dataprotection

Why you should not use Facebook, and nor should government

2010-04-21T05:38:00.000-07:00

This site continually flouts its users' security. Don't believe me, enjoy South Park series 14 episode 4!

Joel Reidenberg’s article detailing the dubious legality of safe harbors

2008-03-25T09:00:00.000-07:00

Also see:
The blog entry on safe harbour: http://essexdataprotection.blogspot.com/2006/03/safe-harbor-studies.html
The report of the European Commission that Joel, I and some colleagues wrote – safe harbors in action: http://ec.europa.eu/information_society/policy/ecomm/doc/library/ext_studies/privacy_trust_policies/final_report_29_02_08.pdf

4 March 1-2 pm Dr Ian Brown Guest Seminar- data protection current issues in the UK

2008-03-25T08:59:00.001-07:00

Day: Tuesday
Date: 04-03-2008 (Week 23)
Time: 13:00 to 14:00
Room: LTB B (35) (AV) (PRS)

Dr Ian Brown is a research fellow at the Oxford Internet Institute, Oxford University, and an honorary senior lecturer at University College London. His work is focused on public policy issues around information and the Internet, particularly privacy, copyright and e-democracy. He also works in the more technical fields of information security, networking and healthcare informatics.

Dr Brown is co-Principal Investigator of the Fair Tracing and e-Curator projects, and teaches courses on Information and Society and Information Systems. He is a member of the VOTES project ethics committee and has advised the PRISD, SWAMI, PRISE and PRIME projects. Previously he worked on the PIMMS, CPOSS and CLEF projects and ran the Cambridge-MIT Institute’s Critical Infrastructure Protection working group.

Since 1998 Dr Brown has variously been a director of Privacy International, the Open Rights Group and the Foundation for Information Policy Research and an adviser to Greenpeace and Creative Commons UK. He is a Fellow of the Royal Society of Arts and the British Computer Society, a senior member of the ACM, and has consulted for the US Department of Homeland Security, JP Morgan, Credit Suisse, Allianz, McAfee, the BBC, the European Commission and the UK Information Commissioner’s Office.

Dr Brown’s work has been covered by the BBC, CNN, CBC and numerous newspapers and magazines. In 2004 he was voted as one of the 100 most influential people in the development of the Internet in the UK over the previous decade.

Blog: http://dooooooom.blogspot.com/

Week 1 LW656 2008

2008-03-25T08:51:00.000-07:00

This week, Iread Google’s privacy policy as a way to familiarise yourselves with data protection policy.

Also read Ian Lloyd, IT Law (3rd Edn 2000 4th Edn 2005) Chapter 3 for background, Chapter 4 for next week’s lecture. You will find many copies in the library and either edition is adequate for background.

You should also read a concise explanation of the rise of privacy laws, Colin Bennett (2002) Information Policy and Information Privacy: International Arenas of Governance

Background reading that may be useful is:
Bennett and Raab (2006) MIT Press, The Governance of Privacy, for the policy background.

There is also a useful collection of readings available:
(2001) http://www2.warwick.ac.uk/fac/soc/law/elj/jilt/2001_2/warren
(2007) http://essexdataprotection.blogspot.com/

Week 2 seminar focus is the development of privacy law up to the Data Protection Directive 1995.

Data Protection Act implenting EC/95/46

2008-03-25T08:38:00.001-07:00

Please read Chap 3 of Lloyd (if you haven’t already) and ESPECIALLY Chaps 4-5.

Note that there are lots of copies of Lloyd in the library – in both the regular and special collections. Let me know BEFORE the seminar of you have problems.

Also note that Part IV of the law relates to exceptions to the legislation: http://www.opsi.gov.uk/acts/acts1998/ukpga_19980029_en_5#pt4

Do you agree that the scope of the exceptions is too wide? We will answer this question in class.

Phorm and the RIP Act - tracing users' data

2008-03-18T13:20:00.000-07:00

See the latest coverage including legal opinions on the new adware application that's causing controversy.

OECD data protection: enforcement

2007-03-21T09:02:00.000-07:00

See report and Working Party home page.

2006 Sources on Data Protection

2007-03-21T03:44:00.000-07:00

A Busch (2006) 3 SCRIPT-ed (4) 304 "From Safe Harbour to the Rough Sea? Privacy Disputes across the Atlantic" http://www.law.ed.ac.uk/ahrc/script-ed/vol3-4/busch.asp
J Rauhofer (2006) 3 SCRIPT-ed (4) 322 "Just because you're paranoid, doesn't mean they're not after you: Legislative developments in relation to the mandatory retention of communications data in the European Union"http://www.law.ed.ac.uk/ahrc/script-ed/vol3-4/rauhofer.asp
P Leith (2006) 3 SCRIPT-ed (4) 389 Squeezing Information out of the Information Commissioner: Mapping and measuring through online public registers" http://www.law.ed.ac.uk/ahrc/script-ed/vol3-4/leith.asp
R Bendrath and R F Jørgensen (2006) 3 SCRIPT-ed (4) 355 "The World Summit on the Information Society - Privacy not Found?" http://www.law.ed.ac.uk/ahrc/script-ed/vol3-4/rikke.asp
C Ncube (2006) 3 SCRIPT-ed (4) 344"Watching the watcher: recent developments in privacy regulation and cyber-surveillance in South Africa" http://www.law.ed.ac.uk/ahrc/script-ed/vol3-4/ncube.asp
C Prins (2006) 3 SCRIPT-ed (4) 270 "When personal data, behavior and virtual identities become a commodity: Would a property rights approach matter?" http://www.law.ed.ac.uk/ahrc/script-ed/vol3-4/prins.asp
Joshua L Colburn (2006) 91 Minnesota Law Review (Nov) 241 "'Don't Read This If It's Not for You': The Legal Inadequacies of Modern Approaches to E-mail Privacy" (Lexis)
Orin S Kerr (2007) University of Chicago Law Review "Enforcing Law Online" http://ssrn.com/abstract=942859
Rebecca Eve Bolin (2006) 24 Yale Law and Policy Review "Opting Out of Spam: A Domain Level Do-Not-Spam Registry" http://ssrn.com/abstract=945290

Reading week 10

2007-03-12T11:59:00.001-07:00

In the CMR you will find various articles by Reidenberg - read at least one, and note his comments on safe harbor provisions.

.Net Passport and Airline passenger data

2007-03-07T11:18:00.000-08:00

In Week 9 we begin our investigation into Safe Harbours, by examining the Microsoft .NET and a US-EU agreement on airline passenger data.

This short Law Review article is useful as a summary of the .NET issue, the EC has a Press Release and the Article 29 Working Party has a Working Document.

On airline passenger data, there is a much longer body of work, with an Opinion of the Article 29 WP in 2003 extending through to a further Opinion in 2007. The 2007 Opinion was necessary because in 2006 the European Court of Justice overturned the 2004 Decision to allow an Agreement with the US: see Joined Cases C-317/04 and C-318/04.

Useful links on SISII

2007-03-05T02:19:00.000-08:00

From Statewatch.

