Legal Research

EDPS calls for data portability rights

By scott

I note that the European Data Protection Supervisor (EDPS), whose job it is to advise the European Commission on DP issues, has responded to their consultation on updating the current data protection/privacy laws. It is a good solid response ? as we have come to expect fromPeter Hustinx.

Of particular interest are his view that the Commission should not be proposing a new Directive, but a Regulation instead.

For those not totally familiar with the workings of the EU the main difference between the two is that Member States are given time (usually 18 months) to change their current laws to reflect the content of a Directive (and historically Member States interpretation and wording in their own implementations can be at odds with what was intended by the text of the Directive), whereas a Regulation immediately becomes law across all member states, without the need for transposition.

For those of us with an interest in social networks, he view that the rights of data portability and the right to be forgotten are ‘useful concepts’ which should be included in any new legal instrument are also interesting. He thinks current protection in the data protection directive could be strengthened to including a data portability right to allow individuals ? for example to export their data out of Facebook etc and important it into another service while at the same time ensuring that Facebook etc delete that information even if they would like to keep it for their own legitimate purposes.

He also calls for a newly codified ?right to be forgotten? ( a ?privacy by design? obligation) that would ensure the deletion of personal data or the prohibition of further use that data. This right would mean that all data would have an expiration date. From a data portability point of view he would envisage this happening without a user (data subject) having to act as it would happen because the data has been already stored for a certain amount of time. “Only in very specific circumstances, where a specific need to keep data longer could be established, could a data controller be entitled to keep the data. That ?right to be forgotten? would thus reverse the burden of proof from the individual to the data controller and constitute a ?privacy by default? setting for the processing of personal data.”

An interesting viewpoint. There are a number of other good points (for those with DP fetishes) in the response on topics such as: the EU’s proposal to convieniently omit data processing by EU institutions and bodies, from any new general instrument; the inclusion of police and judicial matters and civil matter in any new instrument; and making the process for adopting Binding Corporate Rules (BCRs), including providing for the main elements/ conditions for the adoption of BCRs in the instrument.

Full post as published by Information Overload on January 18, 2011 (boomark / email).