Privacy Laws B usiness data protection and privacy worldwide No. 35 Jitme 1996 For many years, Italy and Greece have lagged behind other European Union Member States in terms of adopting a comprehensive data protection law. Their lack of such a law has provided one of the reasons for adopting the EU Data Protection Directive. Now there are signs of change. Greece, under a new prime minister, has prepared a new draft law which reflects the EU Directive's reqirements. Italy, only narrowly, failed to adopt a bill at the end of last year. Now, Italy's new government has given the rewived bill priority status to speed its passage through the legislature (p.2) and it is expected to be adopted later this year. There are signs of the Member States now tackling with urgency the challenge of transposing the EU Data Protection Directive into national law. Sweden and Spain have officially designated their Data Protection Authorities as their official supervisory bodies. The Netherlands is close to a draft law. Belgium's Conseil d'etat cited the EU Directive when giving its advice on the draft royal decree on exemptions from registration, published in Le M oniteur Beige on 15th March. Germany's Federal Data Protection Commissioner has submitted a paper to the Interior Minister. Denmark has established a committee, chaired by the: former director of the Registertilsynet, which also includes the current director and the leading academic expert. The UK's Data Protection Registrar has published a detailed paber inviting all interested parties to join the debate (p. 16). Of course, domestic agendas remain. Public spending cuts have encouraged some fundamental thinking on the rbsources which can be devoted to funding the work of Data Protection Authorities. The Director General of Sweden's Data Inspection Board discusses the limits of her powers in an increasingly computerised society (p. 7). The UK's Home Office published, on 19th June, its white paper on access to criminal records for employment and related purposes. We will discuss the policy implications for employers, the police and the individual in our next issue. j2, i in this issue Italy's new government gives priority to data protection b i l l.... 2 subscription form... 3 Italy's Data Protection Bill's main features.... 4 Ontario defines privacy protection principles for voice mail system s.. 5 What can Privacy Commissioners do? The limits of bureaucratic intervention.... 7 Hungary adopts new sectoral data protection laws... 11 US Department o f Health appoints a Privacy Advocate... 14 The UK Registrar stimulates debate on implementation of the EU Data Protection Directive... 15 Data Protection and the Police workshop papers available... 16 Publisher: Stewart H Dresner Privacy Laws & Business Roxeth House, Shaftesbury Avenue, Harrow, Middlesex, HA2 OPZ, United Kingdom. Tel: 0181 423 1300 (UK) +(44) 181 423 1300 (Int) Fax: 0181 423 4536 (UK) +(44) 181 423 4536 (Int) Copyright 1996 Privacy Laws & Business ISSN 0953-6795 Stew art D resner, Publisher.,... Privacy Laws & Business cannot accept liability for any advice given. Reproduction and transmission in any form without prior permission prohibited.
1 Italy s new government gives priority to data protection bill Italy remains the only European Union Member State, together with Greece, where a comprehensive data protection law has not yet been enacted. The Privacy Laws & Business Newsletter has been reporting on successive bills since 1987. However, this month, the new government submitted data protection bills to the Chamber of Deputies and Judge Giovanni Butarelli, the principal author of the bills, based at Italy s Ministry of Justice, reports that the new government has made use of the priority route to facilitate adoption of the draft legislation. Here he explains the background to the bill and then summarises the main features. In 1989, Italy s Parliament authorized the ratification of the Council of Europe Convention no. 108. The instrument of ratification has not yet ben deposited. No general law in Italy governs data protection. Instead, special provisions apply which are found in different laws. In November 1993, Italy s Chamber of Deputies approved, almost unanimously, a data protection bill (no. 1670/S). However, in February 1994, it came to a halt in the Senate owing to heavy pressure exerted by a number of organisations in the private sector which opposed provisions, especially the protection of data relating to legal persons. Following national political elections in March 1994, the Ministry of Justice considered a few modifications aimed at ensuring undiminished protection of personal data wth less red tape and general costs for data controllers, for example: a few cases of exemption and simplification regarding notification the number of provisions applying to data on legal persons was reduced a few periods of time laid down in the transitional provisions were extended the principle of intent was given greater weight regarding a few criminal offences. In January 1995, the Italian government approved a new bill (1901/C) whose framework was largely similar to the previous one, although introducing modifications in accordance with the text of then current version version of the EU Data Protection Draft Directive. The bill aimed to implement the basic principles in the Council of Europe Convention and took into consideration the EU Directive, except for a few issues, such as applicable national law and transfers of data to third countries which will be addressed at a later stage. Following a lively debate of ovler 10 months duration, the bill was approved without major amendments in November 1995 after having been split into two separate items (no. 296/S and no. 2343/S). Dissolution of Parliameni: in January 1996 prevented the bills from bein g passed at this stage. However, on 7th June this yeail, the Government which resulted from the general elections of 21st April, again submitted the bills to the Chamber of Deputies without any amendments, in order to make use of the priority route established by parliamentary regulations. Obviously, changes may still be made to the texts. The new government has stated that it intends to deposit the instrument of ratification of Council of europe convention no. 108 immediately the bills are adopted into law. P u b lic o p in io n p u s h e s b ill fo rw a rd The temporary exclusion of Italy from the Schengen agreement, owing to the absence of a data protection law, caused an uproar in the media and public opinion. For the first time since there was an attempt to adopt a data protection bill in 1975, the new government went beyond a formal commitment and undertook to rapidly approve the current data protection bill. The approach favoured by the law s opponents, to approve a data protection bill relating only to the Schengen Information System, was considered not practical. Instead, the government considered that a comprehensive law was necessary to allow ratification of Convention no. 108 Reactions to the bill were mixefd The bill was judged favourably by all branches of the public administration. Conversely, despit^ the many amendments meeting the requiremi dnts of the private sector, it was received with greater and more spirited opposition by publish ers, computer equipment companies, insurance c bmpanies, small and medium-sized companies whidl h fuelled a Page 2
lively campaign against its approval in the press and through reports submitted to Parliament. T im e t a b le It is expected that the bill will be finally approved by September 1996 and enter into force in January 1997. By the third week of June, 23 of the bill s 45 articles had been approved. The long period of discussion in Parliament is due to the painstaking paragraph by paragraph analysis by the parliamentary review committee and a lively debate caused by the mass media s request for exemption the provisions of this law which many parliamentary groups considered out of all proportion to their perceived problems with the bill. The competent parliamentary commitee strengthened the safeguards provided for in the government s bill, for example, by establishing the same rules for automated and manual data. The committe has not, so far, considered any amedments conflicting either with the principles of the Council of Europe Covention no. 108 or with the principles or with the guidelines proposed by Italy s private sector. Probably, for the first time in the history of the Italian legal system, the bill expressly mentions the Council of Europe s individual recommendations in the field of data protection, including R (95) 4 on telecomunications. The bill provides for the issuing of delegated legislation in which the general data protection principles set out in the new law will be implemented through specific regulations governing the individual areas which are covered by the Council of Europe recommendations. These regulations must follow guidelines established by the new law. P r o g r e s s o n o th e r d a ta p r o t e c t io n in itia tiv e s Italy has ratified EU Directive 388 on access and competition in the field of telecommunications and introduced a clause which specifies that there will be no prejudice to the implementation of any provisions on data protection approved in the future. The most widely debated data protection issue concerns the relationship between data protection and the new telecomunications media; and the way in which future legal provisions governing the transfer of data to third countries should be applied to Internet conections. It is widely expected that a law will be adopted which would include: establishing the responsibilities of service providers and users whether anonymous access to bulletin board systems should be permitted, and whether encryption systems may be used. Subscription Form The 1996 subscription: five issues, legislation and information service. Subscription 250 (UK), 265 (elsewhere). Sample copy free on request. Your name and address... Telephone...Fax... You may pay by: 1. Cheque enclosed made payable to: Privacy Laws & Business 2. Credit card: American Express Visa Mastercard or Access (please indicate your card) Credit card number... Expiry Date... Card billing name and address if different from above... 3. Please invoice me... Signature... Date... G U ARAN TEE If you are dissatisfied with the newsletter, the unexpired portion of your subscription will be repaid. Privacy Laws & Business, Roxeth House, Shaftesbury Avenue, Harrow, Middlesex, HA2 OPZ, UK. Telephone: + (44) 181 423 1300 Fax: (44) 181 423 4536 Page 3
