InfoSociety
Currently browsing 'InfoSociety'
EU Privacy and the Cloud: Consent and Jurisdiction Under the Proposed Regulation
Cloud computing allows dramatic flexibility in information processing—and on a global basis. Its technology permits data transmissions that span the globe. Computing activities now shift from country-to-country depending on load capacity, time of day, and a variety of other factors. These decisions are sometimes made in real time and by machines rather than humans.
The cloud is also a business sector in which U.S. companies lead the world in new products and services. Important and innovative cloud offerings include Salesforce, Dropbox, Google Drive, the Amazon Elastic Compute Cloud, and Microsoft SkyDrive. The market for cloud computing is already a multibillion-dollar international market. Forrester Research Inc. has predicted a growth in the size of this market from $40.7 billion in 2011 to more than $241 billion in 2020.1
Due to the international dimensions of cloud computing, regulations outside of the United States are now as important as those inside it. The European Union is the most important bilateral trade area for the United States, and its proposed data protection regulation (“Proposed Regulation”) is of profound significance for U.S. companies that offer cloud services.2 As the European Commission notes, concerns about data protection constitute “one of the most serious barriers to cloud computing take-up.”3 It calls for “a chain of confidence-building steps to create trust in cloud solutions.”4 One of the most important of these steps is the Proposed Regulation and its strong protections for information privacy.
U.S. cloud services should take particular note of two areas of the Proposed Regulation. The first concerns its limitations on the use of an individual’s consent to permit data processing. The second is how it crafts a broad jurisdictional reach for EU information privacy law.
Consent
For an American cloud company, a logical step to justify information processing might be to gain permission from the user of its service. After all, “notice-and-consent” is an established legal principle in the United States. Under it, companies provide notice regarding their planned information use to the affected individual and then gain his or her consent for the data processing.5
In the European Union, the starting point is different: personal data processing is only permitted in the European Union pursuant to a legal basis. Without an authorization in an EU law or some legal provision, the use of personal information is impermissible.6 Is consent then a possible means for U.S. cloud companies to gain a legal basis for information processing?
Is consent a possible means for U.S. cloud companies to gain an EU-recognized legal basis for information processing? The short answer is “no.” The Proposed Regulation sets strong restrictions on the use of the consent mechanism with the result of greatly limiting its availability for cloud companies. To be sure, the Proposed Regulation does list “consent” as one of the legal justifications for the processing of personal data.7 It requires that written consent for personal information processing be presented in a form “distinguishable” from any other matter,8 which is a requirement that U.S. companies should be able to meet, although it will require innovative steps on their part. Yet, its Article 7 places the “burden of proof” of demonstrating consent on the “controller,” that is, the party who determines the purposes and means of the processing of personal data.9 This requirement makes the consent option less available and less attractive. It heightens the risk that a user’s consent will not stand up if a data protection commissioner or the user herself challenges the assent after the fact. One such ground for this challenge would be that the affected party did not have an adequate basis to provided consent in a knowing and informed matter to the data processing.
Finally, and most problematically, the Proposed Regulation effectively places consent per se out of bounds for many, indeed perhaps most, situations involving the cloud. It states that “[c]onsent shall not provide a legal basis for the processing” when “there is a significant imbalance between the position” of the controller and the party to whom the data refers.10 Cloud companies cannot justify processing by a party’s consent if they offer take-it-or-leave-it terms for the processing of personal data, or provide cloud services for employees or other parties that lack effective bargaining power.
This skepticism toward consent is already known to EU privacy law. For example, in its investigation of Google’s unified privacy policy, the French data protection commission, the CNIL, expressed strong skepticism about any reliance on consent. The critical language concerned Google Apps, which are a suite of email and office collaborations applications. Google Apps allow teams of workers to collaborate and manage information. In October 2012, the CNIL stated: “For Google Apps end-users, the use of a Google Account is decided by the Google Apps customer (typically the company that employs the end-users): consent may therefore not be valid.”11 The CNIL is arguing that consent from the company in the EU that signs up for Google Apps does not necessarily amount to valid consent from its employee.
In the context of public sector clouds in the European Union, consent is equally problematic. Already, the Article 29 Working Party, an EU-wide organization of national data protection commissioners, has called for “[s]pecial precautions” to be taken before the public sector uses cloud services.12 These officials are also likely to reject citizen consent as a basis for permitting this processing. As in the employment context more generally, there is a significant power imbalance between federal, state, and local governments and their citizens. This imbalance would prevent reliance on the consent of the affected citizen to justify the public sector’s use of cloud services. This language regarding imbalance in negotiating positions also casts doubt on any simple reliance on a contract as a legal basis for allowing the processing of personal data in the European Union. As a consequence, U.S. cloud companies cannot rely on one-sided click-through agreements.
It is therefore back to square one: the processing of personal information in the European Union means compliance with measures in EU law that permit such activity. In particular, as Article 6(3) of the Proposed Regulation states, the law that justifies the processing must be “in the public interest, … respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued.”13 This language means that cloud companies are obliged to meet the strict “fair information practices” of EU information privacy law.
As a silver lining, the Proposed Regulation recognizes the important existing instruments that harmonize EU and U.S. privacy law. These are the the U.S.-EU Safe Harbor Program, binding corporate rules, and model contracts.14 While their use entails higher requirements and burdens for companies than consent, these mechanisms are all available under the Proposed Regulation. Moreover, the European Commission has called for development of “safe and fair contract terms and conditions” for use of cloud services.15 The European Data Protection Supervisor has also emphasized the need for improvement and standardization of the contract terms of cloud service providers.16 In contrast, reliance merely on the consent of the affected party would be made on thin ice.
Jurisdiction
The Proposed Regulation creates a jurisdictional net that sweeps broadly.17 It applies to “processing activities” that are related to “the offering of goods or services” to individuals within the European Union or “the monitoring of their behavior.”18 The result potentially subjects all cloud services to EU privacy law.
The difficulties here are numerous. The Proposed Regulation does not provide any further definitions or explanations of the term, “offering of goods or services.” Since the cloud is available anywhere in the EU that an internet connection can be found, any cloud company is presumably “offering” its product within the European Union and covered by the Proposed Regulation.
Finally, the Regulation equates its concept of “monitoring” of behavior broadly with “profiling.” The EU definition of this concept reaches tracking on the internet “with data processing techniques … , particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.”19 Many kinds of value-added services that draw on the user’s information may be “profiling,” and, hence, “monitoring” in this sense of the Proposed Regulation.
In short, the current formulation of the Proposed Regulation extends EU information privacy law to a wide range of circumstances in which networked intelligence on the internet shapes applications and services for EU users. In many instances, however, there may not be a privacy impact on an EU citizen: a cloud service may only be providing computing power for an EU company. Nonetheless, these companies may still face complex obligations under EU privacy law. The European Union’s arcane distinctions between “controllers” and “processors” add a further degree of regulatory complexity in this area.20
In short, the current formulation of the Proposed Regulation extends EU information privacy law to a wide range of circumstances in which networked intelligence on the internet shapes applications and services for EU users.
Three adjustments are necessary to EU privacy law. As part of their ongoing consideration of the Proposed Regulation, the European Council, Parliament, and Commission should adopt these proposals.
