October 31st, 2012 by Monique Altheim
The
34th International Conference of Data Protection and Privacy Professionals was held this year in Punta del Este, Uruguay, on October 22-26.
Uruguay enacted a comprehensive Data Protection Law, the Ley no.
183331, in 2008, and was recently declared a “third country with an
adequate level of data protection” by the European Union.Uruguay was one
of the first Latin American countries (after Argentina) to adopt an
omnibus privacy law, after which Mexico, Colombia, Costa Rica, Peru and
Nicaragua followed suit. Brazil, Chile and Ecuador might be next. We are
definitely witnessing a trend in Latin America towards enacting data
protection laws, modeled after the European Union data protection
framework.
Part of a 1977 Punta del Este Mural by Carlos Paez Vilaro – Picture by Monique Altheim
The theme of the conference was: Privacy and Technology in Balance.
As Jose Clastornik of the Unidad Reguladora y de Control de Datos
Personales (URCDP), the DPA of Uruguay, declared: since technology is
part of the problem, it should also be part of the solution.
The iconic symbol of Punta del Este is the “La Mano” sculpure on
Brava Beach. It expresses the action of humans in nature. As such, it
was also an appropriate symbol for this conference: How to balance the
technological advances created by humans with what most data protection
authorities around the globe consider human beings’ natural right to
privacy and data protection.
“La Mano” sculpure in Punta del Este by Mario Irarrázabal – Picture by Monique Altheim
Uruguay’s President, Jose Mujica, expressed serious worries about the
lack of privacy created by technological developments. He said,
jokingly: “Sinners, you’re doomed!” At the same time, he expressed the
need for knowledge to move forward and the hope that a proper balance
between advancing technology and privacy protection will be achieved.
In Uruguay, technology and knowledge is indeed moving forward at a rapid pace, thanks to the remarkable
CEIBAL
project. About four years ago, the Uruguyan Government started
distributing free laptops to all elementary school students and
teachers, and provides no-cost internet connection to all.
From
left to right: Diego Caneda, Jose Mujica Cordano (President of
Uruguay), Felipe Rotondo (President of URCDP), Jose Clastornik (Member
of Executive Council URCDP)
In sync with the theme of the conference, I was asked to moderate a
panel on digital forensics, titled: “Forensic Tools: What Our Devices
Tell About Us”.
Unfortunately, I don’t know much Spanish. That led to an amusing
misunderstanding. A Latin American colleague tried to converse with me
in English, and asked whether I had seen the hen yet. I said no, what is
the hen? He explained that it was a very famous sculpture on the beach
of Punta del Este. I spent whatever free time I had in Punta looking for
a hen, but couldn’t find any. It was only when an American colleague
pointed to a sculpture on the beach and said: this is the “hand”, that I
finally understood.
We all speak different languages, and the misunderstandings this
creates can lead to some problems of miscommunication, but they have
usually limited consequences. All you need, after all, is a translator,
dictionary or Google app to set things straight.
We all speak one language though that is identical: today, we all
speak digital. We communicate through email, text messages,
videoconferencing and social media. Those data are stored on databases
in private companies and government agencies, on our laptops, mobile
phones and, increasingly, on servers in the “cloud”. According to a
recent IBM report, there are currently 2.7 zetabytes of digital data in
the universe. That equals one trillion truckloads full of documents. In
the case of a security breach, private civil litigation or internal
audit, government civil or criminal investigation, the goal is always to
find relevant evidence. How does one find relevant evidence among such
monstrous numbers? How do we ensure the authenticity and accuracy of
digital evidence? And how do we make sure that data protection and
privacy rights of individuals are not trampled upon during the search
for evidence?
This is the domain of ediscovery and digital forensics, and my panel of experts examined every aspect of this fascinating issue.
