Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/91 Thanks!
So again, now back to our talk
with us today, we have a member of
the EU parliament who is driving forward
the struggle between lobbyists
of data collection corporations
and citizens who are trying to find ways
to secure their fundamental privacy
rights. And he'll be talking to us
today about that and some latest
updates. So please help me welcome
Jan Philipp Albert.
Hi, thank you very much.
First of all, for the nice welcome
and thank you all for coming.
I'm young, Philip.
I wished I'm as announced
a member of the European Parliament and
I'm rapporteur for the General Data
Protection Regulation.
And today I want to talk about
the European Data Protection Reform
has EU data
and the title
State of the Union is chosen
because I think that
the data protection reform is
one of the most important
procedures of the European Union
legislation.
And I think that
the question how it ends up
and where it ends up is one of
the most essential for the European
Union's future.
That's me.
And you probably will
never see me like that.
I'm I have been a journalist,
a lawyer and a politician, but most of
my life I have been a politician.
I'm representing the region here around
Hamburg and the European Parliament, and
I'm the lead negotiator for the European
Parliament for the European Union's Data
Protection Regulation,
the European Union's data protection
reform.
So why do we need it?
Why do we reform our data
protection legislation in the European
Union?
First of all, we need to update
the rules, which originate
from nineteen ninety
five so time.
The legislative process was from 1990
to 1995 or 1994,
a process which is
before the internet, as the mass
media was existing
in the minds of most people and
before
also politicians
got aware of the internet.
So these rules need to be adjusted.
It doesn't mean that these rules from
1995 are completely wrong.
I think that the principles
which are laid down laid down in the
rules in the directive from 1995
basically right. The principles and
definitions, the idea, the
concept of data protection.
It was not the first time I would come to
that where those rules were written down.
So they are in principle, right?
But obviously, those are
not brought into practice
for the internet environment, and we need
to find new
ways to interpret it to interpret
these principles in the light of the
digital age.
Second, we need stricter enforcement,
stricter enforcement because too
today in today's situation,
around 15 20
years after this
directive came into force,
the enforcement of these rules
is almost zero.
That's my personal view, because in
most of the situations of your
data processing activities, wherever
you are situated in the European
Union, these rules are not
of these processes
are not going in accordance with the
rules set out in
these general EU
rules and the rules which
are applicable.
Nobody really knows what they are if
it's the Irish, the Swedish or
the Austrian data protection
law.
And nobody really has a certain
interpretation of what it means
to apply these rules.
So what we need is a better enforcement
of these rules and
especially one thing needs to be fixed.
And that's closing the loopholes,
loopholes and the meaning that
in the internal market of the European
Union, there have been 28 different
data protection laws.
This is a situation of today,
and it opens up
for companies to move
where they see the least
less regulation in Europe
so they can just choose for the
least protection for us.
And that's a huge loophole
forum shopping.
And of course, in the interpretation
of these laws and the implementation of
international laws, there are quite a lot
of loopholes because of very different
wordings, very different interpretations
by local or national courts.
Then, of course, this leads to legal
certainty.
The question if we can trust in
what the rules on data protection are
about is one of the most important
question not only for citizens and
consumers, but also for business
and for authorities.
So legal certainty
is the basis for
a functioning rule of law system
functioning, fundamental rights and rules
for the markets and in the market.
Of course, it's the most important
trusts.
Without trust, we will not get
the development of
technical, innovative
formats, new data
processing possibilities.
We will have fall back into
nationalization of the online
environment and in
blocking markets
and closing markets.
And then, of course,
a data protection in Europe is a
fundamental right.
I will explain that in a minute.
But safeguarding the fundamental right,
of course, is one of the most important
tasks for the European Union today.
We need to have legislation which
makes fundamental rights practical.
Be enforceable
and
meaningful and not only
written on the paper.
And we need to set a standard
by the EU and export it
because data protection as a concept
is something developed in Europe and
something already
implemented by quite a lot of states
worldwide.
But still, there's a huge gap
and there is still a lack of
acceptance for data protection
as a fundamental right.
And these standards,
and on the global level, one
example the United States, where you
cannot find such a fundamental
right implemented in the way how it
is in the European Union and where there
are no general data protection
rules, but only privacy rules for
sororities.
And then, of course, this leads to the
biggest question the biggest task
for us, and that's leading my
political activity in the European
Parliament, the transformation to digital
and global society.
So the transformation of our rules of
values of what we have
been trusting on for years
and centuries into
what is the digital and global society
of today already?
So the development of data protection and
privacy laws goes back, at
least until the 60s, of course, the
concept of privacy is an old one
and a centuries old, but this is the
history of the development
of data protection and privacy laws
starting from the debates on
registers in the United States, which,
by the way, came by some soldiers
situated in HaShoah to Germany
and led to the first data protection
law worldwide.
The Hessian and Schultz
Act in 1970, and
then four years later, the US Privacy
Act was adopted, applicable, as
I said, only to public authorities.
And they already see that there is a
different development in Europe and in
the United States, which is
the privacy protection, protection of
protection from invading
your privacy on the American
side and data protection
so these so-called self-determination
or informational self-determination
in Germany and then afterwards
in most of European countries
during the 70s and 80s on that
you have also the OCD guidelines
based on those concepts
and the Council of Europe's Convention
100, which then was implemented
in all the EU
member states of today.
So that was the starting for
European standards and then
the well-known census judgment
of the German Constitutional Court and
on the 15th of December nineteen
eighty three. So almost
exactly 30 years ago,
where it was mentioned very clearly
already in nineteen eighty three,
that data protection is about
protecting every data processing
activity because every data processing
activity, no matter where and from
whom it's taking place,
it can have an impact on our
fundamental right on self-determination,
personality rights, our dignity
it's deriving from human dignity.