CHAMBER JUDGMENT HEGLAS v. THE CZECH REPUBLIC

2007-03-02T04:11:00.000-08:00

01.03.2007 Press release: The European Court of Human Rights has today notified in writing its Chamber judgment in the case of Heglas v. the Czech Republic (application no. 5935/02).
The Court held unanimously that there had been
· a violation of Article 8 of the European Convention on Human Rights (right to respect for private life) as regards the use of a list of telephone calls made by the applicant on his mobile phone;
· a violation of Article 8 on account of the recording by means of a dictaphone of a conversation between the applicant and one A.B.;
· no violation of Article 6 § 1 (right to a fair trial).
Under Article 41 of the Convention (just satisfaction), the Court awarded the applicant 1,018 euros for costs and expenses. (The judgment is available only in French.)
1. Principal facts
The applicant, Vojtĕch Heglas, is a Czech national who was born in 1976. He is at present imprisoned in Valdice (Czech Republic). In January 2000 a woman was attacked and her handbag stolen. It contained a large sum of money (about EUR 8,730) intended as payment in a property transaction. On the next day the police arrested A.M. and took him into custody. Under Articles 88-1 and 88-2 of the Code of Criminal Procedure (“the CPP”), the applicant’s mobile telephone was placed under surveillance from 21 January to 21 February 2000. In addition, on 24 January 2000, A.B., A.M.’s girlfriend, was fitted by the police with a listening device hidden under her clothing; she met the applicant and recorded on magnetic tape the ensuing conversation, in the course of which the applicant admitted that he had organised the robbery with the help of A.M. On 12 July 2000 the Prague City Court (mĕstský soud) found the defendants guilty of robbery and sentenced the applicant to nine years’ imprisonment, unsuspended. Among other evidence, it based its judgment on the following two exhibits: (1) a list of the telephone calls made with the mobile phones of the two defendants showing that they had called each other just before and just after the attack on 19 January 2000, and (2) a transcription of the conversation between A.B. and the applicant, which the court described as crucial evidence.
The defendants appealed, citing in particular the illegality of the transcriptions of the conversation between the applicant and A.B. and of the list of the calls they had made to each other. The Prague High Court dismissed their appeals. The applicant also lodged a constitutional appeal, arguing that the recording of his conversation with A.B. and its use as evidence had breached Articles 6 and 8 of the European Convention on Human Rights; the Constitutional Court dismissed his appeal on 5 September 2001, holding, among other considerations, that the courts had convicted him on the basis of a number of pieces of evidence whose substantiation and assessment were not open to doubt. Later the Constitutional Court likewise dismissed an appeal by A.M.
2. Procedure and composition of the Court
The application was lodged on 2 January 2002. Judgment was given by a Chamber of 7 judges, composed as follows: Peer Lorenzen (Danish), President, Snejana Botoucharova (Bulgarian), Karel Jungwiert (Czech), Volodymyr Butkevych (Ukrainian), Margarita Tsatsa-Nikolovska (citizen of “the former Yugoslav Republic of Macedonia”), Rait Maruste (Estonian), Mark Villiger (Swiss)2, judges, and also Claudia Westerdiek, Section Registrar.
3. Summary of the judgment3
Complaints
The applicant alleged that the use of a listening device hidden under A.B.’s clothing and the recording of his conversation with her, and of the list of telephone calls between him and A.M., had breached Articles 8 and 6 § 1 of the Convention.
Decision of the Court
Article 8 of the Convention
As regards use of the list of telephone calls between the applicant and A.M. The Court considered that the use of such a list in the context of the criminal proceedings against the applicant had interfered with his right to respect for his private life. It noted that the interception and recording of the applicant’s telephone conversations had been ordered by a judge in January 2000 by virtue of Article 88 of the CCP. However, Article 88a of the CCP, which empowered the criminal investigation authorities to obtain a list of calls, among other evidence, entered into force only on 1 January 2002. As to the Telecommunications Act relied on by the Czech Government, section 84(7) of which authorises the criminal investigation authorities to obtain lists of telephone calls or other forms of telecommunication, that had come into force only on 1 July 2000.
Even supposing that Czech law had provided a legal basis for drawing up a list of the applicant’s telephone calls, the Court noted that the Czech courts had been supplied with a list of calls covering the two days preceding the date of the interception order. That being so, the Court considered that the interference was not “in accordance with the law” and concluded that there had been a violation of Article 8.
As regards the dictaphone recording of a conversation between the applicant and A.B. The Court considered that this recording and its use had interfered with the applicant’s right to respect for his private life.
On the basis of the information available to it, the Court considered that the measure was not governed by a “law” satisfying the criteria laid down by its case-law, but rather by a practice which could not be regarded as a specific legal basis setting forth sufficiently precise conditions for such interference as regards the admissibility, scope, control and use of the information thus collected.
That being so, the Court considered that the interference was not “in accordance with the law” and concluded that there had been a violation of Article 8.
Article 6 of the Convention: Having regard to its case-law, the Court considered that the use by the Czech authorities of the recording complained of and the list of telephone calls had not infringed the applicant’s right to a fair trial. It accordingly held that there had been no violation of Article 6.

Spam reading and SIS2

2007-02-26T08:12:00.000-08:00

Next week, we'll look at the Schengen Information System 2 - read the article that will be provided by Hayley.

On spam, see OECD presentation at the ASEMEC workshop, the ITU workshop, and resources page, and Richard Clayton's website.

Also the spam conviction site at The Register.

Korea has a new anti-spam law: amended Information Network and Privacy Protection Act (“INPPA”) of Korea. INPPA sets out the minimum procedural requirements for lawful online transmissions in Korea whereby transmissions of advertised materials against recipients’ refusal to accept are strictly prohibited. Although these rules are applicable to unsolicited commercial e-mails via the internet, they were intended to apply to all modes of telecommunication such as cellular phones, facsimiles, etc.

Official: Questions for 4000 word dissertation

2007-02-26T06:57:00.000-08:00

1. 'Privacy is not a right in itself. Attempts by the European Court of Human Rights to apply it to data protection cases risk undermining the economic lifeblood of the Internet: marketing.' Discuss with respect to ECHR case law and economic analysis.
2. Under what circumstances can direct commercial electronic marketing be conducted legally in Europe? Illustrate your argument with reference to the 2002/58 Directive, academic articles and case law (including US cases), showing which legal issues have arisen from [1] cookies; [2] spyware; [3] email 'spam'.
3. Does the Data Retention Directive demonstrate a proportionate response to terrorism? Illustrate your answer with respect to ECHR caselaw, academic arguments and the evidence presented in the course of the passage of the Directive.
4. 'Europe is the de facto global lawmaker for data protection only where American companies overstep the mark egregiously.' Discuss with reference to the Microsoft .Net Passport service and the airline passenger data sharing agreement.
5. Is the work of Information Commissions more important in advising governments about new law, advising companies about compliance or enforcing individual complaints? Illustrate your answer with examples from current practice including the Schengen Information System.

Data Protection in Turkey

2007-02-26T01:52:00.000-08:00

1.LEGAL FRAMEWORK: Although there is no special act regulating data protection in Turkey, there are specific provisions concerning data protection in several acts or secondary legislation, some of them are mentioned below:
TAX PROCEDURE LAW (Law No 213): There is a special provision to prevent access on the data and documents on tax confidence, except for expressly entitled authorities by law, in Article 5 of Tax Procedure Law.
TURKISH PENAL CODE (Law No 5237): Unlawful recording, disseminating, sharing with third parties of personal data is penalized by the articles 135-140 of Turkish Penal Code No 5237.
SOCIAL SECURITIES AND GENERAL HEALTH INSURANCE LAW (Law No 551)
In Article 78 of Social Securities and General Health Insurance Law No 5510, it is stated that data regarding to health of assured person and his or her dependants’ are confidental and protection of these data should be designated by Ministry of Labour and Social Security.
GUIDELINE FOR CONFIDENTIALITY OF CANCER RECORD UNITS: In this Guideline of Ministry of Health, the rules are stipulated for protection of data occurred in the activities of Cancer Record Units.

2. DRAFT LAW ON DATA PROTECTION: Preparations for the draft law for harmonisation are at the final stage. Draft Law on Data Protection was drafted by Ministry of Justice and sent to Office of Prime Minister in 9/11/2005. With the Draft Law, where all personal data on an identified or identifiable individual is undergoing automatic processing, the following issues will be regulated; respect for and protection of rights and fundamental freedoms, in particular the right to privacy; ensuring that the data stored is obtained and processed fairly and lawfully, for specified and legitimate purposes and not used in a way incompatible with those purposes, is adequate, relevant and not excessive in relation to the purposes for which it is stored, is accurate and up-to-date, and where necessary corrected or erased; safeguarding personal data revealing racial origin, political opinions or religious or other beliefs, as well as personal data concerning health or sexual life; recognition of the right to be informed on and access to one’s own personal data. The Draft Law foresees the establishment of a Supervisory Authority (Personal Data Protection Institution), the Higher Board on Personal Data Protection and its administrative units.

2.2 NATIONAL PROGRAMME (for the Adoption of the Acquis)
1- Being a signatory to the “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data” (Strasbourg, 28 January 1981), and,
2- Alignment with the EU Acquis on Personal Data Protection by adopting the principles (“Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data” and “Commission Decision No 95/46/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC”) into national law by the “Law on Personal Data Protection”, are declared “Priority 24.9 Alignment with the EU Acquis on Personal Data Protection” in the National Programme.
Also see: Ordinance on Personal Information Processing and Protection of Privacy in The Telecommunications Sector

DATA PROTECTION IN BULGARIA

2007-02-26T01:50:00.000-08:00

Article 32 of Constitution stress that “The privacy of citizens shall be inviolable. Everyone shall be entitled to protection against any illegal interference in his private or family affairs and against encroachments on his honour, dignity and reputation. No one shall be followed, photographed, filmed, recorded or subjected to any other similar activity without his knowledge or despite his express disapproval, except when such actions are permitted by law”. In the light of that provision and in conformity with Directive 95/46/EC due to the aim of Bulgaria to become a EU member state[1], the Personal Data Protection Act was adopted on 21 December 2001 and came into force on 1 January 2002. The Act applies to the processing of personal data and aims to “guarantee the inviolability of individuals and their privacy through protecting natural persons against illegitimate processing of personal data related to them and through providing right to access such data, which has been collected or processed.”[2]

The Act established the Commission for Personal Data Protection, an independent supervisory authority, consisting of a Chairman and four members, elected by the Parliament for a period of five years, in order to ensure “the protection of individuals in the processing of their personal data and in the access thereof, as well as the monitoring of the observance of this Act”[3]. In addition, the Act involves provisions regarding obligations of personal data administrators, personal data protection, rights of individuals, provision of personal data to third parties, appeal against actions of personal data administrators and administrative penal provisions.

Nevertheless, the Commission still criticizes Bulgaria, because of the inconsistency of the legislation with the acquis communautaire and institutional and financial incompetence of the Commission for Personal Data Protection[4].

