Ebooks in data privacy and protection

Summary

145. OUTLINE – The GDPR has introduced a number of important clarifications and changes when it comes to liability under EU data protection law. The main principles underlying the liability model have, however, essentially remained the same. To provide a comprehensive account of the liability exposure of controllers and processors, both the liability regime of Directive 95/46 and the liability regime GDPR shall be analysed.

146. RELEVANT SOURCES – The main sources used for the analysis are the texts of Directive 95/46 and the GDPR, their preparatory works and the guidance issued by the Article 29 Working Party. Where appropriate, however, reference shall also be made to the preparatory works of national implementations of Directive 95/46 (e.g. the Netherlands, Belgium), as a means to supplement the insights offered by the primary sources. Last but not least, the Principles of European Tort Law (PETL), as well as national tort law, are also considered for issues not addressed explicitly by Directive 95/46 or the GDPR.

DIRECTIVE 95/46: “STRICT” LIABILITY FOR CONTROLLERS

147. BASIC PRINCIPLE – Under Directive 95/46, a controller was, as a matter of principle, liable for any damages caused by the unlawful processing of personal data. Article 23(1) of Directive 95/46 stipulates that Member States must provide that the controller shall be liable towards data subjects for any damages suffered as a result of an unlawful processing operation. A controller could be exempted from liability, however, in whole or in part, if he proved that he was “not responsible for the event giving rise to the damage” (Article 23(2)). Directive 95/46 does not contain any provisions regarding the liability exposure of processors. While Article 16 stipulates that processors may only process the data in accordance with the instructions of the controller, the Directive does not explicitly allocate liability in case of a disregard for instructions.

CONTROLLER LIABILITY

A. The nature of controller obligations

148. “MEANS” OR “RESULT” – To properly understand the liability exposure of controllers, it is necessary to first understand the nature of controller obligations. Directive 95/46 imposes a variety of obligations upon controllers. In certain instances, the obligations specify a result to be achieved (e.g. “personal data must be collected for legitimate purposes and not further processed in a way incompatible with those purposes”). In other instances, the obligations are specified as an obligation to make reasonable eff orts to do something (“obligation of means”).

Summary

NATIONAL DATA PROTECTION LAWS BEFORE 1980

297. OUTLINE – This chapter will analyse three of the earliest data protection laws, namely the Hessian Data Protection Act of 7 October 1970, the Swedish Data Act of 11 May 1973 and the French Law on Informatics, Files and Liberties of 6 January 1978. The objective of this analysis is to ascertain how the early data protection laws allocated responsibility for complying with the norms they contained. For each instrument, the analysis will commence with a discussion of the origin and development of the instrument in question. Next, the scope ratione materiae of each instrument shall be discussed, followed by an overview of the basic protections it contains. Finally, a separate section shall be dedicated to an analysis of how each instrument allocates responsibility and liability.

THE HESSE DATA PROTECTION ACT (1970)

ORIGIN AND DEVELOPMENT

298. A TALE OF HOPE AND DISENCHANTMENT – Following the “Great Hessen plan” of 1965, the German Federal State (“Land”) of Hesse embarked upon a large-scale data collection exercise. The goal of this exercise was to assist the government in its development of long-term policies in economic and social matters, such as finance and social security. In 1969, the government enacted legislation which authorized the creation of an integrated data processing system for state and communal data. By using automated data processing techniques, policy makers would be able to “replace the most intuitive political decisions by rational conclusions based on knowledge of all the relevant data”. Towards the end of the ’60s, however, euphoria regarding the benefits of automation started to dwindle, as critical reflections regarding the consequences of such automation began to increase. Two concerns in particular permeated the debate: destabilization of the balance of powers (“Gewaltenteilung”) and the loss of privacy (“Verlust jeglicher Privatheit”).

299. UPSETTING THE BALANCE – A first area of concern related to the balance of power between the legislature and the executive. Some worried that the use of automated data processing techniques would unduly strengthen the power of the executive vis-à-vis the legislative branch (by providing the former with an “informational advantage” over the latter). A second set of concerns revolved around the relationship between the State and its citizens.