My panel consisted of, from left to right,
Oscar Puccinelli, an attorney and professor of Constitutional Law at the National University of Rosario in Argentina,
Jeimy Cano, CIS at Ecopetrol and professor at the Univesidad de Los Andes in Bogota, Colombia,
Gustavo Betarte, CTO at Tilsor and researcher and professor at the Engineering School of the Univesidad de la Republica in Montevideo, Uruguay.
And, from left to right, Yoram Hacohen, head of the Israeli Law, Information and Technology Authority (ILITA), and William C. Barker, associate director and chief cyber security advisor at the National Institute of Standards and Technology (NIST).
William C. Barker started by giving us a digital forensics 101
overview, which you can follow in this powerpoint presentation. He
explained the different phases of digital forensics, concepts such as
digital signatures and hashing, the policies companies and organizations
should adopt regarding forensic investigations, and the standards that
NIST has developed so far, such as the Computer Forensic Tool Testing
(CFTT).
Digital Forensics by William C. Barker (NIST)
Following this excellent presentation, Gustavo Betarte delved into
the privacy issues arising out of forensic analysis of deleted data. He
explained how amazingly difficult it is to truly delete data from
computer systems and how very oftern forensic investigators find troves
of sensitive data thought to be deleted. For example, in the notorious
Enron case, many of the incriminating emails were reconstructed from a
“deleted data” folder.
After listening to Gustavo for a while, I started thinking that
maybe the whole “right to be forgotten” controversy is just wishful
thinking of policymakers with no knowledge of computer forensics.
For more details on Gustavo’s presentation, check out his slides:
Threats to Privacy in the Management of Data Stored in Computer Systems by Gustavo Betarte
Yoram Hacohen gave us a couple of interesting practical case studies
conducted by his office involving forensic examinations and privacy.
He explained how his department, with the help of its forensics lab,
cracked the biggest privacy breach case that ever occurred in Israel,
involving the theft of Israel’s entire Population Registry. See here a
previous entry about this notorious case.
Yoram put it very succintly when he said: the suspect remained silent, but his computer spoke volumes!
Watch this fascinating briefing to find out how the investigation led
to the unmasking and arrest of six suspects and how one fatal “mistake”
by the hacker who published the registry online led to his discovery.
As more and more companies and organizations move their IT operations
to the “cloud”, it was essential to address the forensics issues
arising in this ecosystem.
Jeimy Cano gave a comprehensive powerpoint presentation on digital forensics in the cloud environment.
This slide gives one an idea of the complexity of conducting digital
forensics analysis in a cloud architecture. One of the particularities
of cloud forensics is the ability to conduct remote probing into distant
systems. There are even applications one can install in order to allow
for future remote forensic investigations, should the need arise.
And finally, cloud computing creates a unique challenge in criminal
investigations. Whereas in a physical home search, the police must show a
warrant before proceeding, in a remote search of computers or servers
in the cloud, the data subject or data controllers/processors are not in
a position to ask for a warrant before letting investigators in, since
remote digital forensics can be executed without the knowledge of the
data subject or the data controller/processor. The same is true when
cybercrime investigators install remote trojans to monitor suspect
computer systems.
Oscar Puccinelli tackled this thorny issue. He sighed at the fact
that the law is always seriously trailing behind the technology, and
stressed that currently there is a lack of balance between technology
and the law. Technology develops at lightning speed, while the law
develops at a snails’ pace. This is especially true concerning the cloud
environment. He stressed the importance of international cooperation,
and praised the EU and US for their cooperation efforts in this field.
Important efforts harmonizing substantive and procedural criminal law
come from the Council of Europe Cybercrime Convention, the leading
public international law in this field, which came into force on July
2004 with some 47 signatures, including non-European states such as the
United States.
Oscar deplored the lack of a regional agreement in Latin America.
He also mentioned that the cloud is a new space that is strongly
monitored under national security laws by most government agencies
around the globe.
The “Patriot Act” is not alone.
