Content Listing

Summary

Cross-border trade, (digital) rights and the use and regulation of new technologies increasingly overlap, but discussions about these topics remain fragmented Trade negotiators, civil society organisations, legislators and tech experts try to address the opportunities of the digital economy, Internet governance, the protection of digital rights in various fora – without necessarily having a clear overview of who is doing what.

Some actors have raised concerns about the potential dangers of trade agreements, such as the cementing of outdated copyright rules or the circumvention of privacy standards Others have focused on opportunities to safeguard and strengthen the open Internet, for instance by banning unjustified forced data-localisation or prohibiting online censorship.

Below are my initial takeaways on trade and technology I invite you to share your input about what can work and what does not work, where trade rules can help advance the open Internet, and where we should be careful not to overregulate.

NO OLD-SCHOOL TRADE – VIEWS TO ADDRESS THE DIGITAL ECONOMY OF THE FUTURE

The Internet has fundamentally changed the way companies do business and reach consumers globally Some business models are purely data-driven, or focus only on the provision of digital goods and services Other companies – in sectors ranging from design to legal services – have digitised their services, and used the Internet to profoundly change their business models or value chains Small and medium-sized enterprises are now able to easier find and reach new customers and markets The potential of digitisation processes is clear and goes far beyond only a digital economy.

For the European Union (EU), this increasing digitisation of more traditional aspects of our services economy provides great opportunities Services make up around 70 per cent of the EU's GDP, and they are more oft en being delivered digitally Close to a third of the growth of the overall industrial output in Europe is now a result of the uptake of digital technologies The expectation is that the importance of the digital economy will continue to grow, as more of the world's population gains access to the Internet, and new technologies such as the Internet of Things become more widespread.

Summary

A series of events have led to the idea for this book and the first one is more than obvious: the Edward Snowden affaire On 6 June 2013 Glenn Greenwald published in The Guardian the first in a series of articles – and later co-authored a few other – on global mass surveillance practices led by the United States ‘National Security Agency (NSA) On the first day, the worldwide public learned that the NSA has obtained a clandestine court order from a secretly operating court of law, called the Foreign Intelligence Surveillance Court (FISC), and on its basis the Agency has been collecting metadata on telephone calls of millions customers of a major private telecommunications provider, Verizon This provider was forbidden from disclosing both the order itself and its compliance with it On the second day (7 June), the worldwide public learned further that these practices had not been limited to a single provider and that the NSA was allegedly’ tapping directly into the central servers of nine leading U.S Internet companies ‘: Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, and Apple The worldwide public also learned that the NSA has been ‘listening’ to anything about anybody whose data merely flew throughservers located on US soil, even when sent from one overseas location to another Finally, the NSA has shared these data with its fellow agencies in the US, such as with the Federal Bureau of Investigation (FBI) These practices were variously codenamed – labels of surveillance programmes such as PRISM, Xkeyscore, Upstream, Quantuminsert, Bullrun or Dishfir have since entered the public debate– and their aim was to procure national security with the help of surveillance (These practises were not a novelty for the NSA has operated domestic surveillance programmes since the Agency's establishment in 1952 It is also true that surveillance practices are as old as humanity and over time have became an integral part of modernity, but these have intensified in the aft ermath of the 11 September 2001 terrorist attacks.)

Summary

INTRODUCTION

There is a constant flow of information, including personal data, between the European Union and its largest trading partner – the United States The EU – US cooperation, including in the digital trade area, may soon be further strengthened if the Transatlantic Trade and Investment Partnership (TTIP) negotiations are successfully concluded As American privacy standards – and in general the American way of thinking about privacy and personal data protection – differ from the approach adopted by the EU, it is crucial for US companies to be able to assess whether particular processing operations they conduct fall within the scope of the EU data protection legal regime The territorial scope of the EU data protection law, together with rules on transfers of personal data, constitute one of the most important elements of the EU data protection regime from the trans-Atlantic perspective.

