v. Article 8 The most common instances of interference with the right to private life by media are publications which target one’s reputation (such as libel, defamation, insult), disclosing facts from private life or person’s image. Below you will find the key standards developed by the ECtHR which may help with finding the right balance between FoE and right to privacy in such cases. Protection of unpopular or offensive ideas Facts v. value judgments Privacy and public figures Proportionality of sanctions Module: Privacy, data protection and media

26. Proportionality of sanctions The imposition of disproportional sanctions for the exercise of the FoE may lead to a so called “chilling effect”. The chilling effect may likely discourage the author from making criticism of that kind again in future and deter them from contributing to a public debate (Lingens v. Austria). The character of sanctions is therefore an important factor in deciding whether the interference with the Article 10 was “necessary in a democratic society”.Lingens v. Austria The imposition of disproportional sanctions for the exercise of the FoE may lead to a so called “chilling effect”. The chilling effect may likely discourage the author from making criticism of that kind again in future and deter them from contributing to a public debate (Lingens v. Austria). The character of sanctions is therefore an important factor in deciding whether the interference with the Article 10 was “necessary in a democratic society”.Lingens v. Austria Example According to the ECtHR especially the criminal penalties should be subject to a strict scrutiny. The imposition of criminal sanctions for defamation, even if they are relatively light, may still cause a chilling effect (Długołęcki v. Poland). However this may also apply to disproportionately large damages awarded in the course of civil proceedings (in Tolstoy Miloslavsky v United Kingdom the applicant was ordered to pay £1,500,000 in damages for defamation - the sum awarded was three times the size of the highest libel award ever imposed in the country before).Długołęcki v. PolandTolstoy Miloslavsky v United Kingdom Too severe sanctions Chilling effect Module: Privacy, data protection and media

27. Key takeaways + Additional readings

28. Question 1 Right to privacy is protected both under the CoE’s European Convention of Human Rights and by the EU’s Charter for Fundamental Rights whereas personal data is protected only under the Charter. TRUE FALSE Module: Legal framework

29. Question 1 Right to privacy is protected both under the CoE’s European Convention of Human Rights and by the EU’s Charter for Fundamental Rights whereas personal data is protected only under the Charter. TRUE FALSE CORRECT FEEDBACK Even though personal data protection is not explictly mentioned in the ECHR (as it is in the Charter of Fundamental Rights) it is accepted due to the ECtHR’s jurisprudence that it is covered by the Article 8 of the Convention protectiing private and familiy life, home and correspondence. CORRECT FEEDBACK Even though personal data protection is not explictly mentioned in the ECHR (as it is in the Charter of Fundamental Rights) it is accepted due to the ECtHR’s jurisprudence that it is covered by the Article 8 of the Convention protectiing private and familiy life, home and correspondence. Module: Legal framework

30. Thank you! d.glowacka@hfhr.org.pl