t Italy s Data Protection Bill s main features Italy s Constitution includes provisions relating to data protection. Such provisions define the level of the balance of interests involved - as seen also in the laws concerning personality rights and in those governing economic activities. The laws concerning economic activities, according to jurisprudence, cannot be in conflict with the principles of personal freedom and human dignity. Moreover, there are several special laws (Workers Statute, AIDS laws, right of access to public documents) which the bill leaves intact. Scope of the Bill: The new data protection law will not immediately apply to police data files (which are governed by Law no. 121 of 1981), to intelligence agencies, to justice or to matters under State secrecy - except as related to the principles of data security, quality of data, automated profiles and control by the supervisory authority. Still, the new data protection law will immediately apply to these sectors with regard to those articles allowing immediate ratification of the Strasbourg Convention and the Schengen Agreement. It will be determined, through delegated legislation, whether, and the extent to which, some principles may be applied to the processing of the above data. Manual data: Manual data falls within the scope of the bill. The preceding Government hasdproposed that manual data should be governed by this law only if it was (or was expected to be) included in data files. The preceding Parliament held that they should be protected in any case. Public and private sector: This distinction is related above all to the procedures for obtaining the data subject s consent. Consent is required only in the private sector, as an alternative to the requirements that are set out in the EU directive. Information to the data subject: It is to be provided only at the moment of data collection (except for cases of right of access). Parliament can be expected to introduce amendments which entail further obligations in this area, as is provided for under article 11 of the EU Data Protection Directive (95/46/EC). Data subject s consent: Consent is to be given in writing only for sensitive data. In other cases, express consent (orally or in writing)! must be given freely and in a specified form. Notification: To facilitate control by the supervisory authority and exercise access rights: a simple notification is available covering a wide range of personal data classes a similar notification applies to data transfer to third countries a special authorization is required for the processing of sensitive data. Security: This principle has been assigned a high level of priority, with effects in the fields of civil and criminal legislation. Specific dec rees will set out more detailed rules. Special safeguards are required for appointing a data processor and a processor must comply with them. Legal persons and deceased person!;: Data relating to legal persons falls within ihe scope of the bill as well as those concerning various other bodies. The processing of such data is not governed by the rules applying to the transfer of data to third coutnries and to the right of access. The rights concerning deceased persons may be exercised by those who have a justified interest. Supervisory authority: The powers conferred on the independent supervisory authority are wide-ranging and include: keeping of the registry of processings, powers of direct access, and control. Any data subject may apply to the supervisory authority either through a simple clai m or by formally lodging a complaint which institutes a legal proceeding. The final decision rendered by the authority at the end of this procei eding is to be complied with under sanction of a cri iminal penalty. Such a decision may be appi icaled against by legal means. The data subject mai also decide to apply directly to the judicial author: ities. Other features: The bill also include s the concept of anonymous data, an equal discipline for temporary processing, rules concemi: :ig codes of conduct, transititonal provisions, admii nistrative and criminal punishments, regulations applying to research and statistics, provisions go Veming transfer of data to third countries. Page 4
f Ontario defines privacy protection principles for voice mail systems Information and Privacy Commissioner for Ontario, Tom Wright, issued, last October, a set of privacy protection guidelines aimed at users of voice mail systems. This is a third in a series of extremely useful papers produced by the Commissioner s Office to help organisations in both public and private sectors deal with privacy issues, related to technology in the workplace, arising from the widely used facilities and technologies - facsimile transmission, e-mail and voice mail systems. The has already reported on guidelines for fax transmissions and e-mail systems (PL&B, Feb 1995, p.4, Dec 1994, p.8). Both private and public sector organisations should find the voice mail principles useful in their development and implementation of corporate voice mail policies. The widespread use of voice mail and its popularity continues to expand on a daily basis. Many advantages have been recognised by its users; it facilitates communications, improves customer service, reduces time spent on hold, returning calls or talking on the phone. It can even enhance privacy since personal messages are communicated directly to the user, rather than through someone taking a message. However, the voice mail system also has a negative side. Insecure systems or improper set-up and implementation can result in privacy breaches, as well as poor customer service. Voice mail security becomes even more critical with developments in technology and computer systems being increasingly integrated with telephone systems. These integrated systems can provide voice mail, e-mail, fax on demand, interactive voice response and other technologies at the desktop. The greater the number of connections, the greater the vulnerability of all those technologies to unauthorised access. That is where a corporate policy on privacy issues involved in these new technologies becomes essential. Voice mail raises potential privacy concerns for senders, recipients and individuals who are the subject of voice mail messages. The principles developed by the Information and Privacy Commissioner are not meant to be a standard set of guidelines applicable to all organisations. Due to different varieties and uses of voice mail systems, the guidelines are more of a framework for the development and implementation of an organisation s own privacy protection policies for the use of voice mail. They may need to be supplemented by examples specific to an organisation in order to increase employees understanding of the principles. T h e p r in c ip le s 1. The privacy of voice mail users should be respected and protected. Voice mail should be considered a private communication between the sender and recipient. However, due to the inherent characteristics of most voice mail systems, it is not possible to guarantee complete privacy. It is up to organisations to ensure that the system is set up and operated to guarantee the best possible degree of privacy and security. Unless organisations strive to offer the highest degree of privacy, employees may be reluctant to use voice mail to its maximum potential, hence annulling all the advantages of using the system. 2. Employees should receive proper education and training regarding voice mail and the security/privacy issues surrounding its use. The more users know about voice mail systems, the better able they will be to protect both their own privacy and that of others. Any training should make the employees understand the following: the voice mail process in not inherently private a message that has been sent or deleted may still exist voice mail systems can be broken into voice mail technology may work against privacy. 3. Each organisation should create an explicit policy which addresses the privacy of voice mail users. A formal and clear policy on voice mail privacy creates employees expectations, helps to establish trust between employees and management, prevents litigation, wrongful termination law suits Page 5
f a n d h a r m f u l p u b lic it y. E m p lo y e e s s h o u ld b e m a d e a w a re o f t h e ir r ig h ts a n d o b lig a t io n s u n d e r th e p o lic y a n d a g re e to a d h e re to it. A s a m in im u m, the p o lic y s h o u ld set o u t the f o llo w in g : a p p r o v e d u s e s o f the v o ic e m a il s y s te m t h ir d p a r t y a c c e s s to v o ic e m a il, in c lu d in g c o n d it io n s a n d p r o c e d u re s f o r a c c e ss c o n s e q u e n c e s o f v io la t io n s o f the v o ic e m a il p o lic y. 4. Each organisation should make its voice mail policy known to employees and inform them of their rights and obligations regarding the confidentiality of messages on the system. A l l s t a f f s h o u ld b e in f o r m e d a b u t t h e ir p r iv a c y r ig h ts a n d o b lig a t io n s r e g a r d in g th e u se o f v o ic e m a il in the w o r k p la c e. B y s e ttin g a c le a r p o lic y a n d s ta n d a rd th a t e v e r y o n e u n d e rs ta n d s a n d a g re e s w it h, u s e rs w i l l k n o w w h a t to e x p e c t r e g a r d in g th e c o n f id e n t ia lit y o f m e s s a g e s o n the s y s te m. 5. Voice mail systems should not be used for the purposes of collecting, using, retaining and disclosing personal -------------------- inform ation, without adequate safeguards to protect privacy. E v e r y c o h e r e n t c o rp o ra te v o ic e m a il p o lic y h a s to r e c o g n is e th a t in a d d it io n to p r o te c tin g the p r iv a c y o f v o ic e m a il u s e rs, in d iv id u a ls w h o a re s u b je c ts o f v o ic e m e s s a g e s a ls o r e q u ir e p r o te c tio n. S o m e fe a tu re s in h e r e n t to v o ic e m a il m a y c o n tr ib u te to b re a c h e s o f f a ir in fo r m a t io n p r a c tic e s, s u c h a s th e e ase w it h w h ic h p e rs o n a l in f o r m a t io n c a n b e in t e n t io n a lly o r u n in t e n t io n a lly s e n t/ fo r w a rd e d. T h e fu r th e r p e rs o n a l in fo r m a t io n b e c o m e s f r o m its o r ig in a l s o u rc e, the m o re d if f ic u lt it b e c o m e s to a d h e re to f a ir in fo r m a tio n p r a c tic e s. S in c e r e c ip ie n ts o f p e rs o n a l in f o r m a t io n m a y b e u n a w a r e o f th e o r ig in a l p u rp o s e f o r w h ic h the in f o r m a t io n w a s c o lle c te d, th e y m a y in a d v e r te n tly u se o r d is c lo s e it f o r a n in c o n s is t e n t p u rp o s e. F o r a ll th e se re a s o n s, s u b s c r ib e r s m a y w is h to r e c o r d g r e e tin g s th a t d is c o u r a g e c a lle r s f r o m le a v in g m e s s a g e s c o n ta in in g s e n s itiv e in fo r m a tio n....subscribers may wish to record greetings that discourage callers from leaving messages containing sensitive information. 