1 data protection and privacy rights - outline of the e-learning course council of europe help in...
TRANSCRIPT
1
Data protection and privacy rights - outline of the e-learning course
Council of EuropeHelp in the 28
Dorota GłowackaHelsinki Foundation for Human Rights
University of Lodz
INTRODUCTION
3
Main challenges
Threats to data protection are linked to the development of new technologies which are always faster than legislation
Threats coming from both public authorities as well as private companies
Different sources of law, different legal regimes
Fundamental Right Agency (FRA) report: „Access to data protection remedies in EU Member States”
General conclusion: the effectiveness of data protection and redress mechanisms is considerably low.
Main barriers for effective redress mechanisms inter alia:
1) low awareness and lack of education on data protection issues among data subjects 2) limited access to effective legal aid (low awarness among legal professionals)
Need for training of legal professionals in the area of data protection and the right to privacy
2005 2006 2007 2008 2009 2010 2011 2012 2013 20140
500
1000
1500
2000
2500
3000
979712 796
986 1049 11141272
15931879
2472
A number of complaints lodged to the In-spector General for Personal Data Protection
in Poland
Source: Statistics and reports on the website of the Inspector General for Personal Data Protection, http://www.giodo.gov.pl/138/j/en/
Objectives of the course• Understanding the key principles of data protection and privacy rights
• Knowing different legal systems protecting the right to privacy and personal data
• Understanding the legal framework concerning data protection and privacy rights
• Understanding the case law of the ECtHR and the CJEU and its domestic implementation
• Understanding the role of international and national actors
• Understanding the interplay between law and technology
• Identifying the source of law which is applicable in a specific case
• Being able to apply the source of law
• Understanding the role of legal professionals in
protecting personal data in the daily work
STRUCTURE OF THE COURSE
Structure of the course
• 10 modules • 3 parts:
I. Introduction + basic knowledge
II. The most problematic areas
III. Enforcement
Module 1:
• Introduction
• Pratcical problems
Modules 2-3:
• Legal framework (CoE and EU law, hard law + soft law, role of European courts and their jurisprudence, main actors)
• Key concepts: data protection v. privacy
• Introduction to data protection law (material and territorial scope, terminology, key principles and rules)
I. Introduction + basic knowledge
European standards
EU system:
• Charter of Fundamental Rights• Data Protection Directive• CJEU jurisprudence• WP29 opinions• EDPS opinions
CoE system
• ECHR• Convention 108• ECtHR jurisprudence• Soft law by CoE
institutions
II. The most problematic areas
Module 4: Data protection/privacy rights and health
• Protection of medical data as sensitive data (regulatory framework, main principles, jurisprudence)• Challenges related to electronic medical records • Anonymisation and pseudonymisation in health, clinical trials • New technologies, wearables, internet of things in health sector Module 5: Data protection/privacy rights and media
• Balancing freedom of expression and the right to privacy• Special role of media, protection of journalistic sources of information• Challenges related to online media (managing online newspapers’ archives,
restrictions of access to media content via search engines, liability for the third- party content, journalistic use of unverified Internet sources)
• Personal data protection and media (journalistic exemption)
Module 6: Data protection/privacy rights - e-communications and marketing
• Confidentiality of on electronic communications • Privacy policies, cookies regime• Profiling, selling of data • Spam • Data retention • Cybersecurity
Module 7: Data protection/privacy rights and disruptive technology • Surveillance technology (CCTV, drones, GPS etc.) • Internet of things, cloud computing, big data Module 8: Data protection/privacy rights in the work place
• Notion of privacy in a professional field• Surveillance of communication in a workplace, processing employees’ data
(consent as a basis for processing?)• Protection of whistleblowers • Professional secrecy
III. Enforcement
Modules 9 – 10:
• Data subjects’ rights• Legal remedies available to victims of violations of the right to
privacy/data protection (civil, criminal and administrative law regimes) and sanctions for breaches
• Role of Data Protection Authorities • Transboarder data flows (principles of transferring data to
third countries, Safe Harbor and other grounds for transferring data)
GENERAL CONTENT RULES
Excerpts from the course
[work in progress]
Module Structure: OverviewI. Freedom of
expression (FoE) and media
Scope and limitations of FoE
FoE and a special role o media
Key ECtHR standards: Article 10 v. Article 8
II. Challenges related to online
media
Managing online newspapers’ archives
Restrictions of access to media content via
search engines
Liability for the third- party content
Journalistic use of unverified Internet
sources
III. Personal data processing and
media
Journalistic exemption
MODULE: PRIVACY, DATA PROTECTION AND MEDIA
Learning Objectives
Legal professional will be able to
• Describe the data protection and privacy issues related to the processing of data in the workplace
• Understand the relevant case law of the ECtHR and of the CJEU on the rights at issue
• Interpret and apply rules properly
Module:
Privacy in a workplace
I. FREEDOM OF EXPRESSION AND
MEDIA
Module:
Privacy, data protection and media
I. Freedom of expression (FoE) and media
Art. 10 ECHR
Art. 11 ChFR
One of the rights likely to come into conflict with the right to data protection is freedom of expression which is protected both by ECHR (Article 10) and the Charter of Fundamental Rights (Article 11). When such conflict occurs, courts need to strikes a right balance in order to establish the pre-eminence of one right over the other.