EU – US exchange of information should be seen in the context of a bigger picture, which is the development of the information society and a global digital market General access to the Internet, breakthroughs in processing, storage and transmission of information technologies as well as the constant fall in costs of IT equipment – all these have allowed the application of technology in almost all areas of our day-to-day life Advocate General J ä ä skinen is right when he compares the development of the Web to the invention of printing in the fift eenth century Both printing and the Internet irretrievably changed the way information is shared Both allowed for processing of information on a scale never seen before In the information society, processing of data constitutes an inseparable part of our life Connected devices such as smartphones, connected cars, wearables and smart TVs are being used on day-to-day basis as means to not only provide certain services but also to obtain information about their users.

However, globalisation of technology has not been followed by globalisation of legal standards For example, the European data protection standards, set – in particular – in legal acts such as the Council of Europe's Convention 108 and the EU Directive 95/46/EC (the Directive, Data Protection Directive) date from the 1980s and 1990s, the age of telefaxes and land-line phone services.

Summary

The contours of privacy law oft en evolve in response to excessive or inappropriate government surveillance Since the 1765 proto-privacy decision of Entick v Carrington addressing unwarranted searches of documents and private property by the English executive, judges have continued to advance or produce new privacy protecting limitations on law enforcement However, the manner in which privacy law might respond to the 2013 Edward Snowden revelations regarding the startling surveillance capabilities of various nation states is somewhat uncertain The goal of this chapter is therefore to evaluate certain proposals as to how privacy law might react to contemporary law enforcement surveillance techniques In particular, this chapter explores ideas around automated privacy enforcement and the articulation of individual protections from profiling into the telecommunications infrastructure.

While remaining broadly supportive of proposals involving automation and informatics, and believing strongly in the need to reconsider the media of legal transmission and relations in the contemporary technological environment, this chapter questions the achievability of automated privacy solutions to law enforcement surveillance both technically and politically In particular, the possibility of creating systems that could be deployed at web-scale, and of developing automated approaches capable of achieving an acceptable balance between effectively constraining inappropriate surveillance and completely forbidding those law enforcement practices – a seemingly untenable political position – remain unclear Rather than acquiescing to the overwhelming difficulty of the task however, the chapter outlines some paths of further inquiry that might assist in directing future research in the area.

CHARACTERISING CONTEMPORARY LAW ENFORCEMENT SURVEILLANCE

Although there are multiple forms of high-technology surveillance used in law enforcement and security, this chapter focuses on automated profiling technologies It is worth briefly explaining some basic features of those surveillance exercises in order to better understand suggestions as to how they might be constrained by law While law enforcement (and indeed law itself) are taken to have always been information technologies, it is argued here that the technologies of law enforcement are becoming increasingly automated Law enforcement surveillance, especially as performed in ‘high’ or political policing that focuses on calculating criminal propensity and pre-empting future conduct, increasingly operates through the collection (or interception), retention and algorithmic processing of information stored across multiple databases.

Summary

INTRODUCTION

The creation of a Digital Single Market is an important objective of the European Union (EU); a basic concretisation of this objective can be seen in the Commission's proposition for a ‘Digital Single Market Strategy for Europe’, presented on 6 May 2015 This Communication is based on the acknowledgement that the EU needs liberalised digital facilities encompassing better online-access for consumers and businesses and addressing crossborder e-commerce rules that are trustworthy Apart from specific topics, the Commission proposes to create the right conditions and a level playing field for advanced digital networks and innovative services In addition, trust and security in the handling of personal data are to be improved.

However, the main objective of the Digital Single Market Strategy of the Commission consists in strengthening the digital ecosystem and overcoming market fragmentation In this context, two elements are of major importance, namely (i) building a data economy (big data, cloud services, Internet of Things) that is likely to increase the competitiveness of the EU industry, and (ii) boosting wealth maximisation through interoperability and standardisation based on innovative technologies Obviously, a stable and foreseeable legal framework for digital services is a desirable cornerstone of the single market concept, but a parallel framework for cross-border data flow should also be implemented in order to equally satisfy data privacy requests.

