EN Official Journal of the European Union C 392/9

Executive summary of Opinion No 4/2015 of the European Data Protection Supervisor, ‘Towards a new digital ethics: Data, dignity and technology’

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2015/C 392/08)

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41.2 of Regulation (EC) No 45/2001 of the European Parliament and of the Council (1). ‘With respect to the processing of personal data … for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘… for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. He was appointed in December 2014 together with Assistant Supervisor with the specific remit of being more constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

This Opinion follows on from the EDPS’s previous Opinion on the General Data Protection Regulation which aimed to assist the main institutions of the EU in reaching the right consensus on workable, future-oriented set of rules which bolsters the rights and freedoms of the individual. Like the Opinion on Mobile Health in early 2015, it addresses the challenge of data protection to ‘go digital’ — the third objective of the EDPS Strategy —‘customising existing data protection principles to fit the global digital arena’, also in the light of the EU’s plans for the Digital Single Market. It is consistent with the approach of the Article 29 Working Party on data protection aspects of the use of new technologies, such as the ‘Internet of Things’, to which the EDPS contributed as a full member of the group.

‘Human dignity is inviolable. It must be respected and protected.’

Article 1, EU Charter of Fundamental Rights

The fundamental rights to privacy and to the protection of personal data have become more important for the protection of human dignity than ever before. They are enshrined in the EU Treaties and in the EU Charter of Fundamental Rights. They enable individuals to develop their own personalities, to lead independent lives, to innovate and to exercise other rights and freedoms. The data protection principles defined in the EU Charter — necessity, proportionality, fairness, data minimisation, purpose limitation, consent and transparency — apply to data processing in its entirety, to collection as well as to use.

Technology should not dictate values and rights, but neither should their relationship be reduced to a false dichotomy. The digital revolution promises benefits for health, the environment, international development and economic efficiency. Under the EU’s plans for a digital single market, cloud computing, the ‘Internet of Things’, big data and other technologies are considered key to competitiveness and growth. Business models are exploiting new capabilities for the massive collection, instantaneous transmission, combination and reuse of personal information for unforeseen purposes, and justified by long and impenetrable privacy policies. This has placed the principles of data protection under new strains, which calls for fresh thinking on how they are applied.

In today’s digital environment, adherence to the law is not enough; we have to consider the ethical dimension of data processing. The EU’s regulatory framework already allows room for flexible, case-by-case decisions and safeguards when handling personal information. The reform of the regulatory framework will be a good step forward. But there are deeper questions as to the impact of trends in data driven society on dignity, individual freedom and the functioning of democracy.

These issues have engineering, philosophical, legal and moral implications. This Opinion highlights some major technology trends which may involve unacceptable processing of personal information or may interfere with the right to privacy. It outlines a four-tier ‘big data protection ecosystem’ to respond to the digital challenge: a collective effort, underpinned by ethical considerations.

(1) Future-oriented regulation of data processing and respect for the rights to privacy and to data protection.

(2) Accountable controllers who determine personal information processing.

(3) Privacy-conscious engineering and design of data-processing products and services.

(4) Empowered individuals.

The European Data Protection Supervisor wants to stimulate an open and informed discussion in and outside the EU, involving civil society, designers, companies, academics, public authorities and regulators. The new EU data protection ethics board we will establish at the EDPS will help define a new digital ethics, allowing to realise better the benefits of technology for society and the economy in ways which reinforce the rights and freedoms of individuals.

4. Conclusion: Time to deepen the discussion

Privacy and data protection are part of the solution, not the problem. For the time being, technology is controlled by humans. It is not easy to classify neatly these potential developments as good or bad, desirable or harmful, advantageous or detrimental, even less so when a number of potential trends have to be seen in context. Policymakers, technology developers, business developers and all of us must seriously consider if and how we want to influence the development of technology and its application. But equally important is that the EU considers urgently the ethics and the place for human dignity in the technologies of the future.

Data protection principles have proven capable of safeguarding individuals and their privacy from the risks of irresponsible data processing. But today’s trends may require a completely fresh approach. So we are opening a new debate to what extent the application of the principles such as fairness and legitimacy is sufficient. The data protection community can play a new role using existing tools like prior checks and authorisations — because no other bodies are equipped to scrutinise such data processing. With technology, global innovation and human connectedness developing at breakneck speed, we have an opportunity to attract attention, to trigger interest and to build a consensus.

With this Opinion we hope to provide a framework for a wider and deeper discussion on how the EU can ensure the integrity of its values at the same time as it embraces the benefits of the new technologies.

Done in Brussels, 11 September 2015. Giovanni BUTTARELLI European Data Protection Supervisor

(1) OJ L 8, 12.1.2001, p. 1.