Data Protection and Privacy: Changing Interplay among Social Values? Mindaugas Civilka, Vilnius University

1
Data Protection and Privacy Changing Interplay
among Social Values? Mindaugas Civilka,
Vilnius University

• LEFIS,
• Rovaniemi meeting
• 19-20 January, 2007

2
Law and Privacy where the social background and
individual values meet each other (I)

• Historically perceived as human right to be left
  alone, in nowadays society privacy is playing
  different societal role
• Today the concept of privacy is overwhelmingly
  becoming a sociological rather than a clearly-cut
  legal concept
• Although historically the human right to privacy
  has given birth to the concept of data
  protection, now legal regime of personal data
  protection claims its right to sui generis regime
  of its own, moving apart from the general concept
  of privacy
• Data protection is more useful and easy-to
  regulate as it is more legally defined concept
• On the other hand, it may pay tribute to
  non-legal constructs as efficacy,
  cost-orientation, networking effects and other
  social/economic perspective based aspects

3
Law and Privacy where the social background and
individual values meet each other (II)

• Two regimes differ data protection is necessary
  a compromise between principles of market-based
  economy (or public safety-related concerns), and
  traditional view to privacy, whereas human right
  to privacy is embedded on the opinio juris and
  general principles of international law and human
  rights
• However, one may not treat this approach as an
  attempt to downgrade privacy and its importance
  in society. Privacy is and will always remain key
  value to the democratic society
• The concern, which is raised here is how the law
  should interact with these changes in the way the
  society perceives its individuals, and
  vice-versa, individuals perceive each other and
  the society at large

4
Human right to privacy and personal data
protection regimes in the changing legal
environment (I)

• Why sui generis data protection regime was
  necessary?
• The first data protection law in the world
  enacted in the Land of Hesse in Germany in 1970
• The Council of Europe's 1981 Convention ETS No.
  108 1981 OECD Guidelines describe personal
  information as data which are afforded protection
  at every step from collection through to storage
  and dissemination
• Data protection regime is about the right of data
  subject to control what is happening with his/her
  data. Data protection regime is no longer based
  on assumption that the personal data may not be
  collected otherwise than through consent of the
  individual the law also presupposes other cases
  where such collection of personal data may be
  legitimate

5
Human right to privacy and personal data
protection regimes in the changing legal
environment (II)

• Directive 95/46/EC serves as a regulatory
  framework for ensuring a balance between a high
  level of protection for individual privacy and
  the free movement of personal data within the
  European Union
• Directive 97/66/EC determines the processing of
  personal data and the protection of privacy in
  the telecommunications sector. However, it is
  already outdated
• Directive 2002/58/EC concerns the processing of
  personal data and the protection of privacy in
  the electronic communications sector replaces the
  Directive 97/66/EC

6
Human right to privacy in the changing social and
technological environment (I)

• Technology has changed the way the society
  perceives the balance between the right to know
  and the right to privacy
• Internet and modern technologies have become
  (accidentally or coincidentally) instigators for
  new type of social environment and new type of
  social rules
• New ways and modes of life are inevitably
  changing the very concept of privacy
• The right to information, the right to
  self-promotion is becoming more and more
  important

7
Human right to privacy in the changing social and
technological environment (II)

• Data protection regime is necessary a compromise
  based on assumption of active data subject, as
  opposed to passive individual for the purposes of
  ECHR Article 8, on collection of data as opposed
  to non-interference with the private life of
  individual under ECHR Article 8, on transmission
  of data as opposed to keeping secrecy and
  preserving autonomy
• Privacy is based on non-interference and
  non-surveillance, whereas pursuant to data
  protection laws collection of personal data is
  not necessary unlawful, provided, however,
  statutory requirements are met
• Data protection regime presupposes certain active
  steps to be made by the individual so that he
  himself decides whether he will provide the data
  for those particular purposes and whether he will
  interact with other society members. Thus, data
  protection is largely about choices and
  self-determination of individual himself/herself