The new General Data Protection Regulation (GDPR) is a cornerstone of the European data protection effort Data protection should no longer be viewed by enterprises as a negative factor but as ‘an essential competitive advantage’ in the Digital Single Market, which aims at adding up to € 415 billion per year to Europe's economy Correspondingly, data protection principles need to be embedded into the Digital Single Market Strategy.

Public consultations are currently ongoing in respect of a wide range of issues relating to the Digital Single Market Their aim is to ascertain the concerns that citizens as well as enterprises might have, and to adjust the Strategy and the corresponding legal instruments accordingly The implementation is to be expected in 2017.

Summary

The Convention for the protection of individuals with regard to automatic processing of personal data (‘Convention 108 ‘) was opened for signature in Strasbourg on 28 January 1981 and came into force on 1 October 1985 Thirtyfive years aft er its opening for signature, the Convention applies to 50 countries.

Convention 108 is unique It was unique over three decades ago, and remains the only legally binding international instrument in the field of data protection Its legally binding force is a key element that makes it unique, but it is not the only one Another key characteristic of Convention 108 is its unmatched potential for global reach: Convention 108 is open to any country in the world.

Is this opening to the world, aimed at affording protection to individuals when data concerning them flow across borders and oceans, with a particular focus on the trans-Atlantic dimension examined here, the result of genetic instructions which guided its development? Or is it instead the result of a genetic mutation or the result of the use of genetic engineering techniques?

Convention 108 was conceived, and delivered, with the idea that data protection should respect the principle of international free flow of information Its trans-Atlantic nature in fact pre-dated the Convention itself, deriving from the identity of its parents and in the hopes they vested in the Convention.

On the life scale of an international treaty, a few decades of life amounts only to infancy, and the trans-Atlantic hopes that have started to materialise only recently are to be considered in a longer-term perspective, with a promising future.

CONVENTION 108, TRANS-ATLANTIC AT BIRTH

The Committee that draft ed Convention 108 had in its mandate the clear instruction ‘to prepare a Convention for the protection of privacy in relation to data processing abroad and transfrontier data processing’ It ‘was instructed to do so in close collaboration with the Organisation for Economic Co-operation and Development, as well as the non-European member countries of that organisation, having regard to the activities which OECD was carrying out in the field of information, computer and communications policy.’

Summary

INTRODUCTION

Information that can be associated with an identifiable individual is given special treatment in law in many countries This ‘personal information’, as it is called in Australia, attracts the coverage of privacy and data protection law The scope of the information that fits within the relevant definition varies between jurisdictions, and is a core concern of this chapter.

Information, which cannot be associated with an identifiable individual in the way defined in a particular jurisdiction, escapes such classification as ‘personal’ It can then be dealt with under oft en less restrictive controls outside of privacy and data protection law such as contractual restrictions on data scraping imposed by data owners, or issues involving copyright clearance This has significant implications for both data subjects (whose information is less protected) and data custodians (who face fewer regulatory constraints) Privacy and data protection laws typically only apply when data or information is linked to a person, or is capable of the identification of a person If Big Data items or records do not fall within the relevant legal definition of categories such as ‘personal information’, ‘personal data’ or their equivalent, they are not subject to privacy law in a given jurisdiction, so there are fewer rules for their use and transfer Where information is ‘personal’ there are a variety of methods that are used, in particular in data analytics, to make the information non-identified The terms for these methods include ‘anonymous’, ‘pseudonymous’, ‘de-identified’, ‘depersonalised’, ‘data minimisation’ and ‘not personal data’ .