For example, the German Federal Office of Criminal Investigation
(BKA) may, in investigations involving terrorism or national security,
use a “Federal Trojan” (a government-issued computer virus) to search a
Cloud provider’s servers, monitor ongoing communications, or collect
communication traffic data without the knowledge of the target. In
addition, the G10 Act provides German intelligence services with the
authority to monitor and record telecommunications without a court order
in investigations of a serious crime or a threat against national
security, such as terrorism.
Oscar ‘s conclusion: Clouds in the cloud.
In order not to end with such a gloomy “weather forecast”, I included
a short recording of the lavish party that the Uruguayan organizers had
prepared for the conference’s attendees. Besides being served a
sumptuous banquet, the delegates were treated to a show of “Candombe” an
Afro-Uruguayan traditional dance. Enjoy!
September 15th, 2012 by Monique Altheim
Lawyers are often labeled as “luddites” and their lack of understanding of technology is legendary.
In an era, where almost all business records are in the form of
electronically stored information, it has become essential for lawyers
to become more technologically savvy.
On the other hand, it is just as important for IT to understand legal and its requests.
Ediscovery is one area, where this has become an absolute necessity.
But how well do IT professionals understand the legal aspects of their work? Most probably, not very well.
Are you an IT professional?
Do you believe that all your company’s data should be deleted as
quick as possible? Do you believe that none of your company’s data
should ever be deleted?
Have you ever received an instruction from the legal department that
sounded like: “Save all responsive documents” and scratched your head as
to what documents legal was referring to?
Is your company moving its database to the cloud? Are you involved in acquiring new hardware or software for your company?
If you answered yes to any of the above questions, the newly published e-book
“E-Discovery Legal Issues Guidebook” is for you. It was published on September 7, 2012, by
PenTest Magazine, the “only magazine devoted exclusively to penetration testing”.
This seventy page e-book is specifically aimed at IT professionals
who deal with ediscovery. With its collection of eleven articles,
written by thought leaders in the field of ediscovery, it aims to
inform IT professionals of the basic legal issues surrounding
ediscovery.
In it, you will find analyses of the major ediscovery cases, from the
seminal Zubulake case to the more recent Apple v. Samsung case. Basic
legal ediscovery principles, such as the duty to preserve and spoliation
are explained without the usual legal jargon. More advanced topics,
such as ediscovery of data stored in the cloud and ediscovery of
personal data in the EU are covered as well.
This publication recognizes the essential part IT professionals play
in the process of ediscovery, and aims to foster co-operation between
the legal and IT departments.
Disclosure: This blogger has contributed to the publication with a chapter on international ediscovery and EU data protection.
September 7th, 2012 by Monique Altheim
August 31st, 2012 by Monique Altheim
August 24th, 2012 by Monique Altheim
July 20th, 2012 by Monique Altheim
July 13th, 2012 by Monique Altheim
July 6th, 2012 by Monique Altheim
June 29th, 2012 by Monique Altheim
June 22nd, 2012 by Monique Altheim
June 15th, 2012 by Monique Altheim
June 8th, 2012 by Monique Altheim
June 1st, 2012 by Monique Altheim
May 29th, 2012 by Monique Altheim
I recently gave a CLE presentation at the
LegalTech West Coast Conference in
Los Angeles
on the legal problems and tensions of conducting U.S. civil litigation
ediscovery in the European Economic Area (EEA), which consists of the 27
EU member states plus Iceland, Liechtenstein and Norway.
The subtitle “Clash of the Titans” derives
from the fact that on the one hand the U.S. has the broadest pre-trial
civil litigation discovery procedure on earth, while on the other hand
the EU has the most stringent data protection framework on the planet.
Trying to collect and transfer terabytes of data, most of which contain
personal components, in the EU, where data protection is a fundamental
right and very heavily regulated, is indeed quite a challenge.
In this presentation, I analyzed the U.S. jurisprudence on the
extra-territorial application of U.S. ediscovery obligations as well as
the EU guidelines concerning personal data collected while conducting
U.S. civil ediscovery in the EEA. I introduced the mostly American
audience to principles of EU data protection.
