Digital Civil Rights in Europe

German Court rejects Data retention ! Civil liberties group call for Civil liberties activists call for the political end to retention of telecommunications data

2010-03-02T12:55:04Z

The German Constitutional court declared the data retention law as unconstitutional, in a landmark decision given today 2.03.2010.

After data retention ruling: Civil liberties activists call for political end to retention of telecommunications data

+++ Data retention opposed by 70% of German population +++ European Citizens’ Initiative for repealing the EU directive on data retention announced +++ Legal action to be continued +++

The German Working Group on Data Retention has today announced a Europe-wide campaign to end Internet and telephone data retention. This follows the German Constitutional Court’s ruling on a mass complaint made by more than 34,000 citizens. According to a newly-published poll, 69.3% of all Germans oppose data
retention, making it the most strongly rejected surveillance law.[1]

“The recording of confidential contacts and movements of the entire population in the absence of any suspicion is unacceptable and must stop immediately”, says Florian Altherr of the Working Group. “In starting an initiative to this end, the Federal Minister of Justice can count on the support of EU Commissioner Viviane Reding as well as of many states such as Austria, Belgium and Romania, all of which do not have data retention laws in place.”

“In order to bring the massive rejection of blanket data retention home to politicians we are in the process of preparing a European Citizens’ Initiative. With the signatures of one million opponents to the permanent logging of our Internet and phone use we want to pursuade the EU to repeal its data retention directive”, announces data protection activist padeluun of the Working Group.

Patrick Breyer of the Group adds: “At the same time we will continue our legal fight against data retention. Today’s decision proclaiming the recording of the entire population’s behaviour in the absence of any suspicion compatible with our fundamental rights is unacceptable and opens the gates to a surveillance state.”

The German Working Group on Data Retention is making five political demands after today’s ruling:
1. The Federal Government, the Federal Minister of Justice and Parliaments must now cooperate with other like-minded states and bodies to take steps to repeal the redundant and detrimental data retention directive.
2. The German law on data retention, going far even beyond EU requirements and - according to the German Constitutional Court - unconstitutional, must not be renewed.
3. European citizens should be given the right to file constitutional complaints directly with the European Court of Justice.
4. The Federal Government must not agree to any further collection of information on citizens not suspected of any wrong-doing in the name of security, such as the air travellers file proposed by the EU. Mass data pools
that were introduced in the past, such as the registration of Internet use by the Federal Office for Information Security or the employee information system ELENA, must be closed down.
5. An independent review of all existing “security” measures must take place in order to systematically examine their compatibility with our fundamental rights, their effectiveness, their cost, their harmful side-effects and alternatives.

Background information:

Communications data enables the tracing of who has contacted whom via telephone,
mobile phone or e-mail. In the case of mobile calls or text messages via mobile
phone, the user’s location is also logged. Data retention allows citizens’
movements to be traced and personal and business contacts to be monitored.
Information regarding the content of communications such as personal interests
and individual life circumstances can also be deduced.

A study commissioned in 2008 shows that data retention is acting as a serious
deterrent to the use of telephones, mobile phones, e-mail and Internet. The
survey conduced by research institute Forsa found that with communications data
retention in place, one in two Germans would refrain from contacting a marriage
counsellor, a psychotherapist or a drug abuse counsellor by telephone, mobile
phone or e-mail if they needed their help. One in thirteen people said they had
refrained from using telephone, mobile phone or e-mail at least once because of
data retention, which extrapolates to 6.5 mio. Germans in total.

German NGO Working Group on Data Retention (Arbeitskreis
Vorratsdatenspeicherung) organised several protest marches against the scheme.
Last year, 20.000 people protested against surveillance in Berlin.[2]

Footnotes and Links:
[1] Poll on data retention (in German):
http://www.vorratsdatenspeicherung.de/im…
[2] Protest march “Freedom not Fear”:
http://www.vorratsdatenspeicherung.de/co…

About Arbeitskreis Vorratsdatenspeicherung (German Working Group on
Data Retention):
The Arbeitskreis Vorratsdatenspeicherung (AK Vorrat) is a Germany-wide
organisation which campaigns against extensive surveillance in general and the
blanket logging of telecommunications and other behavioural data in particular.
Homepage und contact details: http://www.vorratsdatenspeicherung.de

