Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group
October 08
on Privacy & Technology
TECHN0LOGY-INDUCED CHALLENGES IN PR1VACY & DATA PR0TECTION IN EUR0PE
ENISA WG Deliverable
08
About ENISA
The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors.
Contact details:
For enquiries on this deliverable, you may contact:
Ms Barbara DASKALA at Barbara.DASKALA@enisa.europa.eu
web: http://www.enisa.europa.eu/
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
Technology-induced challenges in Privacy & Data Protection in Europe
A report by the ENISA Ad Hoc Working Group on Privacy & Technology October 2008
Authors (in alphabetical order):
Mema ROUSSOPOULOS, Foundation for Research and Technology (FORTH), GR [WG Chair] Laurent BESLAY, European Data Protection Supervisor (EDPS), BE Caspar BOWDEN, Microsoft, UK Giusella FINOCCHIARO, University of Bologna, IT Marit HANSEN, ULD Kiel, DE Marc LANGHEINRICH, ETH Zurich, CH Gwendal LE GRAND, Commission Nationale de l‟Informatique et des Libertés (CNIL), FR Katerina TSAKONA, Foundation for Research and Technology (FORTH), GR
Editors:
Marc LANGHEINRICH, ETH Zurich, CH Mema ROUSSOPOULOS, Foundation for Research and Technology (FORTH), GR
ENISA Secretariat:
Alain ESTERLE Giles HOGBEN Barbara DASKALA
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
1. Introduction
Today, privacy and the protection of personal data are critical challenges for the development of information and communication technologies (ICT) systems and applications. This was clearly recognised in Regulation 2004/460 creating ENISA in March 2004 (Recital 8). The growth of mobile communication and wireless systems, applications relying on end-to-end Internet protocols for their dependability, and the emergence of RFID (Radio Frequency Identifiers), among others issues, create new risks of unlawful processing of personal data. Potential threats arising from both technical and human vulnerabilities (e.g., aggressive spam, malware, phishing) are becoming exploited in organised criminal attacks. The expected proliferation of sensor networks collecting information about the daily life of individuals will strain the ability to give meaningful effect to data protection principles, unless adequate means are found to guarantee compliance.
The ENISA Working Group on Privacy & Technology has been established to analyse the problems posed by these technology trends and the implications for the current EU legal framework. The main task of the Working Group is to propose actions to cope with these difficulties. In this report, we identify the main technology-induced gaps between data protection regulation and the realities of the developing socioeconomic environment. We consider the potential threats and opportunities presented by state-of-the-art technologies and suggest priorities for tackling the most pressing gaps.
The principles of data protection are robustly formulated in technology-neutral terms, but understanding how these principles can be applied effectively to innovations supporting the Lisbon goal of making the EU “the most competitive and dynamic knowledge-driven economy” is a critical task. If citizens are to retain confidence that their
fundamental rights are protected, and that the EU framework is relevant to their daily experience, they must be able to exercise privacy rights in practical and
useful ways. We are concerned that these principles should not become merely a legal abstraction, providing only theoretical remedies for exceptional cases. If such a precarious situation is to be avoided, original thinking and decisive action is necessary.
In the remainder of the report, we provide a preliminary description of each problem identified, give a list of its specific characteristics, and offer a set of recommendations that we view as essential in closing these gaps. Our analysis takes into account the role of relevant public and private sector bodies on a European and Member State level, where applicable.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
2. Recommendations Summary
This section contains a summary of the identified gaps and recommended solutions. For a more detailed discussion, see the individual gap descriptions in the body of this document.
PRIVACY E-INCLUSION
A critical gap is the lack of awareness and understanding of privacy issues amongst individuals as well as the lack of ability to act properly. This may divide society into “privacy-haves” and “privacy-have-nots”. Just as the Information Society has to face the problem of e-inclusion with respect to information and communication technologies (ICT), i.e., how to make ICT more accessible to users, a particular focus must be on enabling citizens to protect and enforce their privacy in ICT. Of high importance are not only ICTchallenged groups such as elderly or handicapped people, but also young people with a low threshold for using ICT.
We recommend that the Commission initiates e-inclusion programmes that reach people via examples relevant to their situation in life, be it in school, in kindergarten, in a company or elsewhere. This not only requires the development of novel user assistance tools and identity management systems, but also improved communication means (e.g., privacy leaflets, education programmes in schools).
USER ASSISTANCE TOOLS
The best technologies and law do not help citizens if they are unable to use them in their best interest. For example, security technologies such as tools for encryption or anonymisation have not seen much adaption by end-users, despite their technical sophistication. Data controllers whose business model is dependent on monetising flows of personal data currently have not enough incentives to provide usable control interfaces for data subjects.
We recommend that research agencies and industry devote resources to the development of more useful and usable user interfaces and wizard-like guides for the proper configuration of systems and control of personal data. In order to help data subjects to better conceptualise the implications of data processing, Member States, DPAs, and consumer associations should increase their educational efforts, potentially tailored to specific citizen groups (e.g., young people, parents).
ONLINE SUBJECT ACCESS
One of the most distinctive aspects of the EU Data Protection framework is a strong legal right for individuals to discover what organisations know about them – the right
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
of “data subject access”. However, and despite the fact that the reasons for which the right was originally established have grown in importance and urgency, the implementation of this right has not kept pace with other aspects of the developing Information Society, hindering it being exercised in an appropriate and effective way. The primary consideration for improving implementation is guaranteeing satisfactory authentication of the data subject making the request.
We recommend that ENISA and the Article 29 Working Party develop a detailed policy analysis for how the right of subject access could be re-framed, with a view to ensuring individuals can access a maximal amount of their personal data online, ideally for zero cost, and as far as possible consistent with the existing legal framework. User Assistance Tools and Identity Management Systems can play an important part in such a framework.
IDENTITY MANAGEMENT
To achieve accountability in the online world, current ICT systems generally require that users give their real name and additional personal information, proven by digital certificates. However, often the user's name is not necessary. So-called “private credentials” or “minimum disclosure certificates” provide privacy-enhancing ways to prove authorisations whilst controlling the conditions determining the user‟s identifiability and accountability at the same time. The availability of these technologies has implications for the interpretation of the data minimisation principle and the meaning of proportionality, i.e., that processing of personal data should not be excessive, but limited to that which is necessary.
We recommend that law and policy makers on the national and the European level re-evaluate the grounds of legitimacy for processing personal data in the light of these techniques. Further we recommend that public and private sector stakeholders contribute to setting up the necessary infrastructure for issuance and interoperability of such credentials and make use of them in their ICT systems where appropriate.
SECURITY INCIDENTS DISCLOSURE
Effective privacy protection is only possible if information about related security and privacy risks of the data processing, as well as the security and privacy incidents in which personal data are involved, are appropriately and timely communicated.
We recommend that the European Commission introduce a comprehensive security breach notification law. In particular it should enable not only DPAs to better identify and react to such incidents, but also individuals, so that citizens can better understand how security and privacy incidents may concern them and
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
to react appropriately. Further we recommend that standardisation bodies consider working on formats and protocols which support ICT systems at the user’s side to interpret these notifications.
CERTIFICATION
Work on providing purely economic incentives to compliance has so far met with little success. Therefore work should be done on other ways of motivating compliance. For example, Member States should design tools for companies to provide certification or selfcertification of compliance to data protection legislation when applying for public procurement. Member States should promote and regulate certification schemes, also involving consumers associations: tax incentives for companies compliant should be provided by Member States, and Member States should consider absolving companies from certain reporting requirements on the condition that they have privacy certification (as in the Swiss Ordinance on Data Protection Certification, DPCO/VDSZ , effective as of January 1, 2008). Effective sanctions (and compensation) for the violation of data protection law should be provided. (e.g., sanctions on a daily basis or punitive damages).
We recommend that the European Commission should encourage the development of privacy certification processes and develop tax and other legislation to motivate such certification. We also recommend that standardisation bodies contribute to standardise certification referentials for privacy. Supervision Tools and Best Available Techniques will be important pieces of a comprehensive certification framework.
SUPERVISION TOOLS
Data Protection Authorities (DPAs) face difficulties to inspect and audit the systems that process personal data. The industry does not either have adequate tools to conduct internal privacy audits. The current state of the art of technologies and legal framework do not provide the means to supervise and inspect easily the processing conducted by data controllers. Standardised supervision tools with automated and possibly remote access to DPAs should be possible to enforce inspections powers appropriately and continuously. In addition, these tools should provide non-repudiatable traceability of systems. Such tools could therefore contribute to improve the inspection processes and to ease the analysis of a privacy breach; finally, supervision tools will enhance the transparency and information about the processing that is provided to the user.
We recommend that the European Commission fund research on efficient privacy supervision tools allowing for reliable and trusted auditing; such tools should then be systematically implemented by data controllers to ensure a continuous privacy monitoring; DPAs should also use those tools in order to automate their inspections.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
BEST AVAILABLE TECHNIQUES
In order to enable the timely and effective auditing and certification of data collection and processing systems, both Industry and DPAs need an established set of sectoral Best Available Techniques (BATs) regarding privacy and security issues. This allows for a checklist-like approach for assessing privacy compliance, establishing a base-level certification upon which further analysis and supervision tools can based on.
We recommend that the Commission propose a legal instrument which will define the required structure and procedures for identifying these BATs. This instrument should foresee the involvement of all relevant stakeholders, the deliverables of which should be considered as primary guidelines by supervisory authorities and public and private organisations which implement those processing systems.
INCENTIVES AND SANCTIONS
There is a general gap of data controllers not being properly motivated to be compliant with data protection law. Many Data Protection Authorities are only able to check a small fraction of data controllers, so that non-compliant data processing frequently goes unnoticed. Also, given the weakness of many sanctions, the economic incentives to be privacy law compliant are often minimal.
We recommend that the European Commission and the Member States encourage an incentive system connected to a certification scheme and an effective economic sanctions system based on BATs, as well as proper auditing and supervision tools.