And then the EU
came up and the European Union started
to legislate on these fields, especially
in view of the ongoing
digitalization. As I said, the
Fundamental Data Protection Directive
1995 and then
first rules for the online environment,
the EU Privacy Directive e-Privacy
Directive with the famous
cookie provision.
And just to mention,
it's because it belongs
there. In 2006, the Data Retention
Directive, which at
the moment is in front of the European
Court of Justice, then something
which is completely underestimated
by most of citizens in Europe, but also
worldwide, that there
has been something like an EU
constitution passed in
1st of December 2009.
It came into force.
The Treaty of Lisbon and the Treaty
of Lisbon had specific
provision on data protection and Article
16.
So since the 1st of December 2009,
there a specific mentioning
in the Treaty of the European Union
that everyone has a right to the
protection of personal data concerning
them.
And that's the clear sentence.
And second, the European Parliament and
the council acting in accordance with the
ordinary legislative procedure shall lay
down the rules relating to the protection
of individuals and compliance with these
rules shall be subject to the competent
control of independent authorities.
More specific with the fundamental
rights culture, which also was declared
binding for all EU member states with
the Lisbon Treaty, and don't listen to
British lawyers that there could be an
opt out. It doesn't apply.
This fundamental rights culture is
applicable for all EU member states and
articulate says clearly again,
everyone meaning
just to note it's a
human rights, not only a citizen's
right. Everyone has the right to
the protection of personal data, so data
protection not only privacy protection
concerning him or her.
Second, such data must be processed
fairly for specific purposes,
purpose limitation and on the
basis of consent or
of some other legitimate
basis laid down by law, meaning that
data processing in the EU is only lawful,
only allowed if it's based one on
consent or second on a specific
law.
Everyone has a right to access
to data.
Some journalists really feel
quite surprised when I say in Europe, the
right to access your data is a
fundamental right, as written in the
fundamental rights culture.
You can ask whomever
which personal data he or she
has collected about you
and the right to have a directive fight,
including, of course, the right to
deletion.
And the independent authorities,
of course, is a very important
issue of EU law, and that's
something which has been enforced vis
a vis Germany, for example once.
But at the end, the enforcement
is a problem.
So who's the European Union?
What are they doing? So this is a famous
picture of how people see the European
Union
quite a bureaucratic block and
unknown officials working on our future.
Just half of the truth.
This is the other half.
It's also democracy.
This is a parliament in which I work, and
somewhere I'm sitting there.
You will not find me out, but
there you have seven hundred
sixty six members of the European
Parliament. They are deciding about
the legislation in the European Union,
but that's also half the truth.
The real decisive
people. So the decision
makers are sitting in these two rooms
on the left side. Do you have the Justice
and Home Affairs Committee in the
European Parliament?
Only a few people sitting in.
That's normal.
You have sometimes only five or six
people caring about the Legislative Act
and on the right side, the Justice and
Home Affairs Council of Ministers.
So those are the main bodies
deciding about the rules in the European
Union, that was just some excuse
on how the legislative
process works.
Just to let you know that lead
negotiators, as I mentioned
myself on the Data Protection Regulation
and then there was a directive on law
enforcement, I will explain that
which is led by Dimitri Stuarts as a
Greek member of the European Parliament
and on the side of the council, you have
rotating presidencies.
First off, 2014 will be the Greek
presidency starting from 1st of January
and then the Italian presidency first of
July. So that's the year of 2014,
and there are in these two rooms that
will be the decisions made on our
privacy and data protection in Europe
and worldwide.
So what's happened until now
from 2009?
So starting from the Lisbon Treaty to
2011, there was a consultation process.
The European Commission already has to do
a consultation process before introducing
new laws on the repeal
on the possible repeal of the Data
Protection Directive from 1995 and July
to July 2011.
At the end of this consultation process,
the European Parliament also passed
through a resolution asking
for first one single EU
standards for data protection on the
basis of the Directive 1995,
so not lower.
Second, strengthening of individual
rights.
Of course, it was a bit more
sophisticated, but it would come to the
points later.
And third, sharp sanctions and
consistency in enforcement
in the European Union and by all
the European Union's authorities and the
European Union's member states'
authorities. And of course, all the
companies. So this is about
a market regulation
or market location principle.
These demands and the results
of the consultation process then ended up
in the proposal by the European
Commission in January 2012.
So last year, in January,
two files were presented.
One Regulation on data
protection for almost all
the sectors and a directive
excluding the law enforcement authorities
from a directive means it has
to be implemented in EU law.
So still, after it passed through a
directive, member states of the European
Union are implementing it and then
national laws.
A regulation doesn't do that.
Data for the Data Protection Regulation
would be directly applicable for the
whole European Union 500 million citizens
and a huge internal market,
no transposing
law for a member state anymore and direct
a particular application by data
protection authorities in Europe and
by the courts,
national courts and
in last instance, European Court of
Justice in Luxembourg.
In March 2012, then
the rapporteurs in the European
Parliament were appointed.
So my work start, we did hundreds of
hearings, meetings, discussions since
and in January 2013
presented draft reports.
So our recommendations as
rapporteurs for the changes to the
commission proposals and collected
the amendments by the other members of
the European Parliament, by the political
groups.
And in October 2013.
So two months ago, we voted on the
European Parliament's position for
negotiations in almost
unanimously.
It was voted almost unanimously, and
it opened the negotiations with
the council in a window
of opportunity until March April 2014.
If we will not conclude negotiations
with the council until then, the European
Parliament will go to a plenary vote.
So some details on the process, first of
all, this was
literally the biggest lobbying tsunami
ever in Brussels.