First, the Proposed Regulation should borrow an existing jurisdictional exemption from the EU Data Protection Directive (95/46/EC). Current EU law withholds jurisdiction if “equipment is used only for purposes of transit through the territory of the Community.”21 Certain cloud services fit neatly within this exemption. An example would be companies that provide Infrastructure as a Service (IaaS). In IaaS, a cloud provider might offer server and network components, virtualization, file systems, and capacity on demand. The EU Electronic Commerce Directive (2000/31/EC) also frees an intermediary service provider if it is a “mere conduit” that transmits information.22
Second, the Proposed Regulation’s concept of the “offering” of services should be replaced with the “directing” of services. An earlier “Interservice Draft” of the Proposed Regulation contained the latter term.23 Relevant existing tests in other areas of EU law as to its meaning include acceptance of the euro for services, or facilitating access within the European Union for the service or product, such as through use of a top-level domain name of an EU member state.24 The benefit of the idea of “directing” services is that it focuses on whether a non-EU organization has chosen to enter the EU market.
Finally, the European Union should modify its view that “monitoring” is synonymous with “profiling.” It should view “monitoring” more narrowly and restrict it to situations where observations of an individual are linked to privacy risks. For example, mere observation without decision making about a person should be excluded from the definition of “monitoring.” Such observational steps might include initial stages of collection and analysis of information where there is no privacy risk for an identified person. An example would be the collection of information to reject unsafe browsers from logging on to cloud services.
Conclusion
The Proposed Regulation will alter the landscape in the European Union for U.S. cloud services. First, the Proposed Regulation drastically narrows the conditions for reliance on the use of “consent” mechanisms as a justification for data processing. It does permit, however, recourse to existing harmonization instruments such as the U.S.-EU Safe Harbor Program, binding corporate rules, or model contracts. Second, the Proposed Regulation extends EU privacy jurisdiction quite broadly. Should these provisions not be reformed before adoption of the final regulation, EU privacy law will widely apply to non-EU cloud companies. While it is necessary and appropriate for the European Union to protect the online privacy interests of its citizens, the European Union should not become the super-regulator of all cloud companies regardless of the extent of an impact on its citizens.
This article was written by SafeGov expert Paul Schwartz of Berkeley Law School. It first appeared on Bloomberg BNA. The original article can be found here.
1 See Shane O’Neill, Forrester: Public Cloud Growth to Surge, Especially SaaS, CIO, Apr. 26, 2011, http://www.cio.com/article/680673/Forrester_Public_Cloud_Growth_to_Surge_Especially_SaaS.
2 European Commission, Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals With Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation) (Jan. 25, 2012) [hereinafter Proposed Regulation], available at http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf (11 PVLR 178, 1/30/12).
3 European Commission, Communication From the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions: Unleashing the Potential of Cloud Computing in Europe 8 (Sept. 17, 2012) [hereinafter Unleashing the Potential of Cloud Computing in Europe], available at http://ec.europa.eu/information_society/activities/cloudcomputing/docs/com/com_cloud.pdf (11 PVLR 1474, 10/1/12).
4 Id. at 9.
5 On the reliance in the United States on a notice-and-consent model, see Paul M. Schwartz, The EU-U.S. Privacy Collusion, 126 Harv. L. Rev. 1966, 1976 (2013).
6 Proposed Regulation, supra note 2, at 43–44.
7 Id. art. 6(1)(a), at 44.
8 Id. art. 7(2), at 45.
9 Id. art. 7, at 45.
10 Id. art. 7(4), at 45.
11 Commission nationale de l’informatique et des libertés (CNIL), Google Privacy Policy: Main Findings and Recommendations 8 (Oct. 16, 2012), available at http://www.cnil.fr/fileadmin/documents/en/GOOGLE_PRIVACY_POLICY-_RECOMMENDATIONS-FINAL-EN.pdf (11 PVLR 1559, 10/22/12).
12 Article 29 Data Prot. Working Party, Opinion 05/2012 on Cloud Computing 23 (July 1, 2012), available at http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2012/wp196_en.pdf (11 PVLR 1097, 7/9/12).
13 Proposed Regulation, supra note 2, art. 6(3), at 44.
14 See id. art. 42(2), at 70–71.
15 Unleashing the Potential of Cloud Computing in Europe, supra note 3, at 11.
16 See Article 29 Data Prot. Working Party, supra note 12, at 23 (emphasizing the need for standardization of contract terms regarding law enforcement access to personal data).
17 For more detailed analysis of the jurisdictional provisions of the Proposed Regulation, see Paul M. Schwartz, Information Privacy in the Cloud, 161 U. Pa. L. Rev. 1613 (2013).
18 Proposed Regulation, supra note 2, art. 3(2), at 41.
19 Id., recital 21, at 20.
20 See Council Directive 95/46, art. 2(d)–(e), 1995 O.J. (L 281) 31, 38 (EC).
21 Id. art. 4(1)(c), at 39.
22 Council Directive 2000/31, art. 12(1), 2000 O.J. (L 178) 1, 12 (EC). The Electronic Commerce Directive sets up a test with three prongs for deciding when an entity is such a “mere conduit.” These requirements are that it “(a) does not initiate a transmission; (b) does not select the receiver of the transmission; and (c) does not select or modify the information contained in the transmission.” Id.
23 European Commission, Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals With Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), art. 2(2), at 36 (Nov. 29, 2011) (“directed”), available at http://statewatch.org/news/2011/dec/eu-com-draft-dp-reg-inter-service-consultation.pdf. For background on this concept, see id. recitals 14–15, at 20.
24 See, e.g., Joined Cases C-585/08 & C-144/09, Pammer v. Reederei Karl Schlüter GmbH & Co. KG, 2010 E.C.R. I-12520, I-12584, para. 29, I-12589, para. 47 (determining whether the operation of a website could be considered activity “directed to” a member state). The opinion is available online in the original German at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:62008CJ0585:DE:PDF, as well as in English, at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:62008CJ0585:EN:HTML.
ICT to be placed at the forefront of the school primary curriculum?
Recently this April, the publication of The Rose Report led by Sir Jim Rose, former director of inspection for Ofsted, concluded that Information Communication Technology should be placed at the forefront of the United Kingdom primary school curriculum. It has been proposed that communication technology should be placed on the same pedestal of the main pillars of education, numeracy and literacy. Currently statistics state that only twenty five to thirty percent of primary children can use information technology well. In the new dawn of a rapidly digitised age in information, a focus on modernised learning is paramount. The report argues that the subject should be taught discretely and be eased into or used in conjunction with a variety of subjects across the curriculum by the end of Key Stage Two. The wide scale dissemination of information within a timeless cyber capsule means that young students will need to know how to intelligently and methodologically select, process, find and refine this large amount of data, whilst also being able to manipulate, communicate and share it across the internet.