TO BE OR NOT TO BE PERSONAL DATA
Despite recent efforts by the Article 29 Working Party to clarify the notion of personal data, this concept is still often challenged. Even when the industry believes that no personal data are involved, an analysis of privacy risks should be conducted and the system should be designed in order to minimise privacy risks. In some cases, data may become personal especially if the means likely reasonably to be used to identify the person evolve as new technologies appear. Therefore, even when data is not intended to become personal appropriate safeguards should be implemented to prevent that data from becoming personal.
We recommend ENISA to develop Privacy Impact Assessment methodologies and the industry to include these Privacy Impact Assessments when defining their privacy and security policy. We also recommend the industry to develop adequate safeguards to protect one’s data adequately, whether this data is personal or not.
SOCIAL SORTING
Social sorting such as behavioural marketing may infringe on people‟s privacy even if the processed data are not personal. Current regulation is scattered in different laws and does not provide an effective privacy protection in these cases.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
We recommend that the Commission develops and establishes a comprehensive legal framework for all data processing affecting individuals, be it personal or non-personal. In practical terms, this could mean to demand a full audit trail of data processing and sources of data, and an obligation for better transparency for individuals concerned. Further we recommend that data controllers set up organisational and technical measures which make sure that individuals concerned can exercise their rights.
PRIVACY, DATA PROTECTION AND SPACE
Information Society presents a clear challenge for keeping personal data of citizens within the European jurisdiction. By digitising the personal domain but also its boundaries, the Digital Territory concept offers the opportunity to introduce the notion of territory, property and space in a digital environment. The objective is to provide tools that enable users to manage proximity and distance with others in this future Ambient Intelligence space, both in a legal and a social sense, as it is currently the case in the physical world.
We recommend that the Article 29 Working Party and the European Commission explore the possibility to apply the notion of territory to the Information Society and extend for example the principle of legal sanctuary applied to the residence to the online world.
FUTURE WORK
Some of the identified gaps relate to privacy risks arising from new business models which target individual consumers through behavioural profiling. The Working Group notes that these issues were recently raised but not resolved in the context of competition inquiries in the United States of America and in the EU, and recommends that ENISA commission further in-depth study of these issues with special emphasis on behavioural economics. The group also notes that although some supervisory bodies and the business sector claim that adequate incentives exist for satisfactory self-regulation, 2,3 existing academic research provides very little support for this view. It may be necessary to consider whether new privacy principles and market structures are required to guarantee that competitive forces reinforce (rather than undermine) privacy protection. ENISA is in a good position to promote such research, in the role of an independent facilitator of EU-wide network and information analyses, and to ensure that its conclusions are reflected in EU policies.
We recommend that ENISA commission research to continue work on privacy and technology to gain a deeper understanding. In particular, a thorough analysis should be performed concerning the market structure of online services
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
supported by advertising in general, and the economic influence of behavioural profiling in particular, with a focus on the effective application of data protection principles and the autonomy of the data subject. The study should sceptically evaluate the potential efficacy of self-regulation, and also study whether divergences in the definition of personal data are resulting in regulatory
arbitrage between Member States.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
3. A Cautionary Tale
In this section we describe a realistic user-scenario that demonstrates many of the gaps and challenges listed in the previous section and which are further elaborated in the next section.
Sylvia has been having some privacy problems recently. For a while her favourite online portal and search engine has been displaying advertisements which seem eerily connected to aspects of her private life, moreover some of these advertisements relate to a medical condition which she has been researching online. Sylvia is concerned because she thought she had been careful not to log-in to any website she used whilst doing her research, and did not enter any other personal information which would identify her. Moreover, she is puzzled by the fact that when she clicks on some advertisements of interest to her, she receives an offer which is on less favourable terms than the offer that is displayed when she uses a friend’s computer. She thinks it may have something to do with “cookies” but
when she tries to understand what different
types of cookie do and how to control them,
she finds it very confusing. However, if she simply deletes and switches off all cookies in her browser, it becomes very inconvenient to
use most of the websites she likes.
She knows that Data Protection laws in her country give her the right to discover what any organisation knows about her, but she is baffled because when she looks at the privacy policies of the websites she uses, it seems that unless she registers and logs in, the websites claim they are not collecting any personal
information at all. She therefore doesn’t know how to begin exercising her legal right to find out what is happening.
Sylvia sometimes gives her e-mail address and mobile phone number to websites providing online services and also to some high-street shops where she buys various products. She notices that when she visits other shops, she sometimes gets a lot of e-mail advertisements and SMS messages for products of the type she has been looking for. She begins to wonder whether these advertisements could be connected with the small electronic tags she has noticed on some of the products she buys. These advertisements also appear on her mobile phone web browser as she moves around the city, and it annoys her that she has to use the bandwidth she is paying for to browse to an opt-out page. However many times she seems to opt-out, she still seems to carry on getting quite intrusive advertisements from ever more companies.
Sylvia is an active campaigner for a controversial political cause, and although her activities are legitimate, her friend Michael (who sometimes uses her computer) has been
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
stopped by the police on the way to demonstrations and was asked a lot of questions when he visited a foreign country. She realises that the combination of her web browsing habits, her movements around the city, and the products she buys somehow seem to be becoming connected in ways she doesn’t understand. She wonders how long this information is being kept, and if the laws of her country allow the police access, and under what conditions. Sometimes she reads stories about new such laws in the media, but they always contradict each other in the details, and seem almost deliberately confusing. On the way to the next demonstration, her car is stopped by the police, and she is questioned about some spray paint and tools she bought (using cash) at a hardware shop recently to make some household repairs, and also about why she reads a certain political website. Back at home, she notices that the items she bought carried RFID tags, but she has no idea how the police knew about the website.
She makes a call to the inquiry line for the Data Protection Authority (DPA) in her country. It turns out that the website she is interested in is based in another EU country, and she is advised to contact the DPA in that country. After quite a few e-mails to the foreign DPA, she gets a reply from someone who was able to understand her language and what she wants to do. She is advised to contact the website but she finds her e-mails to them are ignored or get an automated unhelpful response. She finally writes a letter to the website at their registered address, which isn’t listed on their website, but which she eventually finds in the public register of “data controllers”. However she has a problem – because she didn’t have a lot of trust in that website to begin with, she registered with the website using a name she made up. After a few more exchanges with the DPA and the website, they finally agree to her request (but she has to send them her password for her account in the letter). She didn’t really see why she had to give her real name and address (since she had to give her account name and password), but gave up arguing that point with the DPA and website. After sending an international postal order for 15 Euros (the website didn’t accept online payment), the packet of paper she gets back a month later contains printouts of her usage of the e-mail service of the website, but nothing about “cookies” or the web surfing she did on the site when she was logged out. This was the information she really wanted in the first place (and especially how that information might have been passed to other websites or the authorities). She again contacts the DPA, who tells her that under their interpretation of the national data protection law, the website isn’t required to tell her that information. Sylvia is pretty disappointed by now with how complicated it is to assert her data protection rights, and also that they turn out to be useless for finding out about the things which really affect her privacy online. She has a long list of other companies that she could write to: the shops where she bought products with electronic tags, the other websites she uses, and of course her Internet Service Provider (ISP) and mobile phone company, but it would all cost quite a lot of money in access fees, and since most of these companies will similarly claim that “they don’t know who she is”, she expects the same unsatisfying result. But she has a friend who is a privacy lawyer, and takes on her case. After six months of patient investigation and a blizzard of legalistic correspondence, she finally tracks down the “RFID identifiers” and cookies which she thinks must be responsible for the police asking her the questions on the way to the demonstration. But the only companies who were in a position to let the police patch together her real identity won’t give her any more information, but one helpful company points her to a clause in the data protection law saying that they do not have to if she is “a suspect person”.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Sylvia decides that she has completely lost control of her privacy, and she is even worried that after all her legal efforts to assert her rights, she may be considered a “troublemaker” and put on lists which could give her even more hassle in future and perhaps cause difficulty with her job, medical insurance and credit rating. She decides to give up political activity, to remove all the tags from her possessions, to get a new computer, change her ISP, close all her online accounts, and use a prepaid mobile phone, but she isn’t sure how much she can still be tracked. She tells her friends about her surreal experiences with the bureaucracy of privacy, but they don’t really believe her, and think she is becoming a bit of a crank. After all, they know Europe has the strongest laws protecting privacy, and it doesn’t seem to be an issue that most people or the media or politicians really worry about.
However, Sylvia finds there is a new software package which works with a number of popular websites that have a good reputation for privacy protection. The package allows her to download to her computer a complete inventory of information about the interactions she has had with a website. She is surprised by the amount of detail that is stored about her surfing habits, and also notes that some of this information has been disclosed – via cookies – to other companies for advertising purposes. She chooses an ISP which participates in the scheme, which allows her to discover what “IP address” she was using at any particular time. Using this information she can go to other websites and automatically find out what information they have about her surfing on those websites (but only in some EU countries which recognise this as being “personal data”). The software package even has an analysis function which lets her compare how long different websites are keeping this data about her online behaviour, and whether it complies with the privacy policy (however she finds the policy of most sites is too vague for the software to perform this function). Moreover the software package only works with quite a limited number of websites, and some of the sites she finds most useful aren’t participating in the download service. Surprisingly, some of the most innovative websites in the United States of America are beginning to enable this “attention data” download service, although she has learned by now to be very careful to look at the small print, because she realises that anyone else getting hold of this data could make inferences about some of her most private thoughts.
Her lawyer also has good news. After more than two years, she has finally won her case at a secretive “Data Tribunal” and the police have agreed she should never have been considered a “suspect person”, and she is finally able to discover that a whole series of disclosures about her electronic life were made to the police by the companies she dealt with. The bad news is that all of these disclosures were made according to proper procedures (they were considered “proportionate” at the time in the light of the information available and circumstances), so she has no case against the police or any of the companies for compensation for all the inconvenience and bureaucracy (to put it mildly) she has had to put up with. Apparently, everyone “official” considers that everything was done in the proper way.
