Source: http://privacylawblog.fieldfisher.com/category/privacy-by-design
Timestamp: 2014-11-24 17:26:54
Document Index: 731690611

Matched Legal Cases: ['art 2', 'art 1', 'art 2', 'ART 2', 'art 1', 'art 2']

Monthly Digest Weekly Digest Instant Alert Recent Posts	Spam texts: “substantially distressing” or just annoying?
A New ISO Standard for Cloud Computing
Posted on November 3rd, 2014 by Brian Davidson
The Code recognises the intrusiveness that such technologies pose and emphasises the need for proportionality and, particularly, ‘necessity’ when an organisation is deciding whether to implement a surveillance system. Therefore the Code asserts the need for tools such as Privacy Impact Assessments (PIAs) and Privacy by Design solutions, both at the initial stages of the project and through its lifecycle. Indeed, in the case of more intrusive recording systems such as BWV, which offer significant mobility advantages for the recording of images and sounds, the Code emphasises that in addition to ensuring that it is ‘necessary’ and ‘proportionate’ in response to an issue, there must also exist ‘a pressing social need’ for it. The bottom line is that the ICO considers that the intrusiveness of such systems means that they should not be implemented just because it is possible, affordable or they have public support.
The nature of these systems means that the volume and intrusiveness of the data collected is now potentially much greater. CCTV cameras for example are no longer a passive technology that only records and retains images, but are now proactive and can be used to identify people of interest and keep detailed records of people’s activities – such as with ANPR cameras. Additionally, camera feeds may be shared between different public authorities via a common control room operated by a third party in order to cut back on running costs. Not only does this present considerations around existing data protection concepts such as the need to identify ‘controller and processor’ relationships and apportioning responsibilities via appropriate contractual agreements, but it also presents further issues around ‘Big Data’ and individual profiling. This requires the drafting of appropriate data-sharing agreements, data retention policies and implementing data security practices. The ICO also points out that the principles of the Data Protection Act and the corresponding recommendations in the Code should be followed throughout the lifecycle of the system, including the system upgrades.
And of course, more ‘traditional’ data protection concepts such as providing effective ‘notice’, being ready to fulfil Subject Access Requests and dealing with FOI requests continue to apply. In particular, the Code highlights the need for appropriate staff training, documented processes and considers applicable exemptions in the case of SARs. Finally, the Code sets out the regulator’s expectations that that appropriate signs and audio recordings should be used to inform individuals when they are entering an area where surveillance may be taking place. This will require creative thinking by organisations as they grapple with how to handle these issues; for example in the case of drones the guidance recommends that the drone operator may wear ‘highly visible clothing’ to identify themselves as such in order to satisfy the fair processing requirements under the DPA.
Tags:CCTV, Information Commissioner's Office, privacy impact assessments, surveillance Posted in Big Data, Privacy by design, Profiling What does EU regulatory guidance on the Internet of Things mean in practice? Part 2
Posted on November 1st, 2014 by Antonis Patrikios
I am also unsure whether certain statements in the Opinion can withstand rigorous legal analysis. For instance, isn’t it a massive generalisation to suggest that all data collected by things should be treated as personal, even if it is anonymised or it relates to the ‘environment’ of individuals as opposed to ‘an identifiable individual’? How does this square with the pretty clear definition of the Data Protection Directive? Also, is the principle of ‘self-determination of data’ (which, I assume is a reference to the German principle of ‘informational self-determination’) a principle of EU data protection law that applies across the EU? And how is a presumption in favour of consent justified when EU data protection law makes it very clear that consent is one among several grounds on which controllers can rely?
Consent will be necessary in several occasions such as for storing or accessing information stored on terminal equipment, for processing health data and other sensitive personal data, or for processing location data created in the context of public telecommunications services. But is consent really necessary for the processing of, e.g., device identifiers, MAC addresses or IP addresses? If the individual is sufficiently informed and makes a conscious decision to sign up for a service that entails the processing of such information (or, for that matter, any non-sensitive personal data), why isn’t it possible to rely on the legitimate interests ground, especially if the individual can subsequently chose to stop the further collection and processing of data relating to him/her? Where is the risk of harm in this scenario and why is it impossible to satisfy the balance of interests test?
Ultimately, it’s all about trust: it’s the loss of trust that a company will respect our privacy and that it will do its best to protect our information that results in serious enforcement action, pushes companies out of business or results in the resignation of the CEO.
Acknowledge the privacy issue. ‘Privacy is dead’ or ‘people don’t care’ type of rhetoric will get you nowhere and is likely to be met with significant pushback by regulators.