Previous press releases:
1. Unanimous rejection of proposed telecommunications data retention
(22/01/2007): http://www.vorratsdatenspeicherung.de/co…
2. Thousands of people participated in nationwide protests against data
retention (07/11/2007):
http://www.vorratsdatenspeicherung.de/co…
3. Constitutional complaint filed against German Telecomms Data Retention Act
(31/12/2007): http://www.vorratsdatenspeicherung.de/co…
4. Historic class-action lawsuit filed against telecommunications data
collection (29/02/2008):
http://www.vorratsdatenspeicherung.de/co…
5. Data retention in Germany partly suspended by Constitutional Court - NGO
demands resignation of Minister of Justice (19/03/2008):
http://www.vorratsdatenspeicherung.de/co…
6. After ruling on data retention: activists remain confident (10/02/2009):
http://www.vorratsdatenspeicherung.de/co…
7. Administrative Court: Data retention is “invalid” (16/03/2009):
http://www.vorratsdatenspeicherung.de/co…
8. Civil Liberties Groups Ask EU to Repeal Data Retention Directive
(01/12/2009): http://www.vorratsdatenspeicherung.de/co…

More information:
1. Our mission statement:
http://www.vorratsdatenspeicherung.de/co…
2. Joint statement on data retention:
http://www.vorratsdatenspeicherung.de/co…
3. Class-action law suit against data retention:
http://www.vorratsdatenspeicherung.de/co…

This press release on the Internet:
http://www.vorratsdatenspeicherung.de/co…

WIPO Broadcast treaty resurrected in Council of Europe

2010-02-12T10:13:42Z

Article published in EDRi-gram 8.3

On January 28 and 29, the Council of Europe held a consultation meeting on the launch of work on a new international instrument that would create neighbouring rights for broadcasting organisations. The purpose of this initiative is to take up the work of the World Intellectual Property Organisation (WIPO) which, following twelve years of negotiation has been unable to reach any agreement on the objectives and scope of a proposed treaty for the protection of broadcasters and cablecasters. The draft WIPO treaty has been proposed as the basis for negotiations at the Council of Europe.

Negotiations at WIPO have stalled over two issues concerning the scope of the proposed treaty. First, the majority of WIPO’s Member States want any treaty to be limited to protecting broadcasters’ signals, rather than creating 50 year intellectual property rights to the content carried by those signals, which in most cases, is already protected by copyright. Second, many countries oppose the extension of the treaty to the Internet because that would restrict freedom of expression and the free flow of information on the Internet. Despite this, broadcasters have continued to press for treaty based on IP rights, and want exclusive rights over Internet retransmissions of recorded broadcast and cablecast programming. The current draft WIPO treaty also includes a number of other elements that raise concerns for consumers’ existing rights under national copyright laws, competition policy, and innovation, including obligations for legal entrenchment of broadcasters’ and cablecasters’ technological protection measures and an overbroad ban on decryption devices that would extend to personal computers.

See the entire article published in EDRi-gram 8.3

Belgian transposition of the Data Retention Directive

2010-02-11T10:14:57Z

Article published in EDRi-gram 8.3

The transposition of the Data Retention Directive in Belgium has remained stagnant for a long time. Following a public consultation in May 2008 on a first draft law proposal and draft royal decree to transpose this Directive into Belgian law, a broad group of organisations voiced a strong position against the Data Retention Directive and the way in which the Belgian government wanted to transpose this into the national law.

Not only did the government choose for a maximal transposition (e.g. a retention period of 24 months), but the Belgian government also chose to extend the data retention scheme provided by the European Directive (e.g. demanding more data to be retained, such as banking data, and allowing access and use of these data beyond ’serious’ crime). Even the Belgian Data Protection Authority (DPA) delivered at that time, and for the first time ever, a completely negative advice on the draft law proposal and royal decree.

Together with the public campaign on the website bewaarjeprivacy.be, all the above had an impact on some political parties taking part in the federal government, especially the French speaking ones, which made it hard - given the more general mistrust in the Belgian federal government between Dutch speaking and French speaking parties - to find a political agreement on the matter and for the responsible cabinets to proceed without adjustments.

See the entire article published in EDRi-gram 8.3

European Parliament needs to reject the SWIFT deal !!

