The promise and peril of ICT implants: setting the legal framework 47 th FITCE Congress London, September 2008 Eleni Kosta, Peggy Valcke Interdisciplinary Centre for Law & ICT (ICRI-K.U.Leuven) Dementia or Alzheimer Source: guardian.co.uk If only I could insert implants in these little blue Smurfs Data protection issues When the implant contains itself information about the individual a unique number that can be linked to information that is stored in a database and relates to an individual Privacy? (c) Pertti Jarla Reliability (c) Pertti Jarla Profiling Personal data Personal data are information relating to an identified or identifiable natural person Processing of personal data Article 7 Data Protection Directive Article 8 Data Protection Directive for sensitive data Health data health Sensitive data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life (Art. 8(1) Data Protection Directive) Processing of health data Prohibited Prohibited!! Or consent Explicit consent; however the explicit consent of the data subject may not be sufficient for the processing of health data, when the laws of a Member State provide that the prohibition may not be lifted by the data subjects giving his consent Processing of health data employment law The processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment law. vital interests The processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his consent Processing of health data preventive medicine, medical diagnosis, the provision of care or treatment or the management of health- care services health professional professional secrecy The processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health- care services, and where those data are processed by a health professional subject [] to the obligation of professional secrecy []. The solution? Privacy and security by design is the solution Or maybe? Thank you for your attention! Eleni KOSTA Interdisciplinary Centre for Law & ICT (ICRI) Katholieke Universiteit Leuven IBBT