Naace, the association for ICT teachers in Britain back the report, whilst also suggesting that teachers should also be given the training and support needed to ensure the subject is taught effectively. New age media including Twitter, podcasting, wikis and blogs will be taught within schools, as they are the main portals for information to be exchanged and shared, whilst also providing a civic forum for people to express through their penmanship. However, the report clearly states that this proposal is not about teaching the young about the latest fashions, but rather how to be well equipped to approach and use this technology. There are scientific and social advantages to teaching ICT as it is known to enhance pupil performance. Chris Bayne acting head of Murdishaw West Community Primary School told the Guardian paper that podcasting for example has helped his pupil’s listening, speaking and writing skills, whilst also boosting their confidence to engage and interact with a range of actors face to face.
Various schools have adopted the method. For instance, Torriano Junior School in Kentish Town London follow a values based curriculum, including citizenship and ICT such as podcasting and video-conferencing. The Arts is also emphasised for its communicative and creative expression. Despite these advances, it has been stressed by teachers that new social media sites such as blogging should not jeopardize the importance of good grammar; a lifelong skill required for all professions in the future.
Creating digital jobs easier than putting humans on the moon
I’ve always been interested in space. Mysteries of the universe, space travel, black holes and all that. So it was a real pleasure to hear an 83-year-old Buzz Aldrin speak at a dinner in Brussels recently, and to discover that my dinner table neighbour worked for NASA. It got me comparing the challenges of getting men to the moon, and crucially, back again, with the other challenge that occupied the beginning of that week; creating more digital jobs in Europe.
I imagined someone in NASA setting out a radical plan to achieve this incredible feat and then inviting people to build on it. Here, I’m standing on the shoulders of the many giants who have got us this far and setting out my thoughts on how to meet today’s digital jobs challenge.
The Grand Coalition for digital job creation was launched in Brussels on 4 March. It brings together four parts of the European Commission with a range of stakeholders, including my own association, DigitalEurope. Inspired by EU Commissioner for Digital Affairs Neelie Kroes, the coalition’s purpose is win-win; get unemployed talented Europeans into work and fill the gaps in their workforces that many employers say holds back their growth.
The launch was a big success and a culmination of some impressive cheer-leading and enthusiasm-building by Kroes.
The challenge now is to execute. And first we need a plan. Here’s how I see it.
Start with some definitions. We need to agree what digital jobs are. They aren’t just information communications technology (ICT) jobs but go far beyond that. How about “jobs that create or exploit digital technologies to deliver social or economic benefit in Europe”. Any good definition will stretch from programmers to web entrepreneurs.
Next, segment these jobs and guesstimate how many there will be and in which countries or regions. Only pay attention to big segments. I would guess a long list would include; (big) data analysts; cyber-security specialists; hybrids with both business sector (including public sector) knowledge, and digital technology expertise; app developers; cloud specialists; green experts; and business analysts.
Thirdly, identify the training provision needed for each big segment and spot gaps. Incentivise industry to create vendor neutral “unbranded” training schemes and create maps for each segment that show how the neutral and vendor specific schemes fill the needs.
Fourthly, develop schemes to encourage labour movement between high demand and high supply countries and regions.
Then build tomorrow’s workforce. Equip careers advisers and primary school teachers. Work closely with educators to ensure they find a way of both meeting students’ broader educational needs and giving them the best possible base for a future digital job. It is not either or – it has to be both. Industry needs to be clear – only a very small percentage of future digital jobs require a computer science degree. (Check out the employment rate differences in the UK between an ITMB and a “traditional” computer science degree.)
As NASA knows, a plan is a start but you need to execute it. So here are a couple of thoughts. There is a lot of expertise at a national level. Although there are some things that can only be done at a European level, much of the implementation must be done on the ground, in the countries and regions of Europe.
So bring some of the national e-skills leaders together to drive this forward. I haven’t seen much evidence of this so far. There is a lot of experience and expertise across the Commission, at least four of the directorate-generals. Bring them together into one “tiger team” or “hit squad” for the rest of this Commission’s life and have them, and the other stakeholders work to one plan with one leader.
Leadership and a focus on execution are essential. Don’t let bureaucracy and procedures get in the way. If we can put men on the moon, and get them back we can surely do this. Europe’s future might just well depend on it.
John Higgins – Director General DIGITALEUROPE
The curse of campanilismo?
Media commentators are talking about the long-term risk that the European institutions will “disintegrate”. But the foundations on which these institutions are based – the subsoil of the European Union – are also shaky.
There are a number of long-term trends that all seem to point in the same direction: the ‘balkanisation’ or fragmentation of European society.
The first trend is already with us: a public opinion that challenges the historical status of the institutions. The political classes have lost the respect of the man-and-woman-in-the-street, public administrations are ridiculed, Big Business is discredited, bankers are treated like vermin, NGOs are greeted with cynicism, religion is marginalised, even royalty is now fair game.
In the longer term, what does all this mean for the nation state? And that’s where the second emerging trend looks so threatening: an emotional return to a simpler life ‘closer to home’.
This is not latter-day hippiedom, but a considered reaction by many people. It is a growing commitment to campanilismo or localism, the belief that big countries and big institutions are no longer to be trusted.
This spirit of localism is exploited, of course, by the same political classes that have lost public respect. They ‘harvest’ support successfully, simply because the public environment is so receptive. Campanilismo is firmly rooted in Belgium, Spain and the UK, as well as in Italy. Meanwhile economic arguments citing the Nordic countries stress the superior manageability of mini-states.
But this ‘move downwards’ goes further, from communities to individuals. The Millennial generation is showing the way with its attachment to social technologies and the creation of ‘tele-ghettoes’, where the individual lives in a bubble designed to reinforce his convictions and prejudices.
What drives the young in particular is the desire to reinforce an identity that is no longer determined by nationality, political orientation or some other classification coming from the ‘official’ environment. The fragmentation of European society will continue, with people looking for comfort in what seems ‘closer to home’.
In the words of journalist Anand Giridharadas, “a major consequence of technology over the last many years has been to erode institutions of authority and shelter us in bubbles of personal truths.”
What this will mean for the European ideal remains to be seen. It’ll be some decades before we know the outcome.
Google’s collision course with member states
European Union regulators have taken their first step to making good on their recent threat to take “repressive action” against Google by summer.
Following last month’s final meeting between Google and European regulators at which “no change” in Google’s attitude was seen, at least five European countries have begun their own investigations into Google’s global privacy policy, promising coordinated enforcement action by summer.
There is nothing to stop other EU member states from taking their own actions as well, if, as now seems inevitable, Google does not significantly modify its 2012–issued global privacy policy to conform to fundamental European privacy principles.
But what, exactly, is likely to happen?
Though crystal balls are of little use in predicting what the 27 EU member states may do, a recap of Google’s latest dispute with the EU, and a review of EU data protection enforcement authorities, may provide some clues.
In a significant revision of its global privacy policy, Google early last year asserted the right to expand its data mining activities to combine personal data of its users across all of an individual’s accounts and services, including: gmail; Internet searching; map and location information; and photo sharing, with no ability for individuals to opt out.
Google, which reportedly has 80 percent of the EU search engine market, 30 percent of the EU smartphone market, and 40 percent of the global online video market, is not alone in seeking to expand its mining of users’ personal data. Facebook, for example, launched two controversial programmes last year to aggregate Facebook user data with other private data held by advertisers and collected via loyalty cards and programmes. And, in December, the EU launched a formal inquiry into changes to Microsoft’s privacy policy.