2010-02-10T13:20:14Z

See now FAQ on Swift also in French, German, Italian and Finnish

In German
http://www.edri.org/files/SWIFT-FAQ_2010-02-10-DE.pdf

In Italian
http://www.edri.org/files/SWIFT-FAQ_2010-02-10-IT.pdf

In French
http://www.edri.org/files/SWIFT-FAQ_2010-02-10-FR.pdf

In Finnish
http://www.effi.org/uutiset/100209-swift-faq-sopimus.html

After the Civil Liberties committee in the European Parliament (EP) rejected on 5 February 2010 the interim nine-month SWIFT deal between the EU and US, now it will be up to the plenary of the EP to confirm the decision on 11 February 2010.

The interim controversial deal which provisionally came in force on 1 February was negotiated to order to provide US with a legal background, following new architechture of SWIFT (Society for Worldwide Interbank Financial Telecommunication) which does not longer mirror EU transactions in the United States since 1 January. However, the deal needs EP’s approval to become legally binding. Under the new Lisbon Treaty, which came into force in December, EP obtained extended legislative powers and has to approve any new European law.

The main argument of the EP Civil Liberties committee to scrap the deal is the lack of proper data privacy safeguards. The opponents of the agreement also emphasized that by rejecting the interim deal now would give the EU the upper hand for the final agreement, as only 60-70% of the Parliament’s recommendations on data protection have been considered in the present text.

However, the US officials are pressing EU for a final agreement on bank data access. On 6 February, during the Munich security conference, US national security advisor James Jones restated the need for EP to allow American investigators to access EU banking data in order to trace terrorism funding.

US foreign policy chief Hillary Clinton had phone conversations with EP President Jerzy Buzek, and Catherine Ashton, her EU counterpart and, together with US treasury secretary Timothy Geithner, wrote a letter to Buzek in which they expressed the hope that the EP vote would be positive for the agreement.

EDRi has also explained in an FAQ on SWIFT sent to some MEPs that the current interim framework does not meet EU data protection and privacy standards and that “in effect, the agreement would violate established EU and national law in this field, including the European Convention on Human Rights and the EU Charter of Fundamental Rights.”

EDRi is also pointing on the fact that a lot of data will in fact be shared with the US because of the technical set-up of SWIFT. Thus the company can not limit data searches to specific individuals. “In effect, it will have to (and has in the past) transfer data about all transactions from a certain country on a certain date. There have been reports that the U.S. Treasury has received up to 25% of all SWIFT transactions. This is beyond any proportionality and also puts the EU at risk of wide-scale economic espionage.”

The debate on this topic will take place today, 10 February 2010 at 15 00 CET and can be followed live on the European Parliament website. The vote will follow on 11 February 2010 at 12 00 CET.

EDRi makes a public call to all EU citizens interested in privacy issues to call their MEPs before Thursday, 11 February 2010 to tell them to vote against the SWIFT treaty.

EDRi public letter to MEPs - FAQ - Why should the “SWIFT” Interim Agreement be rejected by the Parliament? (9.02.2010)
http://www.edri.org/files/SWIFT-FAQ-2010-02-09.pdf

Live Coverage of the SWIFT debates in the European Parliament - 10.02.2010 starting with 15:00 CET
http://www.europarl.europa.eu/wps-europarl-internet/frd/live/live-vide…

US links EU security partnership to bank data deal (8.02.2010)
http://euobserver.com/9/29427/?rk=1

Clinton calls parliament chief over bank data deal (4.02.2010)
http://euobserver.com/?aid=29411

Euro MPs shun bank data deal with US (5.02.2010)
http://news.bbc.co.uk/2/hi/europe/8500132.stm

EU lawmakers slam bank data deal with US (1.02.2010)
http://www.dw-world.de/dw/article/0,,5200854,00.html

EDRi-gram: Bank data deal under heavy fire from EU Parliamentarians (27.01.2010)
http://www.edri.org/edrigram/number8.2/swift-deal-european-parliament

European Civil Society Data Protection Award - Call for nominations

2009-12-16T15:21:27Z

AEDH (European Association for the Defence of Human rights) and EDRI (European Digital Rights) launch the first edition of the European Civil Society Data Protection Award (ECSDPA). The prize aims at rewarding positive initiatives contributing to the visibility and effectiveness of right to privacy and to the protection of personal data in Europe. The ECSDPA prize will be awarded each year on 28 January, as a European Civil Society contribution to the Data Protection Day.