Here is the slide deck I used for this presentation.
Thanks to my dual qualification as an attorney in the U.S., as well
as in the EU, I am in a unique position to act as a bridge between the
exclusively common law tradition of pre-trial ediscovery in civil
litigation in the U.S. and the EU tradition of data protection of
personal data.
May 28th, 2012 by Monique Altheim
If you are like me, you post on Facebook in leaps and bounds.
I have periods of silence, followed by bursts of sharing of photos, links to articles and status updates.
During one recent prolific posting period of two weeks, I noticed that
none of my posts had generated any reaction whatsoever: not a single
“like”, not a single “comment”.
I was devastated. I had become invisible and ignored. I had become a Facebook outcast. I felt like I had stopped existing.
I feverishly scanned my 30 something posts since the last sign of human
recognition, and started to wonder whether I had made a faux pas
somewhere along the line.
Had I posted something too racy? Something too controversial?
Had I posted too often? Where my posts too boring, too irrelevant?
Had all my Facebook friends blocked me? Had Facebook censored me?
Then by chance, as I was talking to one of my close Facebook friends
over the phone, I learned that he had just not seen any of my posts for
the last two weeks. This started me thinking: what if none of my 180
Facebook friends had seen any of my posts either? What if the simple
reason for the lack of engagement was that I had become literally
invisible on Facebook? I decided to conduct a little poll among a random
list of a dozen or so Facebook friends and tagged them in a post with
the question whether they had seen any of my posts for the last two
weeks. The response was overwhelming: none of my friends had seen them.
Except for a couple of more sophisticated Facebookers, who had a
gazillion friends and availed themselves of all sorts of filter tools
and therefore might not have seen my posts due to their own decision of
filtering me out, the majority of my Facebook friends were just regular
folks with a manageable load of updates to sift through, who genuinely
liked to find out what their friends were up to, without any filters
whatsoever.
That could only mean one thing: something in the Facebook machine had
decided that whatever I posted should be invisible to the majority of my
Facebook friends. My invisibility was not caused by me, nor by my
Facebook friends.
While, in the end, I succeeded in resolving a technical glitch that
seemed to have caused my total invisibility, this rather painful
experience started me thinking about the importance of visibility or
reach on social media. No matter how fascinating, original or
groundbreaking the post, if no one sees it, what exactly is the purpose
of posting it?
I was reminded of the age old question of when a tree falls in the
forest, but no one is around to hear it, does it make a sound?
A lot has been written about privacy, or rather the lack of it,
online and especially on the social media sites. The common wisdom, at
least in the US, is, that in exchange for the privilege of using sites
like Facebook, one gives away one’s private data for monetization
purposes by those sites. The user gets to use the platform in exchange
for his/her data that the platform provider gets to use. Translated into
legal terms, one could say that the user of a social media site like
Facebook gives up his/her “expectation of privacy” for an “expectation
of connecting with friends”. Except that in the case of Facebook (and
probably other sites as well), this exchange is seriously flawed.
When you talk within the physical walls of a room, you are immediately
aware who you are talking to and how wide your reach is: your audience
is right in front of you.
When the average Facebook user posts something on Facebook, he/she
assumes that all his/her friends on Facebook are able to see that post.
What the majority of Facebook users do not realize is that, according to a recent study,
the average post is only visible to 12% of one’s Facebook friends.
Facebook’s secret algorithms decide which post is seen by which
friends. When you subtract from the 12% visibility all the friends who
do not regularly check their news feed, or do not get notified of new
posts and also subtract from the 12% the more sophisticated Facebook
friends who have siloed their friends into lists and groups and who
have not included you in any of those and you are left with a very puny
audience indeed.
The average Facebook user has 150 friends. The average Facebook user is
also led to believe that all his posts will be visible to all his 150
friends. In reality, the average Facebook user’s post is visible to a
maximum of 10 to 15 friends.