6. Organisations should pursue technological methods o f protecting voice mail privacy. O r g a n is a t io n s s h o u ld c o n d u c t p r iv a c y im p a c t a sse ssm e n ts o f p r o p o s e d o r e x is t in g s y s te m s to d e te rm in e h o w a n d w h e n p r iv a c y m a y b e th re a te n e d a n d a d d re s s v u ln e r a b ilit ie s b e fo r e p r o b le m s o c c u r. S e c u r it y n e e d s o f e a c h o r g a n is a t io n w il l v a r y d e p e n d in g o n d ie ty p e o f in fo r m a t io n th a t is c o m m u n ic a t e d v ia v o ic e m a il a n d the s y s te m s le v e l o f in te g r a tio n w it h th e o f f ic e c o m p u te r n e tw o rk. T h e r e fo r e, a r is k a sse ssm e n t s h o u ld b e c o n d u c te d to d e te rm in e the o r g a n is a t io n s s e c u r ity n e e d s a n d s e le c t a s y s te m w it h a n a p p ro p ria te le v e l o f s e c u r ity. T h e r e a re s e v e ra l t e c h n o lo g ic a l w a y s in w h ic h th e p r iv a c y / s e c u r t y o f v o ic e m a il u s e rs a n d s u b je c ts c a n b e e n h a n c e d. T h e s e c u r ity p r o b le m s c a n b e t a c k le d a n d m e a s u re s b e im p le m e n te d o n th re e le v e ls : b y v o ic e m a il u s e rs b y s y s te m a d m in is tr a to r s b y a u to m a tic s e c u r it y fe a tu re s o f th e s y s te m. 7. Organisations sho develop appropriate security procedures to projtect voice messages. P r iv a c y p r o te c tiv e p o lic ie s a n d t e c h n o lo g ic a l fe a tu re s w il l o n ly b e e f f e c t iv e to the e x te n t th a t th e y a re a c c o m p a n ie d b y a p p r o p ria te p r o c e d u re s to p r o m o te a n d m a in t a in p r iv a c y, c o n f id e n t ia lit y a n d s e c u rity. N e w F a x S e c u r it y G u id e lin e s T h e O f f ic e o f th e I n fo r m a tio n a n d P r iv a c y C o m m is s io n e r f o r O n t a r io h a s is s u e d, y e a r, a n u p d a te d se t o f Guidelines on Transmission Security. F ir s t d e v e lo p e d in 1 9 8 9, a n d u p d a te d in 1 9 9 0, the G u id e lin e s h a v e b e e n r e v is e d o n c e a g a in as a r e s u lt o f the c h a n g e s in fa x a n d c o m m u n ic a t io n s t e c h n o lo g y, in c re a s e in c o m p u tin g p o w e r, th e u s e o f n e t w o r k e d s y s te m s, a n d the In te rn e t, a n d the g r o w in g n u m b e r o f p r o v id e r s o f f e r in g o n - lin e s e rv ic e s. in A p r i l th is Facsimile To obtain these documents, contact the Office of the Information and Privacy Commissioner/ Ontario, 80 Bloor Street W est, Suit; 1700, Toronto, Ontario, Canada, M5S 2V1. Tel + 1 (416) 326 3333 Fax: + 1 (416) 325 91955 Page 6
f What can Privacy Commissioners do? The limits of bureaucratic intervention W ith lim ited resources and powers, it is clear that there are lim its as to what Privacy Commisioners can achieve. The following report is an edited version of a presentation given by Anitha Bondestam, the Director General of Sweden s Data Inspection Board, at a conference last month in Victoria, British Columbia, Canada. As Sweden adopted the first national data protection law in 1973, there is a long perspective to reflect on the role of a Privacy Commissioner in a changing society. It s o u n d s o b v io u s th a t the lim it s o f b u re a u c ra tic in te r v e n t io n a re o f a t le a s t th re e d iffe r e n t k in d s, lim it s p r e s c r ib e d b y legislation, lim it s o b s e rv e d f o r political re a s o n s, a n d lim it s o b s e rv e d voluntarily. M o r e o v e r, circumstances beyond control m a y im p o s e y e t a fo u r th se t o f lim it s. A n d f in a lly, I h a v e so m e id e a s a b o u t h o w w e m ig h t be a b le to p e r f o r m o u r d u tie s without being bureaucratic. I s h a ll b e g in w it h th e le g is la tiv e lim it s. 1. L e g is la t iv e lim its S w e d e n is a la n d o f o p p o rtu n itie s. In S w e d e n, th e re a re v ir t u a lly n o lim it s to w h a t th e P r iv a c y C o m m is s io n e r c a n d o u n d e r the la w. T h e D a ta A c t o f 1 9 7 3 - the o ld e s t n a tio n a l D a ta P r o te c t io n A c t in th e w o r ld - o ffe r s the P r iv a c y C o m m is s io n e r a n a lm o s t u n lim it e d r ig h t o f b u re a u c ra t ic in te r v e n t io n w h e n e v e r p e rs o n a l d a ta a re a u t o m a t ic a lly p r o c e s s e d, b e it in the p u b lic o r p r iv a t e d o m a in. T h e P r iv a c y C o m m is s io n e r c a n is s u e d ir e c t iv e s, s a n c tio n e d b y p e n a ltie s, to p r iv a te f ir m s, o r g a n is a t io n s, lo c a l g o v e rn m e n ts, g o v e r n m e n ta l a u th o ritie s, a n d p r iv a t e c it iz e n s. E a c h y e a r w e is s u e so m e 7,0 0 0 s u c h d ir e c tio n a l r u lin g s. F o r in s p e c tio n p u rp o s e s, th e P r iv a c y C o m m is s io n e r h a s the r ig h t o f e n try in to a n y p r e m is e s w h e r e p e rs o n a l d a ta a re p ro c e s s e d, as w e ll as a c c e s s to a ll d o c u m e n ts c o n c e r n in g s u c h d a ta p r o c e s s in g. A c c o r d in g ly, S w e d e n s h o u ld b e the p r o m is e d la n d f o r a P r iv a c y C o m m is s io n e r, th a t is, in t h e o ry. T h e re a l w o r ld, as so o fte n h a p p e n s, p o s e s p r o b le m s, a m o n g th o se n o t le a s t the s h o rt tim e p e rs p e c tiv e o f p o lit ic ia n s. 2. P o lit ic a l lim its W h e n the s o c ia l c lim a t e c h a n g e s, a ttitu d e s to the p r o te c tio n o f p r iv a c y c h a n g e a s w e ll. T o d a y, the b u d g e t d e f ic it is the o v e r w h e lm in g p r o b le m o f the p o lit ic ia n s. T h e p r o b le m s o f th e P r iv a c y C o m m is s io n e r th e re b y a re in c r e a s in g, b e c a u s e p r o te c tio n o f p r iv a c y d o e s n o t c o m e f o r fre e. A t the e n d o f th e 1 9 8 0 s, th e re w a s n o la c k o f fu n d s in S w e d e n. O n e c o u ld a f f o r d to ta k e a p o s it iv e a ttitu d e to is s u e s o f p r iv a c y. The personal identification number ( P I N ), in tr o d u c e d in S w e d e n in the la te 1 9 4 0 s w a s lo o k e d a t as a n e v il, a s y m b o l o f B ig B r o th e r, th a t h a d s o o n to b e e lim in a t e d, at le a s t in p r in c ip le. F o r th a t re a s o n, so m e ru le s w e re a d d e d to th e D a ta A c t in 1 9 9 2, to lim it th e u se o f P I N s. F o llo w in g the C a n a d ia n d e c is io n to re d u c e the u se o f P I N s, the S w e d is h g o v e r n m e n t in 1 9 9 3 a p p o in te d a c o m m itte e w it h th e ta s k o f f in d in g a c u re f o r the e x c e s s iv e u se o f P I N s. T h e c o m m itte e r e c o m m e n d e d th a t P I N s, n o w p u b lic, s h o u ld b e tre a te d as se cre t. A t th e tim e the c o m m itte e p re s e n te d its r e c o m m e n d a tio n, it w a s a lr e a d y 1 9 9 4, a n d a ttitu d e s to n e w g o v e r n m e n ta l e x p e n d itu re h a d c h a n g e d. T h o s e p u b lic a n d p r iv a t e o r g a n is a tio n s in v it e d to p re s e n t o p in io n s o n the p r o p o s a l d e liv e r e d a d e v a s ta tin g c r it ic is m, a n d the re c o m m e n d a tio n e n d e d in the w a s te -b a s k e t. A n o t h e r e x a m p le o f a p o lit ic a l lim it c o n c e r n s the pre-investigation police file. A p r e - in v e s tig a t io n p o lic e f ile m a y c o m p r is e d a ta o n p e o p le w h o m ig h t h a v e s o m e th in g to d o w it h a c r im e b u t a re n o t n e c e s s a r ily s u s p e c te d o f a p a r t ic u la r c r im e. S o m e b o d y m a y h a v e e x it e d f r o m a b u ild in g w h e re a w e ll- k n o w n d r u g -p u s h e r is re s id e n t, o r h a s b o u g h t a c a r h e s h o u ld n t b e a b le to a ffo r d, o r h e h a s m a d e a s iz e a b le d e p o s it in h is b a n k. H e d o e s n o t k n o w th a t he is o n th e p o lic e f ile, s in c e th e re is n o p u b lic a c c e s s to th o se in v e s tig a tio n s. A s la te as in 1 9 9 2, g o v e r n m e n t tu rn e d d o w n th e id e a o f c o m p u te r is e d p r e - in v e s tig a t io n f ile s. T h a t w a s in 1 9 9 2, h o w e v e r. J u s t t w o y e a r s la te r, the g o v e rn m e n t c h a n g e d a d e c is io n m a d e b y the D a ta I n s p e c tio n B o a r d, w h e r e th e B o a r d h a d r e fu s e d p e r m is s io n to th e F in a n c e P o lic e Page 7
f F o r c e, a s e r v ic e r e s p o n s ib le f o r f ig h t in g m o n e y - la u n d e r in g, to se t u p a p r e - in v e s tig a t io n f ile th a t m ig h t w e ll c o n ta in d a ta o n the b a n k in g b u s in e s s o f in n o c e n t in d iv id u a ls. T h is f ile g a v e n o r ig h t f o r th o se re g is te r e d to k n o w th a t th e y w e re o n th e f ile. T h e e c o n o m y a n d e c o n o m ic c r im e s h a d tu rn e d o u t to b e m o re im p o r ta n t th a n p r iv a c y. A n d ju s t r e c e n t ly, th e fo r m e r D ir e c t o r G e n e r a l o f th e D a ta I n s p e c tio n B o a r d, M a t s B o r je s s o n, c o m m is s io n e d b y the g o v e r n m e n t to s tu d y the is s u e, h a s p r e s e n te d a b lu e - p r in t f o r a la w b o th o n a c o m p r e h e n s iv e p r e - in v e s tig a t io n f ile a n d a D N A f ile. T h e c lim a t e h a s tu rn e d h a rs h e r. J u s t fo u r y e a rs a g o, g o v e r n m e n t tu rn e d d o w n a p r e - in v e s tig a t io n f ile p la n n e d to b e k e p t in the h a n d s o f the p o lic e fo rc e. A c o u p le o f m o n th s a g o, s o m e b a n k s a p p lie d f o r p e r m is s io n to se t u p t h e ir o w n p r e - in v e s t ig a t io n f ile o f u n u s u a l tra n s a c tio n s. T h e D a ta I n s p e c tio n B o a r d o f c o u rs e tu rn e d d o w n th e id e a, b u t the b a n k s h a v e a p p e a le d to the g o v e r n m e n t. I d a re s a y th a t ju s t a c o u p le o f y e a rs a g o, the v e r y th o u g h t o f a p r iv a t e c r im in a l f ile w o u ld h a v e b e e n u n t h in k a b le. A t h ir d e x a m p le c o n c e r n s cross-matching. B y c r o s s - m a tc h in g, I m e a n o b