8
Data Protection within Third Pillar new era in
modern data protection (I)

• Historically, the data protection regime was
  about the balance between usual societal needs
  and business necessities
• However, social, political changes (e.g. the
  threat of terrorism) and technological changes
  (e.g. development of electronic communications,
  including internet and its actors) necessitated
  the need for the different, brand new type of
  balance between higher protection of privacy
  and security of public interests
• Third Pillar of EU may become even more
  controversial to concerns of privacy
• The retention of data as a subsequence of Third
  Pillar has opened the new page on the history of
  online privacy

9
Data Protection within Third Third Pillar new
era in modern data protection (II)

• Directive 2006/24/EC controversial piece of
  legislation
• Privacy-relevant aspects of the Directive
  2006/24/EC
• operators shall be forced to take expensive
  measures in order to keep huge amounts of data
• higher price for internet and related services
• fewer possibilities for self-expression various
  requirements for registration, authorisation of
  users
• The combat with terrorism may make the life much
  less convenient, but what is the real price we
  are paying for safer society?
• Third Pillar of EU reminds us of the price for
  the very concept of privacy. Unfortunately, in
  the hands of evil new technologies may become
  more dangerous to the society as before

10
Big Brother watches you

• Nowadays people increasingly feel that someone is
  keeping a close watch on them. In the words of
  David Brin, darkness no longer offers even a
  promise of privacy
• The society does not expect absolute privacy
  anymore - cameras are on each corner of the
  street
• We should know that we are under surveillance,
  but we should have a possibility to monitor those
  who monitor us
• New social rule is tolerated today much higher
  priority may be given to the security of society
  than to privacy
• From the perspective of a data subject the more
  important thing is to know what will happen with
  his data than the very fact that his data are
  collected and used

11
Whats so special about the internet? (I)

• Internet content has become vaster than printed
  era production, or traditional media,
  audio-visual production. Internet has become the
  biggest, most powerful and ubiquitous printing,
  copying, media-creating, disseminating machine.
  Consumers are contributing to creation of public
  content to such an extent that traditional media
  production is relatively low output in comparison
  with the former
• New society is about making choices. The issue
  that in reality internet provides no real choices
  users cant choose internet without data mining
  and surveillance - merits a separate paper
• Privacy risks inherent in the use of cookies
  novel modes of surveillance?
• In some cases, cookies may be useful for
  providing online services or to facilitate the
  surfing of the Internet user

12
Whats so special about the internet? (II)

• Spam (unsolicited electronic junk or bulk mail)
  and related problems from the users point of
  view
• collection of ones e-mail addresses without
  ones consent or knowledge
• receipt of large amounts of unwanted advertising
• cost of connection time
• But is the spam so really different from
  physical life direct marketing?

13
Location data one of the most sensitive areas
of data protection

• A service provider should regularly remind
  individual that his terminal equipment has been,
  will be or can be located
• Processing location data cannot be justified
  where it is done for the purpose of surveillance
• Working Party Article 29 - the surveillance of
  employees may be justified for the purposes of
  planning operations in real time, or where a
  security objective is being pursued in relation
  to the employee himself or to the goods or
  vehicles in his charge

14
Interplay with intellectual property

• Once again, we are talking about the balance -
  combat against illegal content vs. right to
  internet privacy
• Is Directive 2004/48/EC striking the right
  balance?
• Individuals are not protected from illegal
  internet content (starting from intellectual
  property rights violations and ending with
  criminal offences) and illegal data surveillance
• A balance between the protection of privacy of
  society and protection of intellectual rights
  must be reached once again
• Whether our society in all cases justifies
  disclosure of personal data in order to protect
  the rights of intellectual rights holders?

