Update Privacyrichtlijn

De organisatie Statewatch heeft een gelekt concept van een van de eerste officiële documenten in verband met de update van de Privacyrichtlijn gepubliceerd: A Comprehensive Strategy on Data Protection in the European Union. Deze ‘Communication’ spreekt over twee doelen: ten eerste het veiligstellen van het vrije (internationale) verkeer van persoonsgegevens, en ten tweede het veiligstellen van fundamentele rechten, waaronder het recht op bescherming van persoonsgegevens. De Commissie noemt vijf zaken die speciale aandacht verdienen, waarvan de eerste ziet op technologische ontwikkelingen. In dit kader wijst de Commissie meteen op de eerste pagina expliciet op cloud computing, social networks, cookies en locatiegegevens van bijvoorbeeld smart phones. Zie de SOLV blog (via Wouter Dammers van SOLV).

Enkele citaten:

“Fifteen years later, this twofold objective is still valid and the principles enshrined in the Directive remain sound. However, rapid technological developments and globalisation have profoundly changed the world around us, and brought new challenges to the protection of personal data.

Indeed technology nowadays allows individuals to disseminate information about their behaviour and preferences easily and make it publicly and globally available on an unprecedented scale. Social networking sites, with hundreds of millions of members spread across the globe, are perhaps the most evident, but not unique, example of this phenomenon.

"Cloud computing" - i.e., Internet-based computing whereby software, shared resources and information are on remote servers ("in the cloud") - also poses challenges to data protection, as it involves the loss of individuals' control over their potentially sensitive information when they store their data with programs hosted on someone else's hardware. A recent study confirmed that there seems to be a convergence of views – of Data Protection Authorities, business associations and consumers' organisations – that risks to privacy and the protection of personal data associated with online activity are increasing.

At the same time, the means of collecting personal data have become increasingly sophisticated and less easily detectable: for example, the use of cookies allows economic operators to better target individuals online with advertisements, thanks to the monitoring of their web browsing (so-called "behavioural advertising") and the growing use of geo-location devices makes it easy to determine the location of individuals simply because they possess a

mobile phone. Public authorities also use more and more personal data for various purposes, such as tracing individuals in the event of an outbreak of a communicable disease, for preventing and fighting terrorism and crime more effectively, to administer social security schemes or for taxation purposes, in the framework of their e-government applications etc.”

“All this inevitably raises the question whether existing EU data protection legislation can still fully and effectively cope with these challenges. In order to address this question, the Commission launched a process of review of the current legal framework, which started with a high level conference in May 2009, followed by a public consultation until the end of 20093 and by more targeted stakeholders' consultations throughout 2010. A number of studies were also launched. The results of this process confirmed that the core principles of the Directive are still valid and that its technologically neutral character should be preserved. However, several issues have been identified as being problematic and posing specific challenges. These include:

• Addressing the impact of new technologies

Responses to the consultations, both from private individuals and organisations, have confirmed the need to clarify and specify the application of data protection principles to new technologies, in order to ensure that individuals' personal data are actually effectively protected, whatever the technology used to process their data, and that data controllers are fully aware of the implications of new technologies on data protection. It is to be noted that, in

the electronic communication sector, this has been addressed by Directive 2002/58/EC (socalled "e-Privacy" Directive), which particularises and complements the general Data Protection Directive.”

“Complexity is also growing due to globalisation and the development of technologies:

data controllers are increasingly operating in different Member States and jurisdictions, providing services and assistance around-the-clock. The Internet makes it much easier for data controllers established outside the European Economic Area (EEA) to provide services from a distance and to process personal data in a virtual environment; and cloud computing makes it difficult to determine the location of personal data and of equipments used at any given time.

However, the Commission considers that the fact that the processing of personal data is carried out by a data controller established in a third country should not deprive individuals of the protection to which they are entitled under the EU Charter of Fundamental Rights and EU data protection legislation.”

Lees hier het gehele document.