t a in in g d a ta f r o m o n e o r m o r e p e r s o n a l d a ta f ile a n d t r a n s fe r r in g the d a ta to a n e w f ile. C r o s s - m a t c h in g f a lls u n d e r the p r o v is io n s o f th e D a ta P r o t e c t io n A c t a n d m a y o n ly ta k e p la c e w it h the p e r m is s io n o f th e D a ta I n s p e c tio n B o a r d. T h e D a ta I n s p e c tio n B o a r d c o n s id e r s c r o s s - m a tc h in g a c c e p ta b le, p r o v id e d th a t the in d iv id u a ls th e d a ta re fe r s to h a v e b e e n in f o r m e d in a d v a n c e th a t c r o s s - m a tc h in g w il l o r m a y ta k e p la c e. In c o n tra s t, th e D a ta I n s p e c tio n B o a r d d o e s n o t a c c e p t the id e a o f is s u in g d e c is io n s o n c r o s s - m a tc h in g a fte r the e v e n t. D a ta c o lle c te d f o r o n e p u rp o s e is n o t n e c e s s a r ily s u ita b le fo r d if f e r e n t p u rp o s e s n o t e n v is a g e d f r o m the o u tse t. S o fa r, S w e d e n h a s u n d e rta k e n a g e n e ra l c e n s u s e v e r y f iv e y e a rs. T h e p u rp o s e o f th is is to p r o v id e in f o r m a t io n to b e u s e d, a m o n g o th e r th in g s, f o r h o u s in g a n d ro a d p la n n in g, s ta tis tic s, a n d re s e a r c h. T h e p r o c e d u re h a s in c lu d e d s e n d in g a q u e s tio n n a ir e to a ll re s id e n ts o f S w e d e n. A fe w m o n th s a g o, g o v e r n m e n t m a n a g e d to p u s h a b i l l th ro u g h p a r lia m e n t, p r o v id in g f o r the r e g is t r a t io n o f a ll re s id e n ts n o t ju s t o n th e ir stre e t a d d re s s - th a t w e h a v e b y o ld t r a d it io n - b u t b y a p a rtm e n t n u m b e r. T h e n e x t ste p w il l c o m e o n the o c c a s io n o f th e n e x t c e n s u s, w h e n th e a p a rtm e n t r e g is t e r w ill f o r m the b a s e a n d o th e r in f o r m a t io n w il l b e e n te re d b y c r o s s - m a tc h in g fr o n t d iffe r e n t d a ta b a n k s. A c c o r d in g ly, th o se re g is te r e d w i l l r o t b e in v o lv e d th e m s e lv e s. O n th e c o n tr a r y, it w i l l b e the la n d lo r d a n d the n e x t d o o r n e ig h b o u r, w h o w il l t e ll the a u th o ritie s w h o h e o r sh e b e lie v e s to b e liv in g n e x t d o o r. A l l th is, b e lie v e it o r n o t, is a im e d a t g e ttin g g o o d s t a tis t ic a l d a ta a n d g o o d to w n p la n n in g. T h e D a ta I n s p e c tio n B o a r d h a s f ir m ly o p p o s e d s u c h a p r o c e d u re th a t w o u ld b e im p le m e n te d b e h in d the b a c k s o f the c it iz e n s. A c o r r e s p o n d in g p r o c e d u re w o u ld m a k e it p o s s ib le to c r o s s - m a tc h f ile s c u r r e n t ly u s e d f o r th e p u rp o s e o f a d m in is te r in g u n e m p lo y m e n t b e n e fits, s ic k n e s s a llo w a n c e s, o r s tu d y g ra n ts, a ll f o r c o r t r o l p u rp o s e s, b u t a ll w it h o u t the k n o w le d g e o f the in d iv id u a ls c o n c e rn e d. 3. V o lu n t a r y lim its T h e lim it a t io n s a re set n o t ju s t b y o u ts id e fo rc e s. A s P r iv a c y C o m m is s io n e r, I a ls o o b s e r v e v o lu n t a r y lim it s. A c o m m is s io n e r w h o w a n ts to b e ta k e n s e r io u s ly m u s t u se c o m m o n se n se w h e n a p p ly in g h e r a u th o rity. A c c o r d in g ly, w e h a v e se t a g o a l f o r o u r o p e ra tio n s at the D a ta I n s p e c tio n B o a r c : to s t r ik e th e p r o p e r b a la n c e b e tw e e n th e in d iv id u a l s in te re s ts in p r iv a c y a n d o p p o s in g le g itim a t e p u b lic in te re s ts. S o the is s u e is w h e re to p u t the lim it b e tw e e n p r o p e r a n d im p r o p e r d a ta p r o c e s s in g, f o r in s ta n c e w it h re s p e c t to health data. R e c e n tly, the D a ta I n s p e c tio n B o a r d tu rn e d d o w n a n a p p lic a tio n in w h ic h a te a m o f d o c to rs a n n o u n c e d t h e ir p la n s to c ro s s - m a tc h d a ta o n : a g r o u p o f 2 5 0 t a ll fe m a le s, w h o, i i t h e ir te e n s h a d r e c e iv e d m e d ic a t io n to s to p t h e ir e x c e s s iv e g r o w th, w it h f ile s o n the in c id e n c e o f c a n c e r. T h e w o m e n, n o w g r o w n - u p, w o u ld h o t b e in fo r m e d. T h e re a s o n w a s the w is h n o t to w o r r y th e w o m e n u n n e c e s s a r ily w it h the r is k s o f c a n c e r in v o lv e d in t h e ir m e d ic a t io n. B u t th e a p p lic a t io n to the D a ta I n s p e c tio n B o a r d w a s p u b lic a n d b e c a m e the s u b je c t o f g re a t m e d ia a tte r t io n. C o n s e q u e n tly, the d a m a g e h a d a lre a d y b e e n d o n e. A f t e r re a d in g n e w s p a p e r a r t ic le s a b o u t the Page 8
f a p p lic a tio n, th e d a ta s u b je c ts, o f c o u rs e, d e m a n d e d d e ta ile d in fo r m a t io n. I w a n t to p o in t o u t a n o th e r a re a w h e re d e v e lo p m e n t te n d s to g e t o u t o f h a n d i f w e d o n t j o in h a n d s to s to p it, th e commercialisation of official documents. In m o s t c o u n t r ie s, p u b lic f ile s e x is t, lis t in g, f o r in s ta n c e, a ll th o se h o ld in g d r iv e r s lic e n s e s, a ll c a r- o w n e rs, a n d a ll la n d -o w n e r s. P u b lic s e c to r a c t iv it ie s a re e x p e c te d to ta k e p la c e in the m o s t c o s t e f f ic ie n t w a y p o s s ib le, b y s a v in g e x p e n d itu re o r b y c o n tr ib u t in g fe e s to th e b u d g e t, p r e fe r a b ly b o th. N o w o n d e r th e n th a t p u b lic a u th o ritie s tu rn to th e r e s o u rc e a t h a n d th a t p a r t ic u la r ly e n jo y s in c r e a s in g a ttra c tiv e n e s s in the m a rk e t, a n d o n w h ic h th e y h a v e a m o n o p o ly : th a t is s e llin g p u b lic s e c to r in f o r m a t io n f o r c o m m e r c ia l p u rp o s e s. W h e r e s u c h p o lic ie s h a v e r e c e iv e d e x p lic it a u th o ris a tio n b y the le g is la t o r, it d o e s n o t se e m a p p r o p ria te f o r d a ta p r o te c tio n a u th o ritie s to q u e s tio n th e p o lit ic a l u s e fu ln e s s o r the d e s ir a b ilit y o f s u c h a c t iv it ie s. E v e n a g a in s t th e p re s e n t b a c k g r o u n d o f b ro a d p o lit ic a l c o n s e n s u s, o r p e rh a p s ra th e r ju s t b e ca u se o f th is, d a ta p r o te c tio n a g e n c ie s s h o u ld w o r r y a b o u t th e se d e v e lo p m e n ts. T h e y d o a ffe c t the v e r y p r in c ip le o f d a ta p r o te c tio n. A s d e s c r ib e d b y P r o f e s s o r Herbert Burkert o f G e r m a n y, th re e p r in c ip le s a re je o p a rd is e d : 1) C o m m e r c ia lis a t io n le a d s to a c o m p le t e ly n e w ty p e o f data transfer. 2 ) C o m m e r c ia lis a t io n s t r o n g ly v io la te s the p r in c ip le o f limitation of purpose. 3) C o m m e r c ia lis a t io n e n d a n g e rs the p r in c ip le o f minimisation. S w e d is h c o m p a n ie s h a v e g re a t p la n s f o r u s in g I T f o r c o m m e r c ia l p u rp o s e s. T h e y fe e l th a t the D a ta I n s p e c tio n B o a r d u n d u ly in te rfe r e s w it h t h e ir p la n s f o r e x p a n s io n, a n d th a t the ru le s la id d o w n in th e D a ta A c t a re a n o b s ta c le to fre e e n te rp ris e. L e t m e m e n tio n ju s t o n e e x a m p le. T h e S w e d is h te le p h o n e a d m in is tr a tio n w a s re o rg a n is e d in c o rp o ra te f o r m - in p r e p a ra tio n fo r p r iv a t is a t io n - ju s t tw o y e a r s a g o. Its p re s e n t c o rp o ra te n a m e is T e lia. W h e n T e lia w a s fo rm e d, th e c o r p o r a t io n t o o k o v e r f r o m the state m o n o p o ly a d m in is tr a tio n its f ile s c o n ta in in g d e ta ils o n a ll te le p h o n e s u b s c r ib e r s in S w e d e n. R e c e n tly, T e lia a p p lie d f o r p e r m is s io n to se t u p a n d m a in t a in a n e w f ile, c o n ta in in g n o t ju s t the n a m e s a n d a d d re s s e s o f a ll th e te le p h o n e s u b s c r ib e r s in S w e d e n, th a t is, m o r e th a n 6 0 p e rc e n t o f the p o p u la tio n, b u t a ls o p e rs o n a l d a ta fr o m the M o t o r V e h ic le R e g is te r, the N a t io n a l L a n d R e g is te r, the P a te n t a n d R e g is t r a t io n O f f ic e, a n d S ta tis tic s S w e d e n. T h e d e c la r e d p u rp o s e o f the f ile w a s to b e a b le to p r o v id e a ll the s e r v ic e s a n d p r o d u c ts f o r w h ic h th e re is m a r k e t d e m a n d o r w ill be in th e f u t u r e, f o r p u rp o s e s s u c h as d ir e c t m a il a d v e r t is in g, m a r k e t re s e a rc h, a n d te le - m a r k e tin g. In o th e r w o r d s, T e lia w a n te d to c re a te a g ig a n tic p o p u la tio n r e g is t e r f o r p u r e ly c o m m e r c ia l p u rp o s e s. T h e D a ta I n s p e c tio n B o a r d m a d e the f o llo w in g o b s e rv a tio n : T h e p u rp o s e o f T e lia s s u b s c r ib e r s r e g is t e r is to a d m in is te r r e la t io n s w it h its in d iv id u a l s u b s c r ib e r s. T e lia, b e in g a v ir t u a l m o n o p o ly, m o s t o f th e p o p u la tio n o f S w e d e n is in c lu d e d in th is r e g is te r. T e le p h o n e s u b s c r ib e r s h a v e h a d n o re a s o n to s u s p e c t th a t th e r e g is t e r w o u ld b e u s e d f o r a n y o th e r p u rp o s e. T h e sa m e a p p lie s to the M o t o r V e h ic le R e g is te r a n d th e N a t io n a l L a n d R e g is te r. T h e D a ta I n s p e c tio n B o a r d d id n o t c o n s id e r th a t the re a s o n s g iv e n ju s t if ie d the c re a tio n o f a p o p u la tio n r e g is te r f o r c o m m e r c ia l p u rp o s e s, a n d T e lia s a p p lic a t io n w a s re je c te d. Y e t th e re is n o a s s u ra n c e w h a ts o e v e r th a t g o v e rn m e n t o n a p p e a l w o u ld b a c k u p th e b u re a u c ra tic o b s ta c le p u t u p b y th e D a ta I n s p e c tio n B o a r d. F a r f r o m th a t, th e re is r e a s o n to b e lie v e th a t the c o m m e r c ia l p r o f it lo o k s so a ttra c tiv e as to m a k e th e g o v e r n m e n t b lin d to the v io la t io n o f p r iv a c y in v o lv e d, w h e n g o v e r n m e n t m a k e s m o n e y o u t o f its o w n p u b lic f ile s. 4. C ir c u m s t a n c e s o u t o f c o n t r o l M y la s t e x a m p le o f lim it a t io n s I s h o u ld lik e to c a ll C ir c u m s t a n c e s o u t o f c o n t r o l. O r p e rh a p s ra th e r O n e U n c o n t r o lla b le C ir c u m s t a n c e, th a t is the Internet. T h e in fo r m a t io n o n c e p la c e d o n th e n e t is th ro w n r ig h t in to th e ja w s o f th e m o n s te r. O u t th e re, n o th in g is im p o s s ib le : se a rc h e s, c ro s s -m a tc h e s, s to ra g e, m a n ip u la t io n, y o u n a m e it. B u t w h a t c a n I d o? In c o n tr a s t to so m e o th e r P r iv a c y C o m m is s io n e r s, m y o p in io n is th a t th e In te rn e t Page 9