Snejana Georgieva -Are we ready?http://xdata.gateway.bg/images/downloads/Are%20we%20ready_eng.pps
Polina Roussinova -Private or public information?http://xdata.gateway.bg/images/downloads/Poli_eng.pps
Mina Shoylekova - Personal data protection in Bulgaria – Frequently asked questionshttp://xdata.gateway.bg/images/downloads/Centre_eng.pps
[1] Bulgaria has become a member state of EU since 1 January 2007.
[2] Personal Data Protection Act, Article 1.
[3] Ibid, Article 6.
[4] Communication From The Commission, Monitoring report on the state of preparedness for EU membership of Bulgaria and Romania, COM(2006) 549 final, Brussels, 26.9.2006.

PRIVACY AND DATA PROTECTION LAW IN SOUTH AFRICA

2007-02-26T01:43:00.000-08:00

Currently, the South African Law Reform Commission is conducting an investigation entitled “Privacy and Data Protection” in an attempt to enact a legislation which would ensure the safeguard of people’s rights to privacy. Concern about information protection has increased worldwide as a result of the expansion in the use of computer and telecommunications technologies. The recognition and recognition of the right to privacy as a fundamental human right in the Constitution (South African) provides an indication of its importance. It is, however, not an absolute right and in protecting a person’s personal information, consideration should also be given to competing interests such as the administering of national social programmes, maintaining law and order, and protecting the rights, freedoms and interests of others, including the commercial interests of industry sectors such as banking, insurance, direct marketing, health care, pharmaceuticals and travel services.

The preliminary recommendations of the Commission, as set out in the Bill accompanying the Discussion Paper, can be summarised as follows:
(1) The protection of personal information in the public and the private sector should be regulated in an act of general application, called the Protection of Personal Information Act, supplemented by codes of conduct for specific sectors. Both automatic and manual processing of information will be covered and identifiable
natural and juristic persons will be protected.
(2)The proposed Bill gives effect to eight core information protection principles which, inter alia, prescribes the following duties and obligations for responsible parties and provides for the following rights for data subjects (i.e. persons whose information is being collected):
(i) information can only be collected or stored if it is necessary for or directly related to a lawful, explicitly defined purpose and does not intrude upon the privacy of the data subject to an unreasonable extent;
(ii) information must be collected directly from and with the consent of the data subject;
(iii) data must be informed of the purpose of any such collection and of the intended recipients of the information, at the time of collection;
(vi) information must not be kept for any longer than is necessary for achieving the purpose for which it was collected;
(v) information must not be distributed in a way incompatible with the purpose for which is was collected;
(vi) reasonable steps must be taken to ensure that the information processed is accurate, up to date and complete;
(vii) appropriate technical and organizational measures have to be taken to safeguard the data subject against the risk of loss, damage, destruction of or unauthorized access to personal information;
(viii) data subjects are allowed a right of access to their personal information and a right to demand correction if such information should turn out to be inaccurate.
(3) Exceptions to the information protection principles are provided for and exemptions are furthermore possible for specific sectors in applicable circumstances. Special provision has furthermore been made for the protection of special (sensitive) personal information such as those revealing racial or ethnic origin, political
opinions, religious beliefs, philosophical or ethical persuasions, trade union membership, health and sexual life.
(4) Provision has been made for an independent Information Protection Commission with a full-time Information Commissioner to direct the work of the Commission. The Commission will be responsible for the implementation of both the new, envisaged Protection of Personal Information Act and the current Promotion of Access to Information Act 2 of 2000.Data subjects will be under an obligation to notify the
Commission of any processing of personal information before they undertake such processing. Provision has also been made for investigations to be conducted by the Commission prior to commencement of the processing to establish whether it complies with the law in instances where the nature of the information being collected warrants a stricter regime.
(5) Enforcement of the Bill will be through the Commission using as a first step a
system of notices where conciliation or mediation has not been successful. Failure
to comply with the notices will be a criminal offence. The Commission may
furthermore assist a data subject in claiming compensation from a responsible party
for any damage suffered. Obstruction of the Commission’s work is regarded in a
very serious light and constitutes a criminal offence .
(6) A flexible approach will be followed in which industries will develop their own codes of conduct (in accordance with the principles set out in the legislation) which will be overseen by the regulatory agency. Codes of conduct for individual sectors may be drawn up for specific sectors on the initiative of the specific sector or of the Commission itself. This will include the possibility of making provision for an adjudicator to be responsible for the supervision of information protection activities in the sector. The Commission will, however, retain oversight authority. Although the codes will accurately reflect the information principles as set out in the Act it should furthermore assist in the practical application of the rules in a specific sector.
(7) It is the Law Commission’s objective to ensure that the legislation provides an adequate level of information protection in terms of the EU Directive. In this regard a provision has been included that prohibits the transfer of personal information, except under special circumstances, to countries that do not, themselves, ensure an adequate level of information protection.
It should be noted that the promulgation of information protection legislation in South Africa will necessarily result in amendments to other South African legislation, most notably the Promotion of Access to Information Act (No. 2) of 2000, the Electronic Communications and Transactions Act (No.25) of 2002 and the, still to be enacted, National Credit Bill [B18-2005]. All these Acts contain interim provisions regarding information protection in South Africa.

CCTV Regulation Eyed for Privacy

2007-02-26T01:42:00.000-08:00

Extracted from the Korea Times (Feb, 21, 2007):
The government plans to employ tighter restrictions on the use of close circuit television (CCTV) cameras in public spaces over privacy concerns.

According to plans announced by the Ministry of Government Administration and Home Affairs Wednesday, policymakers are also considering lowering the voting age to 19 for local elections as they prepare to introduce recall elections in July that allow voters to remove an elected official from office.

``We expect to produce legal guidelines by the end of the year that will regulate the installment and use of CCTV cameras to protect the privacy of individuals and reduce infringements,’’ said Home Affairs Minister Park Myung-jae in a news conference at the central government complex in Seoul.

Although the ministry did not reveal details of the regulations, there are a number of related bills being discussed in the National Assembly.

The suggestions include limiting the buildings and public spaces where the surveillance cameras can be used and employing stricter guidelines on the storage of images and their availability.

CCTV cameras have been increasingly used by administrators and law enforcement officials in recent years, especially in high-income neighborhoods or business districts, to eliminate the fears of crime among residents. However, critics have been urging authorities to take a harder look at the concerns over privacy infringement.

Currently, there are about 7,500 CCTV cameras installed by the municipal government or police in Seoul, which means one camera for every 1,300 of the city’s residents.

Under the representative recall system that will be enacted in July, voters of a municipal district can sign a petition to have an incumbent official removed from office.

To enable a recall election, at least 10 percent of registered voters must sign the petition.

At least one-third of the electorate must participate in the recall election and the representative needs a majority of 50 percent plus one vote to stay in office.

The ministry also said it plans to interview leaders at 104 organizations _ including civil servants unions, civic groups, and media outlets _ through the end of next month before finalizing a framework on a new pension system for public workers. The government has been planning to cut retirement payments and raise contribution rates because of increasing concerns about shrinking pension fund assets.

Draft questions - suggestions?

2007-02-19T14:56:00.000-08:00

1. 'Privacy is not a right in itself. Attempts by the European Court of Human Rights to apply it to data protection cases risk undermining the economic lifeblood of the Internet: marketing.' Discuss with respect to ECHR case law and economic analysis.
2. Under what circumstances can direct commercial electronic marketing be conducted legally in Europe? Illustrate your argument with reference to the 2002/58 Directive and case law, showing which legal issues have arisen from [1] cookies; [2] spyware; [3] email 'spam'.
3. Does the Data Protection Directive demonstrate a proportionate response to terrorism? Illustrate your answer with respect to ECHR caselaw, academic arguments and the evidence presented in the course of the passage of the Directive.
4. 'Europe is the de facto global lawmaker for data protection only where American companies overstep the mark egregiously.' Discuss with reference to the Microsoft .Net Passport service and the airline passenger data sharing agreement.
5. Is the work of Information Commissions more important in advising governments about new law, advising companies about compliance or enforcing individual complaints? Illustrate your answer with examples from current practice including the Schengen Information System.

Reading for 19 Feburary

2007-02-13T00:49:00.000-08:00

We are studying the effect of the Directive on Privacy in Electronic Communications this week - in particular the problem of spam.

Read Lloyd - especially his sections on the cases of Durant (Chapter 5.8 and 5.43 and 8.17), Blomquist and Norman Baker/Hitchens (Chapter 8.30-38).

On spam, read Chater 9.30 until the end of the chapter.

