Article 29 Data Protection Working Party Archives

Article 29 Working Party Discusses the Right to be Forgotten

by McDermott Will & Emery | Sep 30, 2014 | Consumer Protection, Data Privacy

On 18 September 2014, the European Union’s Article 29 Data Protection Working Party published a press release outlining its recent plenary session discussions on the so-called “right to be forgotten” or “de-listed.”

The Working Party identifies that search engines, as data controllers, are under an obligation to acknowledge requests to be de-listed and establishes amongst European data protection authorities a “tool box” for ensuring a common approach to complaints handling in the case of refusals to de-list.

Background

The Working Party, made up of EU member state national data protection authorities, is an independent advisory body on data protection and privacy, set up under Article 29 of the Data Protection Directive (95/46/EC) (DPD) in order to contribute to the DPD’s uniform application.

The purpose of its latest plenary session held on 16 and 17 September 2014 was to discuss the aftermath of the European Court of Justice’s (ECJ) May 2014 ruling which recognised an EU citizen’s right to have the results of searches conducted against their name and containing their personal information removed where such information was inaccurate, inadequate, irrelevant or excessive for the purposes of data processing.

Key Messages

The Working Party has acknowledged that there is high public demand for the right to be forgotten, based on the number of complaints received by European data protection authorities relating to refusals by search engines to de-list since the ECJ ruling.

The Working Party has agreed that there is a need for a uniform approach to the handling of de-listing complaints. As such the Working Party has proposed that:

It is necessary to put in place a network of dedicated contact persons within European data protection authorities to develop common case-handling criteria; and
Such a network will provide data protection authorities with a record of decisions taken on complaints and a dashboard to assist in reviewing similar, new or more difficult cases.

Going forwards the Working Party also confirmed that it will continue to review how search engines comply with the ECJ’s ruling, having already held a consultation process with search engines and media companies over the summer.

Article 29 Working Party Defends BCR-P to European Institutions

by McDermott Will & Emery | Jul 9, 2014 | Data Privacy

On 12 June 2014, in a letter from the Article 29 Data Protection Working Party to the President of the European Parliament, the Working Party has defended, and urged the EU institutions to discuss, Binding Corporate Rules for Processors (BCR-P) in respect of the forthcoming EU General Data Protection Regulation.

In its letter, the Working Party clarifies its views on BCR-P, outlines the safeguards that BCR-P offer and addresses concerns that have led some to call for the dropping of BCR-P. The letter suggests that these issues should be covered during future trialogues between the EU Council, the European Commission (whom both received copies of the letter) and the European Parliament.

Background

Binding Corporate Rules (BCR) represent one of the ways that a data controller can overcome the general prohibition contained in the EU Data Protection Directive (95/46/EC) on cross-border transfers of personal data to countries outside the EEA that do not offer adequate levels of data protection. Broadly, BCR are legally enforceable corporate rules applied by company groups which, on the approval of the relevant national data protection authority, are deemed to ensure sufficient protection for international transfers between group companies.

In December 2011, the European Commission announced that BCR would be updated in the new EU General Data Protection Regulation. Whilst BCR only apply to data controllers, the Working Party is a proponent for BCR-P (which apply similarly to data processors rather than data controllers) and, in June 2012, established a BCR-P framework. In brief, BCR-P permit data processors, on the instruction of data controllers, to forward personal data to their group companies, otherwise known as “sub-processing”. The Working Party has officially permitted companies to apply for BCR-P since January 2013. To date, three international organisations have BCR-P approved by their national data protection authorities, with a further 10 currently under review.

In Defence of BCR-P

In its letter, the Working Party encloses an explanatory document setting out the main guarantees offered to data controllers, data subjects and data protection authorities generally, relating to:

Use of external sub-processors;
Conflict between an applicable legislation and BCR-P and/or Service agreements / Access by law enforcement authorities;
Controllers’ rights;
Data subjects’ rights;
Processors’ obligations towards data protection authorities; and
Implementation of accountability measures.