Sylvia now wonders why anyone would risk engaging in political activism to bring about social change, when the consequences can be so disturbing. She knows that democracy is an imperfect system, and justice can sometimes be haphazard, but it seems to her modern electronic life deters civic activism and has created a sinister Surveillance State.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
All in all, she has had enough of politics (and life online), but she does wonder what kind of democracy her children will inherit, if everyone made the same decision. She realises she would never have understood what had happened to her without the help of her friend the privacy lawyer (whose fees she could not have afforded). Perhaps the software package for accessing and managing her own personal data would have helped if she had found it earlier, by letting her gauge the extent to which her online behaviour exposed her to privacy risks, but she reads that the software company has stopped making it. Apparently too few people were sufficiently concerned with their privacy at any given time, to make the software profitable, and the major websites she really liked really weren’t interested in participating.
Links
For much more detailed scenarios see also SWAMI “Dark Scenarios” at http://is.jrc.es/pages/TFS/documents/SWAMI_D2_scenarios_Final_ESvf_003.pdf.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
4. Privacy Gaps and Challenges
The following lists the twelve major privacy gaps that the Working Group identified between data protection regulation and the realities of the developing socio-economic environment. Each section begins with a description of the identified gap, and then lists a list of challenges regarding technical research and development (R&D), legal development, and communication.
4.1 Privacy E-Inclusion
A critical gap is the lack of awareness and understanding of privacy issues amongst individuals as well as the lack of ability to act properly.
Specific Gaps
Many people are completely unaware of the important privacy People are unaware of issues that arise from the use of new data collection technologies, privacy issues or social networks, pervasive technologies, etc. Others feel uneasy unable to protect their about some kinds of data processing, but still cannot fully grasp the privacy in the current potential consequences of their actions on their own privacy. Still ICT landscape others may be aware of the privacy issues but do not know what to do to protect their privacy. Those that want protection often decline to participate in the digital world and therefore cannot reap the benefits of the information society. Those that want to reap the benefits often give up on their privacy protection, viewing they have no choice in the matter.
For users that know how to maintain their private sphere, taking the Actions for redress are necessary steps may be too costly or too cumbersome for them. time-consuming and The same is true for situations when their privacy rights have been sometimes ineffective violated. Actions for redress are usually time-consuming, and in several cases the effects of the privacy infringement are not revocable anyway.
The lack of awareness, understanding and ability to properly act may divide society into “privacy-haves” and “privacy-have-nots”.
The Information Society has to face Usability of privacythe problem of e-inclusion with protecting tools is respect to ICT, i.e., how to make insufficient ICT more accessible to users. Since privacy effects in ICT are often based on user actions, the e-inclusion challenges are even more urgent if the goal is to protect users‟ privacy in ICT, e.g., for the elder generation or for handicapped people. Usability is an important, yet not satisfactorily solved issue when designing tools for protecting one's privacy.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
One particular group showing the need for privacy e-inclusion is The need to include young people, i.e., kids and teens: Young people have a low young people threshold for using ICT. However, in many cases they are more easily subject to seduction by services offering games or playful applications, disclosing data about themselves and possibly also about their relatives and friends.
Proposed Solutions
Raising awareness in the general public of privacy issues will need different approaches for different audiences. For example, kids have to be approached differently than elderly people. Humourless schoolbooks in an overly didactic style are not a promising means to teach privacy awareness. Instead, people must be reached via examples relevant to their situation in life, be it in school, in kindergarten, in a company or elsewhere.
Challenges for R&D
When developing ICT systems of any kind which may be related to Integration of ethical processing of personal data, ethical and privacy needs should be and privacy needs in taken into account from the beginning. ICT systems should enable ICT people concerned to protect their privacy and exercise their data protection rights instead of bypassing large groups of the population. For age-based inclusion, work is already done in SENIOR project which aims to provide a systematic assessment using dialogue as the key instrument to evaluate the social, ethical and privacy issues involved in ICT and Ageing.
The development of usable assistance tools such as “privacy The need for user wizards” – possibly offered free of charge by the national States to assistance tools support their citizens – could be beneficial in the goal to educate users. For example, a “privacy wizard” browser plug-in could warn a user of the implications of entering personal information onto a website (e.g., mother‟s maiden name, identification number, etc.). Or these tools could be used for setting appropriate privacy defaults when configuring Internet access software or identity management systems. Embedding these sorts of “helper” tools directly into standard ICT systems would provide an automated means of educating users about the effects on their individual privacy.
Legal Challenges
Both the European Data Protection Directive 1995/46/EC and the e-Privacy Directive 2002/58/EC require to give specific information to data subjects. This information should not be phrased in legalese, but should be understandable by all the people concerned. For online services, Article 29 Working Party has published opinions on how to fulfil these legal demands, e.g., in WP43 and WP100. In addition, WP147 describes requirements for informing children on data protection issues concerning them.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
However, unfortunately these recommendations are rarely followed The need for legal by now, and sometimes even basic information is missing. So it is harmonisation and necessary to be even more definite in describing the mandatory enforcement requirements for informing data subjects, at best harmonised on the European level. Further, best practices of ideal ways to notifying data subjects and providing further information should be highlighted in the discussion. The process of informing and making aware data subjects also should be evaluated in privacy certification programmes.
Communication Challenges
There is a need for regular broadcast documentaries with visual The need for public depictions of what could specifically go wrong. Brochures as well as education and training audio-visual means (e.g., such as the material of “YOU decide”) could thus show the potential dangers of ongoing surveillance so that people can become aware where they are monitored. Simulations should be available which show possible consequences for people releasing their personal data in different contexts. People could thus get a feeling for long-term risks for many kinds of personal data, in particular those which are more sensitive and bound to one‟s personality. In schools, role-plays can raise privacy awareness amongst pupils, e.g., on the possible influence of data posted in social networks on job interviews years later.
Important is also the usual education within the family. Several privacy guidelines already exist in the non-digital world suggesting to parents how to impress certain messages upon their kids, e.g., to say no if their bodily privacy is imposed upon or not to accompany strangers. Parents should also be empowered to teach kids how to protect themselves in the ICT world. It may also be the other way round, i.e., kids teaching their parents or grandparents in understanding ICT effects on privacy and in using privacy tools.
Teachers, families, media and state bodies should be involved in the – probably life-long – education and learning process of all citizens which should cover how to interpret privacyrelevant information (e.g., privacy policies or privacy seals) and how to deal with privacy risks.
Links
Article 29 Working Party: Recommendation 2/2001 on certain minimum requirements for collecting personal data on-line in the European Union, 5020/01/EN/Final, WP 43, adopted on 17 May 2001, http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2001/wp43en.pdf
Article 29 Working Party: Opinion on More Harmonised Information Provisions, Version: November 25 2004, 11987/04/EN, WP 100, http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2004/wp100_en.pdf
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
Article 29 Working Party: Working Document 1/2008 on the protection of children‟s personal data (General guidelines and the special case of schools), 00483/08/EN, WP 147, adopted on 18 February 2008, http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2008/wp147_en.pdf
The Data Inspectorate in cooperation with the Norwegian Directorate for Education and Training and the Norwegian Board of Technology: YOU decide … Thoughts and facts about protecting your personal data, January 2007, http://www.dubestemmer.no/pdf/englishbrochure.pdf
SENIOR – Social Ethical and Privacy Needs in ICT for Older People, FP7 project 2008-2009, http://seniorproject.eu/
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
4.2 Improved User Assistance Tools
Ideally, data subjects should get “ubiquitous privacy”, i.e., a zero- User Assistance Tools configuration, zero-management privacy default that would allow help individuals one to freely disclosure personal data, while offering the right set of inspect, control, and defaults to ensure the data subjects get the protection they desire. communicate their However, maintaining one's privacy and security will most likely data and preferences. always require an effort on behalf of the individual. This is because privacy and security are complex constructs that depend very much on the individual situation and particular context that data is exchanged or disclosed. User Assistance Tools help individuals maintain their privacy, by offering means of inspection, control, and communication.
Specific Gaps
Today‟s digital world does not offer a comprehensive “privacy suite” Current tools are for end-users that supports them in managing all aspects of their fragmented and privacy, but only a variety of scattered tools that typically only help scattered to solve very specific problems.
Moreover, most privacy technology today places a heavy burden on They require the data subject, expecting him or her to manage identities, considerable obfuscate location queries, and anonymise Internet traffic – not only consumer effort to use in front of the computer but constantly throughout the day, in situations ranging from public appearances, business events, and private meetings.
The simple notice-choice model might lead to the situation where most people simply not bother to make an effort, thus leaving privacy to be an elitist If left unchecked, most concept enjoyed by a few privacy fundamentalists. Even those who people might simply are willing to invest resources in the protection of their privacy may not bother to maintain either be tricked into revealing more information than they planned, their privacy or simply become overwhelmed by the complexity of the data processing world.
Proposed Solutions
Assistance could mean better integrated and more easily usable technology tools that are offered to interested parties or made available in exceptional situations, i.e., when one wants to find out the details of a particular data collection. It might also take the form of an improved educational strategy that teaches citizens how to properly control and manage their privacy.
Challenges for R&D
Ease-of-use is of particular importance for user assistance tools, Promote ease-of-use since subject-access will not be used if it is complicated and/or in user assistance tools costly (in both time and hard currency). Such tools could use “data tracking” to allow users the inspection of their personal data flows, i.e., when is their personal data released, to whom, for what purpose? System designers should be trained and educated to develop tools according to guidelines for usable conceptualisation and implementation of secure and privacy-compliant ICT systems. To ensure a correct
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
translation of legal regulation and language into user interfaces, Data Protection Authorities need to be involved.