Also, look at the Durant briefing note on www.ico.org.uk

THE IMPLEMENTATION OF DIRECTIVE 95/46/EC IN ITALY

2007-02-13T00:48:00.000-08:00

Directive 95/46/EC, was initially transposed into Italian law by Act no. 675 of 31 December 1996 on the protection of individuals and other subjects with regard to the processing of personal data. This law was enacted to fully implement the Directive. However, following the application of the law especially in relation to the rules of the Directive, it was described as unsatisfactory and more cumbersome than any other national law transposing the Directive. The 1996 Act contained elements which were either inconsistent with or contradictory to the Directive. Of particular interest are the requirements for consent and the adoption of security measures. While unambiguous consent is all that is required by the Directive, in the 1996 law effective consent could only be; freely given, in a specific fashion, and documented in writing. Moreover, the rules on notification set in the Act ignored the Directive’s rules on the simplification or exemption of the notification process. The Act created more security requirements than provided for in the Directive rendering its application complex and difficult. Nonetheless the 1996 law adopted most of the Directive’s rules and ensured a considerable level of protection for Italian citizens.
The 1996 Italian data protection Act was replaced in 2004 by the Italian personal data protection code. This code is a combination of all regulations and laws on data protection existing since 1996 including, EC Directive 2002/58. This new code offers more protection for data subjects while simplifying most of the existing complex procedures and rules. And it is moreover a better adaptation of Directive 95/46/EC. The new rules on notification laid out in the code are in line with the Directive’s requirement for the simplification or exemption of the notification process unless the data subject’s rights could be adversely affected. Furthermore, according to the new code written consent would only be necessary for the processing of sensitive data and not for all forms of personal data as previously required, and the Directive’s rules on the processing of sensitive data have been fully adopted. The 2003 code also introduces a new principle of data minimisation which requires, less and when possible no use of personal data at all especially if anonymous data could be just as effective except in cases of necessity.

SOURCES
Act no. 675 of 31 December 1996 on the protection of individuals and other subjects with regard to the processing of personal data http://www.privacy.it/legge675encoord.html
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data http://www.cdt.org/privacy/eurdirective/EU_Directive_.html#HD_NM_22
Italian personal data protection code: legislative decree no.196 of 30 June 2003
http://www.privacy.it/privacycode-en-html
http:www.garanteprivacy.it/garante/document?ID=31106
CONFINDUSTRIA: Implementation of Directive 95/46/EC in Italy I http://ec.europa.eu/justice_home/fsj/privacy/docs/lawreport/paper/confindustria_en.pdf
Garante per la protezione dei dati personali: An overview of Italy’s new data protection code http://www.garanteprivacy.it/garante/doc.jsp?ID=311113
http://www.garanteprivacy.it/garante/doc-jsp?ID=1030925

DATA PROTECTION IN INDIA

2007-02-13T00:43:00.001-08:00

Info: The Constitution of 1950 does not expressly recognize the right to privacy. However, the Supreme Court first recognized in 1964 that there is a right of privacy implicit in the Constitution under Article 21 of the Constitution, which states, "No person shall be deprived of his life or personal liberty except according to procedure established by law." There is no general data protection law in India. In June 2000 the National Association of Software and Service Companies (NASSCOM) urged the government to pass a data protection law to ensure the privacy of information supplied over computer networks and to meet European data protection standards. The National Task Force on IT and Software Development had submitted an "IT Action Plan" to Prime Minister Vajpayee in July 1998 calling for the creation of a "National Policy on Information Security, Privacy and Data Protection Act for handling of computerized data." It examined the United Kingdom Data Protection Act as a model and recommended several cyber laws including ones on privacy and encryption. No legislative measures, however, has been considered to date.

Data protection and offshoring to India
India getting data protection laws 30/07/2004
India to tighten data protection laws
Data protection regulations in India
How does European legislation impact on India’s BPO industry?
A: The EU directive 95/46/EC is specific on the requirements for the transfer of data. It states that personal data of EU nationals cannot be sent to countries that do not meet the EU "adequacy" standards with respect to privacy. The directive also sets down the principles regarding the transfer of data to third countries. Under this directive the third country should provide an adequate level of protection to personal data of the citizens of EU member states. It states: "The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country."

Article on bringing data protection law in India
The compelling and much needed mandate for providing protection to the information provided by various interested parties has again set in motion the thought process and the legislative wing of the Constitution of India is facing a situation where it has to decide whether it should bring new amendments to the already existing Information Technology Act, 2000 or to enact a separate law for the same. The choice between these options is not the real issue to be addressed presently but is ancillary to a more important and overlooked perspective relating to data protection. A law on data protection must address the following Constitutional issues on a "priority basis" before any statutory enactment procedure is set into motion:(1) Privacy rights of interested persons in real space and cyber space.(2) Mandates of freedom of information U/A 19 (1) (a).(3) Mandates of right to know of people at large U/A 21.
If these issues are sidelined in the zeal of providing data protection then it may have catastrophic results because the law(s) providing for data protection will be vulnerable to the attack of unconstitutionality on the ground of violation of Articles 19(1) (a) and 21 of the Constitution. Thus, the pre requisite for the enactment of any law dealing with data protection is to keep in mind the mandates of these rights.

BPO: In India data security cost skyrockets
India – The Emerging IT super power..need data protection laws.

Data protection in Greece

2007-02-13T00:43:00.000-08:00

The rapid growth of new forms of information leads to the constitutional consolidation of the ‘right to information’. The revised Constitution of Greece (2001) has implemented Ar.5(a) ,which specifies that: ‘anyone’ has the right to ‘information’ as the ‘law defines’. In the same article there are cited the limitations of that right. Moreover Ar.9(a) of the Constitution reads:
‘Everyone has the right of protection from the collection, processing and use, mostly by electronical means, of his personal data, as the law defines. The protection of personal data is secured from an independent public authority, which functions as the law defines’.
For the harmonisation of the European Directive 95/46 with the Greek law the Statute of 2472/97 came into force. Hence, when the constitution reads ‘as law defines’, it refers to the abovementioned Statute. Moreover, with the scope of the protection of this constitutional right an independent authority was born, which is called ‘HELLENIC DATA PROTECTION AUTHORITY’. By enclosing everything into one concept, one could point out that the existing Greek legislation follows the path of the European one.

2007-02-05T13:24:00.000-08:00

First, thanks for sticking with us during the technical difficulties with the presentation for Ian Brown - I'm glad you enjoyed the talk and the slides should be available by the end of the week.

Second, I'm looking forward to receiving your emails with details of the implementation of the Directive EC/95/46 in your chosen countries: remember, its a summary of information in the hyperlinks you provide to [1] the law itself; [2] an academic article on its implementation; [3] the comparison of that with what you've discovered throgh for instance Google Scholar or a recent news article. I only want 1 or at most 2 paragraphs.

Third, reading for next week. Information Commissions and their work is our focus. Read Lloyd, IT Law, Chapters 5-6. Pay particular attention to his summaries of the cases of Durant and Blomqist.

Reading for 12 February

2007-02-05T13:12:00.000-08:00

First, thanks for sticking with us during the technical difficulties with the presentation for Ian Brown - I'm glad you enjoyed the talk and the slides should be available by the end of the week.

Second, I'm looking forward to receiving your emails with details of the implementation of the Directive EC/95/46 in your chosen countries: remember, its a summary of information in the hyperlinks you provide to [1] the law itself; [2] an academic article on its implementation; [3] the comparison of that with what you've discovered throgh for instance Google Scholar or a recent news article. I only want 1 or at most 2 paragraphs.

Third, reading for next week. Information Commissions and their work is our focus. Red Lloyd, IT Law, Chapters 5-6. Pay particular attention to his summaries of the cases of Durant and Blomqist.

French Big Brother Awards 2006

2007-02-01T04:38:00.000-08:00

The French Big Brother Awards event that took place on 20 January 2007 has brought the exclusion from this competition of Mr. Sarkozy, for having already won three of the Orwell prizes during the last three years and thus by far outclassing his competitors. This year, the jury decided to eliminate Minister Sarkozy, the only personality having been nominated 6 times in 7 editions of the event, for multiple attacks to private life and for having actively promoted surveillance in general.
The organizers of the event, in creating the diplomas for the awards were inspired by a real picture of a fossil found in Niger in 2000, of the biggest crocodile that lived 110 million years ago, called by US palaeontologists, "Sarcosuchus imperator". The specialists considered that the reptile disappeared completely for not having intelligently foreseen the future and adapt. The organizers of the French Big Brother Awards considered that the resemblance with a present character was not fortuitous.
The winner of the State award was Jacques Lebrot, "security" sub-prefect of Seine-St-Denis for having deprived of jobs several thousand of people with police records created just on the basis of suspicion and discrimination, violating their right to the presumption of innocence.
Sony-BMG company took the enterprise award for its "rootkit", a spy software installed in the sold CDs in order to control the usage of the CD, ironically, by those who had became the rightful owners by buying the respective CD.
The Locality Orwell prize was given to Paul Anselin, Mayor of Ploërmel in Morbihan, for having installed more than 50 video-surveillance cameras in a locality with 9000 inhabitants and zero degree of delinquency and for the creation of a free number encouraging denunciations.
Orwell Novlang prize was awarded to Frédéric Péchenard, director of the Judiciary Police who supports the genetic filing of the entire population arguing that innocent persons could thus be rid of any suspicion.
The Voltaire prize for vigilance was taken, ex-aequo, by the school directors who have refused to fill in the children database (Base-eleves) and by Pierre Muller, the webmaster of Ordinateurs-de-vote.org (ex recul democratique.org), for his work in showing why the electronic vote is a false good idea and a threat to democracy.
Big Brother Awards France (only in French, 20.01.2007) http://bigbrotherawards.eu.org/Palmares-2006-des-Big-Brother-Awards-France.html

Guest speaker Ian Brown next Monday 2pm

2007-01-31T00:45:00.000-08:00

Dr Brown's blog is here.

