Data Protection Reform Published by Jan Philipp Albrecht MEP
Total Page:16
File Type:pdf, Size:1020Kb
The EU´s Data Protection Reform Published by Jan Philipp Albrecht MEP 1 Imprint Table of contents Publisher Jan Philipp Albrecht MEP Foreword…....…………………………………………………....…………..……………………………………………………………………....…………....4 European Parliament Green European Foundation Why data protection? Where does the idea actually come from?.…………………………………………....…………....6 Rue Wiertz 60 15, Rue d’Arlon 1047 Brussels 1050 Brussels The EU data protection reform: What is it about?.…...…………...........................………………………………....…………....8 Belgium Belgium www.gef.eu Challenges in data protection….......................………….....……..…………………………………………………………………....…………....10 Selling off our data…....…………….................………………....…………..…………………………………………………………………....…………....12 Editor Ralf Bendrath Text Jan Philipp Albrecht, Ralf Bendrath, Florian Jotzo, Zora Siebert The surveillance society….................…...…......………....…………..……………………………………………………………………....…………....14 Proof-reading Levka Backen, Benjamin Breitegger, Pia Kohorst, Siana Rott Coordination of the English version Fiona Costello Frequently asked questions Design and Illustration p*zwe Print AktivDruck, Göttingen 1. Who is the Data Protection Regulation really for?…..…………..………......…………………………....…………....16 2. Will a law like this really work for the internet?…..…………......……………..........……………………....…………....18 December 2015 3. Will the new data protection regime generate more bureaucracy?…..…………….……....…………....22 4. How can I assert my rights in the EU?…..………...................……........…………………………………………....…………....24 With the financial support of the European Parliament. 5. Does data protection wipe out the press, science and archives?…..…………………………....…………....26 6. What happens if data is transferred outside EU borders?.……………...……………………....………….......28 How does EU legislation such as the Data Protection Regulation come into being?…..…....…………....30 Lobbying and the Data Protection Regulation…..…………......…...................…………………………………………....…………....32 How can I protect my privacy on the internet?…..……............…......………………………………………………....…………....34 2 Dear reader, Many people still see the words “data protection“ Nowadays it is not just every few years that how and think they are something technical that does much we earn or what religious community we be- not really affect them. However, this is a mistaken long to is gauged. The digitisation and networking notion. As well as being outdated, it is mistaken of all areas of life and all things means that, ev- because data protection is in fact not about pro- ery second, we divulge a whole raft of information tecting data at all: it is about protecting people. that can be – and, in the vast majority of cases, ac- When a census was planned in Germany in the tually is – beamed around the world at almost the early 1980’s, many people complained that the speed of light and stored in practically unlimited collection of their personal information (such as data centres until the end of time. The question their income or religious affiliation) constituted a then arises as to how we can remain in control of violation of their fundamental rights. The German our lives and our own selves in this situation. Or Federal Constitutional Court ruled that a human have we already become products of a data-orient- right to “informational self-determination“ arose ed society in which the large IT service providers out of human dignity and the right to free devel- have a firm grip on our work, economic activities opment of one‘s personality. This cumbersome and private life? This brochure aims to provide an- term marked the beginning of the long develop- swers and background both to these questions and ment of the fundamental right to data protection to the potential political and personal action that in Europe. can be taken. With best data protecting regards, Jan Philipp Albrecht Member of the European Parliament, Vice-Chairman of the Committee on Civil Liberties, Justice and Home Affairs, Rapporteur for the EU Data Protection Regulation 5 When authorities and businesses started to use who knows what about us and what they might be mainframe computers in the 1960s, a broad debate able to do with that information with the help of a took place about the power of these new machines. computer. The Federal Constitutional Court very Then, as now, the idea of data protection was to perceptively recognised that a society in which we make the most of the opportunities and possibilities feel constantly observed, recorded, evaluated and offered by new technology without reducing people scanned is no longer an open society of free and to mere objects of automatic computer operations. It equal people. was then that the concept of “data protection” was developed. In 1980, Council of Europe Convention No 108 and the Organisation for Economic Cooperation and De- Data protection is, at its core, not a technical matter. velopment (OECD) guidelines made a first attempt It is not data that is to be protected, but people. Data to harmonise the right to data protection at inter- protection is about our ability, in this digitised world, national level and thereby to take account of the to make our own decisions regarding who can know increasingly international circulation of data. The something about us, what is done with this data and hitherto most decisive step taken by the European WHY DATA PROTECTION? the possible effects on our lives. The German federal Union is Directive 1995/46 on the protection of per- state of Hessen brought in the world’s first data pro- sonal data, adopted in 1995. The EU Charter of Fun- Where does the idea actually come from? tection law in 1970. Discussions also took place in damental Rights – which has been binding on the Eu- the United States during the student protests about ropean legislature since 2009 – stipulated that data whether computers should be used for the purposes protection was a fundamental right in the EU as well. of political control – by means of databases of radical The saying “my home is my castle” was coined as first paparazzi, whom Warren and Brandeis wished opposition figures, for example. In response, the US Unfortunately, many companies do not comply with long ago as 1604, in England. The notion arose in to counteract. Even then, the aim was not to resist Privacy Act was adopted in 1974. However, this act European data protection law and do what they the context of a legal dispute and limited the right technology or innovation, but rather to foster the only regulates data protection with regard to the au- want with our data. Thus the present EU data pro- of the king’s soldiers to enter a house unannounced dignified use of these things so as to respect peo- thorities; there is still no comprehensive American tection reform is the next major step and it aims to and without a reason. The right to privacy therefore ple’s right to self-determination. law on data protection with regard to companies. guarantee that we can finally exercise our rights ef- initially extended to one’s own four walls. An addi- fectively. The EU’s data protection reform is an at- tional concern for “informational self-determina- Automated machine processing of data was devel- National data protection legislation gradually ap- tempt to reclaim our digital self-determination. It is tion” arose starting in the late nineteenth century. oped in the 20th century. Even prior to the invention peared, primarily in the European Union. These laws also a component of the completion of the European In 1895, Boston lawyers Samuel Warren and Louis of the computer, punch cards were used to process set limits on data processors and granted rights to digital single market. Brandeis wrote an essay entitled “The Right to Pri- large quantities of data automatically. This played a those affected – i.e. us – to receive information about vacy”, in which they laid out the right to control role in technical calculations, but punch cards also data or to delete it, to take two examples. In its land- what other people know about us. The impetus for enabled information about people to be automati- mark decision on the 1983 census, the German Fed- this essay was provided by technological develop- cally processed – for administrative purposes, for eral Constitutional Court coined the more accurate ments that were new at the time: the first hand-held example. The Nazis, too, used punch card machines term “informational self-determination”. As an in- cameras for taking snapshots and the emergence from IBM subsidiary Hollerith to organise the in- creasing amount of information on our lives is avail- of modern daily newspapers had given rise to the dustrial mass murder of Europe’s Jews. able digitally, we must have the right to determine 6 7 gives it a clear advantage. Moreover, both American 1) High fines are planned in order to ensure that and European companies often conceal information our rights are better enforced, as are consumer about what actually happens to our data within data protection instruments, such as group litigation or protection statements that are long and difficult to class actions (the ability for associations represent- read. ing data protection, consumer protection or other public-interest causes to initiate court proceed- The EU has therefore been working for several years ings). Meanwhile, coupling is prohibited (i.e. the on a new data protection law. Numerous public con- provision of a service cannot be made conditional sultations took place starting in 2009, and