So me and my stuff, we had hundreds
of meetings with lobbyists alone.
In nine months of 2012, we registered
268 meetings.
We published all of them on my website.
And it was,
I would say, 80 90 percent
lobbying by industry and
the rest shared by
very different interest groups
coming from civil society authorities
or unions,
whatever interest groups, non
industry.
Some of them were understandable.
Concerns like SMS
should be overburdened.
So we don't want the bakery to
have overburdening
duties by these data protection
rules.
Why we could ask why your bakery
anyhow should process personal data.
But that was very often
the example and of course,
the right to be forgotten.
Huge debate, which is still going
on and where there are very different
ideas and concerns.
But of course, also some
just way over the top.
So there have been quite a lot of
concerns.
Trying to completely eliminate
data protection as the concept as
we have it today undermine
the fundamental rights which are in our
constitutions, that European data
protection should not apply to this
or that area or not to our
business or whatever
that data processing should
be possible without the consent of
citizens under the
term of legitimate interests
in several regions
and scope of data protection
as such should be reduced.
So those we
we had to face those concerns, of course,
and those who were brought in
quite a lot of them by
lobbying groups trying to
approach European parliamentarians
with hundreds of amendments to be sent
in. And at the end, there were
hundreds or even thousands of amendments
sent in completely
copy pasting proposals
by industry groups or other interest
groups.
Most of them, of course, companies like
Amazon, eBay, Facebook, Google,
coming from Silicon Valley
or the American Chamber of Commerce.
Their representation in the world.
Somehow, you can find it on these
websites.
Those data journalists did an overview
and they still do it.
It's very helpful for European
legislation, as it's quite
complicated to understand how
decisions are made.
At the end, we had three thousand nine
hundred ninety nine amendments to deal
with.
So that was
what we had on our tables in
around March this
year.
I don't know the number of the pages, so
but you can imagine it's quite a lot
and it was hundreds
of pages and that as
a green is quite hurtful
to see because these three
thousand nine hundred ninety nine
amendments in the European Union need to
be translated into 23 official
languages.
So the first
meeting scrutinizing these amendments
in our committee.
You remember the room I showed you were
that every place had such a
staple of amendments
on its table and
the parliamentarians had to, first
of all, read all of them.
Of course, not all of them did.
But we had to to find
the compromises and to find
solutions for the core issues.
So what have been the
core issues in all these debates?
First of all, the definitions, what is
personal data?
That's the central question of data
protection.
So questions like
how to deal with IP addresses, how to
deal with RFID
IDs or
cookie IDs, etc.
So we managed to
cover most of those in
the definition. We still managed to hold
the definition quite broad.
Second point, of course, also the
question what means
personal data, which leads
to identification or which
leads to an identifiable
information?
Should there be an addition?
That identifiable also means
singling out someone
we managed to to hold the discussions
on that and at the end had some,
uh,
some signal that
this is also covered.
And hopefully this will also
be prevailing
in the negotiations with the Council of
Ministers.
Thank you.
The second big
point is consent, so the question
how needs consent to be given
if you use the
justification for a data processing
that there is consent, it has to be
specific, it has to be informed and
explicit.
That was a huge fight
in the European Parliament.
At the end, we got the explicit
consent in the position of the European
Parliament, and that's quite a success
in my view, because
the way to undermine consent
during the last five, 10 or even 15
years was already made
and it's already going on.
So we need to work on that.
And that was one of the core issues we
need to tackle.
And the scope of application, of course,
was one of our greatest concerns.
First of all, that we have a market
allocation principle.
I already referred to it.
So this means that
the European Union sets its EU
data protection standards in a way that
it's applicable to whomever
is acting on the European Union's
territory or whomever
is acting on the European Union's
markets.
Both of its.
Which means that
if there's a company based somewhere
in China acting on the European markets
through online business, for example,
it's applicable, which means
it's a territorial extraterritorial
application of our rules.
I think that this is the main change
of these laws because it's saying clearly
for the European Union, we have to
safeguard the right to data protection
wherever we can
and that we do by market regulation.
Second question, not so big, but
interesting, the EU institutions
have been regulated already by
a regulation, so there was a question
how to include those in
the protection of these new regulation.
Quite a technical task, but at the end we
managed to do so in
a transition provision
and even more important
again, the private and household
exemption. So the question
what does it mean to be
exempted by these data protection rules?
Because I'm doing data processing.
In the course of my private own private
and household activities,
the question which role
gainful interest plays,
where it's clear that if there
is gainful interest,
if there is private or household
activity, still it should be covered by
this exemption.
On the other side, it should be clear
that if you
act in a way that it's
not usually seen as
to be a private activity
or household activity, you should be in
the duties again, of course.
Next issue.
Legitimate interest, I already referred
to a legitimate interest as one of the
most important loopholes
in the existing protection
because in the director from 1995,
it was clear that legitimate interest can
be a legal ground for processing,
but it was not further defined.
So there were very different
interpretations in EU member states.
Why in Austria you have to opt
into almost everything and legitimate
interest is absolutely the exception
in the UK, it's the other way round.
So this is the way
where we came from and where we needed to
debate about the question how to reduce
the scope and the possibilities
for data processing and the legitimate
interest.
And we brought in the
idea of saying that legitimate interest
every always has to meet
the reasonable expectations based on
the relationship with the data
controller.
So my reasonable expectations
should play a central role.
It shouldn't be a company
which I never have seen and never have
contact had contact to
collecting my personal data just because
it thinks it's legitimate interest.
The second big point
in this scope was the direct
marketing issue.
Direct marketing issue is one of the most
important debates because there
is most money in
and most growth opportunities today are
based on direct marketing with personal
data.