Please be right on time at 2pm - we may hav guests and therefore space my be limited.

Sunday was European Data Protection Day!

2007-01-30T09:50:00.000-08:00

See this speech by the European Commissioner - note the Council of Europe called for the Day.

Reading for Week 2 ready

2007-01-24T23:24:00.000-08:00

Your week 2 reading should be available by Friday morning.

Note that it includes both the Directive EC/95/46 - from which you should read the Recitals - and an optional extra. This is an assessment of the implementation of the Directive, written by consultants for the Commission 3 years ago.

It will help you to see how national governments have incorporated the law.

LW656-G-SP: DATA PROTECTION

2007-01-20T05:06:00.000-08:00

Supervisor: Chris Marsden
Contact details: essexdataprotection.blogspot.com
Email: ctmarsden@yahoo.co.uk

Course DescriptionSee the course blog (open to posting by both students and me) at http://essexdataprotection.blogspot.com for the spring course.

This course seeks to introduce students to the complex area of data protection - that is: to the complex system of rules and regulations aimed at protecting individuals (and to a limited extent "legal persons") with regard to the processing of information on them by public and private bodies.
The course will cover:
the history and development of data protection as a concept from the 1970s to now;
the multi-layered international-legal framework for data protection;
selected national data protection laws; and
transnational legal questions, including in particular the application of data protection rules and concepts to the Internet.

In addition, students will be given the opportunity to study the way in which selected public and private data users ("controllers") process personal data in practice, and what measures they take to comply with data protection rules. They are asked to discuss whether practice lives up to the theoretical requirements, whether this is actually achievable under the current national and international legal regime, and what the future can or should hold.
Week 2: Theories of privacy - comparative approaches
Week 3: Directive 1995/46 - How The Legislation Was Introduced
Week 4: Information Commissioners - Guest Speaker Dr Ian Brown
Week 5: Implementation in National Law: Data Protection Act 1998 Example
Week 6: Safe Harbour Provisions
Week 7: Lindquist case - defining 'data controllers'
Week 8: CCTV Cameras and other surveillance techniques
Week 9: Electronic Privacy, Data Retention
Week 10: Conclusion - Futures for Privacy and Trade in Privacy

Will data protection abuse become a criminal offence in UK?

2006-09-06T09:25:00.000-07:00

July proposal by the Department of Constitutional Affairs to make wilful misuse of personal data subject to criminal sentence, detailed in online reports: http://www.foi.gov.uk/irj060905.pdf

Congratulations to the Class of 2006

2006-08-16T03:05:00.000-07:00

A good effort in the final exam - especially those who won the 'right to be let alone' in future!

Police data leak case clashes with Durant judgment, says lawyer

2006-08-16T03:03:00.000-07:00

Cullen said that this judgment appeared to clash with that in the case of Durant, who lost his case in 2003. In that case he sought copies of information held on him by the FSA. The court found in the FSA's favour, supporting its case for a narrow interpretation of what constitutes personal data, and therefore a lighter information provision burden for organisations.

Link here.

European Data Protection Supervisor presents annual report

2006-04-27T02:06:00.000-07:00

European Data Protection Supervisor (EDPS) 2005 annual report was presented on the 19 April . As stated by the report, following the first year of setting up the new independent authority on protecting personal data and privacy, 2005 was a year of consolidation confirming its main activities: supervision, consultation and cooperation. The authority increased its staff and set up its own press service.
Peter Hustinx, the European Data Protection Supervisor, stated that EDPS is now advising the European Commission, Council and Parliament on proposals of new legislation affecting privacy and six formal opinions were published last year in this context. Related mainly to the policy area "Justice, Freedom and Security", these opinions included proposals such as the highly controversial one on data retention, but also for large scale IT-systems such as the second generation Schengen information system (SIS II) and the Visa information system (VIS).
In 2005 efforts were made to further develop the network of Data Protection Officers (DPOs) of institutions and bodies. A paper on the role of the compulsory Data Protection Officers was published and advice and training was also provided to DPOs. Resources were used to prior checking risky operations (although most of them â€œex postâ€ as the respective systems already existed before EDPS was created).
EDPS ensured a series of tools facilitating the compliance of data protection obligations by the EU administration as well as 34 opinions out of which 30 on systems existing in various institutions and bodies. It established some thematic priorities such as medical files, staff appraisal, disciplinary procedures, social services and e-monitoring.
A background paper was also elaborated on how public access to documents and data protection relate in the context of EU institutions and bodies.
As the supervisory authority of the central unit of Eurodac, EDPS prepared a series of activities in 2005 expressing a general satisfaction on the findings of the first stage of inspections.
Peter Hustinx expressed his trust in EDPS achievements during the first two years of activity and considered progress has been made in developing a data protection culture.
Consolidating the EDPS â€“second Annual Report presented â€“ press release
(19.04.2006)
http://www.edps.eu.int/Press/EDPS-2006-5-EN_annual%20report.pdf
EDPS 2005 Annual Report (19.04.2006)
http://www.edps.eu.int/publications/annual_report/2005/AR_2005_EN.pdf
EDRI-gram : Results data protection inspection EURODAC kept secret
(15.03.2006)
http://www.edri.org/edrigram/number4.5/eurodac
EDRI-gram : EU Visa Database under scrutiny of the European Data Protection
(2.02.2006)
http://www.edri.org/edrigram/number4.2/visadatabase

Some interesting articles

2006-04-03T03:13:00.000-07:00

The new Department of Constitutional Affairs freedom of information journal
European Commission reports on UK's first use of standard clauses for Safe Harbour
The Durant case is being appealed to the European Court of Human Rights
"Home Is where the Internet Connection Is: Law, Spam and the Protection of Personal Space" by Andrea Slane (2005) 2 University of Ottowa (2) 255
"Spam Legislation in Canada: Federalism, Freedom of Expression and the Regulation of the Internet" by Karen Ng (2005) 2 University of Ottowa (2) 447
"Data Protection: Too Personal to protect?" by M J Taylor (2006) 3 SCRIPT-ed (1)
"UK the worst in Europe at enforcing spam laws" Blogzilla March 9
"Don't Smile, Your Image Has Just Been Recorded on a Camera-Phone: The Need For Privacy in the Public Sphere" by Aimee Jodoi Lum (2005) 27 Hawaii Law Review 377 (Lexis)
"Search Engines: Seek and Ye Shall Find? The Position of Search Engines in Law" by Nico van Eijk IRIS plus 2006-2 (January 2006)
"Solving the Inbox Paradox: An Information-Based Policy Approach to Unsolicited E-mail Advertising" by Derek E Bambauer (2005) 10 Virginia Journal of Law and Technology (1) (Lexis)

Pop up ads and privacy

2006-04-03T02:06:00.000-07:00

"Too Many Open Windows? Exploring the Privacy Implications of Pop-Up Ads" by Emily Woodward Deutsch (2005) 2 University of Ottowa (2) 397 http://www.uoltj.ca/articles/vol2.2/2005.2.2.uoltj.WoodwardDeutsch.397-424.pdf

Safe Harbor studies

2006-03-21T08:12:00.000-08:00

The 7 December EC presentation, Reidenberg on jurisdiction, the Safe Harbor homepage, the text of GATS, the Staff Document on standard contracts.

Reidenberg's study for the EC on safe harbour implementation

2006-03-21T03:00:00.000-08:00

Published in late 2004 - lots of problems in implementation discovered.

new book on WTO and trade in digital services

2006-03-21T02:23:00.000-08:00

By OECD expert Sacha Wunsch Vincent - I will be reviewing it so email me if you would like a copy of the review.

Reading for Week 10, 21 March

2006-03-16T06:14:00.000-08:00

Its WTO and safe harbour this final week - you can collect on Friday 2 pieces by Reidenberg and one by Charles Raab and Colin Bennett - that one is a really good overview and summary of the types of data protection available as well as the WTO dispute.

Also look at some of last year's materials. If you want to read Reidenberg in direct action, read this.

National Health Service patient database

2006-03-14T02:36:00.000-08:00

A doctor has issued a legal opinion claiming that the new NHS database will be unlawful as it does not let patients give full consent, nor does it maintain their confidentiality and restrict use of their data to absolutely necessary purposes.

Ian Brown lecture notes and links

2006-03-13T05:55:00.000-08:00

Ian's homepage provides lots of links to data retention and ID cards debates. You can find even more on his blog. I will provide notes from his slides later this week for collection from Hayley.

Don't forget to ask me if any of the essay questions need clarifying. If you email me ctmarsden@yahoo.co.uk
I can provide more detail for tomorrow's class.

Reading Weeks 9-10

2006-03-08T04:44:00.000-08:00

As here - note Week 9 remains the same, CCTV as in the materials you have - the 'safe harbor' we will deal with in Week 10 (21st March) - so it's not Week 8 but Week 10, right?
http://essexdataprotection.blogspot.com/2005/03/weeks-8-9-reading.html

EDPS on data retention

2006-03-08T04:43:00.000-08:00

See this link:
http://essexdataprotection.blogspot.com/2005/11/edps-opinion-on-data-retention.html

Data retention

2006-03-08T04:38:00.000-08:00

See these articles:
http://essexdataprotection.blogspot.com/2005/03/data-protection-articles.html

Google plan to store all our data, ever!