The EU’s main privacy regulatory body, the “Article 29” Working Group, voiced concern about the increased threat to EU citizens posed by Google’s sweeping 2012 privacy policy change almost immediately after it was announced.
Even before the policy went into effect, the Working Group, comprised of EU member country Data Protection Authorities (“DPAs”), publicly urged Google to delay putting the policy into effect until the Working Group could carefully review it. Google refused to delay implementation of the policy and, at the request of the Working Group, the French national DPA, the CNIL, took the lead in investigating Google’s new policy.
In late February 2012, the CNIL made a preliminary finding that Google’s policy violated the key EU privacy law, the Data Protection Directive ((Directive 95/46/EC, the “DPD”). The CNIL then sent Google several letters of inquiry and asked them not to implement the policy. Google responded to the CNIL’s questions but implemented the new policy over the CNIL’s objections and, at least in the CNIL’s opinion, failed to fully and sufficiently provide the requested information.
After the CNIL’s investigation, the Working Group found that Google’s policy violates a number of provisions of the EU Data Protection Directive and ePrivacy Directive, including requirements that: collection of personal data only be for limited purposes; users be fully informed about the intended uses of their data; and users be given the right to opt out. The regulators asked Google to make significant changes to its policy and threatened regulatory action if Google failed to make such changes in four months.
Repressive action
To date, Google has failed to make any significant changes, leading to the threat of “repressive action.” What might such action look like?
Although the EU strives for integration, the power to impose sanctions for privacy violations is, under current law, left to the member states. Under the DPD, EU member states are required to endow their individual DPAs with the power to investigate violations and impose sanctions and/or initiate legal proceedings. The Working Party itself can advise the EU Commission and issue opinions. Though these are not legally binding, they carry a great deal of weight with the individual Member State DPAs.
In its announcement (18 February), the EU data protection authorities said they would “coordinate their coercive actions… [which] should be implemented before the summer.” Then, after a two-day Working Group meeting, the regulators announced that Google would be called to appear before regulators as they prepare for coordinated enforcement actions.
If, in the wake of the most recent meetings and investigations announcement, Google maintains its unwillingness to modify fundamental provisions of its privacy policy in response to the Working Group’s concerns, it seems likely that at least some member states, including some or all of the five identified as opening their own investigations, will take enforcement action against the company.
The regulators have issued so many warnings to Google, and the issues raised are so integral to how Europeans view their fundamental human rights, that it is difficult to see how the EU regulators can back down. They likely will calculate – reasonably – that failure to act now will encourage similar actions by numerous other companies and strike a blow to meaningful deterrence of future privacy violations.
Enforcement and sanctions authorities and activities in EU member states vary widely, from Belgium, where the DPA has limited authority to impose fines, to Spain, which issues substantial fines, to Germany and France, which have substantial authority but use it in widely divergent ways depending in particular cases.
The types and severity of sanctions available to DPAs, depending upon individual national laws, can include, in increasing severity: relatively informal guidance; recommendations; investigations; formal warnings; administrative sanctions (monetary fines); public admonishment; blocking of data processing or transfers; and, finally, criminal sanctions.
It seems likely, then, that, without accommodation by Google, the Article 29 Working Group will coordinate enforcement actions by at least some member states by summer. It is at least possible that some member states will attempt to make an example of Google, and deter other companies, by imposing unusually high fines, and possibly impose injunctive remedies, such as legally prohibiting processing of data found to violate EU privacy law. Given the EU member states’ history, however, it seems highly unlikely that any Google officials will be subjected to criminal process.
Bryan Cunningham is an independent information security and privacy lawyer and a Senior Adviser to the Chertoff Group, where he advises clients on information security, data privacy and data protection programmes. He served previously in senior intelligence and law enforcement positions in the US government in both the Clinton and Bush Administrations.
[NOTE: This article first appeared on euobserver.com.]
Virtual Classroom Unites Rural Students from Greece and Cyprus
When Gaydo and Agios Spiridonas Nicosia started a Open Discovery Space inspired collaborative project using folk songs and poems to learn about Byzantine Border Protectors little did either school know that they were about to change the educational experience of one little girl on a depopulated rural island in Greece. But this is exactly what happened.
Good Morning Brussels: Waking up European Innovation
Europe faces many innovation challenges. Venture capital is not easy to come by and credit is expensive and difficult to get. When compared with the US where risk-taking is part of the culture, Europe has a more conservative culture that is driven by fear of failure.
So, why is it so hard to get a start-up off the ground in Europe? Why is it so hard for Europeans to be entrepreneurial? How can easing administrative burdens encourage innovation and entrepreneurship in Europe?
If we compare the tools and the strengths of the most successful digital entrepreneurs in the world today, most of them come from the United States. We all buy books on Amazon, trade on eBay, share pictures on Flickr or Tumblr, we chat on Messenger, we socialise on Facebook, we Google, we Youtube and much more. All these things are done using American technological innovations and platforms.
So, what does the US have that we don’t have here in Europe? They have a uniquely successful technology hub, Silicon Valley, that has not been emulated in Europe. They attract top talent and pay highly competitive wages. Plus, there is a singular American dream to be the best and most innovative. This dream is supported by the highest political office, the President. In his victory speech after the election last year, Barack Obama reminded Americans that everything is possible and he called on Americans to put the United States back on top. Have we ever heard such an elegant call to action inviting Europeans to build the big dream from President Barroso or President Van Rompuy
The other challenge remains the European Single Market. In the United States they can reach a scale 250 to 300 million people and thus make their platforms profitable. With this fast pace of scaling possible in the US market, a natural next step is expansion. Entrepreneurs in the US look to expand across the Atlantic through the UK, to a logical first port, and then into the Continent. By comparison, local initiatives quietly simmer in Europe and rarely reach scale, let alone entertain notions of expansion. Unless these Start-ups move their businesses offshore early on they can’t access what they need for growth.
The European Single market is a nice concept, but language is a huge barrier to its successful completion. This is particularly challenging for Start-ups where platforms change daily. To make a company viable across Europe, every change creates significant additional costs and requires a massive investment of time because it needs to be in at least 24 languages. Then there’s cross-border marketing. The markets of Europe are vastly different. In Europe companies roll-out in country by country – first Germany and then France etc. This generates a massive time lag in scaling potential – not to mention the high costs of marketing, which means less money for investment in innovation.
Europe is overly bureaucratic. For example, a Greek company recently wanted to set up an eCommerce business to sell Greek food abroad, but it was impossible to get the Greek banks to give them facilities to accept payments online. This demonstrates that Europe just is not ready for innovative businesses, we’re just not used to it – we don’t have the infrastructure in place to facilitate it. In the end the Greek company used Paypal to facilitate its cross border payment facilities.
Legal costs are an additional impediment. This is due to the fact that laws are transposed differently in member states. The reality is that even if Europe has one law, companies still need to operate according national laws. When we add to this the general distrust amongst European consumers about eRetail, the soil appears to be nearly barren when it comes to potential for innovation.
