#eudataprotection

CNIL, the French regulator, is now involved in technical testing of mobile applications, including the data they access while in use.  This is an indication that they are likely to take an EU lead on mobile privacy enforcement.  The PC World article includes interesting technical details.

The French National Commission on Computing and Liberty (CNIL) studied the behavior of 189 apps on six iPhones equipped with monitoring software and analysis tools developed by the French National Institute for Research in Computer Science and Control (INRIA).

The Article 29 WP in Europe has issued a detailed opinion outlining explicit consent requirements for big data applications that will have a direct impact on individuals, including advertising and market research related uses.

"Such consent should be required, for example, for tracking and profiling for purposes of direct marketing, behavioural advertisement, data-brokering, location-based advertising or tracking-based digital market research," the Working Party said in a new opinion.

In its opinion, the Working Party said that where businesses engage in big data projects that involve trying to "detect trends and correlations" from personal information, they may not require individuals' consent to process their data for that purpose providing they put in place certain safeguards. 

It said that if firms intending to use personal data for that purpose can ensure that the information is not used to "support measures or decisions ... taken with regard to the individual data subjects concerned" – such as through anonymisation measures – they may not require individuals' consent to engage in the activity.

"Although there is not, strictly speaking, new material in the opinion, the fact that several pages are devoted to the European Convention on Human Rights and the EU's Charter of Fundamental Rights indicates a hardening of attitude," Information law specialist Marc Dautlich of Pinsent Masons, the law firm behind Out-Law.com, said. "The Working Party has obviously seen fit to rehearse the arguments in full technicolour detail, complete with 22 examples at the end of the opinion to provide specific context, and indirectly demonstrate that effort has been made to anchor the guidance in real world business models."

Next week, data protection regulations come into effect in Mexico that look very similar in scope and requirements to the ePrivacy Directive in Europe.

On April 17, 2013, Mexico's new Privacy Notice Guidelines will go into effect. The Guidelines impose extensive requirements for furnishing adequate data privacy notices and obtaining consent before personal data is collected directly from a person or electronically via "cookies," "web beacons" or other automated means. The Guidelines are mandatory and particularly important to employers that regularly collect, process, and/or transfer personal data about employees or job applicants, and to companies operating or advertising in Mexico that use cookies, web beacons, and similar media technology that automatically collects personal data online. As shown in a recent decision by the Federal Institute for Access to Information and Data Protection ("IFAI" for "Instituto Federal de Acceso a la Información y Protección de Datos"), sanctions may be imposed for noncompliance.

These privacy rights are a constitutional cornerstone found in Article 16 of Mexico's Magna Carta.

It looks as though the ePrivacy Directive is taking hold in Poland, where notice systems are deploying that use a similar model to what we've seen in the UK.  Note that the Polish regulation includes fining authority of up to 3% of a year's profit, which is far higher than in the UK ... assuming that you have profits.

Is that a startup immunity clause?  ;0)  

Joanna Tomaszewska, an expert in privacy laws at Polish law firm SSW, told Out-Law.com that if users do not alter browser settings that as default enable cookies, website operators, or third parties such as advertising networks, could serve cookies providing they have complied with new rules relating to the quality of information about cookies that should be made available to users. In such cases the inaction of a properly informed user will be sufficient to constitute acceptance of cookies, she said.

"The new amendment imposes a very strict information duty that requires businesses to clearly inform website users, through easily accessible and comprehensible information, about the purposes that cookies will be served as well as detailing that users can define the conditions of processing of their data through specific software or browser settings, or by service configuration," she said. 

"The practical result has been that lots of Polish websites are now displaying banners that contain text that link through to an amended cookies policy that sets out all the information required to be provided under the revised law," she added.

This is in light of the fact that the maximum penalty for infringement is fine of up to 3% of firms' annual profits gained in the preceding calendar year.

The EU is launching the first major upgrade of its centralized system for sharing security information.  Concerns are already emerging about how the data will be combined and how broadly it will be used.

"It's important for member states to exchange data among one another more closely and join forces in fighting crime - as a counterbalance to the absence of border controls," said Markus Beyer-Pollock, spokesman for Germany's Federal Ministry of the Interior.

He criticizes the fact that SIS, including in its second generation, is intended to be a way to search for people and things, but it could be coupled with other, brand new registries. For example, a new European registry records all travels in and out from the Schengen zone. A visa information system is in the works, and the European Commission recently granted the European police force EUROPOL access to SIS II.

BREAKING: Viviane Reding and Eric Holder meet in Washington and niceties are exchanged.  Several paragraphs of fluff behind the jump.

European Commission Vice-President Viviane Reding and United States Attorney General Eric Holder met today in Washington in order to discuss various issues regarding the collaboration between the Department of Justice and the European Commission.

The meeting concluded with talks on the ongoing negotiations for a data protection agreement covering police and judicial information. Both the Attorney General and Vice-President Reding underlined the need to provide a high level of personal data and privacy protection for all individuals in the EU and the US.

Google's task with EU regulators just got a lot more complicated.  You want to avoid a multi-DPA discussion on a single issue whenever you can.

So, what now? Additional investigations and inspections by the Europeans, but this time they’re being called “enforcement actions,” and they’re being conducted by each country individually.

Six countries — France, Germany, Italy, the Netherlands, Spain, and the United Kingdom — launched actions today based on their own laws. The investigations and inspections could result in fines and restrictions, but it’s not yet clear that those would be significant.

The NY Times Bits blog covers the slow progress of baseline privacy legislation in the United States, observing the the EU is moving swiftly by comparison.  The EU expects to pass their revised data protection directive next spring, while it is difficult to envision legislative progress in the US any time in the foreseeable future.

In the United States, by contrast, a year after the Obama administration introduced the notion of a consumer privacy bill of rights, a draft has yet to be completed, let alone made public.