Technical standards such as RFID communication protocols might Include legal also include additional references to applicable law, data collector‟s information in identity, or planned use and retention time. technical protocols
Legal Challenges
For making privacy policies more accessible and understandable, Standardised different pictograms have been proposed to express privacy policy pictograms ease legal content while sparing people from studying legal jargon which may understanding be confusing. Standardising these icons might help simplifying notice and choice. However, existing proposals do not yet focus on European data protection law.
Communication Challenges
The development of assistance tools could and should be supported Active support for user by the States. In particular in areas of e-government or e- education from States participation where the States directly involve their citizens in and DPAs processing of their data, they should offer exemplary assistance tools for security and privacy and teach their citizens to use them. Data Protection Authorities could be equipped and assigned the task to support users by educating them, providing downloadable privacy-preserving configuration files or wizards where possible, giving instructions how to protect oneself in typical settings or offering a general helpdesk. Avatars might offer an interesting option to provide easier metaphors for users to understand and manage online personas and “partial identities.” This is closely linked to the gaps and challenges regarding Privacy E-Inclusion, Online Subject Access Requests, and Information on Security Incidents.
Links
The PRIME project has investigated requirements for user interface design in privacy tools.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
4.3 The Right of Subject Access: Measures for Effective Implementation
Article 12 of the EU Data Protection Directive 1995/46/EC Every individual has guarantees every individual has the right to access, i.e., the right to the right to access and obtain from the controller a confirmation on whether data relating to rectification him are being processed and information on the purposes of the processing, the data concerned, and possible recipients or categories of recipients. In addition, Article 12 grants every individual the right to obtain from the controller the rectification, erasure, or blocking of data concerning him as far as the processing does not comply with the requirements of the Directive, in particular when the data at issue are incomplete or inaccurate.
The reasons for which the right was originally established have grown in importance and urgency. The right is not merely a “backstop” to facilitate redress in particular cases, it should also function as a “grass-roots” socio-political transparency mechanism to warn policymakers if privacy is systemically threatened in some sector. Two Eurobarometer surveys in the past five years have confirmed that the awareness and exercise of subject access rights is languishing, for understandable reasons– it is frustrating, time-consuming, and inconvenient for individuals to get all the information they are entitled to, when they need it, in a form that it useful.
Specific Gaps
Subject access has become a “Cinderella” human right. The rhetoric Online subject access of promoting the Information Society resonates with calls for facilitates more business efficiency, innovation and citizen convenience. But if convenient exercising individuals want to keep track of what data is held about them, and one’s privacy rights understand the inferences made which affect how they are treated, they must overcome a legalistic obstacle course that might have been designed by Dickens and Kafka. There is a gap of offering individuals easier ways to exercise their privacy rights, in particular via online subject access which could significantly lower the threshold for individuals. But even in the case of online services, users typically do not get online access to all their personal data including those being stored in log files or being processed by profiling, scoring or data mining systems.
The primary consideration for improving implementation is guaranteeing satisfactory authentication of the data subject making the request. If the authentication process is flawed, it opens up the biggest privacy loophole of all – “pre-texted” access requests. However the ideal tool for subject access authentication is conveniently at hand: “usercentric” identity management systems, which allow the individual to manage online relationships with a plurality of unrelated data controllers, with strong mutual authentication of each party.
In addition, there is a lack of procedures for subject access to Online subject access pseudonymous data which is especially relevant in the online world should be possible in with the variety of identifiers a user can have. data minimising manner
Proposed Solutions
Data subjects should be better supported in exercising their privacy rights, in particular in the online world. Data controllers should offer online subject access wherever possible.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
Challenges for R&D
To provide convenient ways to exercise one‟s privacy rights, Usable design of online understandable user interfaces are necessary. Data controllers access to be provided should not restrict the subject‟s access to their customer master by the controller data. Usually online reading access is not problematic provided that the user has been authenticated and the requested personal data can be shown separately from other protected information, but online rectification or erasure may often be not that easy to implement, in particular as there may be other conflicting goals. For example, users should not be able to alter audit trails or digital evidence. In particular, research is needed that allows
structuring data controller systems to minimise the effect of exemptions (e.g., data which relates exclusively to the data subject, and does not engage other exemptions) strategic options to phase-in obligations on data controllers who maintain online identity relationships with data subjects, to ensure they are able to fulfil access requests online safely and to the fullest practical extent
In addition, users may be equipped with tools which assist them to Tools for users which send requests to the data controller or – if necessary – file support exercising complaints to a supervisory authority. Such tools can benefit from one’s privacy rights the functionality of user-controlled identity management and machine-readable privacy policies. Of importance are
removal of barriers to the exercise of subject access rights, which are not appropriate to the situation of online access, “meta-privacy” measures necessary to protect the individual from interference or surveillance or discrimination arising from the exercise of their access rights, and procedures for exercising access rights against “indirect” data controllers (i.e., controllers holding data referable to individuals only by means of a pseudonymous identifier).
The right to access personal data requires some kind of identity Data minimising ways proof so that the data are not disclosed to an unauthorised person. to access own data If a user has disclosed data under a certain pseudonym, a proof has to be given that the requesting user really is the holder of this pseudonym. This requires appropriate – data minimising – authentication mechanisms, including
strong mutual authentication of the data subject and data controller by means of usercentric identity management technologies, adequate for submitting and fulfilling access requests online, and a higher level of authentication for the data subject unambiguously to authorise activation of an online subject access mechanism with a particular data controller.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Legal Challenges
For services processing personal data in the Internet or other online Legally demanding scenarios, the provision of online access and other online ways to online access exercise one‟s privacy rights should be legally demanded as far as possible.
In addition it has to be discussed whether pseudonyms which do not Demanding provide for proving the individual holdership in a data minimising appropriate way (at least without the necessity to reveal one‟s civil identity) pseudonyms for data should be accepted in data processing because then individuals minimising access would not be able to exercise their privacy rights. This might also require
options for extra legal safeguards against risks of coercive subject access, and a framework for supervisory bodies to assess the adequacy of security measures protecting online access mechanisms and procedures.
Communication Challenges
Individuals as well as data controllers should be made aware of the Informing people data subject‟s privacy rights and possibilities to exercise them. about their privacy rights
Links
The FP6 project PRIME – Privacy and Identity Management for Europe proposed ways to integrate online subject access in a user-controlled identity management system.
In some countries, citizens are granted online access to their personal data in the national register file, including the logfile containing access to their data, e.g., in Belgium (“mijndossier/mondossier”) and Norway (“minside”).
Eurobarometer surveys on data protection:
Data Protection, Opinion Poll, Special Eurobarometer No. 96, Wave 60.0 – European Opinion Research Group EEIG, Survey conducted upon the request of the Directorate- General Internal Market, Unit E4 – Media and data protection, December 2003, http://ec.europa.eu/public_opinion/archives/ebs/ebs_196_data_protection.pdf
Data Protection in the European Union – Citizens‟ perceptions, Analytical Report, Flash Eurobarometer No. 225, Survey conducted by the Gallup Organization Hungary upon the request of Directorate-General Justice, Freedom and Security, February 2008, http://ec.europa.eu/public_opinion/flash/fl_225_en.pdf
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
4.4 Identity Management for Context Separation
It is well known that the accumulation of personal data may yield Purpose binding is an severe privacy problems. The purpose binding principle laid down in important legal the European Data Protection Directive strives for limiting the principle in Europe collection and use to prior specified purposes: “Member States shall provide that personal data must be: … (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. … (c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed …” (Article 6 No. 1 of the European Data Protection Directive).
However, also in Europe there is a trend macerating this principle so Context-spanning that personal data available often may also be used for other accumulation of purposes even if this had been excluded in the legislative processes, personal data e.g., it is being discussed to use toll data for law enforcement, or jeopardises people’s retention data in telecommunication for marketing purposes. This privacy trend is amplified by more and more unique identifiers which can act as so-called “Personenkennzeichen” (personal identification number). These identifiers usually may appear in different application contexts (e.g., different sectors in the governmental area or Internet usage across various activities) and can identify uniquely the individual behind. Appearances of personal data in different contexts enable contextspanning linkage and thereby increasingly detailed profiles. This is also acknowledged by privacy experts outside Europe, e.g., Nissenbaum who discusses privacy as “contextual integrity”.
Specific Gaps
The increasing digital availability of personal data combined with The problem: their increasing linkability is a major problem. Even if data are increasing digital anonymous in the beginning, they may be linked to a profile which availability of linkable then may yield enough information to identify the data subject. The personal data increasing linkability is mainly caused by the repeated usage of unique identifiers which often are introduced by ICT systems, e.g., IP addresses, cookies or index numbers in data bases, but also the disclosure of information such as the name in different occasions may be sufficient for search engines to accumulate related information.
Purpose binding is hard to enforce unless the data are already Enforcing purpose prepared for a context-specific usage. Employing the data binding is difficult minimisation principle supports quite efficiently the purpose binding principle. There are several possibilities for restricting the data to context-specific usage,
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
e.g., via sector-specific identifiers in e-government (cf. the citizen card (“Bürgerkarte”) in Austria), via the use of different pseudonyms for different Internet websites, via pseudonymisation of personal data in data bases, or via so-called “private credentials” or “minimal disclosure certificates”: Such credentials provide privacy-enhancing ways to prove authorisations and guarantee accountability while ensuring the user's anonymity at the same time – only in the case of misuse the user can be identified. Thus, they implement methods for accountability in the online world without the necessity for users to give their real name and additional personal information to all their interaction partners.
Although all these solutions are discussed as components for user- Poor distribution of centric identity management systems and have gained maturity technological solutions over the last years, the concepts – in particular the more sophisticated approaches for private credentials – are not well known, and designers of applications rarely employ them in their ICT systems. Also, a societal discussion on the desired conditions of linkability and unlinkability is underdeveloped as many stakeholders haven‟t perceived this as an important challenge, yet, or are not aware of possible solutions.