Such achievements and initiatives have to enhance public awareness, stimulate creative and constructive input, and favour useful exchanges of information at any level, from the very local neighbourhood to the whole European continent.

The award is open to all non-governmental organisations, trade unions, non-profit institutions and any other civil society actor from the 47 member States of the Council of Europe. The ECSDPA winner will benefit from a one week lobbying training in Brussels, travel expenses and lodging being fully covered.

The ECSDPA initiative, the first of its kind, has been made possible thanks to the support of The Law Science Technology & Society Research Group of the Vrije Universiteit Brussel (LSTS/VUB) and The Flemish-Dutch House deBuren.

You can find the operational details about the prize, including application and selection procedures, by following the link: http://www.ecsdpa.org.

The deadline for submitting nominations is 15 January 2010. Nominations should be sent to: nominations at ecsdpa dot org.

For any further information, please contact: contact at escdpa dot org

See this press release in French, German or Spanish.

Towards International Privacy Standards

2009-11-03T16:56:29Z

(Please note that all notes from Live Blogging were taken live and might contain some errors)

Last session from the Public Voice events - http://thepublicvoice.org/events/madrid0…

Presenting the declaration - Global Privacy Standards for a Global World, The Civil Society Declaration Madrid, Spain, 3 November 2009

Ms. Jennifer Stoddart, Privacy Commissioner, Canada (Canada)

Describing Canada’s situation. Other activitis from the DPA.

The Canadian DPA fully supports the Declaration.

Mr. Jacob Kohnstamm, EU Article 29 Group Vice-Chairman (Netherlands)

I am impressed not only by the things in the declaration, but also by the vast ammount of NGOs who signed. How to empower data subjects ?

Accountabilty - but to explain it better, haiving the DPAs more power to enforce.

Mr. Rafael García Gozalo, Agencia Española de Protección de Datos (Spain)

Frank and sincere support of the Spannish DPA for this Declaration. Resolution from the past conf - international resolution of privcay standard s - creating a huge map of compatibilities (you should see the presentation here) - just four issues where is the same opinion.

Mission - to draft a document according to the criteria set up by the conf. define the effective application, examine the role of self-regulation

Wanted to obtain the broadest institutional and social consensus. Now final draft for the Madrid conf.

Main features:

- not an innovative text - based of existant principles

- not a european text - looking for maximum consensus

- guarantee adequate level of protection

- importance of international transfers

- importance of self-regulation

Mr. Simon Davies, Privacy International (UK)

Mr. Simon Davies, founder of Privacy International (UK), sends a bouquet of flowers to the regulators and organizations

I missed his speech

Mr. Peter Hustinx, Supervisor, European Data Protection Supervisor (Netherlands) - closing remarks

Congratulate Public Voice and Marc. EDPS underscores the enourmos work or civil society - also on keeping other actors sharp. We agree on the increased importance of privacy in and ICT dependant. The stakes getting higher every year.

We need to focus on greater effectiveness. It should be effective in a real world - drilled to the bottom. Integrated approaches to combine.

The Lisbon treaty has a very proeminent provision of data protection. I find not only welcome this declaration and a strong signal of awareness.

String messages in the text by the spannish DPA: adopted by consensus - strong consesus of messages fromall over the world. There are innovative elements - there will be long and hard until it will be an international convention.

Responsibility is key - in implementing privacy in everything that is being done.

The emphasis is shifting from DP Authorities to responsable parties that need to prove that they did the correct thing.

The role of the DPA will change - and will need to focus where that it needs to be.

We need to fix things in RFID isues, Social networks, cloud computing.

Transborder Data Flow: Bridges, Channels or Walls? - live blogging at Public Voice event in Madrid

2009-11-03T15:37:12Z

See the previous workshops coverage

Moderator: Prof. Yves Poullet, Computing Research Centre, Facultés Universitaires Notre-Dame de la Paix (Belgium)

Mr. Pedro Martinez, Fiscal, Madrid High Court (Spain)

Data retention directive - scope to monitor citizens

Implementation in spain - software SITEL - part of Interpol. Discussion on spanish issues regarding wiretapping and data retetion directive ( The translator is doing a great job, but he has a rough time in keeping up with the speaker

Relationship between us and eu

Mr. Eddan Katz, Electronic Frontier Foundation (USA) .

inadequate protection of data.

Under the derogations - list of data that can be transferred - legal incertanty about it.