f c a n n o t b e re g u la te d. F ir s t o f a ll, it c a n t b e d o n e w it h o u t r e s t r ic t in g fr e e d o m o f e x p r e s s io n. T h a t r e a s o n s h o u ld s u f f ic e in it s e lf, b u t th e re a re p r a c t ic a l o b s ta c le s a s w e ll. It is s a id th a t to d a y 3 0 m illio n p e o p le in 7 0 c o u n t r ie s h a v e a c c e s s to T h e In te rn e t. A s s u m e th a t I w o u ld lik e to c o n t r o l o n e o f th e m. W h a t w il l the o th e r 2 9,9 9 9,9 9 9 d o in the m e a n tim e? W h a t I can d o is s p re a d in fo r m a t io n o n the la c k o f r e lia b ilit y a n d o n the d a n g e rs in v o lv e d. F a ilin g in a n e f f o r t to a p p ly r e g u la tio n s to a n e t w o r k b u ild in g o n th e v e r y b a s is o f a n a rc h y c a n o n ly b a c k f ir e a n d p u t in je o p a r d y the re s p e c t the p u b lic m a y h a v e f o r th e P r iv a c y C o m m is s io n e r. 5. P r o g r e s s w ith o u t b u r e a u c r a c y W h a t I h a v e s a id so fa r c o n c e r n s the o b s ta c le s to th e b u r e a u c r a t ic in te r v e n t io n o f the P r iv a c y C o m m is s io n e r. N o w th e f in a l issu e : h o w c a n w e m a k e p r o g r e s s w it h o u t b u re a u c ra c y? F ir s t o f a ll b y co-operation across national borders a n d w o r k in g w it h in th e E u r o p e a n U n io n, r e s u lt in g in th e E U D a ta P r o t e c t io n D ir e c t iv e. T h is D ir e c t iv e a p p lie s n o t ju s t to th o se o f u s w h o a re m e m b e rs o f th e E u r o p e a n U n io n. O n e A r t ic le r e s t r ic ts M e m b e r S ta te s fr o m r e le a s in g p e rs o n a l d a ta to t h ir d c o u n t r ie s, u n le s s th e r e c e iv in g c o u n t r y m a in t a in s a p r o te c tio n le v e l a d e q u a te to w h a t is p r e s c r ib e d f o r E U c o u n trie s. T h e r e fo r e, the D ir e c t iv e is r e le v a n t to o th e r c o u n trie s a s w e ll, fo r in s ta n c e C a n a d a, Ja p a n, a n d the U n it e d S ta te s. A u n a n im o u s E u r o p e a n U n io n is a n e c o n o m ic, a n d th e r e fo re e f f e c t iv e, p re s s u re o n o th e r c o u n trie s, to im p r o v e t h e ir p r o te c tio n o f p r iv a c y w it h re s p e c t to p e rs o n a l d a ta, a n d to d o so v o lu n t a r ily. A n o t h e r v e r y im p o r ta n t e le m e n t in m a in t a in in g the p r o te c tio n o f p r iv a c y w it h o u t b u re a u c ra c y is effective sanctions. E c o n o m ic s a n c tio n s a re, o f c o u r s e, th e m o s t e f f ic ie n t o n e s. F in a lly, s o m e visions a re in p la c e. H e r e a re so m e o f m in e : 1. I n tro d u c e s t r ic t lia b ilit y fo r fe e d in g c o m p u te r s w it h in c o r r e c t p e rs o n a l data. 2. In c re a s e the p u n is h m e n t a n d le n g th e n the sta tu te o f lim it a t io n s f o r c r im e s a g a in s t p e rs o n a l p r iv a c y. T h e p re s e n t lo w fin e s h o u ld b e th e e x c e p tio n. 3. M a k e p o lic e m e n, p r o s e c u to r s, a n d ju d g e s le a r n th e la w s o n th e p r o te c tio n o f p e rs o n a l d a ta, so th a t in v e s t ig a tio n s c a n b e fin a lis e d b e fo r e th e sta tu te o f lim it a t io n s r u n s o u t, a n d so th a t im p r o p e r w r it e - o f f s a re a v o id e d. 4. P u t th e r e s p o n s ib ilit y f o r th e (O bservance o f the la w w h e re it b e lo n g s - to e v e r y a c t iv it y th a t in c lu d e s th e p r o c e s s in g off p e rs o n a l d ata. A p p o in t a Person Responsible for Privacy, ju s t as e v e r y f ir m w i l l h a v e to h a v e a Person Responsible for Environmental Matters. It is to th a t p e rs o n o n e s h o u ld t u rn f ir s t w it h q u e s tio n s, n o t the P r iv a c y C o m m is s io n e r. 5. T h e in fo r m a t io n h e ld in th e c o m p u te r, a c c e s s ib le b y m o r e th a n o n e p e rs o n, m a y a lw a y s la n d in th e w r o n g h a n d s. T h a t is w h y the d a ta fe d in m u s t b e lim it e d. O n ly a lim it e d a m o u n t a n d t o t a lly n e c e s s a r y d a ta s h o u ld b e a llo w e d to b e s to re d. 6. W e c a n n o t lim it th e f lo w o f in f o r m a t io n b y p u ttin g in d is t in c tio n s b e tw e e n r e le a s in g p e rs o n a l d a ta o n - lin e, o n d is k e tte s, o n C D - R O M, a n d o n p a p e r. 7. T h e d a ta a n d th e d ia r ie s o f p r ivate c it iz e n s c a n n e v e r b e c h e c k e d. S o le a v e th e m a lo n e, b u t g iv e th e m f u ll r e s p o n s ib ilit y f o r w h a t th e y le t o u t f r o m t h e ir c o m p u te rs. 8. T h e p e r m it s y s te m is o b s o le te. L e t e a c h s e c to r d e v e lo p its o w n r u le s o f e th ic s a n d c h e c k th a t th e y a re d u ly o b s e rv e d. T h e n the P r iv a c y C o m m is s io n e r w il l f o llo w u p w it h a n y n e c e s s a ry in s p e c tio n :;. 9. L e t u s w o r k f o r a la w th a t b u Ids n o t o n te c h n ic a l p r o c e d u re s b u t o n th e b a s ic n e e d f o r p r o te c tio n. P e n a l c o d e s n o r m a lly t e ll y o u th a t y o u s h a ll n o t k ill. N o t th a t it is fo r b id d e n to k i l l b y a x e, p o is o n, h a n d g u n...... o r b y c o m p u te r. T h is is a sto ryl a b o u t th e p e rfe c t c r im e. A d o c to r k n e w th a t h is w if e w a s a lle r g ic to n o r m a l g e n e ra l a n a e s th e s ia. B e fo r e sh e w e n t in to s u rg e r y, he e n te re d the c o m p u te r is e d jo u r n a l s y s te m o f the h o s p ita l, u s in g th e lo g o f the n u rs e, a n d d e le te d the in f o r m a t io n o n th e a lle r g y. W h e n h is w if e p a s s e d a w a y u n d e r s u rg e r y, h e r h u s b a n d h a d a lre a d y r e s to re d the in f o r m a t io n in the c o m p u te r is e d jo u r n a l. T h e o p e ra tin g s u rg e o n, o f c o u rs e, w a s h e ld lia b le, a n d d ie n jie rry w id o w e r in h e r it e d h is w if e s esta te. Page 10
i ------------------------- d Hungary adopts new sectoral data protection laws Before the changes in eastern European political systems in 1989, little or no attention was paid to data protection in former socialist countries, including Hungary. The political and legislative practices in place at the time made no reference to data protection, nor did the citizens have any knowledge of the existence of the concept of data protection. Dr. Kinga Szurday, Data Protection Expert at Hungary s M inistry of the Interior, explains the legislative changes which have occurred and those which are being prepared. T h e H u n g a r ia n C o n s t it u t io n w a s a lm o s t c o m p le t e ly r e fo r m u la t e d in 1 9 8 9. A n im p o r ta n t p a r t o f th e c o n s titu e n t w o r k w h ic h la id the fo u n d a tio n f o r c h a n g in g th e H u n g a r ia n le g a l s y s te m w a s the in te g r a tio n o f a g u a ra n te e o f b a s ic h u m a n r ig h ts in to the C o n s titu t io n. A s a re s u lt, th e p r o te c tio n o f p e rs o n a l d a ta as a fu n d a m e n ta l r ig h t is n o w g u a ra n te e d to a ll in d iv id u a ls. R e g u la tio n s w h ic h d e ta il th e e x a c t re q u ire m e n ts o f th is g u a ra n te e a re se t o u t in H u n g a r y s D a ta P r o t e c t io n A c t ( P L & B, S e p 1 9 9 5, p.3 ) D e c is io n n u m b e r 15 o f the C o n s t it u t io n C o u r t in 1991 ( P L & B, D e c 1 9 9 1, p.2 0 ) p r o v id e d a n im p e tu s f o r le g is la t io n o n d a ta p r o te c tio n. T h is d e c is io n f ir s t e x a m in e d th e c o n s t it u t io n a lit y o f the p e rs o n a l id e n t ific a t io n n u m b e r ( P I N ) a s s ig n e d to in d iv id u a ls. P I N s w e re b e in g v e r y w id e ly u s e d w it h o u t r e s t r ic tio n s, a n d p r o v id e d le g is la to r s w it h a c o n c re te e x a m p le o f d a ta c o lle c t io n w h ic h d id n o t m e e t the s ta n d a rd s o f f a ir in fo r m a tio n p r a c tic e s. P I N s b e c a m e the b a s is o n w h ic h le g is la t o r s fr a m e d a n a c t o n d a ta p r o te c tio n. T h e d a ta p r o t e c t io n fr a m e w o rk la w T h e r e s u lt w a s th a t A c t N o. 6 3 o f 1 9 9 2 o n the P r o t e c t io n o f P e r s o n a l D a ta a n d F r e e d o m o f I n fo r m a t io n (th e Data Protection Act) w a s p a s se d b y P a r lia m e n t in 1 9 9 2. T h is A c t c o n ta in s tw o s o m e tim e s c o n f lic t in g c o n s t it u t io n a l fu n d a m e n ta l r ig h ts - th e r ig h t to p r o te c tio n o f p e rs o n a l d a ta, a n d th e r ig h t to fre e d o m o f in fo r m a tio n. In c o m m o n w it h th e E u r o p e a n U n io n D a ta P r o t e c t io n D ir e c t iv e, th e H u n g a r ia n Data Protection Act sta rts f r o m th e p r in c ip le th a t p e rs o n a l d a ta s h o u ld b e c o lle c t e d d ir e c t ly fro m, a n d w it h th e c o n s e n t o f, th e in d iv id u a l to w h o m it p e rta in s. T h e in d iv id u a l h a s th e r ig h t to k n o w w h a t in fo r m a t io n is b e in g h e ld a b o u t h im o r h e r, a n d h a s the r ig h t to re q u e s t c o r r e c t io n a n d d e le t io n o f p e rs o n a l d ata. L a s t b u t n o t le a st, th e p e r s o n a l d a ta m u s t b e u s e d o n ly f o r s p e c if ic a lly d e te r m in e d p u rp o s e s. T h e A c t a llo w s f o r the c o m p u ls o r y d is c lo s u r e o f p e rs o n a l d a ta c o n ta in e d in a d m in is tr a tiv e r e g is t r ie s o n ly w h e re s p e c if ic a lly a u th o ris e d u n d e r a n A c t. F u r t h e r m o r e, th e A c t se ts o u t in s ta n c e s w h e n the rig h ts o f the in d iv id u a l m a y b e r e s tric te d, b u t a g a in, o n ly b y s ta tu to ry p r o v is io n s. E x a m p le s o f s u c h in s ta n c e s a re w h e re th e re is a r is k to the in te rn a l o r e x te r n a l s a fe ty o f th e sta te, n a tio n a l d e fe n c e, n a t io n a l s e c u r ity, p r e v e n t io n o f c r im e, la w e n fo r c e m e n t, f in a n c ia l in te re s ts o f the state o r lo c a l g o v e rn m e n ts, o r the p r o te c