Proposed Solutions Challenges for R&D
Although the maturity of the concepts for context separation and Need for improving user-centric identity management have improved over the last year, implementations there is still the need for better integration, better interoperability and better usability.
Further we recommend that administration and industry contribute Need for building the to setting up the necessary infrastructure for issuing private infrastructure for credentials and make use of them in their ICT systems where private credentials appropriate.
Moreover, research should be done on the measurement of Need for measuring linkability and unlinkability. This is both important for ICT system linkability design and the control of the user himself over his private sphere. In particular for long-term maintenance of privacy it is an open question how to guarantee data protection.
Legal Challenges
The availability of technologies for context separation has Evaluation of today’s implications on the interpretation of the data minimisation principle, law in the light of i.e., that processing of personal data should not be excessive, but private credentials as minimal as possible. We recommend that law and policy makers on the national and the European level evaluate today‟s laws in the light of private credentials.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
Communication Challenges
We propose that the wished conditions of (un-)linkability and the Trigger a societal possible legal, organisational and technological implementations are discussion on (un-) brought into focus of policy makers, developers, privacy linkability commissioners and users. This is especially important for quite counterintuitive concepts such as the private credentials.
Links
Brands, Stefan A.: Rethinking Public Key Infrastructures and Digital Certificates, MIT Press, 2000
Camenisch, Jan, Anna Lysyanskaya: Efficient Nontransferable Anonymous Multishow Credential System with Optional Anonymity Revocation, Research Report RZ 3295, no. 93341, IBM Research, Nov. 2000
Chaum, David: Security Without Identification: Transaction Systems to Make Big Brother Obsolete, Comm. ACM, vol. 28, no. 10, Oct. 1985, pp. 1030-1044.
Jøsang, Audun, Simon Pope: User Centric Identity Management, Proceedings of AusCERT, Gold Coast, May 2005
Nissenbaum, Helen: Privacy as Contextual Integrity, Washington Law Review, Vol. 79, No. 1, 2004
PRIME White Paper – Privacy and Identity Management for Europe V3, https://www.prime-project.eu/prime_products/whitepaper/
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
4.5 Information on Security Incidents
Individuals can only effectively protect their privacy if they have sufficient information on the planned data processing, related security and privacy risks as well as the security and privacy incidents in which their personal data are involved.
Specific Gaps
In the current European legal framework on data protection, data No obligation to controllers are not required to inform individuals concerned about inform individuals security and privacy incidents. According to the Article 4 of the about security and Directive 2002/58 , the obligation for the data controller to mitigate privacy breaches. possible risks with security measures and to inform the user on these risks, is only triggered before any security incident occurs but there is no communication obligation after the incident takes place.
The legislator might think that the competitive environment together with self-regulatory process would have completed the legal framework with the implementation of technical and organisational safeguards requested for the proper management of security incident. However, it appears in light of critical and illustrative incidents that these first incentives are not enough for promoting the need to notify the end user of security breaches and to mitigate proactively their negative effects.
The lack or even absence of incident notification also undermines the implementation of preventive measures which are requested by today‟s legal framework.
Another direct consequence of the absence of notification and information on security incidents is the production of figures and statistics which are not reliable and which do not contribute to a more trustworthy and transparent environment.
Even if information is available on the fact that a security breach occurred, people usually neither know how they might be affected by such an incident nor how to react in an appropriate way.
Proposed Solutions Challenges for R&D
Basing on news feeds for reporting security-relevant vulnerabilities, Security feeds as a e.g., by Computer Emergency Response Teams, a prototype of a standard reporting “security feed” has demonstrated how information on security and format privacy threats and incidents can be transferred in a structured XML format via an RSS feed to be interpreted by the identity management system of the project PRIME – Privacy and Identity Management for Europe. This concept comprises all mechanisms and implementations in use such as protocols, applications, cryptographic
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
algorithms, as well as the identity management system software itself. In particular users are informed about the risk to their private sphere, i.e., who definitely or potentially has unauthorised access to personal data, and about the consequences, e.g., options to take action.
Legal Challenges
The data controllers themselves should be legally obliged to inform We must legally oblige people individually or via broadcast media on incidents – similar to data controllers to the Security Breach Notification Acts in many U.S. States. notify security breaches. In November 2007, the European Commission issued a proposal for reviewing the Directive 2002/58 and introduced the obligation to notify security breach.
Note that the discussion usually focuses on security incidents only, Privacy incidents also e.g., hacking attacks or lost data. There might be other privacy- relevant relevant events such as the fusion of companies which join their databases or the change of the country where personal data are being processed. This kind of information may also be relevant to the individual‟s privacy.
Communication Challenges
People should be informed in an understandable way about security Incident and privacy incidents which may relate to them or their data. They communication also should be given advice in each individual case on the actions to enables citizen privacy take to minimise undesired effects to their privacy. This kind of management information enhances the transparency of actual privacy-related data processing and acts as a basis for individuals‟ management of their private spheres.
A more accurate and exhaustive reporting of security breaches would permit to promote post-incident solid safeguards and well tuned compensation measures for managing the residual risk.
Not only the data controllers themselves, but also other parties such Multiple distribution as newspapers, Data Protection Authorities, consumer protection channels for incident organisations or peers could distribute available information on reporting security and privacy threats or incidents. This kind of information could be transmitted in a standardised digital format which makes it easier to be interpreted by the user‟s computer. In particular a combination with user-controlled identity management systems creates synergies.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Links
Security Breach Notification Laws: Views from Chief Security Officers A Study Conducted for the Samuelson Law, Technology & Public Policy Clinic, University of California-Berkeley School of Law, December 2007, http://www.law.berkeley.edu/clinics/samuelson/cso_study.pdf
Hansen, Marit, Jan Schallaböck: Extending Policy Negotiation in User-Controlled Identity Management by Privacy & Security Information Services, Position Paper Submission to the W3C Workshop on Languages for Privacy Policy Negotiation and Semantics-Driven Enforcement, http://www.w3.org/2006/07/privacy-ws/papers/18-hansen-user-controlledidm/.
Hansen, Marit: Marrying Transparency Tools With User-Controlled Identity Management. In: Simone Fischer-Hübner, Penny Duquenoy, Albin Zuccato, Leonardo Martucci (Hrsg.): The Future of Identity in the Information Society, Proceedings of the Third IFIP WG 9.2, 9.6/11.6, 11.7/FIDIS International Summer School on The Future of Identity in the Information Society, August 2007; IFIP International Federation for Information Processing, Volume 262; Springer; 2008, pp. 199-220
Hogan & Hartson Analysys: Preparing the Next Steps in Regulation of Electronic Communications – A Contribution to the Review of the Electronic Communications Regulatory Framework. http://ec.europa.eu/information_society/policy/ecomm/doc/library/ext_studies/next_steps /regul_of_ecomm_july2006_final.pdf.
Nageler, Antje: Integration von sicherheitsrelevanten Informationen in ein Identitätsmanagementsystem. Diploma Thesis, Christian-Albrechts-Universität zu Kiel, May 2006.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
4.6 Guidance on Certification Schemes
One of the main problems facing the information society today is a Certification Schemes lack of transparency in ICT products and services developed with can aid compliance respect to their compliance to security and privacy standards. For verification users, data controllers, and DPAs, privacy compliance is one of the main challenges of ICT systems. Certification schemes should ensure that a product or a service has been designed and can be used in compliance with European legislation on data protection.
Specific Gaps
The availability of trustworthy ICT solutions in general and Today, no such privacy particularly of data privacy and security enhanced technological certification exists applications today is equally important for all players across the EU. Attention therefore should be focused on developing the means and criteria necessary for making available such trustworthy and privacy compliant certification schemes in a harmonised manner in all Member States.
In this section the discussion to follow shall illustrate the existence Certification schemes of this gap along with the respective requirements to be met and make privacy the impact/advantages to be gained. The latter include competitive protection more advantages, trust enhanced in certified products, public trust and effective awareness raised, the promotion of privacy by design rather than as an afterthought, and the application of data protection principles in a homogenous manner and thus more effectively, for all information society players concerned (data subjects, data controllers, Data Protection Authorities, ICT developers, vendors, manufacturers, Member States, etc.).
We stress here that (a) such certification schemes should ultimately A minimum level of guarantee that a specific product meets a certain (minimum) level protection of personal of protection of personal data, that (b) there is a need to develop a data should be set methodology to serve that purpose, as well as to promote adoption of such certification systems, and that (c) standardisation bodies need to standardise certification referentials, criteria and conditions used to assess privacy compliance.
Proposed Solutions
Member States should promote and regulate certification schemes, There need to be also involving consumers associations: tax incentives for compliant incentives for companies should be provided by Member States, and Member certification States should consider absolving companies from certain reporting requirements on the condition that they have privacy certification.
Having considered whether such a certification system should be mandatory or not, who should endorse adoption of such systems, and how to be transparent in reaching a general consensus on what privacy requirements should be met in order to fill in this gap, new solutions to motivate compliance should be examined. For instance, Member States should design tools to provide a voluntary certification or self-certification of compliance to data protection legislation when applying for public procurement.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
We suggest that ideas should be taken from lessons learned through Already experiences similar research projects (e.g., EuroPriSe ) and other countries with certification (e.g., Switzerland ) that have developed such certification schemes exist schemes, as well as past experience gained in accredited electronic signatures, encryption related technologies and their respective legal frameworks.
We suggest that such a certification scheme should have the Key characteristics of a following key-characteristics: those parties willing to be known to privacy certification the public as accredited privacy and security certifiers should be scheme previously certified for that purpose by certain independent (third) parties that have been already established as dedicated accreditation bodies (in cooperation with DPAs).This certification should occur once they have met the respective technological and legal requirements (privacy by design, Best Available Techniques, minimum of privacy principles) set out in the respective regulations issued by DPAs in cooperation with the Article 29 Working Party and the European Commission. The duration of such a certificate should be for a certain period of time, no more than two or three years, for instance, during which annual evaluation of compliance should be envisaged. In case of violation, misuse, misrepresentation or misappropriation of this certificate, penalties and fines should be imposed let alone cancellation of this certificate. There is thus a need for further legislative steps be taken to this direction at a Commission level to facilitate a harmonised implementation and application across the European Union. In particular, controls and liability of the evaluators and the certifiers should be defined.