2006-03-07T10:46:00.000-08:00

A leaked investor presentation details plans to store everyone's data (not just text, as currently offered) on Google's on servers! Or for more depth, here.

5% of all internet traffic goes to "risky" sites

2006-03-07T01:52:00.000-08:00

1 Billion visits are made to "sites that upload unwanted software to a PC, send out spam or attempt to trick users into handing over sensitive information" every month, according to MIT research quoted in New Scientist

iPod ID

2006-03-05T09:39:00.000-08:00

Further to discussion we had in the first week, your identity can be traced from your iPod

Google answers questions on privacy

2006-03-03T01:21:00.000-08:00

- "There are tremendous economic reasons to make sure we are trusted [with users' information]" - Page, 2:22
- On China, "We gradually came to the realization to the fact that we were hurting not just ourselves but the Chinese people." - Brin, 1:57
- On Department of Justice case, "should we be doing homework for the government?" - Brin, 1:57

Full text here

Google moves search records out of China

2006-03-02T11:17:00.000-08:00

To prevent the Chinese Government from being able to access its users' search data, Google is moving the whole lot to US servers. Because the US Government won't be interested in that at all. Probably.

ID Card & Data Retintion in Kuwait

2006-02-28T04:47:00.000-08:00

ID Cards and Data retention in KUWAIT:
According to the Civil Information Act (32/1982) the Public Authority for Civil Information has been established in order to be a unified public data bank for civil information. Since then, all individuals, who live permanently in Kuwait, are obliged to register with the Authority. A civil ID Card is issued by the Authority for registered individuals, including their identity information, in particular the Civil ID Number.
In my country the Civil ID Card is the main reliable document almost in all formal dealings, and it is compulsory required when deal with public firms.
However, what seems special in the Kuwaiti System is that the individual’s data can be provided by the Authority for any other public firm whenever it is asked.
Also, data can be provided for individuals and private sector firms .However, this should be done under specific and justified circumstances.

(http://www.paci.gov.kw/paci.asp )

Spam

2006-02-28T01:35:00.000-08:00

The origin of the word spam.

UK data retention

2006-02-27T15:33:00.000-08:00

The UK has just been awarded the ISPA Internet Villian Award for attempting to push through its "tough" data retention laws. BT had a short lived SMS service with no respect for their users' privacy. Here are the privacy policies for BT, for Vodafone, for Bulldog and for MSN Messenger.

US privacy activists call for updated digital privacy regulation

2006-02-27T05:00:00.000-08:00

Centre for Democracy and Technology report just released.

ID Cards and Data Retention in Mexico

2006-02-27T04:27:00.000-08:00

Under Mexican legislation, the scope of the use of identity cards is currently limited to electoral purposes. Article 144 of the Federal Electoral Code (Codigo Federal de Instituciones y Procedimientos Electorales) provides the obligation of every and each Mexican citizen to register before the Electoral Authorities in order to receive the so called "Voting Card" which contains among other information, a colour picture, fingerprint, address and an individual identification number. In theory this ID serves only to electoral purposes, however in practice it is the only valid ID card accepted in Mexico.

On the other hand, data retention regulation in Mexico is still being discussed in the congress along with the other data protection legislation.

Additional question requested

2006-02-27T03:20:00.000-08:00

Here's a fifth topic:
Under what circumstances can direct commercial electronic marketing be conducted legally in Europe? Illustrate your argument with reference to the 2002/58 Directive and case law, showing which legal issues have arisen from [1] cookies; [2] spyware; [3] email 'spam'.

ID card and data retention in Thailand

2006-02-24T05:35:00.000-08:00

It surprised me so much when I found this article about introducing of new ID card in my country. I've never thought that my country will come this far for ID card. I knew that we use smart card before (partly, mostly in big cities). And it's only about 2-3 years to become the biometrics. In Thailand, individuals have to apply for ID cards when we turn 15 and renew every 6 years (same as passport). The old ID card which I carry now contains ID number, address, DOB, blood type, religion, photo, and signature. We use ID card to identify ourselves, for example, before voting, open the bank account, use as the fundamental document when sign any contracts, apply for job, etc.
About data retention, I cannot find the legislation (at least on-line), so I've tried to e-mail some mobile companies and waiting for them to reply. For other data, for example, helth data, this is hand written and the hospital or clinic will store it as long as our life and/or may can be transferred to family members as a reference of health investigation. But we don't have the system that can merge all the information together. I mean each hospital and each clinic work independently.
I will post again as soon as I receive the information from the companies.

Proposed essay titles

2006-02-24T04:40:00.000-08:00

1. Is data retention a proportionate response to the terrorist threat? Explain with regard to three bodies of evidence; [1] case law; [2] the Article 29 Working Party's opinions; [3] the legislative debate in the UK and one other EU country.
2. Is the Safe Harbour provision in Directive EC/46/95 contrary to free trade rules? Has its implementation demonstrated any real potential adverse consequences for companies operating in third countries?
3. Do you consider Information Commissions effective in upholding individual rights to personal data? Explain using evidence from at least two jurisdictions in the EU.
4. Do identity cards protect individual rights? Illustrate your argument with reference to the proposed UK Identity Cards Bill 2006 and one other jurisdiction.

ID cards in Greece and Data Retention in Telecommunications

2006-02-23T09:58:00.000-08:00

According to Law 1599/1986, the greek identity cards are issued by the Police Authorities after the interested party has submitted an application along with a series of supporting documents and four photos.The applicant's data on the application are verified by a witness.
The Directive concerning the retention of data drawn from telephone conversations and the use of internet, aiming to eliminate terrorism, reached a majority from the European Parliament. However, some countries raised objections that there could be an abusive use of the data retention systemby national authorities.
As soon as the Directive will be adopted, all the telecommunications companies will have the obligation to save data concerning the activities of their clients. In particular, the source and the recipient of every phone call, sms and e-mail, along with their precise time, but not their contents.
According to the Greek Minister of Justice, the details concening the type of crimes and the exact time of data retention will be regulated nationally.

With the contribution of Maroula.

22 February: EU passes controversial data retention law

2006-02-23T07:12:00.000-08:00

From EU Observer
EU justice and interior ministers have sealed a landmark data-retention law, forcing telephone operators and internet service providers to store data in the fight against terrorism and organised crime. The data retention directive was approved by ministers in Brussels on Tuesday (21 February), putting an end to a heated debate in and outside EU institutions for over a year and a half. The directive aims at tracking down terrorists, paedophiles and criminal gangs, but civil liberties campaigners have argued it damages basic privacy rights and breaches the European Convention on Human Rights. According to the directive, member states will have to store citizens' phone call data for six to 24 months, but the deal does not stipulate a maximum time period, cooling anger among member states who want longer storage periods. The data would only detail the caller and receiver's numbers, not the actual conversations themselves, while so-called failed calls - calls that do not get through - will not be covered.EU countries have 18 months to implement the rules, which already have the backing of the European Parliament."This is a wonderful example of how co-operation between the council [member states], the commission and the parliament can work," Austrian justice minister Karin Gastinger, hosting the ministers' meeting, said. Terror attacks trigerred actionThe data retention directive was tabled after the Madrid bombings in March 2004 and then fast-tracked under the British EU presidency after the London underground attacks last July.Britain, France and Sweden have stressed the need to retain data in order to trace terrorists using modern technology.Swedish justice minister Thomas Bodstrom said on Tuesday he was satisfied with the deal, arguing that fast-moving changes in the telecom market made it important to force phone companies to comply. Telephone call records are usually saved for a month for billing purposes, but ever more popular pre-paid subscription contracts have led some companies to ditch paperwork. "In five years, the police would have been faced with a catastrophy, if this deal had not been clinched today," Mr Bodstrom said.
EU oversteps mark?
Ireland and Slovakia voted against the law, saying they regard national security as a matter for member states not the EU. "This remains our position and we believe that provision for data retention should be made by way of a framework decision under the third pillar," an Irish official indicated.The third pillar is a technical term relating to intergovernmental decisions made by unanimity, while so-called first pillar decisions are typically made in conjunction with the European Parliament by qualified majority. "In the circumstances, and for the legal reason I have indicated, we would merely wish to formally record…the fact that Ireland cannot support the adoption of the proposed directive," he added. Dublin insisted that Ireland retains its veto in justice matters, and is currently cosulting the Irish attorney general about how to proceed with an appeal to the European Court of Justice (ECJ).The ministry of justice in Slovakia said Bratislava agreed with the content of the directive but also objected to placing it under the first pillar.

Reading and research for 28 February

2006-02-22T03:21:00.000-08:00

1. Read Lloyd Chapter 8 - you might want to read ahead on telecoms data protection.
Also read the short report by the European Data Protection Commissioners which is available from Hayley.
2. Spend no more than 30 minutes searching on Google and posting to the blog:
[a] your country's law on ID cards - please provide a 3 sentence summary;
[b] your country's law or voluntary agreement by telecoms companies on data retention - i.e. keeping telephone/mobile/ISP/Instant Messenger records of previous days/weeks/months. How long do they keep records?
3. Read the Explanatory Notes to the ID Cards Bill here:
http://www.publications.parliament.uk/pa/ld200506/ldbills/028/en/06028x--.htm

Data protection and information security

2006-02-22T03:20:00.000-08:00

An interesting discussion in the Register about the loss of a laptop containing 550,000 full credit histories in the US - do you think the individual who lost the data or his company should be liable?