tio n o f o th e r in d iv id u a ls. C iv il a n d c r im in a l s a n c t io n s P r e v a ilin g H u n g a r ia n la w c o n ta in s m a n y c iv i l a n d c r im in a l s a n c tio n s f o r c a s e s w h e re a n in d iv id u a l s r ig h t to p e rs o n a l d a ta p r o te c tio n h a s b e e n v io la t e d. T h e Data Protection Act e n a b le s a n in d iv id u a l to b r in g a n a c tio n f o r lo s s o f d a ta p r o te c tio n a n d to su e f o r d a m a g e s. S a n c tio n s a re a ls o p o s s ib le i f p e rs o n a l d a ta is b e in g m a in ta in e d in s o m e u n a u th o ris e d m a n n e r. T h e s e s a n c tio n s v a r y w it h the s e v e r ity o f the u n a u th o r is e d a c t iv it y. H u n g a r y h a s a D a ta P r o t e c t io n C o m m is s io n e r, D r. L a s z lo M a jt e n y i, w h o w a s e le c te d in J u ly 1 9 9 5, w h o s e r o le is to e n s u re th a t th e Data Protection Act is b e in g c o m p lie d w it h, a n d a ls o to e x a m in e w h e th e r o r n o t the A c t p r o v id e s a d e q u a te d a ta p r o te c tio n. T h e C o m m is s io n e r s le g a l sta tu s is id e n t ic a l to th a t o f a n o m b u d s m a n. H e o r sh e h a s in d e p e n d e n t c o n s t it u t io n a l sta tu s a n d is e le c te d b y P a r lia m e n t. R e s p o n s ib ilit ie s o f th e D a ta P r o te c t io n C o m m is s io n e r in c lu d e : g e n e ra l s u p e r v is io n o f th e A c t, e x a m in a tio n o f in d iv id u a l c o m p la in ts c o n c e r n in g th e w a y th a t p e rs o n a l d a ta is h a n d le d, a n d th e k e e p in g o f r e c o rd s p e r t a in in g to d a ta p r o te c tio n. T h is la s t r e s p o n s ib ilit y is a d m in is tr a tiv e in n a tu re, a n d h a s n o le g a l e ffe c t. N e w s e c t o r a l s ta tu te s f o r s ta te r e c o r d s H u n g a r y s Data Protection Act id e n t ifie s c o m p u ls o r y d a ta m a in te n a n c e a s a s u b je c t r e q u ir in g s ta tu to ry r e g u la tio n. H o w e v e r, d e c id in g ju s t w h a t d a ta s h o u ld b e m a in ta in e d h a s b e e n a Page 11
I d if f ic u lt ta s k. P r e v io u s ly, th e re w a s n o s ta tu to ry r e q u ir e m e n t to m a in t a in d a ta, a n d the r e s u lt w a s th a t th e re w e re s e v e ra l s y s te m s o f re c o rd s m a n a g e m e n t th a t w e r e e s ta b lis h e d b y s e c re t in te r n a l o r d e r s. A f t e r the Data Protection Act e n te re d in to fo r c e, th e H u n g a r ia n g o v e r n m e n t h a d to r e v ie w a ll state a d m in is t r a t io n a n d ju r is d ic t io n a l r e c o rd s m a in t a in e d f o r c o m p u ls o r y d a ta d is s e m in a t io n p u rp o s e s, a n d h a d to e n a c t le g is la t io n to p r o v id e the r e q u ir e d s ta tu to ry b a s is f o r th is d is s e m in a t io n. In the p a s t f o u r y e a rs, s ig n if ic a n t p r o g r e s s h as b e e n m a d e in th is a re a. H u n g a r y s g o v e rn m e n t is f u lf illin g the r e s p o n s ib ilit ie s se t o u t in the le g is la t io n in t w o w a y s. R u le s a re b e in g la id d o w n c o n c e r n in g the b a s ic a d m in is tr a tio n o f r e c o rd s, w it h r e g u la t io n s b e in g a s s ig n e d to s p e c ific a c t iv it ie s in s e p a ra te A c t s. P o p u la t io n r e c o r d s : O n e o f th e f ir s t ste p s in th is d ir e c t io n, b a s e d o n the a b o v e m e n tio n e d d e c is io n o f the C o n s t it u t io n a l C o u r t, w a s th e a d o p tio n o f a n A c t w h ic h re g u la te s the s y s te m o f p o p u la tio n r e c o rd s a n d se ts o u t e x a c t ly to w h o m, f o r w h a t p u rp o s e s a n d u n d e r w h ic h c o n d itio n s d a ta m a y b e d is s e m in a te d. T h is A c t a llo w e d the u se o f P I N s u n t il D e c e m b e r 3 1, 1 9 9 5, a n d c le a r ly s p e lls o u t w h ic h o r g a n is a t io n s m a y u se th e m a n d f o r w h ic h p u rp o s e s th e y m a y b e u s e d. P e r s o n a l I d e n t if ic a t io n N u m b e r s ( P I N S ) : S in c e the p r e v io u s ly m e n tio n e d d e c is io n o f the C o n s t it u t io n a l C o u r t, th e re h a s b e e n a c o n tin u in g d is p u te s u r r o u n d in g the q u e s tio n o f the c o n s t it u t io n a lit y o f the P I N a n d the fu r th e r fa te o f the s y s te m o f p o p u la t io n r e c o rd s. T h e a d m in is tr a tiv e s y s te m g o v e r n in g p o p u la tio n r e c o r d s th a t is c u r r e n t ly in o p e ra tio n w a s d e v e lo p e d in 1 9 7 2 b a s e d o n a S w e d is h m o d e l. H o w e v e r, d u e to la c k o f t e c h n ic a l f a c ilit ie s r e s u lt in g f r o m the b a n o f so m e c o m p u te r s y s te m e x p o r t s to fo r m e r c o m m u n is t c o u n trie s, as in f o r m a t io n w a s a d d e d o v e r the y e a rs, it w a s n o t c a r r ie d o u t in k e e p in g w it h th e o r ig in a l m o d e l. T h e r e s u lt is th a t the p o p u la tio n r e c o rd s a re n o w a d m in is te r e d u n d e r a s y s te m w h ic h is o u t-o f-d a te f r o m th e s ta n d p o in t o f in f o r m a t ic s, a n d th e re is n o w a y to e n s u re th a t d a ta is u p d a te d a n d c u r re n t. A t the sa m e tim e, th e c ir c le in w h ic h th is d a ta c a n b e d is s e m in a te d is m u c h s m a lle r a n d m o re r e s tric te d th a n in S w e d e n. B e fo r e 1 9 9 1, the u se o f th e P I N w a s v e r y w id e s p re a d, e s p e c ia lly in b a n k in g a n d in s u r a n c e. A t th e sa m e tim e, it w a s n o t u s e d - p r e s u m a b ly b e c a u s e o f la c k o f c o n fid e n c e in th e s y s te m s w e s te rn o r ig in - in state r e c o r d s y s te m s w h ic h b e lo n g e d e x p r e s s ly to the o p p re s s iv e s tru c tu re o f the c o m m u n is t s y s te m, s u c h as r e c o r d s c o n c e r n in g p a r t y m e m b e rs a n d r e c o r d s d e a lin g w it h the a c t iv it ie s o f the in te rn a l in fo r m a n t n e t w o rk. O n th is b a s is, it is p o s s ib le to d is p u te the c o m m o n ly h e ld v ie w th a t the P I N is a s y m b o l o f the o ld o p p re s s iv e c o m m u n is t s y s te m a n d s h o u ld th e re fo re b e a b o lis h e d. W h ile the o ld r e g im e m a y n o t h a v e h a d a n y s y s te m o f r e c o r d k e e p in g a n d m a y n o t h a v e m a d e u s e o f P I N s, it is a re g re tta b le h is t o r ic a l fa c t, n o t o n ly in H u n g a r y b u t e ls e w h e re, th a t d ic ta t o r ia l s y s te m s v io la t e d p r iv a c y rig h ts. In the m o s t e x tre m e m a n ife s ta tio n o f p r iv a c y in v a s io n, th e se r e g im e s t o o k a w a y p e o p le s liv e s. T o d a y, it is in d is p u ta b le, th a t g u a ra n te e s a n d r e s t r ic tio n s s h o u ld b e e s ta b lis h e d r e la t in g to the u se o f P I N s. R e c e n tly, th e C o n s t it u t io n a l C o u r t t o o k a p o s it io n o n c e a g a in o n the q u e s tio n o f P I N s. In the C o u r t s v ie w, p r iv a c y r ig h ts c a n b e a d e q u a te ly p ro te c te d b y in tr o d u c in g se p a ra te sys te m s a n d d iffe r e n t id e n t ify in g s y m b o ls fo r d iffe r e n t b ra n c h e s o f g o v e rn m e n t. T h e H u n g a r ia n g o v e r n m e n t is n o w p r e p a r in g a n A c t w h ic h m a k e s it p o s s ib le to se p a ra te the th re e b ig in d e p e n d e n t s y s te m s c u r r e n t ly in e x is te n c e as w e l a s th e id e n t ify in g s y m b o ls a s s ig n e d to t h e n. T h e th re e sy s te m s a re a s y s te m o f ta x r e c o rd s, a s y s te m o f s o c ia l in s u ra n c e re c o rd s, a n d a s y s te m o f p o p u la tio n r e c o rd s. D a ta f ile s o f th e la tte r c o u ld s e rv e as a m o d e l in the fu tu re w h e n a p p ly in g se p a ra te id e n t ify in g s y m b o ls. It is im p o r ta n t th a t m a n a g e rs o f th e th re e s y s te m s d o n o t k n o w e a c h o th e r s id e n t ify in g c o d e s. W h e n d a ta d is s e m in a t io n a n d e x c h a n g e is r e q u ir e d b e tw e e n the s y s te m s, it w il l b e re g u la te d b y the A c t, b a s e d o n th e c o n te n t o f the d a ta a n d the p u rp o s e s f o r w h i :h it is r e q u ir e d. T h is d r a ft A c t is c u r r e n t ly o n ly a n o u tlin e c o n c e p t w h ic h w il l b e d is c u s s e d b y P a r lia m e n t in th e c o m in g m o n th s, a n d c a n n o t y e t b e c o n s id e re d fin a l. R e s e a r c h a n d m a r k e t in g d a t a : T h e H u n g a r ia n g o v e r n m e n t h a s p r e p a re d a se p a ra te d r a ft A c t d e a lin g w it h the u se a n d m a in te n a n c e o f p e rs o n a l d a ta fo r s c ie n t if ic re s e a rc h, p u b lic o p in io n p o lls, m a r k e t re s e a rc h a n d d ir e c t m a r k e tin g T h is A c t, Page 12
t n u m b e r 1 1 9 a d o p te d in la te 1 9 9 5, e n te re d in to fo r c e in J a n u a r y 1 9 9 6. S t a t is t ic s : S p e c ia l m e n tio n s h o u ld b e m a d e o f the Act on Statistics w h ic h w a s a d o p te d b y P a r lia m e n t in 1 9 9 2. It re g u la te s d a ta p r o te c tio n in th e f ie ld o f s ta tis tic s in h a r m o n y w it h th e re c o m m e n d a tio n s o f the C o u n c il o f E u r o p e. T h e r e a re t w o a d d it io n a l fie ld s w h e re d a ta m a in te n a n c e w il l b e r e g u la te d b y se p a ra te A c ts : h e a lth d a ta, a n d d a ta o n c r im in a l p r o c e e d in g s a n d the r e g u la t io n o f c r im in a l s ta tis tic s. H e a lt h a n d c r i m i n a l d a t a : A d r a ft r e g u la tio n o n th e p r o te c tio n a n d k e e p in g o f h e a lth d a ta is n o w re a d y a n d H u n g a r y s P a r lia m e n t is e x p e c te d to a d o p t it th is y e a r. R e g a r d in g c r im in a l d a ta, p a r t ia l r e g u la t io n is s t ill r e q u ir e d in a re a s s u c h as c r im in a l s ta tis tic s. O t h e r a re a s a re d e a lt w it h b y th e Criminal Code a n d the Police Act. P o lic e d a t a : It is im p o r ta n t th a t la w y e r s d e a lin g in d a ta r e g u la t io n m a k e a s e rio u s a tte m p t to in c o r p o r a t e f a ir in f o r m a t io n p r a c tic e s in to s e c to ra l A c t s. T h e m a in te n a n c e o f p o lic e d a ta h a s a lre a d y b e e n re g u la te d in th is w a y b a s e d a g a in o n the R e c o m m e n d a tio n o f th e C o u n c il o f E u r o p e in the Act on the Police a d o p te d in 1 9 9 3. N a t io n a l d e fe n c e : T h e Act on National Defence c o