Finally, the certification referential schemes should be standardised International at the international level to ensure harmonisation and transparency standardisation of the methodologies used and of the criteria assessed. This needed referential should contain the criteria to be checked when evaluating the products or services concerned. They should serve as guidance to evaluators on how to assess ICT products and services.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
4.7 Supervision Tools
Companies that process personal data must specify their privacy Tools are needed to policy and ensure that it is properly implemented in their perform internal environment. This privacy policy may indeed be very complex due privacy auditing to the great number of parameters to be considered. Once this policy is deployed, scalable and automated compliance checking solutions should be performed continuously, however adequate supervision and management tools are not available to the industry that lacks efficient tools to conduct internal privacy auditing.
In addition, Data Protection Authorities (DPAs) have continuously These are also useful faced difficulties for implementing controls and conducting audits on for supervisory the personal data registered, processed and used. Finally, although authorities the European legal framework defines detailed obligations and safeguards data controllers need to implement and follow , it does not provide practical supervision tools or does not ask for the development of such tools for the benefits of supervisory authorities.
Specific Gaps
Most of the ICT systems which process personal data are usually not Individual privacy designed for facilitating audit exercises or even self-auditing auditing is highly activities. The tools for such supervision need then to be tailored on resource intensive a case by case which request additional resources. This requires an ability to verify the compliance of a physical implementation privacy policy to a high level privacy policy. Therefore, dedicated metrics need to be considered for privacy, and certain means to map high level specifications to physical configurations within the information system should be included.
In addition, given the huge volume of data collection activity to be audited, it is therefore crucial that standardised and non-repudiatable logging techniques be developed to allow for reliable automated auditing.
These tools could then possibly be considered to be made available Supervision tools to DPAs, to assist them in enforcing their inspection powers on a would be useful for continuous basis and possibly remotely. The end user should also be industry, DPAs, and in a position to obtain automatically feedback on the way his/her users alike personal data are processed.
Proposed Solutions Challenges for R&D
Privacy policies could be applied to the transferred data (e.g., Sticky Policy paradigm encapsulated as “sticky policies”) so that data controllers would be obliged to respect what is stated therein. For transparency reasons, this also would require
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
that not only – as legally demanded today – recipient categories be documented, but accurately the real recipients.
Effective automated audit tools of data protection practices would Synching technical and make it easier to enforce policies. Audit trails could be included legal privacy policies proactively in the systems to enable reverse-engineering of a through audit trails technical privacy policy and check that it complies with an acceptable high level privacy policy.
R&D on more automatic tools for control, traceability and audit operations should be encouraged. Another path could be to outsource this activity to accredited (private) bodies able to conduct such activity and provide certificates to organisations meeting privacy requirements (see, e.g., the certification scheme implemented in Geneva canton, Switzerland).
Both internal auditors (such as the auditing department) and Defined checkpoints external auditors (such as the DPA in charge) could profit from simplify verification defined (and possibly standardised) checkpoints in ICT systems and data processing workflows. Moreover, the testing procedures used in an audit should cover all relevant cases. For a long-term supervision even specific dummy data could be inserted to see whether these data leak and later appear outside of the ICT system. This means that careful attention must be given to ensure that these dummy test data do not become an uncontrolled digital identity themselves with misuse potential.
Legal Challenges
It would be possible to legally require that processing of personal Require audit trails data be only allowed if the data come from a trustworthy source along the entire data where all data transfers have to be documented. trail
Remote and permanent access by DPAs to limited features of Remote access for privacy supervision tools used by data controllers could be DPAs considered to verify that the systems comply with the notifications and to facilitate inspections.
Communication Challenges
Self-auditing reports would also contribute to the effective execution Internal testing of the tasks of the supervisory authorities that will be able to through self-auditing identify the weakest spots and to focus on them during their own auditing procedure.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
4.8 Guidance on Best Available Techniques
Privacy and security are complex issues that will hardly be solved BATs are a particular once and for all using some kind of universal technical solution. combination of Instead, different application areas call for different technical technologies, support to provide privacy to citizens. Such technical support must protocols, and also be carefully complemented with legal frameworks and practical standards guidelines that specifically target a particular application domain or selected set of operational principles. We can call this particular combination of technologies, protocols, standards, practices, etc., that can provide a reasonable level of privacy protection in a particular area “Best Available Techniques.”
Specific Gaps
There is a gap of defining and then harmonising – at the European BATs for privacy and level – what the Best Available Techniques (BATs) in various security need to be domains are, and to what extent they should or must be employed defined and by data controllers and processors. harmonised
The current discussion around location privacy techniques may Example: Location illustrate this gap. Many of today's location privacy proposals try to Privacy hide location requests in an area large enough to hold at least k-1 other users. This is called “k-anonymity.” However, while a powerful technique, it is important to more specifically address the practical use of such techniques. How can a user employ, say, a k-anonymity technique? How would one be able to judge what value of k is appropriate, or when to turn the system on or off? How would one strike a balance between location precision and location privacy? Or should we simply adopt a trusted third party model where all data is centrally administered by, e.g., the mobile phone provider, and we use statistical database approaches and other tools to protect user profiles? Different application scenarios might require different answers.
Proposed Solutions
Creating a set of BATs in the area of data protection is both a question of finding suitable techniques, and establishing a process to harmonise these across European Member States.
Challenges for R&D
A first step would need to identify the sets of relevant applications, Identify and group in particular those grouped around novel technological technologies and developments (e.g., RFID, Location Based Services, and practices biometrics). These should be further grouped according to their respective information flow models, i.e., their particular data processing practices and information needs.
Once generic application types have been identified, one can survey Find suitable sets of current technologies and practices and provide a well-defined set of techniques by specific best available techniques for such applications of such a type. As application domains defined above, economic and technical viability are important factors in such an assessment.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Legal Challenges
Data Protection Authorities (DPAs) have to be involved in this Address DPA process of identifying and enumerating privacy and security BATs. It involvement and has to be determined how DPAs can and should enforce the usage enforcement models of BATs, in particular if technologies are available, but not part of standard systems (e.g., secure deletion through wiping tools that are not part of standard operating systems) or if their use requires either the cooperation of multiple parties or an additional infrastructure (e.g., anonymising systems to protect personal data before they are noticeable by a specific data controller cannot be operated by this data controller itself, but need additional independent providers).
Note that solutions have to take into account the risks created by Anticipate future the combination of several existing technologies, i.e., these have to combinations of be anticipated, analysed and quantified. For example, major risks technology arise when combining facial recognition biometrics with video surveillance tools or Location Based Services with cartography information. When defining a policy with respect to a specific technology, future uses should therefore be foreseen as much as possible so that adequate purpose limitation safeguards can be included at each technology‟s design phase.
Communication Challenges
The list of identified BATs for important application settings and A public process their characteristics need to be made public, so that every data controller and processor can be aware of them. Best Practices could also illustrate the usage of BATs.
Links
BATs have successfully been defined within the environmental context, given by the IPPC Directive 96/61/EC .
The BSI (Bundesamt für Sicherheit in der Informationstechnik; the German Federal Office for Information Security) recently launched a project which could constitute an illustrative 19 example of BATs for RFID applications.
See http://www.bsi.de/presse/pressinf/071207_RFID.htm
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
4.9 Effective Incentives and Sanctions
Data protection law has quite old roots. However, today‟s data Privacy laws are often processing world often shows a lack of compliance of ICT not followed components and organisational structures with data protection law. It could be seen in the past decades that when relying solely on free market forces, privacy-enhancing technologies do not evolve on a large scale.
Specific Gaps
There is a general gap of data controllers not being properly There is a lack of motivated to be compliant with data protection law. Closely linked to motivation and not this gap is also the lack of motivation to employ privacy-enhancing enough incentives technologies, which would bring forward the state of the art.
In general, sanctions against non-compliance can only be imposed if A lack of tools makes it the supervisory authority in charge or a court becomes aware of the hard for DPAs to check infringement of data protection law. Today, Data Protection compliance Authorities only check a small fraction of data controllers so that non-compliant data processing frequently goes unnoticed.
Given the weakness of many sanctions, the economic incentives to Today's economic be privacy law compliant are often minimal. For example, data scales provide not controllers in some jurisdictions can only be fined once – even if enough incentives to they do not change their data processing, they only have to pay a follow the law fine once. In several cases, courts have also withdrawn the obligation to pay a fine to avoid having to check all competitors of the accused data controller when faced with discrimination charges.
Proposed Solutions
To encourage data controller to improve the privacy of their data Compliance through subjects, two general solutions are possible: rewards or punishment 1. Providing incentives which reward the data controller 2. Providing sanctions which punish the data controller
What can be an incentive or a sanction may depend on the kind of Effective sanctions data controller. For example, for companies economic drivers matter differ between private most. This also means that a fine to sanction non-compliance with and public entities data protection regulation has to be noticeable by the company – it should not pay off for the company to behave in a privacy-invasive way. For governmental processes, processing must be compliant with data protection law – otherwise regulatory supervision should intervene immediately.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Challenges for R&D
The lack of automated audit tools makes law enforcement against Standardised auditing breaches minimal. Such tools would require a certain tools are needed for standardisation and certification process that would identify, in effective compliance cooperation with Data Protection Authorities, the set of information testing required for such an audit trail.
Legal Challenges
Procurement conditions in the public service could require a privacy- Compulsory compliant design or a certification or self-certification. Certain certification or use of technological measures could be regarded as compulsory as they privacy technology already are in some jurisdictions; though it remains to be defined which measures would be beneficial.