Summary

INTRODUCTION

409. DATA CROSSES BORDERS – During the 1970s, policy makers became increasingly concerned with the international dimension of data protection. Transborder flows of personal data were gradually becoming a reality to be reckoned with. Certain policymakers feared that protections offered by national laws might be circumvented by “off shoring” data processing activities. Any restrictions on the international transfer of personal data, however, would disrupt free information flow and trade. To address this issue, international organisations started to form working groups of experts to explore the necessities and implications of data protection at the international level.

410. INTERNATIONAL INITIATIVES – Although individual accounts vary, the first international discussions on the need for data protection may be situated towards the end of the 1960s. The increasingly international dimension of data flows made it imperative that certain “basic rules” be established and agreed upon at international level. Data protection was discussed at various intergovernmental and non-governmental fora. In the end, however, there were two international organisations which would contribute most to the development of harmonised data protection standards, namely the Organisation for Economic Cooperation and Development (OECD) and the Council of Europe.

THE OECD GUIDELINES (1980)

ORIGIN AND DEVELOPMENT

411. ECONOMIC RELEVANCE – The Organisation for Economic Co-Operation and Development (OECD) took an early interest in information processing and computerization. From the 1960s onward, the OECD considered information to be an increasingly important economic asset. When the first data protection laws emerged, concerns arose as to how such legislation might affect the free flow of data across borders. Transborder data flows (“TBDF”) were generally perceived as being beneficial to economic and social development. Any restrictions upon TBDF could impede those benefits from accruing and therefore required careful consideration.

412. PREPARATION – Between 1968 and 1974, the OECD undertook a range of studies and organised multiple seminars regarding the technological, economic and legal implications of computing. In 1977, an intergovernmental Expert Group on “Transborder Data Barriers and Privacy Protection” was established. The mission of this Expert Group was to (1) develop guidelines on basic rules governing transborder flow and the protection of personal data and privacy with a view of facilitating harmonization and (2) investigate the legal and economic problems relating to the transborder flow of nonpersonal data. The Expert Group was to carry out its activities “in close co-operation and consultation” with the Council of Europe and the European Community.

Summary

261. OUTLINE – The qualification of an actor as either a controller or processor has implications beyond the allocation of responsibility and liability. To begin with, the qualification is important to determine whether EU data protection law applies to the processing, and if so, to what extent. In addition, determining the appropriate qualification of the actors involved may also be necessary to comply with a number of substantive provisions, in particular provisions regarding (a) transparency of processing; (b) data subject rights; (c) balance of interests and (d) legal binding between controllers and processors. The aim of this section is to briefly elaborate upon the additional functions which the controller and processor concepts fulfil within the regulatory scheme of EU data protection law.

TERRITORIAL SCOPE

262. ESTABLISHMENT OF CONTROLLER OR PROCESSOR – Article 3 sets forth when processing of personal data falls within the territorial scope of the GDPR. One of the main factors in each of these instances is the territory in which the controller or processor is established. For example, Article 3(1) stipulates that the GDPR shall apply to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union. Determining the territorial scope of the GDPR pursuant to Article 3(1) therefore implies prior identification of the entity which is acting as a “controller” or “processor” of the processing, as well as the location of its “establishment(s)”.

263. SEPARATE APPLICATION – The EDPB has taken the view that when it comes to the identification of the different obligations triggered by the applicability of the GDPR, the processing by each entity (controller or processor) must be considered separately. The GDPR envisages different and dedicated provisions or obligations applying to data controllers and processors respectively, and as such, should a data controller or processor be subject to the GDPR, the related obligations would apply to them respectively and separately. As a result, the EDPB also considers it important to consider the establishment of the controller and processor separately for purposes of Article 3.

264. TARGETING OR MONITORING – Similar considerations also apply in the context of Article 3(2) GDPR. Article 3(2) determines the territorial scope of the GDPR in case of processing of personal data by a controller or processor not established in the Union.