If the new paradigm is the exchange of private information for the
opportunity to connect with friends, then social media sites like
Facebook are not only not keeping their end of the bargain, they are
also misleading their users concerning the exchange.
The agreement between the Postal Services and the users is that the user
writes down an address and glues the required stamp on the envelope and
the Postal Services delivers the letter. If the Postal Services would
only deliver 12% of the mail you sent, you would righteously be outraged
and start a law suit: you have a right to expect that each letter that
you put the appropriate stamp on, gets delivered (or at least almost
each letter, taking into account inevitable mistakes in delivery).
Otherwise, you should only have to pay 12% of the stamp value. The same
logic should apply for each status update on Facebook: with each status
update, you give away private data that Facebook monetizes. You have a
right to expect that each update gets delivered to its intended
audience: your Facebook friends, at a minimum (unless you set your
privacy setting to “only me”). By limiting the amount of your Facebook
friends who can see your posts to 12%, Facebook is not keeping its
purported end of the bargain. The whole concept of Facebook is built on
the idea that one can share information with one’s Facebook friends.
Facebook does not inform its users that they will only be able to share
with at most 12% of their friends. The average Facebook user has a
rightful expectation of reaching all his/ her Facebook friends with each
update. Facebook monetizes 100% of all user’s updates, but gives only
12% of friend connection in return.
To add injury to insult, Facebook now plans to charge users who want
more than 12% of their friends to see their posts on their news feeds, a
few $$ per post with their new
“Highlight” program.
To use the analogy with the Postal Services: this is the same as if the
Postal Services would announce that if you want more than 12% of your
letters to be actually delivered, you must pay a hefty premium ( on top
of paying for the stamp). Otherwise, you can just continue to write the
letter, pay for the stamp, send the letter, but sorry, only 12% of those
letters will be delivered.
As far as I am concerned, I did a simple math exercise: I have around
180 Facebook friends. 12 % of 180 is 21.6. Out of the 21.6 friends who
might see my post in their feeds, at least a couple will be too busy to
check their newsfeed regularly and another couple will not have me
included in the lists or groups that they do check. I am now down to
approximately about 15 friends who might see my post. Out of those,
maybe half will be inclined to occasionally engage with my posts. After
making a cost/ benefit analysis of the time and effort it takes me to
post, and the loss of privacy I experience by having each post monetized
to third parties on the one hand and the benefit of connecting and
sharing with a very small audience of maybe 15 Facebook friends on the
other hand, I have come to the conclusion that the ROI is just not there
for me.
Even a Facebook superstar with the maximum allotted 5000 Facebook
friends, will only get a maximum reach of 600, and will have no say in
who those 600 are, since they will be secretly and algorithmically
determined by Facebook.
The only chance of ever reaching a significant audience is to make
all your posts public and get hundreds of thousans of subscribers. Or to
create a public Page, and get millions to “like” it.
Over time, Facebook has morphed from a site, where one could keep up
with one’s friends, to an all-in-one Twitter, Google+, Pinterest wannabe
public forum. Personally, if I want to post to those kinds of public
fora, I post to Twitter, Google+, and Pinterest.
Where should I go to share with friends?
I am looking forward to reading your comments.
May 25th, 2012 by Monique Altheim
May 18th, 2012 by Monique Altheim
May 15th, 2012 by Monique Altheim
A first try at Infographics. Tweet it, Like it, Pin it, Plus it and most of all, Like
The Law Office of Monique Altheim!
create infographics with
visual.ly
May 11th, 2012 by Monique Altheim
May 4th, 2012 by Monique Altheim
April 27th, 2012 by Monique Altheim
April 20th, 2012 by Monique Altheim
April 13th, 2012 by Monique Altheim
April 6th, 2012 by Monique Altheim
April 4th, 2012 by Monique Altheim
Yesterday, the first
Privacy Law Salon in Washington DC, took place at the National Press Club.