n ta in s im p o r ta n t d a ta p r o te c tio n p r o v is io n s w h ic h s p e c ify th e p e rs o n a l d a ta th e d e fe n c e a u th o ritie s m a y c o lle c t a n d p ro c e s s a b o u t s o ld ie r s a n d to w h ic h in s t it u t io n s o r p e rs o n s th is d a ta m a y b e tra n s fe rre d. P a s s p o r t s : T h e r e is a ls o a n A c t d e a lin g w it h p a s s p o rts a n d r e c o rd s r e la te d to th e m. B o r d e r g u a rd s a re c u r r e n t ly b e in g p re p a re d w it h s ig n if ic a n t d a ta p r o te c tio n r e s p o n s ib ilit ie s. In p r e p a r in g th e A c t o n b o r d e r g u a rd s, H u n g a r y s h o u ld ta k e in to a c c o u n t the S c h e n g e n I n fo rm a tio n S y s te m ( P L & B, A p r 1 9 9 6, p.1 0 ) o n p o lic e r e c o rd s r e la t in g to p e o p le t r a v e llin g a c ro s s b o r d e rs, s in c e it is n o s e c re t th a t H u n g a r y in te n d s to j o in the S c h e n g e n A g r e e m e n t as s o o n as p o s s ib le. C o u n c il o f E u r o p e a n d th e E U I n te r n a tio n a lly, H u n g a r y s S e c r e ta ry o f S ta te h a s s ig n e d the C o u n c il o f E u r o p e D a ta P r o te c t io n C o n v e n t io n N o. 108 w h ic h H u n g a r y p la n s to r a t if y a fte r a d o p tin g the a b o v e le g is la tio n. M o r e o v e r, H u n g a r y is p a y in g s p e c ia l a tte n tio n to th e r e g u la t o r y a c t iv it ie s o f the E u r o p e a n U n io n in t h is f ie ld. T h e W h it e B o o k p u b lis h e d b y the E u r o p e a n C o m m is s io n - w h ic h c o n ta in s th e h a r m o n is a t io n ta s k s in the f ie ld o f le g is la t io n to b e c a r r ie d o u t b y c o u n t r ie s b e fo r e jo in in g - d e a ls w it h d a ta p r o te c tio n in a se p a ra te c h a p te r. T h e r e fo r e, it is v e r y im p o r ta n t f o r H u n g a r y to a n a ly s e a n d p r o c e s s the E u r o p e a n U n io n s D a ta P r o t e c t io n D ir e c t iv e a s e a r ly a s p o s s ib le. (In th is e n d e a v o u r, the p u b lic a t io n s o f Privacy Laws & Business h a v e b e e n o f g re a t a s s is ta n c e ). R e o r g a n is a tio n o f s ta te r e c o r d s n e e d e d B e s id e s le g is la t iv e r e s p o n s ib ilit ie s, the H u n g a r ia n g o v e rn m e n t h a s s e v e ra l a d d it io n a l ta s k s to u n d e rta k e. T h e o u td a te d s y s te m s o f r e c o r d s m u s t b e r e o rg a n is e d in o r d e r to s a t is fy d a ta s e c u r ity re q u ire m e n ts, w h ic h w il l r e q u ir e s s ig n if ic a n t f in a n c ia l r e s o u rc e s. In th e p u b lic a d m in is tr a tio n, th is ta s k w il l b e e x c e e d in g ly d if f ic u lt a s o n ly a s m a ll p a r t o f th e a n tic ip a te d c o s ts c a n b e m e t b y the b u d g e t. In the p r iv a t e s e c to r, th e re a re n o t a s m a n y o b s ta c le s to u p d a tin g r e c o rd s s y s te m s, b e c a u s e p r iv a te c o m p a n ie s c a n m a in t a in t h e ir m a r k e t p o s it io n o n ly b y k e e p in g u p -to -d a te r e c o rd s. H o w e v e r, p u b lic a w a re n e s s th a t c o u ld fo rc e o r g a n is a tio n s, s u c h as b a n k s a n d in s u r a n c e c o m p a n ie s, to ta k e d a ta p r o te c tio n r u le s in to a c c o u n t is n o t y e t e v id e n t. T h e state d o e s n o t p la n to in te rfe r e w it h r e g u la tio n in the p r iv a t e s e c to r, b u t w o u ld lik e to see s e lf- r e g u la t in g m e c h a n is m s in o p e ra tio n. H o w e v e r, th e se h a v e n o t y e t ta k e n sh ape in H u n g a r y. N e e d to r a is e p u b lic a w a r e n e s s F in a lly, o u r m o s t im p o r ta n t ta s k is to t r a n s fo r m the c o n s c io u s n e s s o f o u r c it iz e n s, to e n r ic h t h e ir k n o w le d g e o f t h e ir o w n p r iv a c y in te re s ts, a n d to e n c o u ra g e th e m to p r o te c t th o se in te re s ts b y t a k in g a p p ro p ria te ste p s, s u c h as a p p e a lin g to a c o u r t, w h e re n e c e s s a ry. A c t iv e le g a l p r o te c tio n lik e th is w a s n o t p r a c tis e d d u r in g 't h e p e r io d o f s o c ia lis m. T h e D a ta P r o te c t io n C o m m is s io n e r h a s a s ig n if ic a n t r o le to h e lp f a m ilia r is e th e p u b lic w it h th e ir rig h ts to h a v e t h e ir p e rs o n a l d a ta p r o te c te d a n d in r a is in g a w a re n e s s o f t h e ir p r iv a c y r ig h ts. T h is r e p o r t w a s w r it t e n b y D r. K i n g a S z u r d a y, D a t a P r o t e c t io n E x p e r t, I n t e r io r M i n i s t r y, B u d a p e s t, H u n g a r y a n d e d it e d b y S h a u n a V a n D o n g e n, a Privacy Laws & Business c o n s u lt a n t. Page 13
1 U S D epartm ent o f Health appoints a P rivacy A d v o cate The O ffice of the Privacy Advocate was established by an administrative decision of United States Department of Health and Human Services (DHHS) Secretary, Donna Shalala, on March 12th 1996. The Privacy Advocate, John Fanning, is an institutional representative and resource for privacy issues with respect to personally identifiable information about individuals in programmes and activities of the DHHS. T h e P r iv a c y A d v o c a t e r e p o rts d ir e c t ly to the S e c r e t a r y o n s ig n if ic a n t p o lic y m a tte rs a n d in ca se o f c o n f lic t s a n d d is p u te s. T h e O f f ic e o f the P r iv a c y A d v o c a t e is in the O f f ic e o f the A s s is ta n t S e c r e t a r y f o r P la n n in g a n d E v a lu a t io n, w it h in the O f f ic e o f the S e c r e t a r y. T h is t it le e x is ts in o n ly o n e o th e r p la c e in U. S. fe d e ra l g o v e r n m e n t - in the In te rn a l R e v e n u e S e r v ic e, w h e re it is h e ld b y R o b e r t V e e d e r. T h a t p o s it io n is a b o u t 2 y e a r s o ld, a n d is a m o r e e s ta b lis h e d a n d e la b o ra te p o s it io n th a n in the D H H S, b e c a u s e V e e d e r h a s s t a ff a n d c a n p a r t ic ip a te in th e d e s ig n o f d a ta s y s te m s. J o h n F a n n in g e x p la in s h is n e w r o le. Policy Consultation and Advice to the Secretary. T h e A d v o c a t e c o n s u lts w it h the D e p a r tm e n t s c o m p o n e n t a g e n c ie s o n p r o p o s a ls f o r n e w d a ta s y s te m s, f o r p r o g r a m m e s r e q u ir in g n e w c o lle c t io n s o f d a ta, a n d f o r r e g u la t o r y a n d le g is la t iv e a c tio n s n e c e s s ita tin g d a ta c o lle c t io n, a n d a d v is e s th e S e c r e t a r y o f t h e ir im p lic a t io n s fo r p e rs o n a l p r iv a c y. T h e A d v o c a t e a ls o in d e p e n d e n tly a n a ly s e s e x is t in g p o lic ie s a n d d a ta c o lle c t io n s w it h im p lic a t io n s f o r p r iv a c y. B u t e a c h s e p a ra te d a ta c o lle c t io n n e e d n o t b e se n t f o r h is r e v ie w a n d a p p r o v a l. M embership o f the Data Council. T h e P r iv a c y A d v o c a t e is a m e m b e r o f the D a ta C o u n c il, w h ic h w a s fo r m e d in 1 9 9 5 a n d m e e ts m o n t h ly. It c o - o rd in a te s a ll d a ta c o lle c t io n a n d a n a ly s is a c t iv it ie s in the D e p a r tm e n t th ro u g h d e v e lo p m e n t o f d a ta c o lle c t io n s tra te g y a n d c o - o r d in a t io n o f d a ta s ta n d a rd s, p r iv a c y a n d r e la te d p o lic y a c t iv it ie s. It is c o m p o s e d o f A s s is t a n t S e c r e ta rie s a n d a g e n c y h e a d s r e p o r tin g to the S e c r e ta ry, the S e n io r A d v is e r to th e S e c r e ta ry o n H e a lth S t a tis t ic s, a n d th e P r iv a c y A d v o c a t e. T h e P r iv a c y A d v o c a t e a r tic u la te s p r iv a c y c o n c e r n s r e g a r d in g d a ta p o lic ie s u n d e r d is c u s s io n, id e n t ifie s a n d b r in g s to th e c o u n c il p r iv a c y is s u e s, a n d c h a ir s the P r iv a c y W o r k in g G r o u p o f th e C o u n c il. T h e la tte r g r o u p h a s re p re s e n ta tiv e s f r o m u n its o f th e D e p a r tm e n t, b u t th e y d o n o t f o r m a lly re p re s e n tin g t h e ir a g e n c ie s. T h e ir m e m b e rs h ip is b a s e d o n th e ir in te re s t a n d s p e c ia lis e d e x p e r tis e a n d w il l c h a n g e o v e r tim e. Technical Assistance and Consultation. T h e a d v o c a te is a s o u rc e o f t e c h n ic a l e x p e r tis e a n d e a r ly c o n s u lta tio n o n the p r iv a c y im p ic a t io n s o f p r o p o s e d a c tio n s. T h e P r iv a c y A d v o c a t e w ill m a in ta in re fe re n c e m a te r ia ls, p r o v id e in f o r m a t io n a n d r e fe r D e p a r tm e n t p e rs o n n e l to s o u rc e s o f e x p e rtis e w it h in o r o u ts id e th e D e p a r tm e n t. T h e A d v o c a t e is a s o u rc e o f e x p e r tis e f o r th e D a ta C o u n c il a n d the N a t io n a l C o m m it te e o n V it a l a n d H e a lth S ta tis tic s, a p u b lic a d v is o r y c o m m itte e to the S e c r e ta ry o n h e a lth d a ta m a tte rs. Developmental and Resource Funct ions. T h e A d v o c a t e m a y c o n d u c t o r c o m m is s io n r e s e a rc h a n d te c h n ic a l stu d ie s o n in f o r m a t io n u s e a n d d is c lo s u r e p o lic ie s, a n d m a y p r o v id e t r a in in g in th e se a re a s. A t th is p o in t, th e re is n o s p e c if ic p r iv a c y b u d g e t b u t the A d v o c a t e is in th e O f f ic e o f A s s is t a n t S e c r e ta ry f o r P la n n in g a n d E v a lu a t io n, th ro u g h w h ic h fu n d s a re a v a ila b le. N o r e s e a rc h h a s y e t b e e n c o m m is s io n e d. Representation and Liaison T h e A d v o c a t e is a p o in t o f c o n ta c t a n d s o u rc e o f in f o r m a t io n o n is s u e s o f u se a n d d is c lo s u r e o f p e rs o n a l in fo r m a t io n f o r o th e r a g e n c ie s o f g o v e r n m e n t, as w e ll as f o r p r iv a c y a n d c o n s u m e r a d v o c a c y o r g a n is a tio n s, p r iv a t e - s e c to r o r g a n is a tio n s th a t u t ilis e p e rs o n a l d a ta, the S ta te s, fo r e ig n g o v e rn m e n ts, a n d in te rn a t io n a l o r g a n is a tio n s in te re s te d in p r iv a c y a n d d a ta p r o te c tio n m a tte rs. T h e A d v o c a te is a p o in t o f p u b lic re fe re n c e a n d re s o u rc e f o r c o n c e rn s a b o u t d e p a rtm e n ta l a c t iv it ie s w it h re s p e c t to p e rs o n a l in fo r m a t io n, a n d re fe r s in q u ir ie s r e q u ir in g in v e s t ig a tio n to ap p r o p r ia te u n its o f th e D e p a rtm e n t. Contact details: John P. Fanning, 1 rivacy Advocate, 440D Humphrey Bulding, U.S. Department of Health and Human Services, 200 Independence Avenue SW, W ashington, DC 20201, USA. Tel: +(1) 202 690 5896 Fax: + (1) 202 690 5882 Internet: jfanning@ osaspe.dhhs.gov Page 14
