MEP Jan Philipp Albrecht, Rapporteur to the European Parliament's Committee on Civil Liberties, Justice and Home Affairs has published a report with suggested amendments to the EU Data Protection Framework proposals.
These might well add to the concerns of the UK's Justice Committee, and certainly from the advertising industry around the issue of explicit consent and a widening of the definition of personal data, including in some circumstances "Internet Protocol addresses, cookie identifiers and other unique identifiers".
The report outlines the current text proposed by the Commission, the proposed amendment and justification for the proposed change. Apologies for the length of this post, but some of the more important suggested amendments for web site and web service operators are outlined below to give a flavour of what might be expected.
- 14 "... The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable"
changed to
"... This Regulation
should not apply to anonymous data,
meaning any data that can not be related,
directly or indirectly, alone or in
combination with associated data, to a
natural person or where establishing such
a relation would require a
disproportionate amount of time, expense,
and effort, taking into account the state of
the art in technology at the time of the
processing and the possibilities for
development during the period for which
the data will be processed."
- 15 "When using online services,
individuals may be associated with online
identifiers provided by their devices,
applications, tools and protocols, such as
Internet Protocol addresses or cookie
identifiers. This may leave traces which,
combined with unique identifiers and
other information received by the servers,
may be used to create profiles of the
individuals and identify them. It follows
that identification numbers, location data,
online identifiers or other specific factors
as such need not necessarily be
considered as personal data in all
circumstances."
changed to
"When using online services,
individuals may be associated with one or
more online identifiers provided by their
devices, applications, tools and protocols,
such as Internet Protocol addresses, cookie
identifiers and other unique identifiers.
Since such identifiers leave traces and
can be used to single out natural persons,
this Regulation should be applicable to
processing involving such data, unless
those identifiers demonstrably do no
relate to natural persons, such as for
example the IP addresses used by
companies, which cannot be considered
as 'personal data' as defined in this
Regulation."
- 31 "In order for processing to be lawful,
personal data should be processed on the
basis of the consent of the person
concerned or some other legitimate basis,
laid down by law, either in this Regulation
or in other Union or Member State law as
referred to in this Regulation."
changed to
"In order for processing to be lawful,
personal data should be processed on the
basis of the specific, informed and explicit
consent of the person concerned or some
other legitimate basis, laid down by law,
either in this Regulation or in other Union
or Member State law as referred to in this
Regulation."
- 19 "In order to ensure free consent, it
should be clarified that consent does not
provide a valid legal ground where the
individual has no genuine and free choice
and is subsequently not able to refuse or
withdraw consent without detriment."
changed to
"In order to ensure free consent, it
should be clarified that consent does not
provide a valid legal ground where the
individual has no genuine and free choice
and is subsequently not able to refuse or
withdraw consent without detriment. The
use of default options which the data
subject is required to modify to object to
the processing, such as pre-ticked boxes,
does not express free consent."
- 25 New "The interests and fundamental
rights of the data subject override the
interest of the data controller where personal data are processed in
circumstances where data subjects do not
expect further processing, for instance
when a data subject enters a search query,
composes and sends an electronic mail or
uses another electronic private messaging
service. Any processing of such data,
other than for the purposes of performing
the service requested by the data subject,
should not be considered in the legitimate
interest of the controller."
- 45 New "The right to the protection of
personal data is based on the right of the
data subject to exert the control over the
personal data that are being processed. To
this end the data subject should be
granted clear and unambiguous rights to
the provision of transparent, clear and
easily understandable information
regarding the processing of his or her
personal data, the right of access,
rectification and erasure of their personal
data, the right to data portability and the
right to object to profiling. Moreover the
data subject should have also the right to
lodge a complaint with regard to the
processing of personal data by a
controller or processor with the competent
data protection authority and to bring
legal proceedings in order to enforce his
or her rights as well as the right to
compensation and damages resulting of
an unlawful processing operation or from
an action incompatible with this
Regulation. The provisions of this
Regulation should strengthen, clarify,
guarantee and where appropriate, codify
those rights."