The Privacy Law Salon: Dialogue with Policymakers,
was “a unique meeting of the most experienced practitioners and
corporate executives dealing with privacy law matters, and a unique
opportunity to interact with the policymakers affecting the future of
privacy.”
The purpose of the Salon was “to facilitate a high-level exchange of
ideas and in-depth dialogue on cutting-edge and emerging issues that are
vital to clients, corporations, government and the public interest.”
The Salon was held under the Chatham House Rule.
Some of the main points discussed included:
1. Do Not Track: The DNT system will be in place within a year from now.
2. EU and Global Privacy Interoperability:
- The global debate of the EU prescriptive system v. the US enforcement system will take center stage in the coming year.
- The global flow of information has been rephrased as a trade policy
issue: the use of mutual recognition and enforcement arrangements, so
information can flow freely.
- Many are uncomfortable with the notion of the US seeking “adequacy”
status from the EU. The terms “interoperability” and “mutual
recognition” are much preferred.
- The single most important action from the US towards “interoperability” with the EU would be the passing of the “Privacy Bill of Rights” proposed by The White House last February, but it is very questionable whether this bill will be passed within the next year.
- Instead, the Safe Harbor and BCR Frameworks will probably be expanded.
3.
Context:
- The new “context of interaction “ standard, recommended in the FTC report
of last March, for establishing whether the consumer needs to be
provided with privacy choice when personal data are collected, prompted a
lot of participants to demand clarification as to exactly what that new
standard meant: Is the new standard to be measured by the “Expectation
of Privacy” from the consumer, or should the absence v. possibility of
harm to the consumer be preferred as a measuring rod in order to
determine whether the collection of personal data happened within the
“context of interaction”? The latter seemed to be the more popular view.
- This lead to a request from participants for more clarity and guidance as to what exactly constitutes “privacy harm”.
4. Hot Topics: As current “hot topics” in Privacy were mentioned:
- Social Media Policies and their need for compliance with the NLRB rules.
- The need for coherence in policymaking and applications of the rules.
- The need for more technical knowledge from the regulators.
- The gaps in health data coverage by HIPAA. The example was cited of
the physician who does not accept health insurance, and therefore is not
covered by HIPAA.
- The “Cloud” and access to personal data by Governments.
5. FTC Enforcement Issues: Participants expressed a
desire for more transparency and for more disclosure of standards used
in FTC settlements. It was pointed out that, even though the right to
appeal the FTC settlement decisions exists, it has never been exercised.
The lack of jurisprudence in this area was unanimously deplored.
March 30th, 2012 by Monique Altheim
March 23rd, 2012 by Monique Altheim
March 21st, 2012 by Monique Altheim
In
2000, the EU and the U.S. agreed on the Safe Harbor Framework as a
means to ensure adequate protection for personal data, transferred from
the EU to be processed by U.S. companies.
At the recent
EU Conference on Privacy and Protection of Personal Data,
held in Washington DC, the last panel took the opportunity for taking
stock and discussing the way forward for this agreement. In this
session, businesses and regulators presented their views and experiences
with the U.S.-EU Safe Harbor Framework.
Francoise Le Bail, Director-General for Justice, European Commission,
started by reassuring all stakeholders that the current reform in EU
Data Protection Law would not put the Safe Harbor Framework at risk as
one of accepted ways for adequate transfer of personal data between the
EU and the US, as was mentioned in the
Joint Statement issued by EC Vice-President Viviane Reding and U.S. Secretary of Commerce John Bryson.
“In line with the objectives of increasing trade and regulatory
cooperation outlined by our leaders at the U.S.-EU Summit, the United
States and the European Union reaffirm their respective commitments to
the U.S.-EU Safe Harbor Framework”.
The panelists considered the framework to be mostly a success story,
with 3,000 US companies currently enrolled in the program, 50% of which
are small and medium enterprises, but most agreed that the system could
use some improvement.