Start early and aim to bake privacy in. It’s easier and less expensive than leaving it for later. In practice this means running privacy impact assessments and security risk assessments early in the development cycle and as material changes are introduced.
Transparency is absolutely essential. You should clearly explain to individuals what information you collect, what you do with it and the benefit that they receive by entrusting you with their data. Then do what you said you would do – there should be no surprises.
Obtain consents when the law requires you to do so, for instance if as part of the service you need to store information on a terminal device, or if you are processing sensitive personal data, such as health data. In most cases, it will be possible to rely on ‘implied’ consent so as to not unduly interrupt the user journey (except when processing sensitive personal data).
Tags:Article 29 Working Party, article 5(3), consent, data protection, Directive 95/46, General Data Protection Regulation, Internet of Things, IoT, right to privacy Posted in 95 directive, Anonymisation, Applicable law, Article 29 Working Party, Big Data, Consent, Data minimisation, Data ownership, Data sharing, DPAs competence, Legislative reform, Privacy by design What does EU regulatory guidance on the Internet of Things mean in practice? Part 1
Posted on October 31st, 2014 by Antonis Patrikios
The Internet of Things (IoT) is likely to be the next big thing, a disruptive technological step that will change the way in which we live and work, perhaps as fundamentally as the ‘traditional’ Internet did. No surprise then that everyone wants a slice of that pie and that there is a lot of ‘noise’ out there. This is so despite the fact that to a large extent we’re not really sure about what the term ‘Internet of Things’ means – my colleague Mark Webber explores this question in his recent blog. Whatever the IoT is or is going to become, one thing is certain: it is all about the data.
There is also no doubt that the IoT triggers challenging legal issues that businesses, lawyers, legislators and regulators need to get their heads around in the months and years to come. Mark discusses these challenges in the second part of his blog (here), where he considers the regulatory outlook and briefly discusses the recent Article 29 Working Party Opinion on the Internet of Things.
Shortly after the WP29 Opinion was published, Data Protection and Privacy Commissioners from Europe and elsewhere in the world adopted the Mauritius Declaration on the Internet of Things. It is aligned to the WP29 Opinion, so it seems that privacy regulators are forming a united front on privacy in the IoT. This is consistent with their drive towards closer international cooperation – see for instance the latest Resolution on Enforcement Cooperation and the Global Cross Border Enforcement Cooperation Agreement (here).
The regulatory mind-set
You only need to read the first few lines of the Opinion and the Declaration to get a sense of the regulatory mind-set: the IoT can reveal ‘intimate details'; ‘sensor data is high in quantity, quality and sensitivity’ and the inferences that can be drawn from this data are ‘much bigger and sensitive’, especially when the IoT is seen alongside other technological trends such as cloud computing and big data analytics. The challenges are ‘huge’, ‘some new, some more traditional, but then amplified with regard to the exponential increase of data processing’, and include ‘data losses, infection by malware, but also unauthorized access to personal data, intrusive use of wearable devices or unlawful surveillance’.
In other words, in the minds of privacy regulators, it does not get much more intrusive (and potentially unlawful) than this, and if the IoT is left unchecked, it is the quickest way to an Orwellian dystopia. Not a surprise then that the WP29 supports the incorporation of the highest possible guarantees, with users remaining in complete control of their personal data, which is best achieved by obtaining fully informed consent. The Mauritius Declaration echoes these expectations.
Here are the main highlights from the WP29 Opinion:
Anyone who uses an IoT object, device, phone or computer situated in the EU to collect personal data is captured by EU data protection law. No surprises here.
Data that originates from networked ‘things’ is personal data, potentially even if it is pseudonymised or anonymised (!), and even if it does not relate to individuals but rather relates to their environment. In other words, pretty much all IoT data should be treated as personal data.
All actors who are involved in the IoT or process IoT data (including device manufacturers, social platforms, third party app developers, other third parties and IoT data platforms) are, or at least are likely to be, data controllers, i.e. responsible for compliance with EU data protection law.
Device manufacturers are singled out as having to take more practical steps than other actors to ensure data protection compliance (see below). Presumably, this is because they have a direct relationship with the end user and are able to collect ‘more’ data than other actors.
Consent is the first legal basis that should be principally relied on in the IoT. In addition to the usual requirements (specific, informed, freely given and freely revocable), end users should be enabled to provide (or withdraw) granular consent: for all data collected by a specific thing; for specific data collected by anything; and for a specific data processing. However, in practice it is difficult to obtain informed consent, because it is difficult to provide sufficient notice in the IoT.
