#article 29 wp

The details of the story are less important than the fact that the EU Article 29 WP appears to be gaining leverage with Google.  Does Google believe that a strict version of the revised directive will pass after all?

Following mounting pressure from data protection agencies (DPAs) in different European countries, Google has started offering so-called data processing agreements to websites using its Google Analytics suite in the European Union, Iceland, Norway or Switzerland.

Up to now Google did not provide such contracts because it maintains that it does not process personal data. Since 2011 it has offered such agreements only in Germany, after demands from the German DPA.

In October last year the European Union's council of DPAs, the so-called Article 29 Working Party, asked Google to make the agreements available E.U.-wide. The issue is part of a wider ongoing investigation into Google's privacy policies by DPAs in France, Germany, Italy, the Netherlands, Spain and the U.K.

Eduardo Ustaran from FFW writes on the Article 29 WP's encouraging paper on the valuable cover Binding Corporate Rules will provide, even under a revised EU directive.

The Article 29 WP in Europe has issued a detailed opinion outlining explicit consent requirements for big data applications that will have a direct impact on individuals, including advertising and market research related uses.

"Such consent should be required, for example, for tracking and profiling for purposes of direct marketing, behavioural advertisement, data-brokering, location-based advertising or tracking-based digital market research," the Working Party said in a new opinion.

In its opinion, the Working Party said that where businesses engage in big data projects that involve trying to "detect trends and correlations" from personal information, they may not require individuals' consent to process their data for that purpose providing they put in place certain safeguards. 

It said that if firms intending to use personal data for that purpose can ensure that the information is not used to "support measures or decisions ... taken with regard to the individual data subjects concerned" – such as through anonymisation measures – they may not require individuals' consent to engage in the activity.

"Although there is not, strictly speaking, new material in the opinion, the fact that several pages are devoted to the European Convention on Human Rights and the EU's Charter of Fundamental Rights indicates a hardening of attitude," Information law specialist Marc Dautlich of Pinsent Masons, the law firm behind Out-Law.com, said. "The Working Party has obviously seen fit to rehearse the arguments in full technicolour detail, complete with 22 examples at the end of the opinion to provide specific context, and indirectly demonstrate that effort has been made to anchor the guidance in real world business models."