Summary

Practically every organisation in the world processes personal data. In fact, it is difficult to imagine a single organisation which does not regularly collect, store or access information about individuals. European data protection law imposes a series of requirements designed to protect individuals against the risks that result from the processing of their data. It also distinguishes among different types of actors involved in the processing and sets out different obligations for each type of actor. The most important distinction in this regard is the distinction between “controllers” and “processors”. Together these concepts provide the very basis upon which responsibility for compliance with EU data protection law is allocated. As a result, both concepts play a decisive role in determining the potential liability of an organisation under EU data protection law.

For almost 15 years, Directive 95/46 stood strong as the central instrument of EU data protection law. In 2010, however, the European Commission announced that the time for change had come. The Commission considered that while the objectives and principles of Directive 95/46 remained sound, revisions were necessary in order to meet the challenges of technological developments and globalisation. A public consultation conducted in 2009, had revealed concerns regarding the impact of new technologies, as well as a desire for a more comprehensive and coherent approach to data protection. During the consultation, several stakeholders also raised concerns regarding the concepts of controller and processor. Various solutions were put forward, ranging from minor revision to outright abolition of the concepts. In the end, the EU legislature opted to retain the existing concepts of controller and processor in the General Data Protection Regulation (GDPR). Notable changes were made, however, with regards to the allocation of responsibility and liability among the two types of actors.

Technological and societal developments have rendered it increasingly difficult to apply the concepts of “controller” and “processor” in practice. The complexity of today's processing operations is such that a clear-cut distinction between “controllers” and “processors” is not always possible. Identifying “who's who” can be particularly difficult when the processing involves a large number of actors, who each play their own distinct role in realising the goal(s) of the processing.

Summary

271. ALLOCATION OF RESPONSIBILITY AND LIABILITY – Within the regulatory scheme of EU data protection law, the controller carries the primary responsibility for ensuring compliance. At the moment of its enactment, the EU legislature was mindful of the practice whereby one organisation requests another organisation to perform certain processing operations on its behalf. By introducing the concept of a “processor”, the EU legislature hoped to be able address this situation and to ensure a continuous level of protection.

272. RELATIONSHIP CONTROLLER-PROCESSOR – The Article 29 Working Party has approximated the relationship between controllers and processors with the figure of delegation. The analogy appears to be founded on a number of considerations. In first instance, a processor acts “on behalf” of a controller and is called upon to abide by the instructions given by the controller. Secondly, the consequences of the processor's actions are in principle attributed to the controller, provided that the processor merely follows the latter's instructions. Finally, the delegation figure also permits the delegate (processor) to exercise a certain amount of discretion on how to best serve the principal's (controller's) interests.

273. MULITPLICITY OF CONTROL – Not every collaboration involving the processing of personal data among two separate actors implies the existence of a controller-processor relationship. It is equally possible that each actor processes personal data for their own distinct purposes, in which case each actor is likely to be considered a controller independently of the other. It is also possible that collaborating actors jointly exercise decision-making power concerning the purposes and means of the processing, in which case they are considered to act as joint or (co) controllers.

274. VARYING DEGREES OF CONTRACTUAL FLEXIBILITY – The GDPR has devoted several provisions to the relationship between controllers and processors. Article 28(3) specifies that the relationship between controller and processor shall be governed by a contract or other legal act, which must contain, at a minimum, all the elements mentioned in this provision. As far as joint controllers are concerned, Article 26(1) GDPR stipulates that they shall in principle determine their respective responsibilities for compliance, in particular as regards the exercise of data subject rights and their respective duties to provide the information, by means of an arrangement between them. The contrast, in terms of detail, between Article 28(3) and Article 26(1) of the GDPR is striking.

Summary

1352. OUTLINE – The aim of this Chapter is to outline possible avenues for further improving the allocation of responsibility and liability among actors involved in the processing of personal data. The following recommendations shall be presented:

Summary

“You have to know the past to understand the present”.