Controllers are unlikely to be able to process IoT data on the basis that it is on their legitimate interests to do so, because it is clear that this processing significantly affects the privacy rights of individuals. In other words, in the IoT there is a strong regulatory presumption against the legitimate interests ground and in favour of consent as the legitimate basis of processing.
IoT devices constitute ‘terminal devices’ for EU law purposes, which means that any storage of information, or access to information stored, on an IoT device requires the end user’s consent (note: the requirement applies to any information, not just personal data).
Transparency is absolutely essential to ensure that the processing is fair and that consent is valid. There are specific concerns around transparency in the IoT, for instance in relation to providing notice to individuals who are not the end users of a device (e.g. providing notice to a passer-by whose photo is taken by a smart watch).
The right of individuals to access their data extends not only to data that is displayed to them (e.g. data about calories burnt that is displayed on a mobile app), but also the raw data processed in the background to provide the service (e.g. the biometric data collected by a wristband to calculate the calories burnt).
There are additional specific concerns and corresponding expectations around purpose limitation, data minimisation, data retention, security and enabling data subjects to exercise their rights.
It is also worth noting that some of the expectations set out in the Opinion do not currently have an express statutory footing, but rather reflect provisions of the draft EU Data Protection Regulation (which may or may not become law): privacy impact assessments, privacy by design, privacy by default, security by design and the right to data portability feature prominently in the WP29 Opinion.
The regulators’ recommendations
The WP29 makes recommendations regarding what IoT stakeholders should do in practice to comply with EU data protection law. The highlights include:
All actors who are involved in the IoT or process IoT data as controllers should, carry out Privacy Impact Assessments and implement Privacy by Design and Privacy by Default solutions; should delete raw data as soon as they have extracted the data they require; and should empower users to be in control in accordance with the ‘principle of self-determination of data’.
In addition, device manufacturers should:
follow a security by design principle;
obtain consents that are granular (see above), and the granularity should extend to enabling users to determine the time and frequency of data collection;
notify other actors in the IoT supply chain as soon as a data subject withdraws their consent or opposes a data processing activity;
limit device finger printing to prevent location tracking;
aggregate data locally on the devices to limit the amount of data leaving the device;
provide users with tools to locally read, edit and modify data before it is shared with other parties;
provide interfaces to allow users to extract aggregated and raw data in a structured and commonly used format; and
enable privacy proxies that inform users about what data is collected, and facilitate local storage and processing without transmitting data to the manufacturer.
The Opinion sets out additional specific expectations for app developers, social platforms, data platforms, IoT device owners and additional data recipients.
I have no doubt that there are genuinely good intentions behind the WP29 Opinion and the Mauritius Declaration. What I am not sure about is whether the approach of the regulators will encourage behaviours that protect privacy without stifling innovation and impeding the development of the IoT. I am not even sure if, despite the good intentions, in the end the Opinion will encourage ‘better’ privacy protections in the IoT. I explain why I have these concerns and how I think organisations should be approaching privacy compliance in the IoT in Part 2 of this piece.
Tags:Article 29 Working Party, article 5(3), consent, Enforcement, ePrivacy directive, General Data Protection Regulation, Internet of Things, IoT, right to privacy Posted in 95 directive, Anonymisation, Article 29 Working Party, Big Data, Consent, Data minimisation, Data security, Data sharing, DPAs competence, Legislative reform, Privacy by design, Sanctions PART 2 – The regulatory outlook for the Internet of Things
Tags:Cloud, Europe, FTC, Internet of Things, IoT, OFCOM, Regulatory Reform, Trends Posted in Article 29 Working Party, Big Data, Cloud computing, Data as an asset, Data security, Legislative reform, Mobile telecoms, Privacy by design Part 1: Cutting through the Internet of Things hyperbole
Posted on October 15th, 2014 by Mark Webber
I’ve held back writing anything about the Internet of Things (or “IoT“) because there are so many developments playing out in the market. Not to mention so much “noise”.
Then something happened: “It’s Official: The Internet Of Things Takes Over Big Data As The Most Hyped Technology” read a Forbes headline. “Big data”, last week’s darling, is condemned to the “Trough of Disillusionment” while Gartner moves IoT to the very top of its 2014 emerging technologies Hype Cycle. Something had to be said.
The key point for me is that the IoT is “emerging”. What’s more, few are entirely sure where they are on this uncharted journey of adoption. IoT has reached an inflexion point and a point where businesses and others realise that identifying with the Internet of Things may drive sales, shareholder value or merely kudos. We all want a piece of this pie.