Module:
Privacy, data protection and media
I. Freedom of expression (FoE) and media
Art. 10 ECHR
Art. 11 ChFR
One of the rights likely to come into conflict with the right to data protection is freedom of expression which is protected both by ECHR (Article 10) and the Charter of Fundamental Rights (Article 11). When such conflict occurs, courts need to strikes a right balance in order to establish the pre-eminence of one right over the other.
1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.
2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary
Module:
Privacy, data protection and media
I. Freedom of expression (FoE) and media
Art. 10 ECHR
Art. 11 ChFR
One of the rights likely to come into conflict with the right to data protection is freedom of expression which is protected both by ECHR (Article 10) and the Charter of Fundamental Rights (Article 11). When such conflict occurs, courts need to strikes a right balance in order to establish the pre-eminence of one right over the other.
1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.
2. The freedom and pluralism of the media shall be respected.
Module:
Privacy, data protection and media
I. Freedom of expression (FoE) and media
o FoE includes the freedom to 1) hold opinions and to 2) receive and 3) impart information and ideas.
o As a matter of principle, the protection of FoE extends to all forms of expression (through written statements, paintings, films or photographs), disseminated by any individual, group or type of media.
Click on the buttons below to find out more about the scope of the FoE in the light of the ECtHR jurisprudence.
Scope of FoE Limitations of FoE
Political, comercial and
artistic expression
Extreme expression
Freedom of information
Module:
Privacy, data protection and media
Political, comercial and artistic expression
Article 10 protects to the grate extent political expression and expression in matter of legitimate public interest (Lingens v. Austria).
The artistic expression (Müller and Others v. Switzerland) and commercial speech (Markt Intern Verlag GmbH v. Germany) are also guaranteed under Article 10. However, according to the ECtHR, with regard to these matters domestic authorities enjoy a broader margin of appreciation. The ECtHR’s scrutiny is therefore less strict than with regard to the political speech.
Module:
Privacy, data protection and media
II. Challenges related to online media
1.Managing online newspapers’ archives
In this part you will find the key human rights standards in the area of online media developed in the ECtHR and CJEU jurisprudences.
Go through all the sections by clicking „Next” or review a specific problem by clicking on one of the buttons below.
4. Journalistic use of unverified Internet sources
3. Liability for the third-party content
2.Restrictions of access to media content via search engines
Module:
Privacy, data protection and media
2. Restrictions of access to media content via search engines
In the case Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González CJEU found that the accessibility of irrelevant or outdated information concerning an individual on the internet may be – under certain conditions – restricted by delisting it from the search results.
Facts ECtHR’s judgment
The case concerned removal from the Google’s search results references to information available in the internet archives of one of the Spanish newspapers. The information regarded outdated financial liabilities of Mr. Gonzales and was published at the request of Spanish authorities in 1998. The newspaper refused to remove the information from its website even though Mr. Gonzales claimed the debt was not valid anymore and the information was no longer relevant. The individual then redirected his request for erasure to Google asking it not to show links to the newspaper in its search results when his name was entered as a search term in the search engine. Google refused. Eventually the case went to the Spanish court which asked the CJEU for a preliminary ruling on the matter.
Main concepts Implications
Module:
Privacy, data protection and media
Key ECtHR standards: Article 10 v. Article 8
The most common instances of interference with the right to private life by media are publications which target one’s reputation (such as libel, defamation, insult), disclosing facts from private life or person’s image. Below you will find the key standards developed by the ECtHR which may help with finding the right balance between FoE and right to privacy in such cases.
Practical tip
In FoE cases the ECtHR examines the type of expression (political, commercial, artistic, etc.), the means by which the expression is disseminated (personal, written media, television, etc.), and its audience (adults, children, the entire public, a particular group). All these factors have implications for the final assessment of the case.
Protection of unpopular or offensive ideas Facts v. value judgments
Privacy and public figuresProportionality of
sanctions
Module:
Privacy, data protection and media
Proportionality of sanctions
The imposition of disproportional sanctions for the exercise of the FoE may lead to a so called “chilling effect”. The chilling effect may likely discourage the author from making criticism of that kind again in future and deter them from contributing to a public debate (Lingens v. Austria). The character of sanctions is therefore an important factor in deciding whether the interference with the Article 10 was “necessary in a democratic society”.
Example
According to the ECtHR especially the criminal penalties should be subject to a strict scrutiny. The imposition of criminal sanctions for defamation, even if they are relatively light, may still cause a chilling effect (Długołęcki v. Poland). However this may also apply to disproportionately large damages awarded in the course of civil proceedings (in Tolstoy Miloslavsky v United Kingdom the applicant was ordered to pay £1,500,000 in damages for defamation - the sum awarded was three times the size of the highest libel award ever imposed in the country before).
Too severe sanctions
Chilling effect
Module:
Privacy, data protection and media
Key takeaways +
Additional readings
Question 1
Right to privacy is protected both under the CoE’s European Convention of Human Rights and by the EU’s Charter for Fundamental Rights whereas personal data is protected only under the Charter.
TRUE
FALSE
Module:
Legal framework
Question 1
Right to privacy is protected both under the CoE’s European Convention of Human Rights and by the EU’s Charter for Fundamental Rights whereas personal data is protected only under the Charter.
TRUE
FALSE
CORRECT FEEDBACK
Even though personal data protection is not explictly mentioned in the ECHR (as it is in the Charter of Fundamental Rights) it is accepted due to the ECtHR’s jurisprudence that it is covered by the Article 8 of the Convention protectiing private and familiy life, home and correspondence.
Module:
Legal framework
Thank you!