f The UK Registrar stimulates debate on implementation of EU Data Protection Directive The UK Data Protection Registrar s Office does not waste tim e. Shortly after the Home Office had made public its Consultation Paper on the implementation of the EU Data Protection Directive in March this year ( PL&B Newsletter April 1996 p.6), the Registrar issued her own document on this issue. P r o v o k in g d e b a te a n d r e s p o n s e E n t it le d Questions to Answer: Data Protection and the EU Directive 95/46/EC, th is is a 133 p a g e c o m p ila t io n o f se p a ra te p a p e rs w r itte n b y the R e g is t r a r s s t a f f o n v a r io u s is s u e s re g a r d in g im p le m e n ta t io n o f the D ir e c t iv e in the U K. T h e p u rp o s e o f the d o c u m e n t is to s tim u la te d e b a te a n d h e lp d a ta u s e rs fo rm u la te t h e ir o w n re s p o n s e s to the H o m e O f f ic e C o n s u lt a t io n P a p e r. U r g in g d a ta u s e rs to u se h e r p a p e r as a f a c ilit a t o r in r e s p o n d in g to the H o m e O f f ic e, the R e g is tr a r, E liz a b e t h F r a n c e, w r ite s in the fo r e w o r d to the d o c u m e n t: T h is is a n o p p o r t u n ity th a t a ris e s o n c e in fift e e n o r tw e n ty y e a rs to in flu e n c e le g is la tio n. P le a s e ta k e u p th a t o p p o r t u n it y. In o r d e r to a s s is t in p r e p a ra tio n o f the R e g is t r a r s f o r m a l re s p o n s e to the H o m e O f f ic e, d a ta u s e rs w e r e a s k e d to se n d to the R e g is t r a r s O f f ic e a c o p y o f th e ir s u b m is s io n s to the H o m e O f f ic e. A d d r e s s in g th e is s u e s T h e R e g is t r a r s O f f ic e h a s p r o d u c e d a c o m p re h e n s iv e a n d d e ta ile d d o c u m e n t w h ic h a d d re s s e s in d e p th m a n y is s u e s a r is in g fr o m im p le m e n ta t io n o f the D ir e c t iv e in U K le g is la tio n, o fte n s p e c u la tin g b e y o n d the D ir e c t iv e s p r o v is io n s in to the ftitu re. W it h m u c h th o u g h t h a v in g g o n e in to d r a ftin g it, the d o c u m e n t p r o v id e s w o r t h w h ile re a d in g. A lt h o u g h o f s o m e w h a t in t im id a t in g le n g th a n d c o m p le x it y, the d o c u m e n t is d iv id e d in to c h a p te rs b y s u b je c t, h e n c e a llo w in g s e le c tiv e re a d in g a n d e x a m in a tio n. T h e C h a p te r s a re o r g a n is e d as f o llo w s : 1. Introduction, in c lu d in g a rg u m e n ts fo r a s e a m le s s d a ta p r o te c tio n la w, d if f ic u lt ie s a r is in g f r o m a d u a l d a ta p r o te c tio n r e g im e, the A c t as p r iv a c y le g is la t io n e tc. 2. Preliminary M atters, s u c h a s s c o p e, a u to m a tic a n d n o n -a u to m a tic p r o c e s s in g, b o u n d a r ie s o f c o m m u n it y la w, s e n s itiv e d a ta, c r im in a l c o n v ic t io n s. 3. The Principles, in c lu d in g in te rp re ta tio n, r e la t io n s h ip w it h the r e g is t r a t io n s y s te m, f a ir o b ta in in g, T r ib u n a l d e c is io n e tc. 4. Registration, in c lu d in g fu n c t io n s, re q u ire m e n ts, a re a s o f a d m in is tr a tiv e d if f ic u lt y, t im e s c a le a n d fe e s, m u lt ip le r e g is t ra t io n, p o s s ib le m e th o d s o f im p le m e n ta tio n, r is k a n d n o n - r is k p r o c e s s in g, in -h o u s e o f f ic ia ls e tc. 5. Supervision and Enforcement, in c lu d in g in a d e q u a c ie s in the R e g is t r a r s c u r r e n t p o w e r s, in v e s t ig a tio n, T r ib u n a l, s u p e r v is o r y n o tic e s, a u d it p o w e r s e tc. 6. Rights of Data Subjects, s u c h a s r ig h t o f p r iv a c y, r ig h t o f a c c e s s, e n fo r c e d s u b je c t a c c e s s, r ig h t to o b je c t, a u to m a te d in d iv id u a l d e c is io n s, c o m p e n s a tio n, c o n s e n t, p r o v is io n o f in fo r m a t io n, j u d ic ia l re m e d ie s e tc. 7. Transborder Data Flows, e x a m in in g tra n s fe r p r o h ib it io n n o t ic e s, a d e q u a c y o f d a ta p r o te c tio n in a t h ir d c o u n t r y, p r o h ib it io n o f a tra n s fe r to t h ir d c o u n t r ie s e tc. 8. General and M iscellaneous, in c lu d in g n a tio n a l s u p e r v is o r y a u t h o r it y, r e g u la t io n m a k in g p o w e r s, n e w t e c h n ic a l d e v e lo p m e n ts, c o d e s o f p r a c tic e, a p p lic a b le la w, tra n s it io n a l a rra n g e m e n ts e tc. 9. Exemptions, g iv in g o v e r v ie w s o f th e A c t s a n d the D ir e c t iv e s e x e m p tio n s a n d e x a m in in g fu tu re is s u e s s u c h as p u b lic in te re s t e x e m p tio n s, e m p lo y m e n t/ s t a ff p la n n in g, p e rs o n a l r e fe r e n c e s, c o n f id e n t ia l c o rre s p o n d e n c e e tc. Questions to Answer: Data Protection and the EU Directive 95/46/EC may be obtained free of charge from: The Office of the Data Protection Registrar, International Department, W ycliffe House, Water Lane, W ilmslow, Cheshire, SK9 5AF. Tel: (01625) 545 710 Fax: (01625) 524 510 This report was written by Bojana Bellamy, a Privacy Laws & Business consultant. Page 15
Data Protection and the Police workshop papers available Papers are now available from the Privacy Laws & Business workshop dedicated to data protection issues and the police. The workshop was organised on the day before the official International Data Protection and Privacy Commissioner s Conference held in September 1995 in Copenhagen, Denmark. D a t a P r o t e c t io n A u t h o r it ie s f r o m s e v e ra l c o u n t r ie s a n d in te re s te d p a r t ic ip a n t s f r o m the p o lic e fo r c e s, m in is t r ie s o f ju s t ic e a n d a c a d e m ia h a d a n o p p o r t u n it y to e x c h a n g e t h e ir e x p e r ie n c e s a n d v ie w s o n s o m e o f the c u r e n t is s u e s in th is f ie ld, s u c h as s p e c if iic r e g u la tio n s f o r p o lic e fo r c e s, in te r n a t io n a l c o o p e r a tio n, the E u r o p o l a n d S c h e n g e n C o n v e n t io n s a n d the u s e o f D N A p r o f ilin g f o r p o lic e p u rp o s e s. T o o r d e r the f o llo w in g p a p e rs a n d f o r fu r th e r in fo r m a tio n, c o n ta c t th e Privacy Laws & Business o f f ic e. 1. I m p le m e n t in g D a ta P r o t e c t io n in M u n ic ip a l P o lic e D e p a r tm e n ts in B r it is h C o lu m b ia : S o m e P r e lim in a r y O b s e r v a t io n s - D a v id H. F la h e r t y, I n fo r m a t io n a n d P r iv a c y C o m m is s io n e r f o r the P r o v in c e o f B r it is h C o lu m b ia, C a n a d a. 2. T h e R e g u la tio n s o n th e U s e o f P e r s o n a l D a ta in th e P o lic e S e c t o r in D e n m a r k - R e g is t e r t ils y n e t ( D a ta P r o t e c t io n A g e n c y ). 3. T h e N e t h e r la n d s A c t o f 21 Ju n e 1 9 9 0 c o n t a in in g r u le s f o r the p r o te c tio n o f p r iv a c y in c o n n e c t io n w it h p o lic e f ile s ( D a ta P r o t e c t io n [ P o lic e F ile s ] A c t ) w it h the E x p la n a t o r y M e m o r a n d u m. 4. T h e N e t h e r la n d s D e c r e e o f 14 F e b r u a r y 1 9 9 1 im p le m e n tin g th e D a ta P r o te c t io n [ P o lic e F ile s ] A c t ( P o lic e F ile s D e c re e ); 5. N e w Z e a la n d E x p e r ie n c e o f A p p ly in g D a ta P r o t e c t io n L a w s to the P o lic e - B r u c e S la n e, P r iv a c y C o m m is s io n e r, N e w Z e a la n d. 6. A P o lic e C o d e o f P r a c t ic e u n d e r the N e w Z e a la n d P r iv a c y A c t 1 9 9 3 - B la ir S te w a rt, M a n a g e r, C o d e s & L e g is la t io n, O f f ic e o f th e P r iv a c y C o m m is s io n e r, N e w Z e a la n d. 7. D a ta P r o t e c t io n, the E u r o p o l C o n v e n t io n a n d the S c h e n g e n A g r e e m e n t - D r. H a n s - H e r m a n n S c h r a d e r, D a ta P r o t e c t io n C o m m is s io n e r, H a m b u r g, G e r m a n y. 8. T h e S c h e n g e n a n d E u r o p o l C o n v e n t io n a n d D a ta P r o t e c t io n - C h a r le s R a a b, R e a d e r, D e p a r tm e n t o f P o lit ic s, U n iv e r s it y o f E d in b u r g h, U K a n d M ic h a e l S p e n c e r, C o n s u lt a n t / A u th o r, U K. 9. C o n v e n t io n b a s e d o n A r t ic le K. 3 o f th e T r e a t y o n E u r o p e a n U n io n o n th e E s t a b lis h m e n t o f E u r o p e a n P o lic e O f f ic e ( E u r o p o l C o n v e n t io n ). 1 0. M e m o r a n d u m o f th e U K D a ta P r o t e c t io n R e g is t r a r o n th e E u r o p o l C o n v e n t io n ; 1 1. T h e U n it e d K in g d o m F o r e n s ic S c ie n c e S e r v ic e N a t io n a l D N A D a ta b a s e - K e n G ra n g e, H e a d, D a ta P r o t e c t io n D e p a rtm e n t, M e t r o p o lit a n P o lic e, N e w S c o tla n d Y a r d, L o n d o n, U K. 1 2. U K P o lic e U s e W o r ld s F ir s t D N A D a ta b a s e a n d F o llo w D a ta P r o t e c t io n R u le s - D. B. G u n n, Q P M, M A ( C a n t a b ), C h ie f C o n s ta b le, C a m b r id g e s liir e C o n s ta b u la r y, U K. 1 3. R e p o r t b y the P r iv a c y C o m m s s io n e r to th e M in is t e r o f J u s tic e o n the C r i m in a l I n v e s tig a tio n s ( B lo o d S a m p le s ) B i l l o f F e b r u a r y 2 0, 1 9 9 5 - B r u c e S Ia n e, P r iv a c y C o m m is s io n e r, N e w Z e a la n d. 1 4. N e w Z e a la n d C r im in a l I n v e s tig a tio n s ( B lo o d S a m p le s ) B i l l 1 9 9 4 w it h E x p la n a t o r y N o te. 1 5. R e c o n c ilin g D a ta P r o t e c t io n w it h D N A P r o f ilin g : T h e N e w Z e a la n d C r im in a l I n v e s tig a tio n s ( B lo o d S a m p le s ) B i l l - J o h n E d w a r d s, B a r r is t e r a n d S o lic it o r, P r iv a c y C o n s u lt a n t, O f f ic e o f the P r iv a c y C o m m is s io n e r, N e w Z e a la n d. Papers available from the police sessions at PL&B 9th Annual Conference Police issues will also be on the agenda of the Privacy Laws & Business 9th Annua Conference. Papers will be available. Issues for ciscussion will include: enforced data subject access requests; regulating third party access to police records; a report on research in Scotland on implementing data protection principles through a code of practice; and the launch of a new police code for England and Wales. Page 16