Applying Gartner’s parlance, one thing is clear; when any tech theme hits the “Peak of Expectations” the “Trough of Disillusionment” will follow because, as with any emerging technology, it will be sometime until there is pervasive adoption of IoT. In fact, for IoT, Gartner says widespread adoption could be 5 to 10 years away. However, this inflexion point is typically the moment in time when the tech industry’s big guns ride into town and, just as with cloud (remember some folk trying to trade mark the word?!), this will only drive further development and adoption. But also further hype.
The world of machine to machine (“M2M“) communications involved the connection of different devices which previously did not have the ability to communicate. For many, the Internet of Things is something more, as Ofcom (the UK’s communications regulator) set out in its UK consultation, IoT is a broader term, “describing the interconnection of multiple M2M applications, often enabling the exchange of data across multiple industry sectors“.
“The Internet of Things will be the world’s most massive device market and save companies billions of dollars” shouted Business Week in October 2014, happy to maintain the hype but also acknowledging in its opening paragraph that IoT is “beginning to grow significantly“. No question, IoT is set to enable large numbers of previously unconnected devices to connect and then communicate sharing data with one another. Today we are mainly contemplating rather than experiencing this future.
How will things be identified? – believing we have to get to a point where there are standards for things to be sensed and connected;
What will the word trust mean to “things” in IoT? – making the point we need to redefine trust in edge computing; and
How will connectivity work? – Is there something like IoTML (The Internet of Things Markup Language) to enable trust and facilitate this communication?
None of these questions are new, but his piece reinforces that we don’t quite know what IoT is and how some of its technical questions will be addressed. It’s likely that standardisation or industry practice and adoption around certain protocols and practices will answer some of these questions in due course. As a matter of public policy we may see law makers intervene to shape some of these standards or drive particular kinds of adoption. There will be multiple answers to the “what is IoT?” question for some time. I suspect in time different flavours and business models will come to the fore. Remember when every cloud seminar spent the first 15 minute defining cloud models and reiterating extrapolations for the future size of the cloud market? Brace yourselves!
I’ve been making the same points about “cloud” for the past 5 years – like cloud the IoT is a fungible concept. So, as with cloud, don’t assume IoT has definitive meaning. As with cloud, don’t expect there is any specific Internet of Things law (yet?). As Part 2 of this piece will discuss, law makers have spotted there’s something new which may need regulatory intervention to cultivate it for the good of all but they’ve also realised that there’s something which may grow with negative consequences – something that may need to be brought into check. Privacy concerns particularly have raised their head early and we’ve seen early EU guidance in an opinion from the Article 29 Working Party, but there is still no specific IoT law. How can there be when there is still little definition?
For some time we’ve been excited about the convergence of people, business and things. Gartner reminds us that “[t]he Internet of Things and the concept of blurring the physical and virtual worlds are strong concepts in this stage. Physical assets become digitalized and become equal actors in the business value chain alongside already-digital entities“. In other words; a land of opportunity but an ill-defined “blur” of technology and what is real and merely conceptual within our digital age.
Of course the IoT world is also a world bumping up against connectivity, the cloud and mobility. Of course there are instances of IoT out there today. Or are there? As with anything that’s emerging the terminology and definition of the Internet of Things is emerging too. Yes there is a pervasiveness of devices, yes some of these devices connect and communicate, and yes devices that were not necessarily designed to interact are communicating, but are these examples of the Internet of Things? Break these models down into constituent parts for applied legal thought and does it necessarily matter?
My point? As with any complex technological evolution, as lawyers we cannot apply laws, negotiate contracts or assess risk or the consequences for privacy without a proper understanding of the complex ecosystem we’re applying these concepts to. Privacy consequences cannot be assessed in isolation and without considering how the devices, technology and data actually interact. Be aware that the IoT badge means nothing legally and probably conveys little factual information around “how” something works. It’s important to ask questions. Important not to assume.
Tags:Cloud, Connectivity, Future, Internet of Things, IoT, Mobility, Regulation, Smart Devices, Trends Posted in Article 29 Working Party, Big Data, Cloud computing, Data security, Data sharing, Mobile telecoms, Privacy by design, Uncategorized Beware: Europe’s take on the notification of personal data breaches to individuals
Posted in Article 29 Working Party, Breach Disclosure, Data security, Legislative reform, Privacy by design Information Pollution and the Internet of Things
Posted on July 29th, 2013 by Olivier Proust
Tags:CNIL, data security, employee, employer, French law, Olivier Proust, privacy, right to privacy, technology, workplace Posted in Data security, Privacy by design, Uncategorized « Older Entries