A European View of Privacy Protection

John WouldsDirector of Operations

UK Data Protection Commissioner

National Conference on Privacy, Technology & Criminal Justice Information

Washington D.C. 31 May - 1 June 2000

A European View of Privacy Protection

• Information privacy - the European approach

• Some criminal justice case studies• Relevance to the US• The SEARCH Task Force• Conclusion

The view from Manchester

• The UK Data Protection Commissioner :– is a statutory

regulatory body– deals with

information privacy

– covers both public and private sectors

– is based near Manchester UK

The view from Manchester

• The UK Data Protection Commissioner :– is a statutory

regulatory body– deals with

information privacy

– covers public and private sectors

– is based near Manchester UK

• Wilmslow

• London

The European approach to information privacy

• General law to protect personal data:– set of principles– rules for processing (including

transfer overseas)– rights for individuals– legal remedies– independent supervision– enforcement mechanism

The European approach to information privacy

• General law to protect personal data:– set of principles– rules for processing (including

transfer overseas)– rights for individuals– legal remedies– independent supervision– enforcement mechanism

Personal data shall be•processed fairly and lawfully•processed only for specified, lawful and compatible purposes•adequate, relevant and not excessive•accurate and up to date•kept for no longer than necessary•processed in accordance with the rights of data subjects•kept secure•transferred outside the EU only if there is adequate protection

The European approach to information privacy

• General law to protect personal data:– set of principles– rules for processing (including

transfer overseas)– rights for individuals– legal remedies– independent supervision– enforcement mechanism

The European approach to information privacy

• General law to protect personal data:– set of principles– rules for processing (including

transfer overseas)– rights for individuals– legal remedies– independent supervision– enforcement mechanism

AccessCorrection, blocking, deletion, destructionPreventing processing and automated decisionsCompensation

The European approach to information privacy

• General law to protect personal data

• Underpins the approach to information privacy across all sectors

The European approach to information privacy

• General law to protect personal data

• Underpins the approach to information privacy across all sectors Business

Commerce

Finance

Marketing

Employment

Taxation

Social security

Health

Police

Criminal Justice

The European approach to information privacy

• The EU Data Protection Directive:– applies to processing of personal data– establishes individual rights and legal

remedies– sets out rules for legitimacy of

processing, transfers to third countries, data quality, confidentiality and security

– requires independent supervision

Balancing rights

• Individual’s rights:– to private life– to know– to freedom of expression

• Rights of others (other individuals, business, the state)

• Interests of society

Privacy and criminal justice - case studies

• Retention of criminal records• Disclosures to the media• Accuracy of criminal records• HIV warning signals• DNA database• AFR fingerprint database

Information privacy protection

• Europe– omnibus law– harmonisation

across the EU– sector specific

codes– powerful

supervisory authority

– human rights issue

• US– sector specific

law– federal and state

initiatives– industry self-

regulation– private right of

action– commercial free

speech issue

The practical questions

• What level of protection can I expect?

• How can I find out?• Do I have any choice?• Can I secure change?• What remedies do I have?

• Can I safeguard my private life?

European approach - relevance to the US

• Globalisation• International cooperation• EU restriction on transfers of

data– adequacy of protection– safe harbors?

The SEARCH Task Force

• Benefits from:– mix of interests– privacy advocates– privacy regulators– international participation

• A different perspective on the issues

Why does Europe not want to exchange records with the

US?

Why does Europe not want to exchange records with the

US?

“This is a free country, madam. We have a right to share your privacy in a public place.”

Peter Ustinov

“This is a free country, madam. We have a right to share your privacy in a public place.”

Peter Ustinov

Not under European law!