David Smith of the British Data Protection Authority, the ICO,
recounted the “absolutely awful” birth of the framework, the difficult
young years and the current maturing into a working instrument for data
protection interoperability between the US and the EU. “The mistrust is
gone, as we believe the US is acting in good faith.” He did concede
though, that a larger amount of audits would ensure better effective
compliance by all companies.
Michelle O’Neill, of the Department of Commerce, added that in order
to ensure better compliance, the supervising departments needed more
resources.
She announced that her department is currently discussing the
expansion of the Safe Harbor Framework to non-profit organizations.
Hugh Stevenson, of the Federal Trade Commission, stressed the
importance of enforcement and awareness raising in order to make
compliance the norm, but deplored the lack of resources to achieve that
goal. He appealed for more international enforcement cooperation as
well.
Jan Philipp Albrecht, Member of the European Parliament, concurred
that Safe Harbor was performing well but was in need of improvement on
the compliance front. He suggested the granting of individual rights of
action for consumers in order to ensure better compliance by the Safe
Harbor certified companies. Currently, enforcement of Safe Harbor rests
with the FTC, under section 5 of the FTC Act, which prohibits “unfair
and deceptive trade practices”.
Nuala Kelly O’Connor, Senior Counsel – Information Governance &
Privacy at General Electric, advocated for more global privacy
interoperability, in addition to Safe Harbor, which is limited to the EU
– US transfer of personal data.
For a complete overview of this panel, please watch this 4 Gigabyte
HD video, which I taped and uploaded on my YouTube Channel
EdiscoveryMap.
Moderator: Armgard von Reden, Lecturer at SRH and Quadriga University, Berlin
Participants, from left to right:
• Françoise Le Bail, Director-General for Justice, European Commission
• Michelle o’Neill, Deputy Under Secretary for International Trade,
US Department of Commerce
• Jan Philipp Albrecht, Member of the European Parliament
• David Smith, Deputy Information Commissioner, United Kingdom
• Hugh Stevenson, Deputy Director for International Consumer Protection, Federal Trade Commission
• Nuala O’Connor-Kelly, Senior Counsel – Information Governance & Privacy, General Electric
March 21st, 2012 by Monique Altheim
The High Level
EU Conference on Privacy and Protection of Personal Data,
held on March 19, was organized by the European Commission and hosted
by the US Institute of Peace in Washinton D.C. The conference was held
simultaneously in Brussels as well, via a video conference link.
This conference was meant to deepen transatlantic dialogue on
commercial data privacy issues in order to achieve further
interoperability between the two systems at a time, when both the EU and
the US have taken significant steps towards new data potection
legislation.
On January 25, the European Commission had published a
draft proposal for a new Data Protection Regulation , and on February 23, the White House had released its privacy blueprint, including the
Consumer Privacy Bill of Rights.
On the occasion of this conference, Commerce Secretary John Bryson
and European Union Commissioner Viviane Reding announced in a
joint statement a new commitment to collaborate on privacy issues and laws.
While most all panelists on the EU side insisted on the necessity of a
binding set of laws, accompanied by individual rights of action in
order to get significant privacy compliance from data controllers, most
panelists on the U.S. side affirmed that voluntary codes of conduct,
combined with enforcement by the FTC would achieve the same result,
while allowing for more flexibility in adapting to the constantly
changing technological landscape.
Even though the panelists went through great efforts to stress the
common values and goals of the EU and U.S. policy makers, there is no
denying that the European and American “privacy DNAs”remain vastly
different. One major difference is the fact that, even in the commercial
realm, privacy and data protection is a human and constitutional right
in the EU, while in the U.S. it is at best considered a consumer right,
if a right at all.
Did the conference achieve its goal of bringing the two sides a little bit closer together?
In order to enable those who could not attend the conference, either
live or through video transmission, to judge for themselves, I wrote a
“play” in three acts, based on the actual discussions that took place
during three panels.