Article 29 WP issues guidance for companies on 'whistle-blowers'

2006-02-17T03:31:00.000-08:00

The idea is to advise companies on how to encourage reports from employees about criminal or unethical behaviour - a key concern of the Sarbanes-Oxley Act in the US. Here's an article expalining in simple terms what the reprot contains.

Data Protection in Greece

2006-02-15T14:35:00.000-08:00

In Article 9A of the Greek Constitution the right of protection against the processing of data is secured. This article also provides the legal framework for the establishment of the Hellenic Data Protection Authority, which has been operating since November 1997. Its actual operation scheme is based on law 2472/97 that transfers the 95/46 European Directive in national law.

Post drafted with the contribution of Maroula and Dimosthenis.

Essential reading for 21st February

2006-02-15T12:49:00.000-08:00

You should have read Chapters 3-7 of Lloyd by now - that's 5 chapters in 5 weeks.
You also need:
[1] to complete your entry in the blog - 6 of you have blogged by now (assuming 2 to each blog);
[2] to have read the Directive and Recitals to EC/46/1995;
[3] to read the entry on exemptions from last year's students - see how they blog the exact provisions of the exemptions to the Directive. This is the key to the implementation of the Directive.
[4] Also read the article which will be printed for you - it will be very useful for the 28 February guest lecture by Dr Ian Brown.
I do expect everyone to arrive at 2pm - unless you are ill. Its essential for the class.

Data Protection Regulation in Mexico

2006-02-14T10:31:00.000-08:00

A Data Protection federal statute is currently in full force and effect in Mexico (together with several regulations deriving therefrom), however such legal instruments are exclusively directed to the public sector. The referred statute is called Federal Law for Transparency and Access to Public Government Information ("Ley Federal de Acceso a la Informacion") and a synthesis (in English) can be found at www.ifai.gob.mx)

IFAI has recognized the urgent need to create a new law capable to regulate the private sector activity with respect to data processing (in fact some references to international laws can be found in their webpage at http://www.ifai.org.mx/datos_personales/internacionales.htm)

As a result of the above, several efforts have been made by certain Mexican MP's which have presented a federal law initiative on data protection currently approved by the Camara de Senadores ("House of Lords") in 2003 and is pending for the approval of the Camara de Diputados ( "House of Commons") (the Spanish version of such initiative can be found at http://www.cddhcu.gob.mx/servicios/datorele/cmprtvs/1po2/set/2.htm)

In my opinion, this initiative follows a hybrid method (as most of Mexican statutes do) because on one hand it tries to follow the American approach (as it is stated in some of its Recitals), but on the other hand there are some provisions that are apparently based on the 1995 EC Directive (e.g. the language contained in Article 6 is apparently based on Recital (30) of the EC Directive 1995 when stating that the processing of personal data must be carried out with the consent of the data subject)

However, a more deeply analysis to this initiative has to be made in order to be able to establish an accurate opinion

Finally, only two Mexican States (i.e. Colima and Coahuila) have approved a Regional Data Protection Law aimed to the Private Sector

Bainbridge on the 1998 Data Protection Act

2006-02-14T00:16:00.001-08:00

Critical article written in 2000 before the Human Rights Act came into force.

South American data protection law

2006-02-14T00:16:00.000-08:00

Article by Edinburgh professor Andres Guadamuz.

History of privacy and the law

2006-02-14T00:12:00.001-08:00

Mr Justice Douglas's dissent in Warden v. Hayden is an excellent primary source.

Blog your research on national data protection laws!

2006-02-14T00:12:00.000-08:00

Before class.

UK National ID Cards

2006-02-13T15:00:00.000-08:00

There have been criticisms targeted at different elements of the national ID card scheme, including:

• RFID
• You need two if you're a transvestite
• A big database creates a so-called honeypot effect - with more people granted access, the database becomes more vulnerable; a greater traget.
• They are of little value in fighting terrorism, an initial justification for their introduction.
• Will not carry address or phone cumber on the card, so will not be usable as a proof of address - identification of this variety is essential for many businesses eg banks.
• Cost for banks etc of investing in equiptment may be more than simply absorbing the costs of unscrupulous use.
• Two fingers not enough to provide sufficient accuracy in the biometric element of the card
• There was an interesting passage here on the different types of cards that have been anticipated

Dataprotection in Thailand

2006-02-13T05:41:00.000-08:00

here are the relevent web sites that i've found
ecommerce organization
guideline for data protection in thailand

Information Commissioner can't stop spam

2006-02-11T01:39:00.000-08:00

Story from weekly journal Computing

Week 3 reading

2006-02-07T08:00:00.000-08:00

Lloyd Chapters 3,4,5,10 - collect the second part of Directive 19995/46/EC.
Implementation: look at EC website.

Apologies - catch up 7 February

2006-01-31T11:29:00.000-08:00

Dear all
Apologies that I couldn't make it to today's class - the A12 had a disaster! We will make up over the next 4 weeks.
Best regards
Chris

Week 2 Assignments

2006-01-24T11:15:00.000-08:00

1. Read a short introduction to data protection and privacy - either from Lloyd, Bainbridge or the blog - only choose one chapter.
2. Spend 30 minutes in pairs conducting independent directed web research on your national data protection law and its relationship to the European Directive. Any problems, email me: ctmarsden@yahoo.co.uk
3. You will all have to pick up on FRIDAY FROM HAYLEY/MARIA 28th a copy of the Directive EC/95/46 - the data protection directive.
Read the recitals and first chapter - this week we will continue to consider policy towards data protection.
Optional questions:
[1] How well do you consider that the Directive balances the right to data protection against other rights?
[2] Which rights in particular (whether of individuals, governments or the effective working of the market ) do you believe are under-served by the Directive?

2006 Course Catalogue Description

2006-01-24T11:10:00.000-08:00

LW656-G-SP: DATA PROTECTION
Year: 2005/2006
Department: Law
Staff Supervisor: Chris Marsden
Contact details: essexdataprotection.blogspot.com
Email: ctmarsden@yahoo.co.uk
Course Description
See the course blog (open to posting by both students and me) at http://essexdataprotection.blogspot.com for the spring course.
This course seeks to introduce students to the complex area of data protection - that is: to the complex system of rules and regulations aimed at protecting individuals (and to a limited extent "legal persons") with regard to the processing of information on them by public and private bodies. The course will cover:the history and development of data protection as a concept from the 1970s to now; the multi-layered international-legal framework for data protection; selected national data protection laws; and transnational legal questions, including in particular the application of data protection rules and concepts to the Internet. In addition, students will be given the opportunity to study the way in which selected public and private data users ("controllers") process personal data in practice, and what measures they take to comply with data protection rules. They are asked to discuss whether practice lives up to the theoretical requirements, whether this is actually achievable under the current national and international legal regime, and what the future can or should hold.
Week 2 (Week 18, 31 January): Theories of privacy - comparative approaches
Week 3: Directive 1995/46 - How The Legislatin Was Introduced
Week 4: Safe Harbour Provisions
Week 5: Implementation in National Law: Data Protection Act 1998 Example
Week 6: Information Commissioners - Guest Speaker Dr Ian Brown
Week 7: Lindquist case
Week 8: CCTV Cameras and other surveillance techniques
Week 9: Electronic Privacy, Data Retention
Week 10: Conclusion - Futures for Privacy and Trade in Privacy

European Commission homepage on Data protection

2006-01-24T03:39:00.000-08:00

The best source of primary legislative and implementation reports:
http://europa.eu.int/comm/justice_home/fsj/privacy/index_en.htm

ID Cards and Data Retention debates

2006-01-16T12:38:00.000-08:00

This is going to be a course based on an extremely controversial topic. Data protection is currently being debated as part of 2 Europe-wide schemes:
[1] the use of ID cards - the UK doesn't have them currently, never has had, but government is intending to use them. See the LSE Report.
[2] mandatory retention of communications data. This is subject to many discussions, amongst them and quite enlightened several years - amongst them 'Carnivore'.

Week 1 Reading: The Right to Privacy

2006-01-08T02:28:00.000-08:00

Read ths extract from Guardster's tutorial on privacy:
http://www.guardster.com/?Tutorials-The_Right_to_Privacy
Also look at the anonymity offered by Guardster - would you use this if you were websurfing in China?
http://www.bbcworld.com/content/template_clickonline.asp?pageid=666&co_pageid=3

UK police and facial recognition cameras

2005-12-22T07:05:00.000-08:00

Independent story on number plate cameras for police.