Unambigous consent - practical problems how can you differentiate between eu users and others…

Standard clauses

Binding Corporate Rules - but is just for a few organisations

EU-US safe harbour principles presented.

Safe harbour issues - yearly registration at FTC (but only for commercial entities)

But Accountability is the problem.

But all this depands on having a DPA.

Mr. Ivan Ferrando Perea, President, CENTIC (Peru)

Cross border flow - consideration from developping countries

We need a global privacy strandard- is private sector an ally in this search for a global standards ? Not likely

The lesser privacy - the more competiteveness.

Self regulation is not present in this scenario. Companies do not produce self-regulation -a good number of multinational companies apply a privacy standard lower than the one in their countries - so the civil society and developped countries are the one that should lead the topic.

A global standard can’t be based on self-egulation, needs to be a legisltion with a list of minimum standards. Global standard needs to be a comittment to adop DP legislation.

Mr. Nigel Waters, Australian Privacy Foundation (Australia)

TRansboder data flows are essential for several sectors (transport, etc.)

Big question of monitoring and enforcement. See if there are derrogation.

In Australia there are very wide exemptions and the DPA might not apply the rules.

2 types scenario:

1.Transfer of data for filling a purpose of the consumer - in this case he just needs to be informed.

2. When the private company and a govt asks for the private data to flow. In those cases the individual has almost no information or rights. Suggested: destination govt to respect human rights and principles.

Mr. Francisco Javier “Patxi” Sanjuan, UGT, Member of CLI (Spain)

Companies discovered to transfer of data and reduce costs - the changes are also affecting workers. Protecting tools for workers and their privacy … (why would anyone read so much text ?

Mr. Gus Hossein, Privacy International (UK)

A modest proposal - stop focusing on transborder data flows that much. (even though PI fought PNR, SWIFT, etc.)

Let’s stop using transborder data flows as a Trojan horse. Just having a DP Act is not enough.

PI spoke with refugees, work with UN. There is a privacy dynamic - so let’s focus on capacity building.

What is capacity building ? - civil society, consumer groups - privacy is not a new domain.

Your Data in the Cloud - Live blogging from Civil Society Privacy event - Madrid

2009-11-03T13:51:38Z

Moderator: Ms. Anna Fielder, TACD, Privacy International (UK)

Mr. Michael Donohue, OECD

Cloud computing = industralization of IT. No formal defition, cloud servicies - convienient on-demand access to services over the Internet.

Policy - security & privacy. But also procurement (govt buyer of claud services), broadband access, competition policy, IP + consumer protection.

Tension between user control and cloud opportunites (mashups, etc.)

OECD is preparing a report focusing on tech changes in ref. cloud computing.

Mr. Alexander B. Van Eesteren, Ixquick

This too commercial for my taste, just check www.ixquick.com/

Ms. Ann Cavoukian, Ph.D., Information & Privacy Commissioner Ontario, (Canada)

Cloud computing - next wave, qualitative step. We call for a higher standard, that exceeds regulation.

Privacy by design - a much higher standard that regulatory compliance in 3 key areas

Goal of data minimalization - once the info is in the cload - it will be further than the user and thefore difficult to control. Issued a paper last year in Privacy Impact Assesments (PIA) than Privacy of the Clouds - April 2008.

If you can strive to make privacy as default - this is the gold standard.

I am seeking to get organisation to make the privacy the default - both for private and public sector, because privacy trancends borders.

Mr. Andreas Kirsch, EDRi (Austria)- Data protection in the Cloud

What is new - cloud computing 2010 - several mainframes for millions of users, a few data processors, distributed across the globe, connected via the Internet.

Some potential problems:

- the location of the data - where is it?

- how to ensure proper processing ?

- data protection vs ad-financed services

- usage data - every data is recorded

- owenership data (see social networks)

- Access

- Pay per use or pay once, use freely.

- security - are you (still) in control ?

Cloud users - do not use insecure services , stay in control (keep ownership of data)

See also: Andreas: Security issues - Security Guidance for Critical Areas of Focus in Cloud Computing from Cloud Security Alliance http://bit.ly/SQbZz

Prof. Hong Xue, Director Institute for the Internet Policy & Law, Beijing Normal University (China)

Hong Xue APEC has largest internet pop, challenges? legal protection weak, wiki leaks orig in Asia, CJK China Korea Japan

Example: a woman was posted that she worked as an Internet worker and is HIV positive and combinated that info with her telephones, residence address, birthday and even her parents were discovered and were posted on the forum - but the whole posting was a hoax as a revange from her ex-boyfriend.