They are different starting points in
the EU member states.
And what's the position in the European
Parliament now brought at the end
as a differentiation?
Was that in the internet only for all and
similar goods and services, direct
marketing can be a legitimate interests
and only in the analog
environment. If you do, direct marketing
by snow may in most EU member states,
it's already today that you can
do it as legitimate interests.
Send letters to
whomever. This is a huge lobbying
fight, of course, and I would have
liked to reduce it even more.
I would have liked to say, I don't want
your mail. But
unless I say yes, I want
it. But at the end we got this.
And still important is
that an opt out is always possible.
So an analog and
digital environment, of course,
you get your opt out wherever it is, and
it always needs to be.
They are highly visible with highly
visible information, and there's also
an incentive to have do not track
possibilities and technologies developed
and certified.
Next, find profiling a very important
debate because in the current
legal frameworks, profiling doesn't play
such a very important role.
It's automated processing,
which concerns me, always or confuses
me always, because automated processing
seems to be everything today.
So profiling is in the heart
of what we need to regulate it
regulate. And we brought in a specific
article on the limitation
of the use of personal data for
the purpose of profiling and
for profiling as such.
Also,
in addition, privacy by design and
efforts has been brought in as
a new concepts and those
safeguarding a very important
fundamental principle of data protection,
which is data minimization.
And that's, of course, still in
last important core issue.
On substance, the data protection
officer, which is a concept
of deriving from the
example of the German law, where you have
a data protection officer mandatory for
companies having more than nine
persons dealing
with data processing.
And we got away
from the commission's proposal to change
that to 250 employees
because it doesn't make sense.
And now the proposal is that
if there is data processing on
5000 data subjects per year
or more, then there should be an
appointment of a data protection officer.
And of course, this has to be
proportionate to the task so
it can be part time, it can be external.
But it's clear that it helps compliance
with compliance and that it also
helps the data protection authorities
and gives less burden to concentrate
with them.
The entire international transfers,
I come to that also a bit later,
because it was, of course, impacted by
the Snowden revelations, I
now have to be clearly based on EU
law, so there should be a clear
restriction to only what's in the
regulation is possibly to be transferred.
And of course, there are
justifications and and minimum
requirements which have to have to be met
to transfer to third states,
then the consistency.
So the consistent application of these
data protection rules in the European
market or on the European market
and in all the EU member states by
the so-called first One-Stop Shop,
which means what is already
today the case that a company which has
a maintenance establishment on the
European market has
a competent authority for enforcement
and oversight on this company.
For example, Amazon,
based in Luxembourg, Luxembourg is Data
Protection Authority, is competent for
Amazon for the enforcement.
So that's a one stop shop for the
company. But we also brought in the idea
of having a one stop shop for us so
that we can go to our own data protection
authority wherever we are in the European
Union. And these data protection
authorities then have to cooperate,
have to find a common position on
the interpretation of these single data
protection standard on the European
market. And that helps for consistency.
And it helps in a specific case, which I
will point out
in a few minutes at the end.
A final decision in case of conflict is
possible in accordance with the
parliament's position.
So if there is a conflict between data
protection authorities, for example,
a specific authority is not at all acting
or a specific authority has an
interpretation which is completely
outrageous.
Then a two thirds majority of data
protection authorities can overrule a
decision by the Competent Data Protection
Authority.
I think that this cooperative model is
the best approach I've seen until now.
It's safeguarding the independence of
data protection authorities.
It's not bearing up a complete
centralized system in which you
have to contact someone who is completely
out of your region.
But it also helps for consistency,
which is the main
issue here because the loophole,
as I said, a forum shopping in the
European Union is one of the biggest
problems we have.
And the most famous
example is the loophole Ireland.
That's the loophole Ireland's.
This building is somewhere in the suburbs
of Dublin, in Ireland, and
the shop on the left side
is a supermarket and the shop on the
right side is the Irish Data Protection
Commissioner and.
The Irish Data Protection Commissioner is
competent, for example, not
only, but for example, for the company,
Facebook Ireland,
the company, Facebook Ireland
is the main establishment
or the main company of
which
all the people, all the users are in
or contracting with when they are not
based in the US or Canada.
So you could
say Facebook worldwide
and then you have Facebook U.S.
Canada, Facebook Worldwide
is overseen by this authority
that leads that led to the situation
that once there was
an Austrian student called
Max Schrems and he sent
in simple requests
for access,
his personal data by Facebook.
So just asking what
our personal data have you
retained on me, Facebook?
And he sent that letter and got
no answer.
And then he sent
a letter to the Irish
Data Protection Commissioner and
got no answer.
And quite a lot of weeks
later and other
contact
approaches, he
got a reply that there would be no
negotiations on his
case.
And after certain
conversations, he got a DVD
by Facebook with one thousand
two hundred twenty two pages
personal data retained by Facebook
on him.
And quite a lot of it
was not known
by him that it exists, that he has
put it into the
system of Facebook.
And quite a lot of it, he
believed, or he was sure that he already
clicked on delete.
So it was all there and there were plenty
of data protection infringements.
He was studying exactly this the group
of students dealing with data protection
laws. They saw twenty two
different infringements cases
of infringements and started a campaign
which is named Europe versus Facebook.
And in this campaign, they started to
complain against Facebook in front of
the Irish Data Protection Commissioner.
And it took weeks and months,
and it still takes weeks
and months to get these problems
sorted out.
They are not now waiting for the final
answer of the oversight authority
after having sent in all these questions
already. I think one or almost two
years ago and
nothing happened since then, or almost
nothing.