Americans Are from Mars, Europeans Are from Venus
Act 1: A Law or not a Law?
Francoise Le Bail (EC): I realize I
am in the Lion’s Den (giggle), but I shall be brave. It is critical to
have a privacy LAW, so that people will TRUST the internet!
Daniel Weitzner (White House): We
will call on Congress to legislate in order to provide people with the
necessary TRUST in the new information economy. But, meanwhile, we hope
that the stakeholders will create their own little codes of conduct.
David Vladeck (FTC): We all agree!
Yay! By the way, did you know that in the U.S. Voluntary Codes of
Conduct are just like Laws? We are so good, we even obey the law, when
there is no law! And they are so flexible, to boot!
Douwe Korff(EDRi): Waddya all
talking about?? Did you know that in the EU, privacy is a human right?
You need a CONSTITUTION to guarantee a human right! Voluntary codes of
conduct, humph.
Mark Rothenberg (EPIC): I see a window of opportunity. I see legislation on the horizon.
Vivian Reding (EC): One-Stop-Shop!
John Bryson (White House): This will be a landmark year for data protection!
Ed Markey (D-MA): The Europeans are coming! I love
them. We must legislate, especially my own very excellent proposal. Do
it for the children, folks! It’s immoral not to.
APPLAUSE FROM THE EUROPEANS. END OF ACT 1.
Act 2: The Interoperability Dream
Lawrence Strickling (DoC): Yes, we can!
Jennifer Stoddart (Privacy Commissioner Canada): If the Europeans can do it with the Canadians, they can do it wit the Americans too!
Peter Hustinx (EDPS): Now wait, little children:
first eat your voluntary codes, and make them binding, and then we shall
see. I might have a surprise for you!
Daniel Pradelles (HP): Self Regulation Rocks! Plus, we at HP are the only ones to have BCRs approved by all DPAs of all the EU Member States.
Claus-Dieter Ulmer: (Deutsche Telekom): Will you make up your minds already? The faster and the easier the solution, the better for us. Either way, we need to know.
Marie-Helene Boulanger (EC): First, second, third
and finally, fourth. And if you Americans will get off your a..es and
legislate already, well then, we might just become interoperable with
you guys.
Axel Voss ((MEP): What we really need is global data traffic regulation.
Joe Alhadeff (Oracle): HOW on earth are you going to do all this?
END OF ACT 2. LUNCH.
Act 3: Let Me Count the Ways I Enforce Thee
Julie Brill (FTC): We at the FTC protect the Global Community with our fierce enforcement actions!
Cameron Kerry (DoC): The FTC is the Global Leader in enforcing privacy protection!
Paul Nemitz (EC): Global Leader?? Global Leader in P.R., ha!
Maneesha Mithal (FTC): Paul Nemitz, we make sure to publicize our daring dawn raids, so the bad guys will tremble in their board rooms, ha!
Jacob Kohnstamm (Dutch DPA) (with an inexplicable
tired look on his face): We need to enforce to get compliance. And FYI,
opt-out in OBA is NOT adequate. You give me explicit consent, I give you
adequate, capice?
Kostas Rossoglou (BEUC): I wish we had class actions for data protection law suits.
Jeff Chester (CDD): The FTC enforces, and Google and
Facebook are expanding their data collection like never before. Please
listen to me, the entire world is analyzing the entire world!
Law Student Max Schrems (Europe v. Facebook) (fresh faced)
: I took Facebook to task, so why can’t you, old geezers?
Maneesh Mithal and Jacob Kohnstamm (in unison
): if I were a rich man, lala lala lala la, all day long I’do nothing but enforce, la la la la la!
THE END
PANEL 3, moderated by
Cedric Laurant, or where can be heard what really was said
:
Safe Harbor, discussed during the fourth panel, will be the subject of a seperate post.
March 16th, 2012 by Monique Altheim
March 9th, 2012 by Monique Altheim