Effective sanctions could help to convince data controllers that they Effective and should implement privacy-compliant systems. Sanctions should not noticeable economic be limited to administrative ones (in some countries sanctions are sanctions also provided by criminal law) but should include also an efficient liability system. In this case, consumer associations may play an important role.
However, in many Member States the sanctioning system does not work effectively. The sanctioning system should be supported by an efficient audit system. On the other hand, incentive should also be provided. They may include, for instance, tax incentives. This requires and is closely connected to a certification system.
We recommend that European Commission and Member States encourage an incentive system connected to a certification scheme and an effective economic sanctions system.
Communication Challenges
Privacy compliance or the (proven) design according to privacy- Campaigns to create enhancing criteria can be a unique selling proposition for a data consumer demand for controller. This also supports establishment of a good reputation compliance which can help attract and bind customers. Privacy-awareness campaigns could create a market demand for privacy-compliant systems, in particular if there are convenient ways for customers to express their demands for privacy. Less personal data means less risk of misuse which also is good for the reputation of the data controller.
Data controllers could be convinced that the privacy-enhancing Explain the benefits of organisation of data processing, in particular according to the data anonymous data minimising principle, is often cheaper than having to provide not only storage media, but also appropriate safeguards, documentation, and subject (or law enforcement) access.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
Links
Ross Anderson maintains an “Economics and Security Resource” page on his website. Alessandro Acquisti offers a similar site on the economics of privacy.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
4.10 To Be or Not To Be Personal Data?
According to Directive 1995/46/EC, personal data shall mean any The notion of personal information relating to an identified or identifiable natural person data covers all (“data subject”). This notion is very wide so as to cover all information which can information which may be linked to an individual. In fact, many be linked to an different data can be combined and may contribute to the individual identification of a given person (e.g., through social networking, by monitoring RFID tags, by combining search queries on search engines, etc.). Even though European lawmakers have adopted a broad notion of personal data, this notion is not unlimited. The scope of the data protection rules should not be overstretched, but unduly restricting the concept of personal data should also be avoided. Since the border between personal and non personal data can sometimes be blurred, efforts have been made to clarify the notion of personal data, such as the Article 29 Working Party‟s opinion on the concept of personal data.
Specific Gaps
The concept of personal data is often challenged, despite the recent It is not always clear if efforts by Article 29 Working Party to clarify this notion. This is data is personal or not problematic: When data is not intended to be personal, there are not necessarily sufficient safeguards to ensure it does not become personal.
Further, acceptable intrusion in one‟s privacy and user perception of Example: RFID tags in personal data are dynamic concepts. For instance, RFID technology the retail are not is used in many applications nowadays (including retail, digital deactivated even if the identity in passports, car keys, mobile payment, etc.). This tag has no intended technology introduces numerous threats since it could allow user purpose beyond the monitoring and data collection possibly anywhere and without the point of sale person‟s knowledge. It can identify a natural person when data such as the person's name or biometric data is stored on the tag. An individual could also be tracked, traced, and profiled, through his tagged items containing unique numbers. In the retail, since the data contained in a tag is usually not intended to be personal when it is used for logistical purposes, the tag is usually not deactivated at the point of sale so the user carries items containing active tags that could be used to track him.
In addition, acceptable intrusion in one‟s privacy and user perception of personal data are dynamic concepts which evolve in time according to social, factors, expected security requirements and technological improvements. Social factors enter into personal reactions to privacy-invasive technologies since the definition of one‟s private sphere is subjective and depends on one‟s age, culture, and environment. Expected security requirements also differ since expert users may wish to configure their systems accurately whilst the majority is likely to prefer simple, understandable and privacy-compliant default settings. Finally, data which would be considered today as non-personal (since the means required to make them personal would be excessive) may become personal if technological evolution makes those means reasonable.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
Proposed Solutions Challenges for R&D
To assess privacy risks related to data processing, Privacy Impact Develop appropriate Assessment methodologies should be developed and applied. The technological complexity of the analysis to be conducted should depend on the safeguards, even for sensitivity of the processing and of the data concerned. data that is not intended to become Safeguards should be developed to protect one‟s data adequately, personal whether this data is personal or not. This will significantly improve user empowerment and control.
Technological means and evolutions should be anticipated appropriately when designing systems and when defining regulations, so that data that is not intended to be personal does not become personal when technology evolves.
The social impact of new technologies should be systematically and scientifically assessed; the usefulness of technology should be demonstrated.
However, as a form of exercising the right to privacy and the right to data protection, the right to anonymity has to be continuously balanced with other fundamental rights. As anonymity usually cannot be absolute, space should also be left to forms of “reasonable” anonymity.
Especially when sensitive data is concerned, adequate anonymisation schemes should be used when possible.
Once the law has established a right, balancing it with other rights, technology should implement the rules. The effectiveness of a right to anonymity must be guaranteed through technology and technology should provide for the protection of different degrees of anonymity.
The requirement to conduct a Privacy Impact Assessment could be included in the legislation.
Where a Privacy Impact Assessment shows significant privacy risks associated to the processing, the legislator could impose appropriate privacy safeguards to be implemented to mitigate those risks.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Communication Challenges
By improving understanding of user-empowerment technologies and Awareness raising will of the need to protect one‟s data, awareness campaigns will mitigate the risks improve user practices and will thus contribute to mitigate the risks faced by EU citizens in faced by EU citizens in the online world. the online world
By systematically using harmonised Privacy Impact Assessment methodologies and processes, the industry will improve transparency, mitigate privacy risks related to the data they process, and thus benefit from increased trust in the technology by the users.
These campaigns will also trigger a public need for comprehensible and efficient privacy enhancing technologies.
Links
Directive 1995/46/EC defines personal data and the legislative framework to be applied to it.
The concept of personal data has been clarified and discussed in detail in 2007 in an 23 Article 29 Working Party opinion .
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
4.11 Privacy Protection and Social Sorting
In many cases, a unique identification of individuals – i.e., personal Social sorting may data – is not sought by data controllers because processing infringe on people’s concentrates on population groups, aiming at some kind of privacy even if the categorisation, also known as social sorting, stratification, processed data are not segmentation, or classification. This may be done by profiling or personal scoring techniques for various purposes such as marketing, determination of creditworthiness, price discrimination, and decision making in erecruitment, the health sector, or criminal investigations. In these cases, the data themselves are often not considered personal data because they do not relate to specific individuals, i.e., the data controllers do not know the name of the individuals whose data are being processed. However, the consequences of this data collection and analysis often impinge on individuals and thereby affect their privacy. The provisions of Article 15 of the European Data Protection Directive on automated individual decisions are not meant to cover these constellations.
Specific Gaps
The main gap is that individuals often are not aware when they are No transparency of subject to social sorting and how specific decisions concerning social sorting for themselves are reached. This means they neither know whether the individuals data on which the social sorting is based on are correct nor whether the algorithms and implementations of scoring and other analysis tools work properly. In particular the entity which generates decisions on individuals may not be the same as that which collects and aggregates the information which makes it harder for individuals concerned to address complaints and achieve remedy. Furthermore, in predictive scenarios it is usually not possible for the individual to prove the forecast wrong.
As far as the data processed is not considered as personal data, this Exercising individual also weakens the possibility of exercising one‟s privacy rights privacy rights does not (access, rectification, erasure of personal data if illegally stored, work with nonrevocation of consent). This would require a proof that the data in individual data question belong uniquely to oneself as individual. For example there are cases where the data protection right to access has been denied when dealing with cookie data only because a cookie is not necessarily uniquely bound to one individual. This shows that many identifiers bear a sufficient quality of linkage to yield information desired by the processing entity, but do not enable individuals concerned to exercise their privacy rights.
In addition, there are settings where the individual may be Reachability may addressed and reached, e.g., by a telephone call, an e-mail or facilitate direct personalised advertisement via television or website. In particular manipulation those kinds of marketing which aim at seducing potential customers can be manipulative and infringe on the individual‟s privacy. It also may provoke a reaction which enables the processing entity to refine the collected data or establish the personal linkage.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Proposed Solutions
The right to informational self-determination can only be fulfilled if individuals can know about all data processing concerning them.
Challenges for R&D
One solution is an organisational and technical framework which Full audit trail for all makes sure that individuals concerned can protect themselves and data processing can exercise their rights. This may require the preparation of a full audit trail whenever data – be it personal or non-personal – are being processed as far as this may impinge on individuals. This would mean that each step of data processing with all input and output including the information on responsible parties for data, algorithms and implementations can be made transparent to individuals concerned or to parties trusted by them. By this means, incorrect data or flaws in data processing could be identified and corrected more easily.
The organisational and technical framework is even more necessary considering the upcoming ambient world with a variety of sensors, communicating which each other and collecting information on their surrounding – including individuals. Here, transparency enhancing technologies could support individuals concerned [Hildebrandt/Koops 2007].
Legal Challenges
Current regulation concerning this gap seems to be scattered, e.g., Consistent legal some parts are in data protection law, others in non-discrimination framework for all data law and yet other parts seem to be not fully handled. Therefore, the processing affecting main legal challenge is the development of a consistent and individuals comprehensive legal framework for all kinds of personal and nonpersonal data processing which may affect individuals. This framework should especially contain an obligation for better transparency and understandability of data processing for the individuals concerned.
Communication Challenges
Individuals should be made aware when they unwittingly leave data Informing individuals trails, what information about them is being gathered and linked by about data collection different parties, or when they are – possibly mistakenly – held and analysis responsible for specific actions. Further, they should be informed on how to react best if they feel treated in an unfair way concerning their privacy.