And they are waiting now the answer
of these commissioner. And obviously
this answer will not be
in accordance with the EU data protection
law. So that's what he expects and
what he, I think realistically can
expect.
And that means that he then has to go
to courts.
The competent court will be the Dublin
courts. The Dublin court system
is very complicated, so you need a
specific lawyer
which is trained on filing court cases
in front of Irish courts, and they are
quite expensive.
So no, at the moment they are fundraising
around 300000 euros
to start this complaint
and gets easy things
like the right to deletion of your own
personal data and enforced.
So this may take years.
And that's the reason why
the system of the EU Data Protection
Directive from 1995 and the
implementation into national
laws has failed because
the EU Commission, which normally is
competent for the enforcement of these
directives vis a vis the member states,
failed to, at the end really
enforce it.
So the
the the whole thing turned
around in the legislative procedures.
But then, of course, the Snowden
effect came with June
July, where we already
believed that before summer, we will
not really get a breakthrough
with the negotiations, and
it would take even longer after summer
to get these data protection reform
done. But then after summer, we came
back and there was.
At least a little effect.
So what were the effects, first of all,
the strategic effect that there
is now a competitive competitive
advantage for data protection seen
by average users
or politicians?
You can see an article on
the
Yes on the
lacking encryption on Google
servers and an ad for Google Cloud
hosting just right besides it.
So it has an effect.
People are realizing it,
and at least privacy is high on the
political agenda again.
But at the end, we all see and that was
also the conclusion of Glenn Greenwald
yesterday.
Lots of promises, but little meat.
So there's not really much happening.
What we got through here in the European
Parliament was, first of all, the
famous Article 42,
which was in an article in a
previous preliminary
draft of the European Commission, saying
clearly that, as I said, international
data transfers need to be based on
European law,
meaning clear that
a Patriot Act order or
a FISA Act order would not
be a valid legal ground for an
international transfer from the European
Union to a third state.
I have to say thank you to
Edward Snowden, because we brought
this article back into the position
of the European Parliament after
his revelations, and it's still
in there and the European Parliament has
voted almost unanimously on
it. That means that
companies acting on the European markets
will have troubles if they send personal
data out of the European Union
if it's not based on EU law,
and at least that will help, hopefully
to set global standards.
We have reached a sunset clause for
the Safe Harbor Declaration, so adequacy
ratings of the European Union vis-a-vis
such states or sectors safe harbor
vis a vis the U.S. market or U.S.
companies need to be repealed
after a certain timeframe
after this regulation get into force.
We have blocked the proposals
to introduce binding corporate rules for
processes because we see,
of course, this has to be in the hand of
the controllers of those
companies dealing with the consumers
or the citizens.
And we introduced at least
a general framework for whistleblower
protection in this
data protection regulation.
That's an important step and hopefully
an example for other areas
and what we achieved,
and that's quite important.
We achieved fines up to five percent of
the global annual turnover in the
preliminary draft of the European
Commission. It was up to four percent,
then watered down to two percent after
the American Chamber of Commerce did
heavy lobbying on the European
Commission.
European Parliament now lifted
it up to five percent of global annual
turnover. That's quite significant.
At least half of what companies
can be fined to
them with competition law.
And that's quite a heavy thing
if you get into trouble with European
competition law.
So on the core issues, we
have to say that there was not such a
huge impact, but we managed to already
before the Snowden revelations bring
through most of the core issues.
And I think that now it's up
to the ongoing debates.
What of this of this position
of the European Parliament will prevail
in the negotiations with the member
states and the council.
So the overall result in the European
Parliament is for sure a very
good compromise.
It's compared to the lobbying and the
amendments much better than
I or many of us have hoped
for. And that's in
the view of such a majority
of conservative and market liberals in
the European Parliament. By the way, the
next European Parliament will be even
worse.
But this result is quite good.
It's supported from all political
groups in the European Parliament.
Only the right wing extremists
haven't voted in favor of it because they
don't vote in favor of anything.
But it's, of course, also understandable
that civil
rights activists like was
Airdrie and those here cannot be
100 percent happy.
I'm too not happy 100
percent, but I think that others
are even less happier than happy than we.
So what's next?
We're waiting for the Council of
Ministers to adopt their position.
It's going round in circles in the
council because there is
since two years now a debate going
on without any real results.
Some helpful allies of France, Poland,
Austria and Greece companies,
companies, member states in
which those debates take place.
And at least in Poland, the
Acta debates
have really changed something in the
political landscape.
A bit disappointing is that Germany is
not in the round of these allies
in favor of data protection, but one of
the delaying countries, together
with companies like the U.K., Denmark,
Hungary and Slovenia,
which don't want the regulation
at all. But Germany is one of those.
Some others also saying there are lots of
questions and they are
saying since two years without proposing
alternatives, that's diplomat speak
for delay until this debt.
So what we can see is now
that the council will turn its rounds
again and again, and the question is
what scrutiny we will have towards
the EU governments, the member states,
governments with regard to the activity
in the European Council of Ministers.
If it were got a good data protection
reform or not.
The big picture European
data protection reform will not solve
all the issues, but a level
playing field on the whole European
markets and as a market location
principle for the global
market and better data control
for us is something
significant. We can win with it.
With regard to the intelligence
surveillance, I really
recommend to watch out for the EPP
inquiry. So the European Parliament's
inquiry on the mass surveillance on EU
citizens, which I am coordinating
together with some other members of the
European Parliament, and we were present
or vote our report in January
2014. So next month's end of next
month, we will start the voting
procedure on that and we'll be workshop
on day three tomorrow at the same
time as this lot is at the noisy
square assembly.
What do we need this joint effort for
unity kabab capabilities?