In 2008 first court decision for Human flesh searching - Bejing court convicted webmaster because published a a diary of a wife to commit suicide, the ex-husband that was harresed after this publication got damages from the court.

Mr. Cristos Velasco, General Director, North American Consumer Project on Electronic Commerce (Mexico)

Personal data of Internet users must receive the same protection in the claud.

First legal issue related to claud computing - conflict of law and jurisdiction. (see some countries that have no legislation - Mexico, Guatemala). How to comply with laws in different jurisdiction ?

Cross-border data transfers - under the EU data protection - data operator takes security measures and it might breach the eu law .

Is it possible under some laws to make and invetsigation in the cloud ? Are there international agreements to allow that ? What is the role of ISP ?

Also legal problem - electronic evidence in the cloud.

Due to the general concers, there is a need of policy and recommandation for cloud computing.

Questions

Sorry - no time to cover that as well, see twitter for some answers.

Ideas to conclude to include in a global standards: data breach notification, security, data minimalisation, responsability for IT infrastructure introduce in the market (see rfid), but not different standards for law enforcement usage.

Cavoukian: data minimalisation, strenghening security requirements, accountability.

Michael: global networks of privacy enforcement

Lambrinidis at the Public Voice coallition event

2009-11-03T12:22:37Z

Notes taken during the Speech (might have misssed some things):

Speech Stravros Limbrinidis - VicePresident EP

- we live in a world where everyone want to have the biggest access to our private data. And they can, today. This is the schyzofrenia of the Internet. Talk freely. Organize freely. The right to education and access to info. The 21 litteracy will be e-litteracy, including using our fundamental rights through the Internet.

Although the Internet give the explosion of these rights, it also put them into anger. Much easier for my privacy to be breached. Or my FoE to be chilled.

Example from my past: a few decades ago in Greece - a file on every citizen on what newspaper does it read. We burned those files, and today when I access any newspaper online - I left a footprint.

We should not presume to give our consent on the Internet, just because they can. Every law tthat aplies to the real world should apply to the online world. So if they can’t access snailmail, they should not access emails.

Lambrinidis: “We do not and should not be presumed to consent to someone searching us simply because they can.”

Is privacy a dispansable good ? No, only in a democracy you would find this ultimate right. The citizens should monitor the govt and private sector, not the other way arround.

Any measure to fight crime needs to be necessary, proportionate and appriopriate - few of the measures announced today by police meet the standard - enlarging teh scope - from terrorism to grave crimes and then to pickpokets. ( the terorist know that street are surveilant, then they will use living rooms to work -

If you have nothing to hide, you don’t have a life ! Get a life ! - this is not an argument, not in a democracy.

We have assigned to courts to asess these measures.

A legitimate debate in a society to decide how to use copyright. But you can’t legitimate all surveillance technologies in order to catch one criminal.

You shouldn’t play on my fear for bad people. Young people would be the first to tell you what are you talking about (even though they use social networks).

Big Brother in Europe today would not be applied in an authoritian regime. But it will be applied with our consent.

One of the bad and complicate battles that are coming up is the battle for consent.

Amendment 138 - civil society did a good job in raising awareness on this issue.

Acces to Internet should not be cut off without judicial ruling.

Amendment 138 - EP is working on a negociation to make sure that the principle stands from a legal point of view.

Blogging from the event - Global Privacy Standards for a Global World

2009-11-03T08:15:20Z

Live blogging from the Public Voice Coalition - Global Privacy Standards for a Global World - check out the programme here. Held in conjunction with the International Conference of Data Protection and Privacy

Also watch #globalprivacy on twitter or EDRi’s twitter account

Marc Rotenberg starts talking about Public Coalition, thanking Katitza Rodriguez for her help and for her efforts to make this event publicly accesible. Noting that the DPA event will have more than 1 k participants.

Spanish DPA - Mr. Artemi Rallo Lombarte, Director, Agencia Española de Protección de Datos - praises the civil society for their efforts to support privacy and considers it essential. Today’s major newspaper from Spain - El pais- presents 2 main news from privacy ( see)- so this is an important topic in the today’s life.