But that is not to say that there is no potential to create successful model for innovation and entrepreneurship. We can we create a single platform in Europe that builds on the ingredients of scale, identification of talent and harnessing funds from the public-private partnerships. And, while language diversity is something that is holding us back, it can also become an advantage by putting together the finest minds. For example German ingenuity and Greek creativity could create surprising results given the right environment to share ideas and knowledge.
The European Commission’s DG Enterprise and Industry is investigating how to tap European innovation. Their newly launched programme called, Doing Business in the digital age: the impact of new ICT developments in the global business landscape, brings together industry to help figure out how to shape the EU vision and strategy. Together we are focussing identifying all the hurdles to innovation and entrepreneurship and finding ways to remove them.
From my point of view there is a very simple recipe for success. We should focus on identifying one or two European champions and develop this talent. What Europe needs is entrepreneurs like the founders of Spotify and Skype – and the right levers to keep this talent in Europe. We don’t need many champions, just one or two to lead a new generation of young and brilliant entrepreneurs. Success will come from commitment to and investment in young talent.
2020 must be our target. We must deliver all the ingredients of the Digital Agenda for Europe by 2020. Europe should be brave and we must be vocal. We must grow world-leading talent. This will automatically spark the European dream. This European dream will go beyond cultural borders. We could have a Greek or a Danish digital champion who is supported through a centralised incubation system. This will start the ball rolling and others will quickly follow.
This is not an impossible dream. Like great sports winners, where one gold comes others soon follow. If we invest now by 2020 there will not only be eBay and Amazon but we will have some new European platforms. If we don’t move now the risk is that China will beat Europe to the punch. Today, the Chinese dragon is only feeding his appetite on his content and population. There is little desire to expand Baidu, Tudou, Sina or QQ, but it’s still early days.
Meanwhile, Russian digital businesses have long arms. Yandex has just started their expansion. They have four thousand engineers and entrepreneurs eager to learn and they are funding an expansion into Turkey – an 80 million market – with a view of going head-to-head with Google. If they succeed then they might well enter into Europe.
This is a reality check for Europe. If the Chinese dragon starts to expand, Uncle Sam is already dominant globally, and the Russian Roubles all do the same and Europe doesn’t start to get organised, what place will we have in the digital economy of tomorrow?
Europe has already suffered severe losses in the hardware segment of the ICT sector. If we lose the internet battle our future does not look bright. This is more than a wake up call. We have to act. We have all the ingredients, everything is here: employment, talented people, a population that is heavily engaged online. Citizens are ready to start contributing to the online economy. But we need a common vision for Europe. We just need one or two objectives – let’s develop one or two European entrepreneurs into major global players.
We must create a platform, a digital EU incubator, and invite the twenty seven member states to bring three of their most innovative start ups or companies into the champions league. This incubator is a place where substantial public-private funds are invested and where mentors with a track record can provide the necessary know-how and framework for success and development for scale.
If we build an incubation super-platform, the chosen few will be supported by all means necessary to achieve world-wide reach. Only a couple will succeed but we have to accept that some failure is part of deal. If we pump everything we can into creating European digital champions in the next eight years others will surely follow.
Penned by Alan Heureux, President of IAB Europe
Good Morning Brussels is the sound of the European digital advertising industry in Brussels. This is the first in a series of posts by captains of the European online digital industry looking at how to overcome Europe’s innovation challenges.
Digital and Security – a tricky mix
Good audit committees need to be able to deal with all types of risks – many associated with matters about which committee members have no personal prior knowledge. Cyber security is a classic example. Digital technologies are fast moving and ever more pervasive. Security matters are by their very nature often shrouded in secrecy. So audit committees have to ask questions and gather information that allows them to properly evaluate both likelihood and impact and put in place mitigation measures proportional to the risk. The same thinking could be used by policy makers too.
I moderated a DIGITALEUROPE briefing for interested European parliamentarians in early March. It was clear that the nature and scale of the challenge is not properly understood – and that’s understandable given the difficult nature of the subject. Those whose information or infrastructure has been compromised rarely advertise the fact. Yet efforts to raise awareness of the threat run the inevitable risk of causing undue fear. Add to these the need to avoid stifling innovation and fragmenting the European market even further and you can see the difficult tightrope policymakers have to walk.
I offer three guiding principles that could form a useful framework for thinking about cyber security. First concentrate on raising awareness and building circles of trust within which information can be shared, and then implement voluntary mechanisms that are easy to use and bring rewards to the participants. And there are rewards, such as early access to information about new threats. Look for good practice that already exists – there is plenty. Secondly be proportionate. Don’t burden SMEs with unnecessary requirements and regulation and distinguish carefully between what really is important to our well-being and what isn’t. Don’t use sledgehammers to crack nuts. Finally, recognise that cyber knows no geographical boundaries; build the circles of trust using international standards and approaches with like-minded entities across borders.
DIGITALEUROPE cares greatly about the safety and security of Europe’s information and infrastructure ecosystem. Our members own or manage a significant proportion of it and have many years’ experience protecting it. We will continue to play a proper role in helping to shape an appropriate and effective policy and regulatory environment to increase that protection. We want Europe’s businesses and consumers to know they can use it safely.
John Higgins is Director General of DIGITALEUROPE, chairs a University audit committee and earlier in his career was involved in the establishment of an cyber information exchange in the UK.
Protection des données personnelles : les petites et moyennes entreprises mettent en garde
Alors que la commission industrie et recherche(ITRE) du Parlement européen vient de se prononcer, l’association européenne représentant les petites et moyennes entreprises (UEAPME) a mis en garde les députés contre l’Obligation d’imposer dans chaque PME un responsable de la promotion des données, obligation qu’elles jugent trop coûteuse. Avec ces deux avis on peut dire que nous venons d’entrer dans le vif du sujet.
La commissaire Viviane Reding avait proposé en janvier 2012 dans sa réforme de la Directive 95/46 d’exempter toutes les PME à partir du moment où elles utilisent les données d’un certain nombre de personnes, plus de 500 personnes. En dessous d’un certain nombre de salariés. Mais le rapporteur du Parlement européen Jan Philipp Albrecht (Verts/Ale, allemand) a préféré une autre approche, plus logique dans sa rationalité consistant à inclure les PME à partir du moment où elles utilisent les données d’un certain nombre de données, plus de 500 personnes par an .
Pour Luc Hendrickx, en charge des affaires juridiques à l’UEAPME, cela revient à inclure de facto quasiment toutes les PME puis que le plus grand nombre à un carnet d’adresses avec plus de 500 contacts…Pour l’UEAPME, les députés devraient en tout cas davantage prendre en considération et veiller aux intérêts des PME que chercher à s’engager dans une lutte de prestige et symbolique avec les géants américains du secteur, cela en tentant de donner, selon, son expression , naissance à un « Facebook act » qualifié de futile. Il regrette que le débat actuel en commission des libertés civiles et au Parlement européen en général aille dans la mauvaise direction.
A contrario, pour l’UEAPME, le rapport de Sean Kelly, de la Commission ITRE, préserve un bon équilibre en maintenant l’exemption pour les petites et moyennes entreprises .Il invite la commission LIBE à revenir au texte initial. Le choix de ITRE est raisonnable et il est à souhaiter que l’ensemble du Parlement européen s’y ralliera. Estimant qu’une heure d’un data Officer extérieur à la PME reviendrait à 250 cela reviendrait à taxer une fois de plus les PME.