15
Do the surveys of public opinion reflect social
reality? (I)

• Public research for Infobalt2000 convenience
  and quick search as well as comfortable
  navigation in the internet was valued most by
  Lithuanian consumers by the end of 2000 (60).
  While the anonymity and security of personal data
  was deemed as a matter-of-course (54)
• However, quite a big part of consumers (60) was
  ready to choose convenience and quick searching
  services rather than privacy and personal data
  security. In addition, only few respondents
  determined privacy as a problematic aspect of the
  internet (7)
• Two years later, in 2002, the majority of the
  respondents assumed that their personal data
  should not be public, however, less than 10 of
  respondents could determine who has a right to
  collect their personal data
• Thus, lack of information and public knowledge
  about data protection seemed to be the biggest
  problem in Lithuania in those days, although
  situation changes to the better now

16
Do the surveys of public opinion reflect social
reality (II)?

• Eurobarometer survey (Special Eurobarometer 196)
• Around 64 of EU15 citizens polled tended to
  agree that they were worried about leaving
  personal information, such as their name,
  address, date of birth on the Internet. In a
  technological extension to the telephone
  monitoring question, the issue of monitoring
  Internet use was reviewed. The main response from
  40 of polled was that monitoring should only
  take place on those suspected of terrorist
  activities.
• There was less support for the rights of the
  individual when related to the Internet than the
  telephone and, accordingly, only 25 of the EU15
  considered this to be the stance that should be
  taken
• May we say that the public polls may imply that
  new technologies (internet) bring more
  possibilities to society, and expectations of
  society are changing? May it be suggested that
  the right to information, right to selfpromotion
  is becoming more important than privacy? May the
  results show that people do not refuse to stay
  anonymous, but they do not expect privacy
  anymore?

17
Direct marketing different perspective

• Business perceives the personal data on consumers
  as the tool for business activities or as
  economic good/commodity
• Most of consumers treat their data as belonging
  to them, although in case of economic benefit
  gain most of the users may tend to disclose their
  data or relinquish of their rights to privacy.
  Bonuses, promotion, offers, individualized or
  customized solutions may not be effectively
  conveyed without the knowledge of the customers
  and its data
• Thus, why it should be anybody else than the
  consumer, who shall decide which value is more
  important and valuable for him/her bonus,
  discount, information about the new product, or
  his right to be left alone?
• Using of personal data may in the end mean that
  the consumers are better served, provided with
  more new, individualized and better quality
  products, new opportunities to participate in the
  consumption?

18
Conclusions (I)

• New technologies have vested the society with new
  instruments and made individuals lives more
  convenient. The society has happily accepted
  those. Evolution of technologies and social life
  enhanced individuals to access to information and
  knowledge thus it constantly leads to a
  situation when members of society recognize the
  right to know, right to communicate, right to
  express views and contribute to the society as a
  more vital and valuable than the right to be let
  alone
• Of course, in the hands of evil new technologies
  may become more dangerous to the society as
  before. Thats why the price we are paying is,
  inter alia, our privacy (Third Pillar of EU)

19
Conclusions (II)

• New technologies are transforming our lives and
  even the concept of the right to have or expect
  privacy. Personal data protection regime implies
  more active participation of the data subject in
  the societal relationships
• Modern life is about preferences, choices and
  self-determination, therefore if the individual
  does not want to be disturbed or interfered or
  otherwise approached, he is free to choose or opt
  out of such intrusive events
• Individual is already required to MAKE A CHOICE.
  Thus, individuals, no more expect the absolute
  privacy on the internet what they are concerned
  is what will happen with their data collected on
  the internet (cookies, financial information,
  etc.)

20
Conclusions (III)

• At least conceptually data protection regime is
  more tailor-made and more suitable for internet
  and other technologies, which also reside on the
  premise of self-determination and choice, rather
  than on isolation
• Of course, we may not place efficacy ahead of
  justice, economy ahead of human rights. Privacy
  was always about the carefully sought balance.
  Privacy will always remain key value in
  democratic society
• However, the very idea of privacy resembles the
  ever-green vitality of each democratic society.
  Legally speaking, it is hardly possible to
  enforce the system which is difficult to define.
  Furthermore, the idea of privacy, as a very
  general idea, may act as a paramount check and
  balance mechanism, ready for action in those
  cases, where rule of law (data protection regime,
  etc.) is at flaw

21

• Thank you for your attention!