First panel

Moderator: Dean Anita L. Allen, University of Pennsylvania Law School (USA)

First panel

Ms. Jaiok Kim, Consumer Korea (South Korea)- privacy and DP - social issues in the last year - introduces one case - Consumers Korea and other orgs (joint action) bring lawsuit against a big Telecom - started in Apr 2008. In Dec 2008 also submitted Joint Opinion on Privacy protection Act -now the law is in the National Assembly.

There is not a specific law on privacy and electronic communication - thus the work of the NGOs that asked amendment of the Privacy law.

Too many actors ask for the unique ID number.

Behavioural targeting of online activity - possible privacy infringement - study group that prepares a Guideline on this topic.

Ms. Meryem Marzouki, European Digital Rights (France)

A few words about EDRi - be able to see national and EU trends. This presentation taks abiout privacy EU enfocement coperation.

Stockholm programm - full integration and access of databases of Police from EU.

Proposal to give access to Europol and others to EURODAC databases. (even though some countries run huge number of databases - with lacking proper control) - big content of senstive data. Enlargement of scope of databases - target vulnerable groups - minors (see Uk where the DNA is taken , France - intelligence database for public security - keep data o children from 13). Data protection Framework decision has only been adopted in dec 2008 - it lack protection from transferring of data from member countries to third countries.

It does not protects from lost data ( see events from 2007). Revision of Telecom Package includes data breach notifications, but only for ISPS.

Biometric passports - some countries go beyond the Eu requirements (see French national database). Same for the data retention directive.

Ms. Katitza Rodriguez, Electronic Privacy Information Center (Peru/USA)

Talks about Public Voice coalition, but represents EPIC - Privacy and Human Rights Report started in 1991 - joint project EPIC + PI. Contributors - experts, academics, lawyers, DPAs, Govt, EPIC staff.

In this edition 80 countries - added new countries Cuba, Indonesia. Topics: cloud computing, DNA, copyright enforcement privacy,

Major findings:

- raising CCTVs usage - to what extent it has impact to reduce crime? did not affect vanadalism or other minor or major crimes

- developing countries to implement smart ID cards - Mexico or Indonesia. The Indian govt - unique random ID - database with fingerprints and photo. Countries (israel, morroco) include fingerprints in national databases.

- Facebook - change of Terms of services - asked by EPIC.

- The biggest event Germany against data protection. In Australia more important events.

- a lot of countries change laws - including CoE - convention 108

- Important changes - many govts move fwd with biometric cards. Data protection schemes not clear how they stoped that. Next year - important on how we can support each other.

Ms. Ofelia Tejerina, Asociación de Internautas (Spain)

Key problems that Spain is seeing:

- protection of personal data in online

- CCTVs - not only buy govt, but also privat institutions

- social networks (dangers and advantages explained to minors)

- privacy in communications - legal wiretapping - asking for a better law on telecom - as on organic law (so more important). Needs judicial authority and Judge to decide reasons

- lack of resources to guarantee the security to make the most of the technology and training of staff.

Mr. Matias Altamira, Iberoamerican Information Society Research Institute (Argentina)

Editorial of Er Mercurio from Chile - 31 Oct - controversy - by the Chilean - draft law in asking telecom companies of traffic data. (police and ministry asking the data directly from telecom companies) - examples to discuss.

Discussing if the traffic data is enough for a privacy invasion. Yes (with examples).

Nothing to hide - nothing to worry about ? - key to our Constitution right to privacy - it doesn’t means that you need to hide smtg.

Questions

To Meryem : status on Edvige

M: Edvige - example of intelligence database where minors older than 13 can be registered. Last year huge mobiliazation from civil society, legal action - Govt had to withdraw the Decree.

Then law proposal to give some guarantees and to strenghen teh French DPA in respect of police database, but the govt did not want to discuss. After that - new Edvige law - so same kind of mobilisations - compliant againts this.

The law register religous beliefs, minors - legal and democratic issues.

Spain: the Ministry of Interior - urgent tapping - yes, but needs to be reported and have judicial authority in 72 hours. (same in Argentina).

Peter Schaar - more dangerous from the privacy point of the view - registering ussual behavioural and used to create profiles. Edvige is a horror database for us, because it includes many persons that did not breach any laws - they are just “risky persons” .