Database Directive evaluation

2005-12-20T04:57:00.000-08:00

The long-overdue evaluation of the Database Directive, that brought the EU the dreaded sui generis database right, has finally been released by the European Commission. The report is very critical of the sui generis right; it finds that the economic impact of the sui generis right on database production is unproven, and discusses various future scenarios, including repealing the Directive. The evaluation report - a direct result of the fresh air that has been blowing through the EC's Directorate-General for the Internal Market & Services since the beginning of the year (under a new Commissioner and a new Head of the Copyright Unit) - is available at http://europa.eu.int/comm/internal_market/copyright/docs/databases/evaluation_report_en.pdf. Interested parties are invited to commenton the evaluation by 12 March 2006.
P. Bernt Hugenholtz Institute for Information Law University of Amsterdam Rokin 84 NL-1012 KX Amsterdam The Netherlands http://www.ivir.nl

Illustrated guide to what the Internet is

2005-12-02T02:21:00.000-08:00

By the author of 'Netheads versus Bellheads'.

Duties of data protection officers (DPOs)

2005-11-30T03:25:00.000-08:00

A European guide.

Electronic Frontier Foundation on bloggers' rights

2005-11-23T02:14:00.000-08:00

A collection of blogger-specific FAQs addressing everything from fair use to defamation law to workplace whistle-blowing

Bloggers can be journalists (and journalists can be bloggers) - We're battling for legal and institutional recognition that if you engage in journalism, you're a journalist, with all of the attendant rights, privileges, and protections. http://www.eff.org/Censorship/Apple_v_Does/

Bloggers are entitled to free speech - We're working to shield you from frivolous or abusive threats and lawsuits. Internet bullies shouldn't use copyright, libel, or other claims to chill your legitimate speech.

Bloggers have the right to political speech - We're working with a number of other public-interest organizations to ensure that the Federal Election Commission (FEC) doesn't gag bloggers' election-related speech. We argue that the FEC should adopt a presumption against the regulation of election-related speech by individuals on the Internet, and interpret the existing media exemption to apply to online media outlets that provide news reporting and commentary regarding an election -- including blogs. See How to Blog Safely (About Work or Anything Else)

Bloggers have freedom from liability for hosting speech the same way other web hosts do - We're working to strengthen Section 230 liability protections under the Communications Decency Act (CDA) while spreading the word that bloggers are entitled to them. (See Barrett v. Rosenthal)

Information Commissioner survey

2005-11-17T08:07:00.000-08:00

People don't trust websites

EDPS Opinion on data retention

2005-11-17T05:18:00.000-08:00

The European Data Protection Supervisor (EDPS) has published his Opinion on the Commission's proposal for a Directive on the retention of communications data, stressing the need to respect the fundamental rights of EU citizens.

Information Privacy Law text published

2005-11-17T05:16:00.000-08:00

For those of a US legal bent:
The book's website.
You can peruse the table of contents here.

OfCom forced to publish board meeting minutes

2005-11-14T03:23:00.000-08:00

The Information Commissioner is forced to act to secure greater transparency by the regulator.

New United Nations book - 'Law of Cyberspace'

2005-11-14T02:23:00.000-08:00

Not very good, but free.

Joel Reidenberg's new course

2005-11-02T04:05:00.000-08:00

2005 fall schedule, good primer on Internet regulation in US and Europe

Reidenberg on Internet jurisdiction

2005-09-19T09:05:00.000-07:00

Technology and Internet Jurisdiction, 153 UNIV. OF PENN. L. REV. 1951 (2005)
The paper argues that the conventional wisdom about Internet technologies undermining national jurisdictional claims is wrong. The essay demonstrates that interactive technologies give multiple
states/nations greater authority to claim personal jurisdiction and apply local laws to remote Internet players. The essay shows that some of these same innovations also enable states to enforce their
decisions electronically and consequently bypass the problems of foreign recognition and enforcement of judgments.

Indian Parliament passes the new Right to Information Bill, 2005.

2005-05-11T23:16:00.000-07:00

The Right to Information Bill, 2005, replacing the Freedom of Information Act, 2002 has just been passed by the Lok Sabha (House of the People) of the Indian Parliament. The bill will now be passed to the Upper House of the Parliament, Rajya Sabha (House of the States) and then will be sent to the President of India for his assent and signature turning it into an Act of Parliament. But the bill, de facto, can be already said to be in place among the laws of the country.

More details on this can be found in the following Article:
http://autofeed.msn.co.in/pandorav3/output/News/0f60d6dc-d54e-4851-bea1-09f789482b79.aspx

Data Protection articles

2005-03-21T03:06:00.000-08:00

"Data Retention and the War Against Terrorism - A Considered and Proportionate Response?" by Diane Rowland [2004] Journal of Information, Law and Technology (3)
"The Application of Data Protection Law to the Employment Sector" by Gemma Neylon [2005] Cork Online Law Review 4 http://colr.ucc.ie/2005iv.html
"We Know What You Did Last Summer! What Aims Should Guide Ireland's Laws on Data Retention?" by Alan Woods [2005] Cork Online Law Review 3 http://colr.ucc.ie/2005iii.html
"A Comparative Analysis of Zimbabwean and South African Data Protection Systems" by Caroline Ncube [2004] Journal of Information, Law and Technology (2)
"A Model Regime of Privacy Protection" by Daniel J. Solove and Chris Jay Hoofnagle GWU Law School Public Law Research Paper No. 132 (March 2005) http://ssrn.com/abstract=681902
"Abuse of Database Right - Sole-source information banks under the EU Database Directive" by Bernt Hugenholtz Conference paper January 2004

Week 10: Concluding session: International Trade and Data Protection.

2005-03-18T03:53:00.000-08:00

Is the EU taking a large risk in not terminating the Safe Harbour?
GATS Article XIV(c)(ii) specifically authorizes the European privacy regulations to restrict cross-border services provided that the measures are not used to discriminate between trading partner countries and provided that the measures are not used as a disguised restriction on trade in services.
Internal EU compliance problems are not relevant because the GATS obligation, known as MFN, relates to favoring one non-EU country over another non-EU country. Since the 2004 EC study and the 2001 study each showed important compliance deficiencies, third countries such as Australia have a very strong argument that the EU is impermissibly favoring the US in that the EU appears to be holding third countries to a higher standard of "adequacy." WTO Appellate Body Decision in the EC-Bananas III case specifically said that de facto discrimination was as valid a basis for an MFN claim as de jure discrimination.
Even with respect to disguised restrictions, Reidenberg thinks the US would have a very difficult case since European data protection agencies do enforce national data privacy laws, even if the level of enforcement is weak. EU would have serious trade issues if EU data protection agencies were to take enforcement actions only against US companies transferring data from Europe. This form of discrimination is an entirely different type of trade problem -- a violation of the GATS national treatment obligation-- that is independent of the Safe Harbour. The issue is differential treatment of companies within Europe based on their nationality rather than differential treatment of destinations.

Week 8 - safe harbors

2005-03-10T08:22:00.000-08:00

US safe harbor website here, and EU Working Group consultations here.

Essay titles

2005-03-04T00:40:00.001-08:00

1. 'Anonymity online is not a right, but a hindrance to law enforcement and an invitation to fraud.' Discuss with reference to Lessig's views.
2. Is the Safe Harbour provision in Directive EC/46/95 contrary to free trade rules?
3. Do you consider Information Commissions effective in upholding individual rights to personal data? Explain using evidence from at least two jurisdictions in the EU.
4. Do identity cards protect individual rights? Illustrate your argument with reference to the proposed Identity Cards Bill 2005.

Weeks 8-9 Reading

2005-03-04T00:40:00.000-08:00

Week 8: Safe Harbours and US law
Lloyd Chapter 10
Reindenberg, Joel. R. Resolving Conflicting International Privacy Rules in Cyberspace, 52 Stanford Law Review, 1315 (2000)
Jan Dhont, María Verónica Pérez Asinari, Yves Poullet, Joel R. Reidenberg & Lee Bygrave, Safe Harbor Decision Implementation Study (Apr. 19, 2004)
Week 9: CCTV Case Study and Technologies of Control
CCTV regulation by Crime and Disorder Act 1998 here. Also a very good article on ECHR decision in Peck (2003). RIP Act's formation and encryption debate by Hosein is here
Advanced reading:
Lessig, Code and Other Laws of Cyberspace (New York: Basic Books, 1999), chapter 11; "Reading the Constitution in Cyberspace", Emory Law Journal, volume 45, number 3, Summer (1996) pages 869-910
Jamal, Maier and Sunder, E-Commerce and Privacy in the UK and US.

Week 7 - Advanced Readings Cybersurveillance and civil rights

2005-03-02T03:30:00.000-08:00

Hosein, Ian, Creating Conventions - Technology Policy and International Cooperation in Criminal Matters. Available on-line in draft form
Hosein, Ian, Politics of International Co-Operation, Memo for the Social Science Research Council, available on the SSRC website.
Hosein, Ian, The Sources of Laws: Policy Dynamics in a Digital and Terrorized World, The Information Society, Volume 20 number 3, 2004. Available on-line.
Global Internet Liberty Campaign Member Letter on Council of Europe Convention on Cyber-Crime Version 24.2, December 2000, available on the GILC website.

Spyblog

2005-02-23T08:05:00.000-08:00

For a very opinionated blog on all things privacy, see http://www.spy.org.uk/spyblog/