The Working Party also stresses the high level of protection that BCR-P offer to international transfers of personal data, which, according to the Working Party represent the “optimal solution” to encourage data protection principles abroad. In the alternative, the Working Party suggests that model clauses or Safe Harbour do not offer a comparable level of protection.

In response to calls for the European Parliament to drop BCR-P from future legislation due to a lack of guarantees to frame sub-processing activities, the Working Party clarifies that BCR-P offer greater levels of protection that those currently provided by the European Parliament. Furthermore, the Working Party concludes that to drop BCR-P would create legal uncertainty and represent a loss generally to those organisations with approved BCR-P or those currently [...]

Continue Reading

Article 29 Working Party Publishes Statement on the Risk-Based Approach to Data Protection

by McDermott Will & Emery | Jun 24, 2014 | Data Privacy

On May 30, 2014, the European Union’s Article 29 Data Protection Working Party adopted “Statement on the role of a risk-based approach in data protection legal frameworks” (WP281). The Working Party, made up of EU member state national data protection authorities, confirmed its support for a risk-based approach in the EU data protection legal framework, particularly in relation to the proposed reform of the current data protection legislation. However, with a view to “set the record straight,” the Working Party also addresses its concerns as to the interpretation of such an approach and sets out its “key messages” on the issue.

Approaching Risk

In support of the risk-based approach, which broadly calls for increased obligations proportionate to the risks involved in data processing, the Working Party sets out examples of its application in the current Data Protection Directive (95/46/EC) and the proposed General Data Protection Regulation. The Working Party confirms that the risk-based approach must result in the same level of protection for data subjects, no matter the size of the particular organisation or the amount of data processed. However, the Working Party clarifies that the risk-based approach should not be interpreted as an alternative to established data protection rights, but instead a “scalable and proportionate approach to compliance.” Consequently, the Working Party accepts that low-risk data processing may involve less stringent obligations on data controllers than comparatively high-risk data processing.

Key Messages

To conclude its views on the risk-based approach, the Working Party establishes 13 key messages – in summary:

Protection of personal data is a fundamental right and any processing should respect that right;
Whatever the level of risk involved, data subjects’ legal rights should be respected;
While the levels of accountability obligations can vary according to the risk of the processing, data controllers should always be able to demonstrate compliance with their data protections obligations;
While fundamental data protection principles relating to data controllers should remain the same whatever the risks posed to data subjects, such principles are still inherently scalable;
Accountability obligations should be varied according to the type and risk of processing involved;
All data controllers should document their processing, although the form of documentation can vary according to the level of risk posed by the processing;
Objective criteria should be used when determining risks which could potentially negatively impact a data subject’s rights, freedoms and interests;
A data subject’s rights and freedoms primarily concerns the right to privacy, but also encompasses other fundamental rights, such as freedom of speech, thought and movement, prohibition on discrimination, and the right to liberty, conscience and religion;
Where specific risks are identified, additional measures should be taken – data protection authorities should be consulted regarding highly risky processing;
WHile pseudonymising techniques are important safeguards that can be taken into account when assessing compliance, such techniques alone do not justify a reduced regime on accountability obligations;
The risk-based approach should be assessed on a very wide scale and take into account every potential/actual adverse effect;
The legitimate [...]

Continue Reading

Article 29 Data Protection Working Party Supports Reform

by McDermott Will & Emery | Dec 6, 2013 | Data Privacy

On December 4, 2013, the Article 29 Data Protection Working Party (Working Party) endorsed the data protection reform package presented by the European Commission, strongly encouraging all relevant parties to adopt the reform package and determine a final text prior to the end of the term of the current EU legislature.

The Working Party notes the challenges that are brought about by technological developments in the digital economy and globalization, leading to a simultaneous need for a robust and relevant EU data protection regime. In light of this, the European Commission devised a framework in January 2012 to address these issues and strengthen the rights of individuals. The Working Party has emphasised the importance of a unified, harmonized application of data protection legislation in instilling trust in citizens, with respect to governments and the digital economy. The Working Party further noted that a strong EU General Data Protection framework will be fundamental in ensuring the completion of the digital single market by 2015.

For further details, please access the Working Party press release via the following link: https://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/20131204_pr_dp_reform_package_en.pdf