Although the technology practices known as ‘Big Data’ raise many important privacy issues, this paper focuses on their effect on questions about whether a particular record or data set is considered ‘personal’ and therefore ‘about’ an identifiable individual We survey definitions of personal data or information (or their equivalent) in jurisdictions including Australia, the United States and the European Union in the context of identifiability and Big Data.

The divergence of the definitions used in the jurisdictions helps explain some of the differences in how they respond to Big Data developments – and to the challenges that Big Data tools may pose for legal systems.

Summary

POINT OF DEPARTURE

Given the reality of the ‘information society’ worldwide, this is an arena in which we must play the game and we have to recognize that others may make the rules. 1

The author of this quote is George B Trubow, well-known US privacy and information law expert, describing the US position in 1992, a time during which EU institutions were draft ing Directive 95/46/EC The latter introduced the adequacy requirement obliging non-Member States to have an adequate level of data protection, without which no personal data exchange with the EU was allowed Trubow recognised that the US data protection system would not pass this adequacy test, in particular regarding the purpose limitation principle known in the US as the secondary use limitation, or function creep.

Aft er the entry into force of the EU's first legal instrument on data protection, Directive 95/46/EC – on the protection of personal data processed for activities within the scope of Community law, largely corresponding with commercial activities – the adequacy requirement was copied into the Council of Europe's 2001 Additional Protocol to the Data Protection Convention (2001 Additional Protocol) Later it was also copied into EU Framework Decision 2008/977/JHA on data protection in criminal matters (2008 Framework Decision) This means that both EU and Council of Europe (CoE) Member States may have to assess the adequate level of data protection of a third state requesting for personal data The term ‘Member States’ will in this contribution thus refer to EU or CoE Member States For the sake of argument, abstraction is made of the fact that the adequacy requirement is not applied for all data transfers and that not all CoE Member States have ratified the 2001 Additional Protocol This chapter focuses on the (need for an) adequacy rule itself, and not its application.

The adequacy requirement has given rise to a variety of issues in the EU Oft en these concerned issues related to inconsistencies in application Most recently the adequacy requirement was questioned by Austrian national Maximillian Schrems in his complaint against the Irish Data Protection Authority regarding Facebook's transfer of personal data from the EU to its US-based servers.

Summary

INTRODUCTION

[A]s the Internet erases the distance between countries, we see growing efforts by terrorists to poison the minds of people like the Boston Marathon bombers and the

San Bernardino killers

A recent budget bill in the United States, which used an unconventional procedural measure to bring a controversial cyber-surveillance bill to the floor, contained the word ‘cyber’ 423 times It was observed that the word ‘increasingly connotes a malware arms race that nobody wins’ This chapter takes a critical look at international instruments, some selected legislation and case law to better understand how cyber law is dealt with globally against a background of concerns over balancing freedom with regulation of the Internet It discusses the use of terrorism and paedophilia as excuses for regulation of the Internet and considers whether human rights standards are being safeguarded as individual states legislate to regulate use of the Internet Taking a particular focus on an international legal analysis in the context of freedom of expression, freedom of information, surveillance and right to privacy issues, this chapter is approached from the following perspectives: the regulation of criminal activity online, consideration of data privacy relations, jurisdictional issues in the context of cyber evidence, balancing regulation with the freedom of expression (both generally and in relation to political dissent) and balancing the protection of the privacy of victims in the wider context of transnational organised crime It is necessarily an overview of such huge topics and is therefore set against the background of three areas of criminal law:

Summary

INTRODUCTION

While the protection of privacy is a global concern, the new technologies or methods of processing of personal data – such as big data, the Internet of Things, cloud computing, or smartphone applications – might easily drive to despair any legislator attempting to apply local jurisdictional approaches to personal data processing This is because this type of processing is by design addressed directly to individuals anywhere in the world, treating national borders as irrelevant.

