We present here the interview with Mr Giovanni Buttarelli, European Data Protection Assistant Supervisor.
“Saving jobseekers from themselves”, is the purpose of the German draft law which will regulate the use of information concerning job applicants collected on the internet by employers. What is your opinion on restricting by law the use of personal data that can be collected online?
This is an item on the agenda of the Data Protection Supervisors and lawmakers. In Germany for example, particular attention is devoted to this issue, because the German legislation is particularly detailed and advanced regarding data protection of workers, but the problem is also increasing in other countries. As an expert appointed by the Council of Europe, I wrote the new draft of recommendations that should replace Recommendation (89) 2 about data processing in job relationships. A Recommendation of the Council of Europe is not a simple invitation, it is an act addressed to the fifty or so states of the Council, who, by voting for it, commit themselves to putting it into effect. In Italy the Council of Europe recommendations have been mentioned in the delegated law about the adoption of the D.Lgs consequent to law n.675 and even in the 2003 Code itself as directive criteria for the production of ethical behavior codes. This document of mine, accompanied by research, refers to the necessity for specific new rules regarding this point. Up to now we have worked with very general criteria of transparency and accuracy, with the obligation to inform and with the evaluation of the principle of incompatibility and purpose, but these criteria are no longer sufficient because practices may be widely varied today.
Actually, it is already illegal to access social network pages under false pretences such as, for example, delegating someone to use an account or requesting job-seeker friendship on Facebook through deceit. However, even if the employer was openly present on the social network in a transparent way, the problem would occur in any case. Social networks are used in order to socialize with a limited number of people and usually for personal reasons. Therefore, we should make this kind of evaluation, perhaps drawing a distinction between social networks used for entertainment and those used for professional relationships, such as Linked_In.
Facebook’s CEO said that privacy is no longer a social norm for new generations. Yet, in Germany the proposal of teaching how to defend personal data in schools is under consideration. Is the European Supervisor considering the opportunity of teaching privacy?
The 32nd Annual International Conference of Data Protection and Privacy Commissioners recently held in Jerusalem started off with this Facebook statement in order to overturn it and to maintain that it is totally inappropriate. Even Facebook’s attitude demonstrated the opposite of what its CEO had asserted. It was not by chance that they have recently solved several serious privacy issues and in all probability they will solve others in the coming weeks. The fact that people are enthusiastic about new communication systems does not mean that it is correct to consider privacy outdated. For the younger generations this may well be true now, but not necessarily in the future, when they will have to face the consequences of those problems related to a lack of information regarding privacy on social networks.
First of all, we should find an easy way to communicate privacy to the younger generations. Pedagogical approaches must be avoided. We should not speak over their heads, trying to teach young people how to use new technologies. Paternalism will not work at all. Thus we will have to develop a better understanding of the new languages and adapt the information on privacy to the communication devices which people ordinarily use to exercise their rights. Bureaucratic forms will never be used, a user-friendly pop-up window probably will also on smartphones. For this reason the new European Commission’s Communication on the future of European law regarding this issue, draws great attention to educating the younger generations to warning and risk but also to opportunities of having new devices which are more dynamic, functional, immediate and easier to use when exercising individual rights and deleting information, for example in the event of migration from one social network to another.
Privacy by design is considered one of the most effective systems to avoid privacy violations due to the launch of new software online. Will the new European regulation order companies to add privacy consultancy in designers’ work?
Definitely yes. The European Commission’s Communication which was published in all EU languages on the 4th of November, announces the commitment of the Commission to insert privacy by design in the principles of the new discipline.
It is currently under discussion whether to consider it an independent principle or a notion that can be translated later into different practices.
What is certain is that this principle should help us to face problems from the beginning of every project in order to avoid the difficulty of developing data protection systems subsequently, when all the choices have already been made. It is therefore necessary to have technological support to solve problems of privacy, not only through privacy-oriented software but also through the creation of devices which will automatically fulfill privacy requirements, such as the erasure of data by overwriting, or setting of alerts which would allow people to know when further data use is incompatible with the original purposes, or, in addition, something that would prevent search engines from making a personal profile based on a data collection concealed from the user.
Geolocalization through GPS devices is the cause of a recent alert about privacy online. However, IP addresses have always contained localization information. Will the next European regulation specifically consider this point?
There is already an advanced regulation regarding this issue. Directive 2002/58, recently reviewed by the e-privacy Directive which must be acknowledged by Member States before May 2011, touches on these points and with all probability it will not be modified by the new European regulation. So, it will be a pillar for several years to come.
Today, the regulation already requires the approval of the userdata subject, who should be adequately informed, and the possibility of terminating a value-added service involving geolocalization. The issue is also being approaching with an eye to the retention of this kind of data in the so-called data-retention Directive. Today, for police and justice purposes, recorded data is stored for one or two years (depending on whether the data source is the telephone or telematic), which can lead to a possible excess of filing of personal communication activities.
It should also be considered that geolocalization is today mainly controlled through telephone systems, but in the near future, thanks to intelligent transport, it will operate independently of mobile telecommunication systems and will be used in the field of vehicular traffic for services such as toll payments, city centre access and safety systems. For instance, we will be able to use these devices for sending alarm messages in case of an accident. Therefore, we will once again need to have a balance between the benefits of innovative systems and the guarantee that our data will only be used on one off basis and will not be stored. In any case, it should only be used for the specific purposes of the services and not for marketing or filing.
The subject of company accountability was one of the most important topics discussed at The 32nd Annual International Conference of Data Protection and Privacy Commissioners in Israel. How will this issue be integrated into the new European regulation?
Not as a new principle, nor as an extra cost for public bodies and for the private sector. It will, however, help to give a sense of responsibility to data controllers and it will have an influence on the Data protection Authorities themselves, who will have to be more selective and must not be entirely responsible for enforcement. Our approach is to maintain the principles we have followed since 1995, while making them more dynamic and suitable for new technologies. The main point is to do things in a more responsible way; data controllers should not consider these principles as something to comply with only when there is a problem, a complaint or an appeal. They should consider their duties as something to be put into practice on a day-to-day basis. They should take on the responsibility of transforming into internal procedure everything which is necessary to adhere to the principles of law, which would mean redistributing roles and tasks, creating an internal policy and in case of appeal, complaint or inspection by the authorities, they should instantly be able to demonstrate they have been adhering to these principles. So, we will no longer have a situation in which data controllers choose not to fulfill their privacy obligations and run the risk of incurring fines, thinking that an inspection may never arrive. Instead we will have a new scenario in which the data custodian controller is conscious that protection of privacy is a daily obligation. An obligation which, if not correctly carried out, may lead data controller to face serious legal consequences. Therefore, this is something both new and not new at the same time.
[ Please note that the acronyms of the Italian legislative documents have been left in their original form.
D. Lgs. may be translated as Legislative Decree].