I think that there are needs to be
initiative. The whole stack, from
processor design to open software
of source and a free, open
approach helps security for
sure. That is what I also learned
with Rudy's talk
on encryption.
I think we need to fight for open source.
What we also need is a digital new deal.
We need to invest in privacy, we need
to invest into alternatives, and that's
something we need to demand from
politicians also.
And at the end, it's about quite
a huge thing for democracy.
It's about safeguarding our
self-determination, not only
self-determination as citizens in a
free democracy and a rule
of law based democracies,
at least here in Europe, in the US,
anywhere in the world, and
also as consumers, as
consumers in a global market,
which is more and more taking our
self-determination away
because of lack of enforcement
of privacy rules.
And that's quite fundamental.
So what we need is such
a reform as a start for a digital
declaration of Independence.
We need someone to start with
and this is, of course,
a start. And we not we
do not have the majority on a global
level. If you look at the global level,
there is a majority of states
repressive, non-democratic.
It is completely naive
to believe that we will manage to get
global standards done today.
We need to fight for standards on
supranational, supranational level.
We need to fight for standards
like the European Data Protection Reform
to get it done on the global level and to
get pressure on other global
players.
And we have the power here in Europe.
We still have the majority.
It could change, but that's what we need
to work on and we have
privacy activists around the world
watching us watching the European Union.
We got letters from the huge civil
liberties group and northern and southern
America to go on to
go ahead because they believe
it's only the European Union who could do
a step, a significant step to improve
the legal framework for data protection.
And it's the best chance we get today.
And last
but not least, it's a race against the
clock forum.
Shopping takes place, as I said in
the.
Fewest cases you can trust
on your own jurisdiction to be applied
to be a safeguard for you,
and it will be even worse,
which with more and more market opening
and deregulation approaches like T-TIP,
the Transatlantic Trade and Investment
Partnership, which is not a problem only
because of data protection, but also
because of our fundamental rights, data
protection, privacy.
And so we need to regulate as soon
as possible to safeguard
something for the future.
And as I said, parliament and council in
the European Union will both decide in
spring 2014 on significant
waypoints.
So I ask you all to get active
right now.
And it's starting today,
right after this talk, there will be a
demonstration freedom, not fear.
I was asked to just invite
all of you to get to the entrance and
have a short protest of one hour
for privacy outside of the Congress.
Great, thank you.
Yeah, that was very insightful.
I can see that we have a bunch of
questions, so we're going to open now the
floor for interaction from you guys,
so we'll take first.
Microphone number two.
Oh, thank you.
I appreciate your work, and I thank you
very much for your efforts.
And I see it as a
as a big work to increase
our freedom.
And so
most people think that
that that your work in the European
Parliament just produce more rules for
us. So I think
the big chance would be here to make
everything easier to make very strict
laws of data protection, and this is
good for the people to understand them.
And so you get the support of the people
in the countries. So this is the big
chance.
Then second point is
our our right to access
our own data from my side would
be very clear to a demand to the
companies to not
only give the authorities a backdoor
in their systems, but to give me a front
door in the systems so
that I can see what
as the demands of what data
is stored for my next satellite.
And if this is too much work for a bakery
to provide this, then
they shouldn't store my data and.
And you said that there is a
decision to make it opt out in the
systems I've worked in the
in the direct marketing business
when someone
answers on this.
Then you have the the OK
that this address is active and
then the spam increases in this
way. So the opt out
should be mandatory with the deletion of
all the data that are stored there.
And most of the
direct marketing agencies are very small.
So this number of employees that
you're proposed there will never apply
for a system that they should have a data
protection commissioner because they a
small agency.
So put this number down, please.
Thank you for your thoughts.
Thank you.
I would I would like to to answer
just shortly.
You have seen that we change the number
of employees to the number of data
subjects, so that would include those
smaller companies and all
the rest. I completely agree with what
you said. Thank you very much.
All right. Thank you.
We'll take one question from online.
Question from IAC.
What can Parliament do against passive
or active sabotage by commission
and council, for example, through
international agreements, for
instance, like in the current
surveillance hearing?
So I understand it's about international
agreements passed through by European
Commission and European Council or the
Council of Europe, it comes Council of
the European Union. So
international agreements like on
passenger name records like on Swift's
banking data have
been concluded to
transfer of personal data
between the European Union and the U.S..
International agreement or European
agreements, exist for data sharing inside
the European Union.
The European Parliament has played a very
important role in that safeguarding
redress opportunities and
proportionality with
regard to data protection.
Again and again, we rejected
some of those agreements as the European
Parliament after the Treaty of Lisbon.
The European Parliament has to give its
consent to all of these agreements,
especially international agreements.
So nothing can work without
the European Parliament. So the focus has
to be on the European Parliament
representing the interests of European
citizens of all citizens of humans,
having a human right on data protection.
And we need to ask them to do that.
The problem is that's one field where the
European Parliament has no influence and
that is national security
intelligence because that's only
reserved for the member states of the
European Union. It's a black hole of the
rule of law in the European Union.
You could even have a drone attack fired
from Poland to
Slovenia and justified
it by national security.
I think that's unbelievable, but
therefore we need to change the treaties.
All right, we'll take questions from
microphone number one.
Thanks for the work.
I was wondering whether you have also
thought about how to deal with some
of the situation at the data protection
authorities because they are vital in the
overall role to actually enforce
the regulation.
And specifically, my concern is that in
most member states, they are way too
small.
And second, they actually have very few
technical staff who understand internet
technologies.
So mostly lawyers, 90
percent of lawyers there are.
That makes it really difficult to
actually address
the fundamental issues, rather than
trying to deal with some specific
urgent cases that show up in the media.