Quite contrary to what is urgently needed, an entrenchment attitude may be identified even in regional and global data privacy models devised today at the level of the European Union (EU), the Council of Europe (CoE) and the Organisation for Economic Co-operation and Development (OECD) At state level, an increased interest in data privacy has been identified, with more than 100 countries having by now enacted some sort of data protection law within their respective jurisdictions However, this does not necessarily mean that they all approve of and subscribe to, for example, the EU model or any other of the above available global models Regulatory approaches are diverging, failing to reach out to each other Even compatibility among them is hard to achieve, as the recent Privacy Shield saga 3 demonstrates While the right to data privacy is globally acknowledged as an important safeguard for individuals in the digital era, the way to protect it is understood differently in different parts of the world To avoid legal fragmentation, it appears that global cooperation and coordination is imperative However, the ways to achieve it vary considerably, and seemingly insurmountable obstacles lie ahead.

While the question whether an international treaty or convention, which would constitute the obvious policy option, is a viable solution has already been addressed in theory, mostly towards the negative, some hope may come from the United Nations (UN) In July 2015, the UN Human Rights Council appointed Professor Joseph Cannataci as its first-ever Special Rapporteur on the right to privacy His mandate is, among others, to gather information, identify obstacles, take part in global initiatives and raise awareness.

Summary

INTRODUCTION

The Anti-Counterfeiting Trade Agreement (ACTA) marked the rise of a new lobbying power Although traditionally, international trade negotiations have been state-centric forums, public opinion can no longer be ignored when negotiating agreements that include intellectual property rights as a topic of discussion In the aft ermath of the ACTA negotiations, civil society actors were lauded for their successful citizen mobilisation and online advocacy Indicative were street protests of thousands during the Polish winter ACTA was heavily criticised for its lack of transparency and fundamental rights safeguards, especially in relation to data privacy Similar concerns have arisen in ongoing discussions on Transatlantic Trade and Investment Partnership (TTIP) between the United States and the European Union Is it possible to include a diverse stakeholder group in a negotiation process without suffering significant delays in its progress?

ACTA is also illustrative of an ongoing political economy struggle over knowledge creation and information control The arguments brought forward by stakeholders in the ACTA debate were not new: the devastating harm of intellectual property rights (IPR) infringement, the necessity of IPR enforcement for economic growth, the value of the Internet for democratic and societal participation, and the importance of fundamental rights Underlying these arguments are conflicting views on the role of copyright and the Internet to foster innovation and creativity Opponents of ACTA feared that the multilateral agreement would be used to circumvent existing international and domestic legislation that balances IPR against other rights and exceptions Can we find a middle ground between protecting rights and providing access to knowledge and culture in trade negotiations?

This chapter contributes to improving the societal acceptability of trade negotiations on the one hand, and intellectual property rights on the other It is important to note at the beginning of this chapter that the topic is approached from a Eurocentric point of view The core of the chapter elaborates on democratic governance and political economy of intellectual property literature, and analyses the views of interested stakeholders on democratic process and balancing of rights in ACTA.

Summary

When people compare the differing concepts of data privacy in Europe and the United States, along with the different systems of legal and practical protection associated with them and the respective frameworks of informational selfdetermination, they invariably think of the privacy rights of living persons One of the reasons they do this is because in public thinking, the notion of privacy is closely bound up with the actual life circumstances, expectations and rights of living persons, and the value represented by privacy is, manifestly or latently, important for people who are alive The other reason is that in most of the countries where data protection rights have been enacted, the concept of personal data is limited to information associated with living persons Nevertheless, one's personal uniqueness, or unique personality if you like, does not vanish with death: for the relatives and the personal friends, as well as the professional community and cultural memory, or indeed in a broader sense for society as a whole, the essence of a human being is more than the biological functioning of an organism, and it lives on aft er the stoppage of the biological machine We ought to picture this as a comet in the sky: the radiant nucleus represents the human essence of a living person, and its long tail symbolises the personality left behind aft er death: as time passes, this remnant of personality becomes less and less linked to the human essence of the deceased, in much the same way that the end of the comet's tail gradually melts into the dark sky.