C’est la première brèche portée de façon concrète au dispositif proposé par la Commission et à ce stade assez largement avalisé par la commission LIBE. Une brèche dans laquelle seront nombreux ceux qui voudraient s’y engouffrer en espérant en provoquer d’autres .
Texte du Communiqué de l’UAPME http://www.ueapme.com/IMG/pdf/130220_pr_data_protection_ITRE-2.pdf
Classé dans:DROITS FONDAMENTAUX, Protection des données personnelles
Les seniors français de plus en plus accrocs aux réseaux sociaux
Les Français ont beau être en retard dans leurs pratiques numériques par rapport notamment à leurs voisins britanniques ou allemands, les choses évoluent à en croire la dernière étude Médiamétrie sur les usages d’Internet. Les seniors français se mettraient de plus en plus au Web et notamment aux réseaux sociaux.
Selon Médiamétrie, on retrouve 53% d’utilisateurs de réseaux sociaux parmi les Français âgés de 50 ans et plus. Une révolution dans le petit monde digital ! Et Médiamétrie de préciser :
« Les usages de communication et de divertissement en ligne sont de plus en plus pratiqués par toutes les tranches d’âge », constate le quatrième volet de cette étude portant sur le dernier trimestre 2012. Mais si le taux d’inscrits sur les réseaux sociaux se stabilise chez les 15-34 ans, il bondit littéralement chez les internautes plus âgés : +10 points en un an chez les 35-49 ans (73% d’inscrits), et +12 points chez les 50-64 ans.
« Ces tranches d’âge ne négligent pas pour autant les autres modes plus “classiques” de communication sur internet », nous rassure Médiamétrie qui semble donc considérer Facebook comme une plateforme encore un peu exotique. Les plus de 35 ans sont « légèrement plus utilisateurs de l’e-mail que leurs enfants, mais se familiarisent aussi avec les forums sur lesquels ils sont de plus en plus nombreux à consulter voire rédiger des avis ».
Mais l’étude de Médiamétrie démontre également que plus de la moitié des 35-49 ans a regardé une vidéo sur Internet au cours du dernier mois (soit une hausse de 7 points en un an).
Cette génération se familiarise également avec l’écoute de musique en streaming, pratiquée chez un tiers des internautes de 35-49 ans et un cinquième des 50-64 ans.
Google, l’Etat et les éditeurs français scellent un accord. Google s’en tire à bon compte
By EU-Logos Salué par le président exécutif de Google Éric Schmidt comme «historique», et par le président de la République, François Hollande, comme «un événement mondial», l’accord conclu vendredi 1er février entre le moteur de recherche et les éditeurs de presse français méritait-il réellement d’être salué avec une telle emphase ? Pour le président de la République : " un évènement mondial, le premier accord de ce type dans le monde."
Thriving in a Hyperconnected World
E-learning ‘driving forward general medicine education market’
According to a new report released by Transparency Market Research, online training has become a major driver in the market for general medicine education, with resources such as e-books and digital learning materials on the rise. The report pointed to a number of successful strategies used by players in the e-learning industry such as online reference tools, mobile applications and digital textbooks or reference books. Furthermore, it was revealed that using multimedia content to train employees is becoming more popular among healthcare leaders, as well as distance learning platforms and online assessment software. Please click here for additional information.
Google vs Commission : le combat continue, Almunia ne baisse pas les bras
« Je pense que Google abuse de sa position dominante », c’est la phrase clé de l’interview du Vice-président de la Commission européenne en charge de la concurrence qu’il a donnée au Financial Times . Joaquin Almunia s’est déclaré convaincu que le principal moteur de recherche sur Internet abuse de sa position dominante en détournant de trafic d’internet vers ses propres services tels que ses cartes, son comparateur de billets d’avion son comparateur de shopping etc. Une déclaration forte alors que Google a été blanchi de cette accusation aux Etats-Unis par la Federal Trade Commission (cf. autre article dans Nea say). Le commissaire a confirmé que l’enquête continue au niveau de l’UE. Il a renouvelé son souhait d’un accord à l’amiable. Il a tenu à précisé que l’enquête ne concernera pas le système d’exploitation Androïd utilisé notamment par les smartphones.
Joaquin Almunia a justifié la différence d’appréciation par rapport à FTC par la position plus forte en Europe de Google avec 90% des recherches. Les critères pour apprécier les abus de position dominante sont différents. Il a rappelé que les préoccupations de la Commission portent dont Google présente ses propres services et non sur l’algorithme ; Il suggère « un élément de solution pourrait être d’avertir lorsque les services de Google(…) sont affichés dans une position artificiellement plus élevés que ceux des concurrents. Mais d’autres modifications doivent concerner aussi la manière dont les services de Google sont affichés parmi les résultats généraux de la recherche ».
Rappelons que lors d’une réunion en décembre avec le président de Google (cf. Nea say) le commissaire Almunia avait précisé qu’il voulait une proposition de Google pour un règlement à l’amiable avant la fin de janvier sinon il serait obligé d’agir.
-. Texte de l’interview du Financial Times http://www.ft.com/intl/cms/s/0/2b5bead6-5b3c-11e2-8d06-00144feab49a.html#axzz2HybiGvhP
-. Dossier Google de Nea say http://www.eu-logos.org/eu-logos-nea-recherche.php?q=google&Submit=%3E
Classé dans:Droit à l'information, DROITS FONDAMENTAUX
Protection des données personnelles : « Si vous voulez mes données demandez mon consentement !»
La bataille avec certains Etats membres, avec les milieux professionnels s’annonce rude. L’alliance Parlement Commission est indispensable, Viviane Reding en est bien consciente, si non comment expliquer le message officiel de soutien envoyé aux rapporteurs par un communiqué de presse, procédure tout à fait exceptionnelle, mais pas inédite (cf.infra). Cet appui du Parlement dont Viviane Reding prend acte n’est pas nouveau : il y a un an le rapport du député Axel Voss avait déjà reçu un accueil de même nature (cf. infra pour en savoir plus). L’aide mémoire de la Commission européenne du 10 janvier dernier souligne de façon précise plus particulièrement les point d’accord les plus d’importants avec les rapporteurs. C’est un haut niveau de protection qui est attendu par une grosse majorité des députés européens. Le Parlement européen est ambitieux sur ce texte, les rapporteurs également et tout particulièrement Jan Philipp Albrecht: « si vous voulez mes données, demandez mon consentement ». Viviane Reding attache un prix élevé à la réussite de ce dossier qui possède une valeur emblématique évidente et à tout point de vue. Le Parlement européen a commencé, le 10 janvier, à examiner le travail des rapporteurs Jan Philipp Albrecht et Droutsas qui souhaitent un haut niveau de protection, quitte à réveiller les tensions avec les Etats-Unis et avec les professionnels. A cela s’ajoute les exigences du monde des usagers et des internautes qui viennent compliquer également la recherche des compromis, tant leurs sensibilités, multiples et diverses, sont exacerbées par chacun des points du dossier.