Dr. Carl Sagan, 1980

278. PREFACE – The concepts of controller and processor were not created out of thin air. Prior to Directive 95/46 and the GDPR, many other data protection instruments incorporated concepts with similar meaning and scope. The objective of this Part of the book is to enhance the understanding of the meaning and role of the controller and concepts by tracing the origin and development of these concepts over time.

279. RELEVANT PERIODS – When one looks at EU data protection law from a historical perspective, four main periods can be distinguished, namely:

Summary

INTRODUCTION

990. WHAT IS CLOUD COMPUTING? – Cloud computing has been defined in many ways. Often cited is the definition of the U.S. National Institute for Standards and Technology (NIST), which describes cloud computing as

“a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

The European Network and Information Security Agency (ENISA) has defined cloud computing in slightly more neutral terms, as

“an on-demand service model for IT provision, often based on virtualization and distributed computing technologies.”

991. KEY CHARACTERISTICS – Cloud computing involves the remote consumption of IT resources via a network (e.g. the Internet). Not every Internet application, however, is deemed worthy of the label of cloud computing. Most authors also consider “elasticity” and “measured service” as defining characteristics of cloud computing. Cloud providers typically allow customers to expand or decrease their resource consumption almost instantaneously, on a “pay as you go” basis. Finally, cloud services (especially infrastructure services) are often presented in a “virtualised” manner: providers dynamically assign and reassign resources from a pool which are shared as fungible resources with other customers.

992. BENEFITS – When using cloud computing, the customer externalises part of its IT infrastructure and associated maintenance. Instead of purchasing his own hardware and software, the customer relies on the services of the cloud provider. Because customers normally pay by usage, they can avoid large upfront costs which may otherwise be necessary to set up and operate sophisticated computing equipment. Moreover, customers can scale up or down rapidly as their needs increase or decrease. Put differently, cloud computing promises “computing power on demand”, with limited or no expense beyond actual consumption. Providers, in turn, are able to leverage economies of scale, by pooling their resources and reaching large volumes of customers with relatively low overhead.

993. RISKS – The risks of cloud computing mirror its benefits. By externalising portions of IT infrastructure, the customer invariably gives up a certain degree of control. Servers, data and applications are no longer kept within the organisation, but on the premises of one or more external providers. As a result, customers are by definition dependent on the cloud provider to implement appropriate measures to ensure the confidentiality and security of processing.

Summary

ORIGIN AND DEVELOPMENT

588. REVIEW OF DIRECTIVE 95/46 – For almost 15 years, Directive 95/46 stood strong as the central instrument of data protection regulation in the EU. The European Commission assessed its implementation in 2003 and 2007, both times concluding there was no need for revisions. In 2010, however, the Commission announced that the time for revisions had come. The Commission argued that while the objectives and principles underlying Directive 95/46 remained sound, revisions were necessary in order to meet the challenges of technological developments and globalisation.

589. A CHANGING ENVIRONMENT – Formal preparations for the review began in July 2009, when the European Commission launched a public consultation “on the legal framework for the fundamental right to protection of personal data”. The consultation revealed concerns regarding the impact of new technologies on data protection, as well as a desire for a more comprehensive and coherent approach to data protection. Perhaps more significantly, 2009 was also the year when the Lisbon Treaty entered into force. Article 16 of the Lisbon Treaty provided the EU with a legal basis to enact comprehensive data protection legislation across Union policies (including in the area of police and judicial cooperation in criminal matters). It also gave the right to data protection renewed prominence: the right to data protection was recognized both by Article 16 of the Treaty and Article 8 of the EU Charter of Fundamental Rights, which became legally binding as the Lisbon Treaty entered into force.

590. PUSH FOR (EVEN) GREATER HARMONISATION – A new public consultation ensued following the EC Communication of 4 November 2010. The Commission concluded that many stakeholders supported the idea of further harmonisation of data protection rules at EU level. The Commission also felt that despite its aim, Directive 95/46 had failed to ensure an equivalent level of protection throughout the EU. Persistent fragmentation meant legal uncertainty, administrative burden and an uneven protection for individuals. A Regulation would provide a strong and uniform legislative framework at EU level.