- 54 "To strengthen the 'right to be
forgotten' in the online environment, the
right to erasure should also be extended in
such a way that a controller who has made
the personal data public should be obliged
to inform third parties which are
processing such data that a data subject
requests them to erase any links to, or
copies or replications of that personal
data. To ensure this information, the
controller should take all reasonable
steps, including technical measures, in relation to data for the publication of
which the controller is responsible. In
relation to a third party publication of
personal data, the controller should be
considered responsible for the
publication, where the controller has
authorised the publication by the third
party."
changed to
"To strengthen the 'right to erasure and
to be forgotten' in the online environment,
the right to erasure should also be extended
in such a way that a controller who has
made the personal data public without
legal justification should be obliged to
take all necessary steps to have the data
erased, but without prejudice to the right
of the data subject to claim compensation."
- 61 "The protection of the rights and
freedoms of data subjects with regard to
the processing of personal data require that
appropriate technical and organisational
measures are taken, both at the time of the
design of the processing and at the time of
the processing itself, to ensure that the
requirements of this Regulation are met. In
order to ensure and demonstrate
compliance with this Regulation, the
controller should adopt internal policies
and implement appropriate measures,
which meet in particular the principles of
data protection by design and data
protection by default."
changed to
"The protection of the rights and
freedoms of data subjects with regard to
the processing of personal data require that
appropriate technical and organizational
measures are taken, both at the time of the
design of the processing and at the time of
the processing itself, to ensure that the
requirements of this Regulation are met. In
order to ensure and demonstrate
compliance with this Regulation, the
controller should adopt internal policies
and implement appropriate measures,
which meet in particular the principles of
data protection by design and data
protection by default. The principle of data
protection by design require data
protection to be embedded within the
entire life cycle of the technology, from
the very early design stage, right through
to its ultimate deployment, use and final
disposal. The principle of data protection
by default requires privacy settings on
services and products which should by
default comply with the general principles
of data protection, such as data
minimisation and purpose limitation."
- 84 "'data subject' means an identified natural person or a natural person who can
be identified, directly or indirectly, by
means reasonably likely to be used by the
controller or by any other natural or legal
person, in particular by reference to an
identification number, location data,
online identifier or to one or more factors
specific to the physical, physiological,
genetic, mental, economic, cultural or
social identity of that person;"
changed to
"'data subject' means an identified natural person or a natural person who can
be identified or singled out, directly or
indirectly, alone or in combination with
associated data, by means reasonably
likely to be used by the controller or by any
other natural or legal person, in particular
by reference to a unique identifier,
location data, online identifier or to one or
more factors specific to the physical,
physiological, genetic, mental, economic,
cultural, social or gender identity or sexual
orientation of that person;"
- 106 New "4a. Consent looses its effectiveness as
soon as the processing of personal data is
no longer necessary for carrying out the
purpose for which they were collected. "
The topic of information security is also addressed:
- 39 "The processing of data to the extent
strictly necessary for the purposes of
ensuring network and information security,
i.e. the ability of a network or an
information system to resist, at a given
level of confidence, accidental events or
unlawful or malicious actions that
compromise the availability, authenticity,
integrity and confidentiality of stored or
transmitted data, and the security of the
related services offered by, or accessible
via, these networks and systems, by public
authorities, Computer Emergency
Response Teams - CERTs, Computer
Security Incident Response Teams - CSIRTs, providers of electronic
communications networks and services and
by providers of security technologies and
services, constitutes a legitimate interest of
the concerned data controller. This could,
for example, include preventing
unauthorised access to electronic
communications networks and malicious code distribution and stopping 'denial of
service' attacks and damage to computer
and electronic communication systems."
changed to
"The processing of data to the extent
strictly necessary for the purposes of
ensuring network and information security,
i.e. the ability of a network or an
information system to resist accidental
events or malicious actions that
compromise the availability, authenticity,
integrity and confidentiality of stored or
transmitted data, and the security of the
related services offered by these networks
and systems, by public authorities,
Computer Emergency Response Teams - CERTs, Computer Security Incident Response Teams - CSIRTs, providers of
electronic communications networks and
services and by providers of security
technologies and services, in specific
incidents, constitutes a legitimate interest
of the concerned data controller. This
could, for example, include preventing
unauthorised access to electronic
communications networks and malicious
code distribution and stopping 'denial of service' attacks and damage to computer
and electronic communication systems.
The processing of personal data to restrict
abusive access to and use of publicly
available network or information systems,
such as the blacklisting of Media Access
Control (MAC) addresses or electronic
mail addresses by the operator of the
system, also constitutes a legitimate
interest."
While not all these amendments (or the rest of the draft framework itself) will come into law, it would be a brave organisation not to start taking these types of considerations into planning and upcoming projects.