« Si vous voulez mes données, demandez mon consentement ! » a lancé le député européen allemand Jan Philipp Albrecht à la presse, mercredi 9 janvier. L’élu vert présentait à la presse son travail en tant que rapporteur de la commission des Libertés civiles (LIBE) sur la nouvelle législation en cours d’élaboration sur les données personnelles, le lendemain il le faisait devant la commission LIBE. En janvier 2012, (cf.Nea say) la Commission européenne avait lancé une vaste réforme alors que ces informations, les données personnelles, sont devenues capitales dans l’économie du web.
« Les dérogations aux règles devraient être strictement limitées à ce qui est nécessaire »aà déclaré Jan Albrecht. Il a déploré vivement que l’exécutif européen soit aussi conciliant en ce qui concerne l’accès aux données par les services répressifs des Etats. L’une des mesures phare qu’il défend est l’application des règles de l’UE à l’ensemble des entreprises qui traitent des données de citoyens (à partir de 500 citoyens européens), les obligeant ainsi à disposer d’un « représentant » en Europe pour celles nombreuses et importantes domiciliées en dehors du territoire de l’Ur, les américaines par exemple. De plus, Jan Albrecht souhaite que la future législation soit la plus claire possible pour réduire au maximum le rôle de la Commission dans la mise en œuvre des futurs règlements (problème des mesures d’exécution et autres actes délégués). Bien avant que le rapport (à ce stade un projet de rapport) ne soit sorti, il était déjà sous le feu des critiques de l’industrie numérique. La « Coalition des industries pour la protection des données » (ICDP auquel Viviane Reding s’est adressé il y un an) regroupe les grandes entreprises du secteur et considère que le député n’a pas su trouver un juste équilibre. « M. Albrecht a raté une occasion de concilier les garanties de confidentialité efficaces et des règles de protection dans la conduite des affaires, deux droits fondamentaux garantis par la charte de l’UE », a déclaré l’organisation. De telles dispositions frapperont surtout le marché des applications, en grande partie situé aux Etats-Unis. Demander de telles exigences administratives, c’est mettre hors-course ces industries et principalement les PME en raison de leur petite taille et faibles ressources, tente-t-on d’expliquer. Mais les géants de l’Internet ne se sentent pas mieux protégés par leur taille et ont, depuis longtemps, mis toutes leurs ressources qui sont grandes, au service d’une cause qu’ils voudraient voir adoptée par les « petits ». La responsable Europe de Facebook, Erika Mann, s’inquiète de « certains aspects du rapport qui ne favorisent pas l’émergence d’un marché digital européen ». Pour l’entreprise américaine, les données personnelles sont sa principale ressource, faut-il le rappeler ? « Ensuite, nous exhortons les députés du Parlement européen à prendre en compte les contributions importantes d’autres commissions et à promulguer des lois qui préservent la confiance de l’utilisateur tout en encourageant l’innovation et l’entrepreneuriat en Europe. » « L’Association for Competitive Technology (ACT), qui représente les PME du secteur technologique, déplore que le projet de rapport accable les PME, surtout celles centrées sur la technologie, de coûts initiaux qui réduiront indéniablement l’innovation sur le marché et pousseront plus d’entrepreneurs à fuir l’environnement réglementaire hostile de l’Europe », peut-on lire dans un communiqué de l’association. A l’inverse, le groupe Droits numériques européens s’est réjoui des améliorations portées par Jan Albrecht même s’il regrette déjà certains compromis. Le Bureau européen de unions de consommateurs (BEUC) est mobilisé . A cet égard, du point de vue du consommateur, M. Albrecht a été critiqué pour ne pas avoir été assez loin dans ses propositions. L’organisation de défense des droits numériques EDRi a déclaré dans un communiqué que « M. Albrecht avait tenté d’améliorer la proposition initiale de la Commission et d’aborder plusieurs craintes soulevées par ses collègues, mais le résultat est un mélange de tentatives directes d’améliorations positives et de compromis qui s’appuient sur les avis exprimés par ses collègues jusqu’à présent. »
Le travail législatif à venir risque aussi de raviver les tensions entre Bruxelles et Washington. Lors d’une conférence sur la protection des données le 6 décembre dernier dans la capitale européenne, l’ambassadeur américain, William Kennard, a jugé nécessaire pour l’Europe de surmonter ses préjugés et ses stéréotypes. Il souhaite une convergence entre les règles des deux côtés de l’Atlantique pour une plus grande interopérabilité des systèmes. L’UE sommée de choisir une convergence transatlantique sur la protection des données. L’émergence en apparence du « cloud » informatique représentera un obstacle de taille (cf. autre article dans Nea say). A l’inverse, pour Albrecht, le projet de loi européen se veut être une tentative de fixer une norme mondiale ambitieuse. « Nous voulons avoir notre mot à dire sur les standards internationaux, mais cela ne veut pas dire que nous voulons imposer des charges inutiles, et je suis ouvert à une discussion et à la négociation », a-t-il déclaré.
Le postulat selon lequel la protection des données est un droit fondamental constitue un élément central du rapport de M. Albrecht. Il est très largement partagé par les députés européens et par Viviane Reding, vice-présidente de la Commission européenne en charge du dossier. C’est cet aspect qui donne un relief tout particulier au problème du profilage soulevé de longue date, évoqué par plusieurs député et traité par les deux rapporteurs et plus particulièrement par Dimitrios Droutsas. Le contrôleur européen à la protection des données (CEPD) qui a déjà fait connaître son point de vue (cf.Nea say) le renouvellera et l’amplifiera chaque fois que cela sera nécessaire, à-t-il fait dire par son adjoint, Giovanni Buttarelli, lors de la réunion du 10 janvier. Il y a un enjeu considérable pour l’avenir du CEPD mais aussi des contrôleurs nationaux rassemblés au sein du G29 ainsi que tous les contrôleurs des données personnelles. Le CEPD sera quant à lui d’une vigilance sourcilleuse ;
La barque est bien chargée et l’objectif d’une adoption rapide peut être difficile à tenir. Notamment le projet de règlement est très dense : le rapport de Jan Albrecht fait 217 pages, et le proposition de directive n’a pas beaucoup soulevé d’intérêt de la part des Etats membres qui ne seraient pas fâchés de mener une course de lenteur la concernant, voire de dissocier son sort de celui du Règlement ce à quoi les députés s’opposent pour la plupart avec leur plus grande énergie. Interrogée lors de la réunion du 10 janvier, la présidence irlandaise a confirmait qu’elle entendait bien traiter leur adoption comme un tout. Il y aura là, certainement, matière pour mener une guérilla de retardement. D’autres sources de blocages existent : l’obtention d’un consentement explicite des internautes à l’utilisation de leurs données, le droit à l’oubli, deux dispositions qui visent directement les géants américains Google et Facebook. Le « profilage » sera source également de blocage comme il l’a été dans le passé (PNR, rétention des données par exemple). La durée de conservation sera un sujet majeur.