And on top of that, you mentioned
sort of more I it in
in in Europe and privacy for entity,
and that's also a must for
most of the Directorate General.
You don't have computer
scientists in management positions, so
you actually have a lack of
understanding.
And to make it even worse,
if you look at the current procurement
process in the by the U.S..
You can't even procure for
technologies developed, for example, by
the IDF because those are not recognized.
And that's even the most of the internet
technology comes from or W3C.
So there's a there's the
more subtle problems that follow after
that step, and I'm hoping that
you or someone else also takes
a look at this and how to actually get
this to a working system.
I completely agree to that.
And there is an ongoing fight for
the resources of data protection
authorities, as
with all the authorities and all
resources today, it's quite complicated.
And still the member states have budget
competence. So it's all about
the budgets in the member states,
how good equipped
data protection authorities are.
But I think that we really need to work
of having experts wherever personal
data processing has taken place and
therefore the approach of having the data
protection officer and almost every
company is a first step, I think.
All right, we're going a little bit over
time, Yan, if you don't mind and the
audience has in mind, you can take a few
more questions, OK, maybe one more
from the I.R.S.
or Twitter.
We have one more from IOC.
Can you estimate how much more
the voice of one single well-funded
lobbyist counts compared to, for
instance, a regular citizens sending an
email to their representative?
Very good question, I cannot answer
completely, but what I know,
I mean is that the Silicon Valley
on in Washington, D.C.
and in Brussels holds one of the biggest
lobbying resources
ever.
They influence completely jurisdiction
and legislation on both sides
of the Atlantic.
And for years we took that as
something not being critical.
And I think that we should change because
they are very huge companies
and they have quite a lot of resources
to invest and they don't need to say
openly what their interest is.
They just need to fund some things, fund
some movement, some associations
or lawyers having specific
interpretations.
But if I hear Eric Schmidt saying that
privacy is an anomaly and
anonymity is dangerous,
and this company is one
of the biggest companies in the world
investing in research and
lawyers and associations
all around the world, then you can see
how lobbying has an influence,
has an influence on the actual decision
making process.
It's not only in the digital industry,
but of course you have it with
pharmaceuticals, you have it with
tobacco, but it's taking
place, and that's democracy.
It's sad that
it's that way, but what we need is
a critical public asking
for transparency and critical
MEPs or members of Parliament,
Members of Congress who
try to follow what is reasonable
and not only what is said more often.
OK. William speaking.
And we'll take the
gentleman at microphone number four.
Thank you.
So we've followed the talk, right?
Since 1995, there's been a right to
data privacy in the in the European
Union, but in 2013 we're sort
of still talking about whether that right
is supposed to continue as opposed to how
implementations of that
may may work out.
So I'm asking about how do you
see possible implementations of
the rights of whether
they exist, when they might exist and
specifically whether any thought has been
given to an existing
data protection regime that is
copyright or way above that
already is in the
courts. Like we understand how to work
this and whether we could apply this to
personal data that say shows up in all
these databases of the
internet companies.
I didn't get completely the question, but
I would understand it in a way that
you used to ask about,
does the right to privacy right to data
protection changed significantly or
is there a way to to really
better enforce it?
So the right is more
of an abstract concept, right?
But the so the right to privacy is
like, you know, you have a
right, but what are you going to do about
this, this case of this Austrian student
who is fighting the legal
battle in Ireland,
right? But the the process is
not well understood or well-established.
Where as for copyright
infringements, there is already a
well-established, well understood.
OK, I got it.
OK. So
yeah, it's clear that the
enforcement is taking place where the
interests are. So and the interests
to data protection is only shared by
consumers and citizens.
That's different with
IP enforcement, for example.
But what I see is
that there's a general question behind
which is enforcement in the digital
environment.
And that is something which
we need to talk about, which we need to
approach in a way that it's not going
back to nationalistic
or fragment tithing
of the internet environment and of
arbitrary blocking of
content, for example.
But in the direction of clear rules
to be applied by
data controllers and to be asked for
by data subjects in an environment
like a common market or
even in
an extraterritorial approach where
a territory where the server is, for
example, has to be regulated.
So that's the way, how we do it.
But the problem is still that
there's no real concern of
other entities at the moment
than citizens and consumers, and
that we need to change, of course.
Hey, thank you.
I think we'll take
the limit microphone number three and
then went online and then two and one
and go round, right?
All yours.
Thank you.
Great. OK.
I have two questions.
One is when do we get criminal
provisions so that we can also get to
individuals who
do something against the law
and make all those extradition treaties
work for us instead of against us?
And the second one,
how about a global approach, something
rooted in international law like
a treaty, a digital high seas treaty
with the court and stuff like that?
Wouldn't that perhaps solve the problem?
Most of the resource protection
problems and stuff like that?
Very good questions.
The first question we
have criminal law provisions, for
example, for cybersecurity, we just
passed it.
We didn't completely like them
because of course, they were
slightly trying
to criminalize those people
who gather here.
But what they are helpful
against is, for example,
access to information systems also
by such states, entities
or by companies
towards other companies.
So spying, for example.
And I think that should be used by us
more. We should turn around
the table and say, Listen,
the Q does cyberattacks
on the burger com system in Belgium,
and they should be punished for that.
I mean, there should be a criminal
procedure against
Eric Schmidt about the terrorist.
I didn't get that.
Eric Smith thought the terrorists.
Yeah, yeah, OK. Terrorism, I don't
like that term. But anyway, the second
thing?
I forgot already.
International treaties, of course.
Yeah, I mean, I'm completely in favor of
international approach.
At the end, I would like to have
an international treaty of fundamental
rights, which is completely enforced
everywhere, consistently
applied and so on.