Links
Hildebrandt, Mireille, Serge Gutwirth (Eds.): D7.4: Implications of profiling practices on democracy and rule of law, FIDIS Deliverable, Frankfurt a.M., Germany, September 2005, http://www.fidis.net/fileadmin/ fidis/deliverables/fidis-wp7del7.4.implication_profiling_practices.pdf
Hildebrandt, Mireille, Bert-Jaap Koops (Eds.): D7.9: A Vision of Ambient Law, FIDIS Deliverable, Frankfurt a.M., Germany, October 2007,
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
http://www.fidis.net/fileadmin/fidis/deliverables/fidis-wp7d7.9_A_Vision_of_Ambient_Law.pdf
Lessig, Lawrence: Code and other laws of cyberspace, Basic Books, New York, 1999
Lyon, David: Surveillance as Social Sorting: Privacy, Risk and Automated Discrimination, Routledge, 2002
Phillips, David J.: Privacy policy and PETs – The influence of policy regimes on the development and social implications of privacy enhancing technologies, in: New Media & Society, Vol. 6, No. 6, SAGE Publications, London, Thousand Oaks, CA and New Delhi, 2004, pp. 691-706
Article 29 Working Party: Opinion 4/2007 on the concept of personal data, June 20 2007, 01248/07/EN, WP 136, http://ec.europa.eu/justice_home/fsj/privacy/docs/ wpdocs/2007/wp136_en.pdf
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
4.12 Privacy, Data Protection and Space
Territorial privacy has long since played an important role in privacy A lack of boundaries in protection (“my home is my castle”). A territory is usually a the digital domain continuum in space; the real and digital elements of a person, however, may co-exist in disparate locations (in the end, any digital element is recorded on a hard-disk or other medium which has a specific physical substance and location – although the latter may change with time, i.e., if the device is mobile). This lack of clear territorial boundaries in the digital world leads to both specific legal problems and general problems of perception when managing one‟s privacy.
Specific Gaps
According to Article 25 of the Data Protection Directive 1995/46/EC, The need to keep personal data usually may only be transferred to third countries if personal data of that country provides an adequate level of protection. There are citizens within the exceptions such as transfer to companies in the United States which European jurisdiction adhere to the Safe Harbor Principles.
However, in all cases outside the European jurisdiction, the defined adequate level of privacy protection does not take into account the possibility of access of national security agencies. This means that all data in those countries may be subject to access and analysis by these agencies which may have undesired consequences for individuals as well as organisations, e.g., companies whose trade secrets may be exposed.
In the Information Society, there is a lack of territoriality and Physical vs. digital therefore no protective boundaries. At the same time, there is a multiplication of invisible and uncontrolled bridges between the real and the digital environments. If we still have the tools in the physical world to manage our privacy (through distances) it is not yet the case in the digital world but this new environment is becoming through the growing number of bridges an inherent part of our everyday life space.
Legal rules, tacit socio-cultural norms, and even traditions constitute the guidelines for people‟s understanding of what is private or public space or of what is socially accepted as private or public space. Although the distinction between the two spaces is not always that clear, people are aware that boundaries do exist and they act accordingly (e.g., a fenced private land, the „keep out‟ sign on someone‟s private lawn, the questioning or annoyed look given to strangers in a neighbourhood bar).
Although people have an intuitive sense of privacy violation in Perceiving space in physical space, they do not have a similar sense in cyberspace. For cyberspace example even in public spaces if someone eavesdrops, it is clear that there is violation. In cyberspace it is not clear whether someone is eavesdropping nor if this is a violation of privacy. How can these boundaries be made more explicit in cyberspace?
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA Ad Hoc Working Group on Privacy and Technology
In this context and without underestimating the already complicated Remote storage nature of privacy in the physical space and the difficulty of complicates the notion protecting it appropriately, it seems that in the digital space, privacy of spatial boundaries is far easier to violate and more difficult to protect than merely in cyberspace shrugging off an undesirable touch. Moreover, the default in cyberspace is more likely to be privacy-invasive, thus always requiring appropriate action from the user. Consider for example when upon installing a programme or signing-up for an online Internet service, you are automatically subscribed to newsletters or services, and you are subsequently informed that you should go to the respective website and request to be unsubscribed. Consider also a photo album kept in a cupboard of our living-room, which is supposed to be only viewable by the members of the household, including the friends and relatives that may see it; however, a digital family photo album, sometimes available and even searchable over the Internet, usually is not equally protected .
The opt-out possibility for these kinds of applications is thus most of the time made more difficult and requires extra effort on the part of the user, as well as technical knowledge. To make matters worse, the user is often not aware of the amount and the type of information (e.g., IP address, cookies, web-tracking, cache, search terms etc.) that is captured as one surfs the net or performing other online activities, thus making it more difficult to opt-out or to protect one‟s privacy.
So called virtual worlds constitute another manifestation of this lack Virtual worlds of clarity. Some predict that virtual worlds will soon be used by mainstream companies. Applications such as Kaneva are appearing where social networks and virtual worlds converge. There are many unexplored privacy issues here. For example what is the legal status of virtual financial data (e.g., LindenDollar accounts)? Another interesting question is what would be the meaning of issuing an ID card for an Avatar – the point being that even purely digital personae may benefit from strong authentication combined with linkability control. The avatar as a metaphor for a partial digital identity may also be a useful privacy user-interface tool.
Technology-induced challenges in Privacy & Data Protection in Europe
ENISA AdHoc Working Group on Privacy and Technology
Proposed Solutions Challenges for R&D
To protect the personal data of European citizens, mechanisms Data storage and should be applied which keep their data in the European jurisdiction infrastructure within wherever possible. For Internet search engines this could be EU jurisdiction achieved by offering proxies for outside services or providing separate search engines.
Similarly critical infrastructures should be implemented within the European jurisdiction only and avoid dependencies from other nations.
Legal Challenges
The data handling within these European services would have to adhere to European data protection law which would prevent unnecessary storage and usage.
By digitising the personal domain but also its boundaries, the Digital Digital Territory Territory concept offers the opportunity to introduce the notion of concept territory, property and space in a digital environment. The objective is to provide a tool that enables users to manage proximity and distance with others in this future Ambient Intelligence space, both in a legal and a social sense, as we currently do in the physical world.
The physical and traditional concept of residence constitutes a legal sanctuary and protects the citizen from outside interferences or invasive measures . This legal sanctuary has to be now extended to the digital part of our private space.
Communication Challenges
Communication tools will need to be developed in order to express which elements belong to these personal territories.
Links
Beslay, Laurent, Hannu Hakala: Digital Territory: Bubbles. In: Paul T. Kidd (Ed.): European Visions for the Knowledge Age: A Quest for New Horizons in the Information Society, Cheshire Henbury, 2007, pp. 69-78.
Benoliel, Daniel: Law, Geography, and Cyberspace: The Case of online Territorial Privacy, CFP 2004
Daskala, Barbara, Ioannis Maghiros: Digital Territories, Towards the protection of public and private space in a digital and Ambient Intelligence environment .
ENISA WG Deliverable
08
Fotnoter
- Legal notice
- Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004. This publication does not necessarily represent state-of the-art and it might be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2008
- See http://www.admin.ch/ch/e/rs/235_13/
- See http://www.heinz.cmu.edu/~acquisti/economics-privacy.htm
- Tseng, Jimmy C: “An Economic Approach towards Privacy Enforcement”, presentation at the PRIME/ERIM Privacy for Business Workshop, Rotterdam, December 2004. See https://www.primeproject.eu/events/external/ERIM%20Privacy%20for%20Business%20Workshop/Tseng3.ppt
- Reidenberg, Joel R., Paul M. Schwartz: Data-Protection Law and On-Line Services: Regulatory Responses, Brussels, 1998, http://ec.europa.eu/ justice_home/fsj/privacy/docs/studies/regul_en.pdf
- Bohm, Nicholas, Richard Clayton: Open Letter to the Information Commissioner, Foundation for Information Policy Research, March 2008, http://www.fipr.org/080317icoletter.html
- This has been done in several schools on the 2nd European Data Protection Day, 28 January, 2008. See also online: http://www.coe.int/t/e/legal_affairs/legal_co-
- operation/ data_protection/Data_Protection_Day_default.asp
- 8 9 Example privacy icon sets have been proposed, e.g., by Rundle and Mehldau .
- See http://identityproject.lse.ac.uk/mary.pdf
- See http://asset.netzpolitik.org/wp-upload/data-privacy-icons-v01.pdf
- See https://www.prime-project.eu/prime_products/reports/
- We leave open here how fine-grained the concept of “context-specific” usage should be. In some contexts, each transaction may represent an own context, for others a coarser perspective may be appropriate. The notion of purposes may be a landmark for the discussion of contexts, but here also statutory provisions are missing.
- Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.
- Proposal of 13 November 2007 for a Directive of the European Parliament and the Council amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks, and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.
- See http://www.european-privacy-seal.eu/
- See Ordonnance sur les certifications en matiere de protection des donees (OCPD), 28 September 2007, Le Conseil federal Suisse, and Loi federale sur la protection des donnees (LPD) du 19 join
- 1992 (Etat le 1 Janvier 2008), L’ Assemblee federale de la Confederation Suisse. See
- See as an illustrative example the Article 17 of the Directive 1995/46
- See http://ec.europa.eu/environment/air/legis.htm#stationary
- See http://www.cl.cam.ac.uk/~rja14/econsec.html
- See http://www.heinz.cmu.edu/~acquisti/economics-privacy.htm
- Legal Challenges Regulation should ensure that non- Regulation should ensure that data is protected adequately personal data may not especially if there is (or if will be) uncertainty that it could become become personal personal.
- A good example is the case of not well configured so-called online “social networking” applications, such as mySpace.com, Flickr, YouTube, Facebook, which allow for online storing, sorting, sharing but most importantly searching of photos and videos.
- See Articles 7, 8 of the Charter of Fundamental Rights of the European Union See http://www.cfp2004.org/spapers/benoliel-caseOfTerritorialPrivacy.pdf
- See http://ftp.jrc.es/eur22765en.pdf