Jan Philipp Albrecht a concentré son rapport autour de dix points principaux. Si l’idée du consentement explicite est bien reprise, la disposition sur le droit à l’oubli est traitée de façon plus complexe, nuancée dès lors que contrebalancée avec le principe de liberté d’expression. Ainsi une personne ayant donné son consentement préalable à l’utilisation de ses données, ne pourra pas ultérieurement demander leur effacement total. Dans l’ensemble Jan Albrecht a repris les grands principes développés par la Commission tout en s’efforçant de les préciser, de lever les ambiguïtés. Ainsi est-il partisan que le nombre d’actes délégués doit être réduit aux seuls aspects techniques, non essentiels. Cela constituait à l’origine un point de frictions vite levés Viviane Reding ayant rapidement apporté les apaisements nécessaires. La désignation d’un responsable chargé de la protection des données dans les entreprises ne devrait pas dépendre du nombre des employés mais de la quantité et du type de données traitées. La commission avait proposé d’exempter les PME, pour Jan Albrecht, il n’en est pas question. Quant aux sanctions infligées aux compagnies elles doivent, là comme ailleurs, respecter le principe de proportionnalité.
Quant à la directive concernant les affaires policières et judiciaires, la rapport Droutsas vise à renforcer les sauvegardes dans le cas des transferts de données vers les pays tiers, la Commission devant préalablement avoir décidé que tout destinataire de pays tiers de données de citoyens européens présente un niveau approprié de protection des données. Une disposition combattue par les Etats-Unis qui ont estimé à plusieurs reprises qu’elle freinerait le lancement d’opération à grande échelle et les propositions américaines sont jugées trop faibles par Dimitrios Droutsas. Il a proposé dans son rapport que ces transferts de données soient strictement nécessaires et se fassent non seulement vers des pays tiers au niveau de protection jugé adéquat mais aussi que les garanties de protection prévues le soient par un instrument juridiquement contraignant. Dimitrios Droutsas a également renforcé la définition du profilage voulant la rapprocher de celle du Conseil de l’Europe : par exemple, toute forme de traitement automatisé des données à caractère personnel destiné à évaluer certains aspects relatifs aux comportements, aux habitudes, aux rendements au travail, son état de sante. La rapporteur a également prévu un article spécifique pour les données génétiques : leur traitement ne devrait être possible seulement quant un lien génétique apparaît dans l’enquête policière ou la procédure judiciaire et leur conservation uniquement pendant le temps que durent les procédures.
Prochaines étapes :
. Cette réunion du 10 janvier a constitué un « tour de chauffe », celle des 21 et 22 janvier prochain entrera dans le vif du sujet, le round d’observation sera terminé. La chronologie future a son importance, la présidence irlandaise et les députés européens, la Commission européenne ont manifesté clairement leur volonté unanime d’aller au plus vite. Une adoption sous présidence irlandaise, qui pour beaucoup représente une fenêtre d’opportunité, l’engagement irlandais, répété, semble fort ? Avant les prochaines élections ? c’est plus réaliste mais pas acquis, la fenêtre d’opportunité risque de se refermer rapidement. Les tactiques politiques vont inévitablement prendre de l’ampleur. Un exemple anecdotique, l’intervention du député libéral allemand Alvaro, élément moteur et partisan ardent et affiché d’aller vite, a fait remarquer que le délai imparti pour le dépôt des amendements, le 27 février, est trop court et suggère un report à fin mars tout en reconnaissant que rarement on a accordé un délais aussi important pour le dépôt des amendements. Comprenne qui pourra !
Le Parlement européen et la Commission européenne, au moment où les deux institutions vont être renouvelées, souhaitent présenter un bilan aussi positif que possible. Or étant donné la valeur emblématique de la protection des données à caractère personnel, l’adoption du Règlement et de la Directive aurait le meilleur effet au tableau d’affichage. Rappelons: les citoyens européens sont de plus en plus conscients des possibilités d’abus de leurs informations personnelles. Selon un récent sondage de l’Eurobaromètre, 70 % des personnes interrogées se disaient inquiètes quant au fait que leurs informations personnelles soient utilisées par des entreprises dans d’autres buts que celui pour lequel elles ont été recueillies. Quelque 64 % d’entre elles jugent insuffisantes les informations qu’elles reçoivent sur le traitement de leurs données personnelles.
-. 21 janvier 2013 : présentation des rapports de Jan Philipp Albrecht et Dimitrios Droutsas en commission Libertés civiles du Parlement européen (LIBE).
-. 27 février 2013 : date butoir pour le dépôt des amendements
-. Fin avril 2013 : débat d’orientation en session plénière du Parlement européen
-. A partir de mai 2013 : négociations entre le Parlement, la Commission et le Conseil en vue d’obtenir un compromis
Pour en savoir plus :
-. Position de Microsoft http://www.microsoft.eu/digital-policy/posts/the-eus-proposed-data-protection-regulation-microsofts-position.aspx
-. Position informelle du Département du Commerce américain http://www.edri.org/files/US_lobbying16012012_0000.pdf
-. Commentaires de la Mission américaine auprès de l’Union européenne http://photos.state.gov/libraries/useu/231771/PDFs/Five%20Myths%20Regarding%20Privacy%20and%20Law%20Enforcement_October%209_2012_pdf.pdf
-. Proposition de directive de la Commission (FR) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2012:0010:FIN:FR:HTML(EN) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2012:0010:FIN:EN:HTML
-. Proposition de Règlement de la Commission (FR) http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_fr.pdf (EN) http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf
-. Directive du 24 octobre 1995 du Parlement européen et du Conseil (FR) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:FR:HTML (EN) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:HTML
-. Parlement européen :
-projet de rapport de Jan Philipp Albrecht (FR) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/pr/922/922387/922387fr.pd (EN) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/pr/922/922387/922387fr.pd
– document de travail n°3 de Jan Philipp Albrecht (FR) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/916/916462/916462fr.pdf (EN) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/916/916462/916462en.pdf
- document de travail n° 2 de Jan Philipp Albrecht (FR) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/915/915162/915162fr.pdf (EN) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/915/915162/915162en.pdf
-projet de rapport de Dimitrios Droutsas (FR) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/915/915162/915162en.pdf (EN) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/pr/923/923072/923072en.pdf
– document de travail de Dimitrios Droutsas (FR) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/915/915164/915164fr.pdf (EN) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/915/915164/915164en.pdf
-document de travail conjoint Albrecht/Droutsas (FR) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/905/905569/905569fr.pdf (EN) http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dt/905/905569/905569fr.pdf
-. Point de vue de l’Association for Competitive Technology (Act) http://actonline.org/
-. Memo de la Commission européenne : « Commission welcomes European Parliament rapporteur’ support for strong EU data protection rules » http://europa.eu/rapid/press-release_MEMO-13-4_en.htm
-. Statement of the vice-president Reding on the European Parliament’s vote on the Voss Report http://europa.eu/rapid/press-release_MEMO-11-489_en.htm
-. Discours de Viviane Reding devant le Consil Justice du 26 octobre 2012 http://europa.eu/rapid/press-release_SPEECH-12-764_en.htm
-. Dossier de Nea say Protection des données personnelles http://www.eu-logos.org/eu-logos_nea-say.php?idr=4&idnl=129&lang=fra&lst=0&arch=0&nea=129&idssth=204
Classé dans:DROITS FONDAMENTAUX, Protection des données personnelles
Bulgaria
Czech Rep.
Hungary
Poland
Romania
Turkey
Slovakia