But I just told you that this will not
happen. I mean, we have the United
Nations and we have a human
rights culture, but I mean,
in in practical meaning,
it doesn't mean anything at the moment,
you know? So the problem is that we
need to get rule of law
jurisdiction, which is
applicable in practical meanings
where we have redress possibilities
and real activities to be taken.
And that's possible at the moment
in some areas of law of
legislation.
And we should use the opportunities we
have to then at the end to build the
pressure for international agreements
as far as possible.
I don't think that a different approach
is possible at the moment.
If if
the big powers in politics fail
to regulate multilaterally,
important questions for them, like
external security,
whatever you know, then we will not
manage to do that for privacy.
But we will manage by building up
the pressure from all around the globe,
by building out systems
which work and risk practically
GIF enforcement and security for
us as citizens and consumers.
Thank you, Signal,
Angel. Do you have a question from our
online viewers?
Yes, just a question from IAC.
How does the upcoming trip
deregulation undermine privacy
rights or will make it harder to defend
and extend them?
That's a good question, where I can
just start with a sentence, which I
forgot to say to the last question,
because of course, we need to
also insist on international agreements
on standards internationally.
I don't think we should.
It should exclude each other.
What we have, for example, at the moment
is the transatlantic data protection
framework agreement negotiated
since two years.
Since two years, we tried to get the
United States government to agree
on the protection of privacy
for non-U.S. citizens or residents,
because the Privacy Act only protects
your citizens and residents and that we
need to change. We need to have the
fundamental right, the human right
notion like it in the EU
treaty and the EU fundamental rights
culture into the US law.
That's what we need to achieve and
what we tried to achieve in the European
Parliament. And I think that tied to
the trade agreement is
endangering these
approaches.
If T-TIP would include debates
on issues like fundamental rights
or data protection.
Therefore, I say that the
ongoing negotiations should be reduced
in scope on technical
standards in many regions,
but not not there, where it's about
fundamental rights, for example, data
protection, because we need to work on
standards now what T-TIP does
is mutual recognition.
What is mutual recognition?
Mutual recognition says OK, the United
States says you Europeans.
If you sell products to our markets, we
accept that you have your own standards.
But if we sell products to your markets,
you have to accept that you have to
follow our standards.
So that's not the way, how we do it,
because that's just a race to the bottom.
It's undermining the standards which
exist because it's always a competitive
disadvantage if you have standards
and if you have higher standards.
Because of course, it's always
a burden for trade.
It's always a burden for those who
want to sell the products so that we
need to get away from.
And therefore, I ask us all to
oppose the T-TIP negotiations because I
don't think it's helpful.
Great. Thank you.
Speaker at number
two.
Yes, I want to thank you very much for
the great work you're doing in the
European Parliament.
I represent the beekeepers
in Europe and
the Green Party in the Parliament
has helped us win many
lobbying battles and it's important
that you're there.
Thank you so much for that.
But my question goes back to the
trade agreement issue, because
you indicated that we have
a race against the clock because
if these trade agreements are in
place before
the European regulations are in
place, then the companies may
be able to go to an arbitration
panel and see
any rules
instituted after
the TTIP is in place
as an unfair trade
barrier and seek compensation from
the taxpayers.
There is an issue, though, that we might.
We may already be losing this race
against the clock because the EU has
already concluded a free trade agreement
with Canada.
And as long as these internet
companies have a significant entity
in Canada, they may already
be entitled to such investor protections.
And as a member of European Parliament,
I already asked your colleagues because
they are in the GMO and pesticide
area, they're probably similarly
similar problems.
As a member of the European Parliament
in the rapporteur position, do you
have any idea what is in the
agreement that has already been
negotiated between Canada and the EU?
It's it's a problem.
I mean, we oppose this
agreement due to the reasons
you already noticed.
I think that the investment security
provisions are the most dangerous for
democracy worldwide.
Unfortunately, we as Europeans
are doing it with so it's so
states already.
You mentioned Canada, but there has been
more in
equal agreements like the free trade
agreement with India.
And I think
that there's only one opportunity
to oppose those ideas of invest
in vessel security provisions in these
agreements because it just means
that you reduce the scope of democratic
decision making in
in our democratic states.
And I don't think that this is a valid
provision. Companies shouldn't have
a reservation that they can
say what can be law and what not,
but it should be the democratic
debate which should decide about that.
So in the Canada provisions,
there are some of these provisions
already in. It's a problem, and it could
be a precedent for T-TIP.
And of course, they will use
it. And they, by the way, try to
negotiate they the U.S.
negotiators in the Canada EU
negotiations. That's not how it goes all
the time.
They know how to negotiate quite good.
So the issue is
that there is a majority
structure, a majority on both sides of
the Atlantic in favor of it
because of jobs and growth.
And that's a debate which is longer than
what we have right now.
I mean, we need to think
about a way
how we can improve
awareness for these problems, especially
with regards to technologies
and how we can create
awareness for the political process
procedures.
But that that means.
So, Michael, I'm
sorry, I don't want there to be a ping
pong back and forth to allow other people
to speak and the young man
at speaker number one, please.
OK. Hi, and thanks for doing more than
your job. And the question
is simple does it apply to
agencies as well or just companies?
And how to enforce that in
the future? Two agencies, yes.
Which agencies and the
public?
It depends on the nature of
the agency. I mean,
yeah, public administration.
OK, so the data protection
regulation will apply to all public
administrations, which are not law
enforcement or national security.
That's the point.
For law enforcement, there's the
directive and for national
security, as I said, black hole.
OK, thank you. OK, I'm sorry, I
have to leave, so thank you very much.
Thank you so much, Dan.
Thank you all for your questions.
I guess it's break time to make sure your
take your things with you.