Artificial DNA - new technology made by the Germany Police to identify things…

Meryem: answers how the surveilance techniques are very dangerous - ths is why we have seen in UK and other countries - within a EU project - eprivacy directive opened the way of systematic profiling.

Ann Cavoukian, Ontario DPA - collection biometrics beyond ID cards - administrative purposes - business related uses, marketing - which were never intended first. trying to restrict this…

Spain: employees of public admin companies - to enter public institutions - included biometric info and included fingerprints. Considered as a disporportionate measures, so considered excessive. The Madrid DPA said that it is not a problem.

Schaar: fingerprints are just within the biometric passports - not outside, no database

Coffee Break - time to rest my fingers…

Second Session: “Privacy Activism: Major Campaigns”

Moderator: Prof. Colin Bennett, University Of Victoria (Canada)

Mr. Ralf Bendrath - Privacy Activism 2.0 - lessons learned from the fight against data retention

Feedom not Fear campaigns - biggest demonstration against surveillance in Germany. EVER.

We had no plan how to get there. Started in dec 2005, after the data retention directive was adopted. Open structures, using UGC.

Wiki AK vorrat - 2000 pages - waw ! - Javascript applet to put on your website. Special website for webmasters not to log visitors. Also Freedom speakers project. + Mass constitutional challenge - no fees on that. Creating a lot of attention for the case - with the high number of signatures.

Campaign becoming a Pop Culture, using Viral Marketing - see stasi 2.0 viral campaign.

Started with 250 participants, and then 2000 and then 15 000 part.

Good: - open structures, fun, experts for substance issues, give people jobs that they want to you.

Difficult : trust does not scale

BEUC - Ms. Willemiem Bax, BEUC (Belgium) - digital issues

Campaign for consumer rights - they’ve got an EP report on consumer confidence on the Internet, eYou Guide in the digital environment, Consumer summit, Recommandation of RFID

Mentions also the discussion on Am 138 - 4th novmber negociation.

Expert group on online marketing, Consultation on data protection directive - Privacy has become a sexy issue !

Conference next week - with 2 commissioners + EDPS at Beuc Forum

Ms. Renata Avila, Primera Palabra (Guatemala)

Guatemala - terrible history of privacy - monitoring activitis and making them dissapear - we’ve seen the abuses on personal data.

Second point - discussion forum with open source software - people who were listed on that forum worked with free software. Official media under control, so forum was the only source. Mini campaign within the members of the forum to explain how to hide their IP addresses.

Three point - Share technical tools to protect privacy - sometimes the discussion only at an academic level. Global - see Anonymous Blogging with Wordpress & Tor - http://advocacy.globalvoicesonline.org/projects/guide/

Mr. Antoni Farriols Solá, Comisión de Libertades e Informática (Spain)

Campaign - excessive collection of information by state from citizens, electronic IDs - adopted with any social debates or debate in Parliament. Campaign together with Internet users Association.

Citizens must be informed about it, informed consent - IDs are not used with the exception of tax authorities. RFID tags would also be used in passports (rumour, Antoni totally objects).

DP principles need to be respected !

David (Spain) - Association in the center in Madrid - campaigns aganist the CCTVs - as a measures to counter pickpokets or in other cases - for detecting prostitution cases….

Arguments against the relegious extremism, without pointing out… - according to official info - no one is monitoring in real time - images can be got only with a judge approval and can check the images.

Lack of information and clarity. - what would the security measures entailed - found out from the press. One of the measures adopted - public talk with an expert lawyer on CCTV, petition to collect signatures, blog. Using parody to the former olympic logo - showing other imagessubmitted for their campaign againts CCTV

Smile when you walk on the street !

See http://unbarriofeliz.wordpress.com/ for their website with nice images.

Questions

What can be done for privacy activism ? Example with the local DPA that wasn’t informed about Madrid metro system - work together DPA and civil society.

Ralf - involve people. In Germany it was about Internet, the politicianization of Internet generation. People did not understood why emails could be recorded. More attempt by the Govt to control.

There is no privacy interest, if there is an activity in a public place - this is why they allow CCTV in NY.

Guatemala: instead of raising privacy & saftey, our govts get only complicated CCTVs as the solution.

Ralf: we didn’t have impact on the law, that was adopted - but we are with it at the consitutional court. We put back privacy on the political agenda.

I’ll blog the next sessions in seperate posts. Much easier this way.