THE LEGAL LANDSCAPE

Some of the problems concerning the protection and regulation of the gradually impersonalised information relating to deceased persons are adequately resolved by the traditional institutions of law, both within the national frameworks and in the international context: two examples – important on account of their financial implications, besides anything else – are intellectual property right and copyright The bequest of persons living in today's networked society includes informational items the legal regulation of which is currently underway, although the formation of a unified approach to it is admittedly still further down the road.

Summary

INTRODUCTION

International data transfers are currently regulated by frameworks that vary considerably among countries The lack of harmonisation, even between countries that have very considerable exchanges of personal data, has been the cause of intense debate In this matter, however, Brazil emerges as a jurisdiction which has approached the issue of regulating international data transfers in a mostly empirical frame, and references to some resources and instruments found, for example, in European data protection legislation, have been introduced in the country's debates only recently.

THE SITUATION IN BRAZIL AND LATIN AMERICA

International data transfers are not directly addressed in Brazilian legislation In fact, despite some vivid debate that has taken place in Brazil in recent years regarding similar subjects, such as jurisdiction over personal data and data localisation, the first proposition which aimed to focus the discussion in the general terms of international data transfer has been the Data Protection Bill draft ed by the Federal Government and submitted to the National Congress in May 2016.

Brazil does not have a general data protection law as yet, although a rough legal framework for privacy and data protection has developed over recent decades, from constitutional to specific legal measures, based on constitutional grounds, the Consumer Protection Code and other sources, none of them having any particular international transfer provisions The Brazilian Constitution identifies privacy as a fundamental right but does not extend this attribute to data, so it can be said that, besides not having enacted a data protection framework, Brazilian law does not consider data protection a fundamental right However, more recent legislation such as the Internet Civil Rights Framework (Marco Civil da Internet) identifies data protection, along with privacy protection, as two of the core principles of Internet usage.

The international data transfers rules found today in Europe as well as in other countries developed at a time when global data-sharing was noticeably less intense than today Concepts such as cloud computing basically did not exist back then, and furthermore personal data has become more and more an essential component in international commerce.

Intersentia

Refine listing

Refine listing

Actions for selected content:

7719 results in Intersentia

Part II - Direct Horizontal Effect: Internal Market

Frontmatter

9 - Nine Takeaways on Trade and Technology

Summary

Preface

Summary

10 - Extraterritoriality in the age of the equipment-based society: do we need the ‘use of equipment’ as a factor for the territorial applicability of the EU Data Protection Regime?

Summary

24 - The Future of Automated Privacy Enforcement

Summary

1 - Transnational Data Privacy in the EU Digital Single Market Strategy

Summary

26 - Convention 108, a Trans-Atlantic DNA?

Summary

18 - Big Data and ‘Personal Information’ in Australia, the European Union and the United States

Summary

SECTION V - PRIVACY AND TIME INVITED COMMENTS

INVITED COMMENT

22 - Flagrant Denial of Data Protection: Redefining the Adequacy Requirement

Summary

SECTION IV - PRIVACY AND CRIME

13 - Terrorism and Paedophilia on the Internet: A Global and Balanced Cyber-Rights Response Is Required to Combat Cybercrime, Not Knee-Jerk Regulation

Summary

INVITED COMMENTS

25 - Moving Beyond the Special Rapporteur on Privacy with the Establishment of a New, Specialised United Nations Agency: Addressing the Deficit in Global Cooperation for the Protection of Data Privacy

Summary

INVITED COMMENT

7 - From ACTA to TTIP: Lessons Learned on Democratic Process and Balancing of Rights

Summary

15 - Does It Matter Where You Die? Chances of Post-Mortem Privacy in Europe and in the United States

Summary

6 - International Data Transfers in Brazil

Summary

Intersentia

Refine listing

Refine listing

Actions for selected content:

Save Search

7719 results in Intersentia

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary

Summary