Summary

472. OUTLINE – This chapter will analyse two data protection laws enacted after 1981, namely the UK Data Protection Act of 1984 and the Belgian Data Protection Act of 1992. The objective of this analysis is to track the further development of EU data protection laws leading up to Directive 95/46. In the interest of brevity, the discussion of each act shall be reduced in scope. The discussion will be limited to (1) the origin and development of the act (in order to place it in context) and (2) the allocation of responsibility and liability. Substantive rights and obligations are not discussed separately, as these provisions correspond, by and large, to the provisions of Convention 108 and the OECD Privacy Guidelines.

UNITED KINGDOM (1984)

ORIGIN AND DEVELOPMENT

473. EARLY INITIATIVES – The UK Data Protection Act of 1984 had been a long time coming. The first legislative proposals concerning privacy emerged in the early 1960s, under the form of private member bills. These bills mainly sought to introduce a general right to privacy. None of these proposals made much of an impact, however, until the Right to Privacy bill of 1969. This bill was closely connected to a controversial Justice report entitled “Privacy and the Law” (1970). While the Right to Privacy bill was not adopted, the ensuing debate did induce the Government to appoint a Committee on Privacy, better known as the “Younger Committee”.

474. YOUNGER COMMITTEE – The Younger Committee was tasked to investigate whether legislation was necessary “to give further protection […] against intrusions into privacy by private persons and organisations, or by companies”. Its mandate of inquiry was thus confined to the private sector. In 1972, the Committee found that it would be unwise to create a general right to privacy. It also felt that the introduction of data protection legislation would be premature as the use of computers did not yet form a threat to privacy. It did, however, recommend that computer users voluntarily adopt certain principles for handling personal information on computers. It also recommended that the Government “provide itself with machinery, such as a standing commission, for keeping under review the growth and techniques of gathering personal information on computers”.

475. GOVERNMENT WHITE PAPER – After some years of delay, the UK Government issued a White Paper entitled “Computers and Privacy” (1975).

Privacy as Virtue discusses whether a rights-based approach to privacy regulation still suffices to address the challenges triggered by new data processing techniques such as Big Data and mass surveillance. A rights-based approach generally grants subjective rights to individuals to protect their personal interests. However, large-scale data processing techniques often transcend the individual and their interests. Virtue ethics is used to reflect on this problem and open up new ways of thinking. A virtuous agent not only respects the rights and interests of others, but also has a broader duty to act in the most careful, just and temperate way. This applies to citizens, to companies such as Apple, Google and Facebook and to governmental organizations that are involved with large scale data processing alike. The author develops a three-layered model for privacy regulation in the Big Data era. The first layer consists of minimum obligations that are independent of individual interests and rights. Virtuous agents have to respect the procedural pre-conditions for the exercise of power. The second layer echoes the current paradigm, the respect for individual rights and interests. While the third layer is the obligation of aspiration: a virtuous agent designs the data process in such a way that human flourishing, equality and individual freedom are promoted.

Ebooks in data privacy and protection

Refine listing

Refine listing

Actions for selected content:

690 results in Ebooks in data privacy and protection

Acknowledgments

Chapter 5 - Liability Exposure of Controllers and Processors

Summary

Chapter 3 - National Data Protection Laws before 1980

Summary

Chapter 4 - International Instruments

Summary

Chapter 7 - Additional Functions of the Controller and Processor Concepts

Summary

PART I - INTRODUCTION

Bibliography

PART II - STATE OF THE ART

PART V - RECOMMENDATIONS

PART IV - USE CASES

Abstract

Summary

Chapter 8 - Conclusion

Summary

Chapter 4 - Recommendations

Summary

Chapter 1 - Introduction

Summary

Chapter 4 - Cloud Computing

Summary

Chapter 7 - General Data Protection Regulation

Summary

Chapter 5 - National Data Protection Laws after 1981

Summary

Contents

Frontmatter

Privacy as Virtue

Ebooks in data privacy and protection

Refine listing

Refine listing

Actions for selected content:

Save Search

690 results in Ebooks in data privacy and protection

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Privacy as Virtue