Search

Data portability rights are viewed by policymakers worldwide as a significant legal innovation to stimulate competitive digital economies. These rights allow consumers and businesses to seamlessly receive and transfer data for commercialization and efficiency purposes. The newly implemented Australian Consumer Data Right (CDR) provides an illuminating example of the complex relationship between information privacy and competition law which is central to data portability initiatives. The CDR grants consumers and businesses access and transfer rights for consumer data in the Australian banking, energy, and telecommunications sectors, through the implementation of mandated API standards. There are three policy vectors at the heart of the CDR that parallel previous Australian, UK, and EU data portability developments. They are the type of regulated data covered by the CDR scheme, privacy and security protections and the overarching regulatory framework. We argue that the CDR, and its antecedents, primarily construct data portability as a competition law measure. However, while the general policy intention of the CDR is clear, we contend that the scheme reveals an uncertain role for information privacy law as part of its operation. Uncertainty is evident in how policymakers have considered the information privacy law issues inherent in the three policy vectors. We contend that the CDR could give rise to definitional problems with regulated data, duplicated privacy and security protections and a conceptually challenging regulatory framework. In conclusion, we suggest potential solutions that would assist with the operation of the CDR within Australia’s broader information privacy law framework, governed by the Privacy Act 1988 (Cth), which would also better align with the General Data Protection Regulation (GDPR).

South Korea’s data privacy law has evolved rapidly despite a short history of relevant legislation and enforcement. South Korea’s data privacy law has exceedingly stringent consent requirements. In addition to consent, there are many other statutory provisions with onerous requirements, arguably making the overall data privacy law regime one of the strictest in the world. South Korea’s data privacy law, in particular the Personal Information Protection Act, has a similar structure to the EU’s data privacy law. However, the overall legal regime and enforcement mechanisms for data privacy reveal South Korea’s unique characteristics and the weaknesses of its data privacy law. Both the governance regime and the enforcement powers are too fragmented to achieve consistent policy outcomes. Data privacy has gained greater public attention in recent years in South Korea and, perhaps reflecting this phenomenon, relevant laws and regulations have been amended frequently. A notable trend is to strengthen penalty provisions such as the maximum amount of administrative fine, now set at 3% of relevant sales revenue. It remains to be seen if heightened penalty provisions will meaningfully help to address data privacy concerns.

The paper critically discusses fundamental issues in European data protection law and outlines their possible solutions.

The extraterritorial application of a country’s data privacy laws may severely impact the free speech and financial interests of other countries and their citizens. Yet, around the world, data privacy laws with extraterritorial scope are being introduced or reformed without much discussion, debate, or visible opposition. Indeed, we are currently witnessing an unprecedented level of data privacy laws being enacted (eg Singapore and Malaysia) or revised (eg Australia and the European Union) around the world. Most importantly, the European Union (EU) is in the process of modernizing its data privacy law by replacing its Data Protection Directive 1995 with a new data protection Regulation. Interestingly, that Regulation, with its potential for penalties of up to 2 per cent of an offending enterprise’s annual worldwide turnover, looks likely to apply also to any non-EU enterprise that processes data about persons residing in the EU under certain circumstances. This means that the EU law, with its potential for heavy fines and wide extraterritorial scope, is likely to directly affect businesses around the world. As noted elsewhere, in essence, the conundrum we are faced with can be expressed as follows: extraterritorial jurisdictional claims are reasonable because if states do not extend their data protection to the conduct of foreign parties, they are not providing effective protection for their citizens. At the same time, wide extraterritorial jurisdictional claims are arguably unreasonable because it is not possible for those active on the Internet to adjust their conduct to all the laws of all the countries in the world with which they come into contact. In other words, a widespread extraterritorial application of state law may well end up making it impossible for businesses to engage in cross-border trade. On some occasions, articles in this journal have dealt with extraterritoriality in some detail. Most specifically, in two articles published during the journal’s first year, Moerel addressed the extraterritoriality of EU data privacy law. Further, the editorial of issue 3(3) of this journal sought to bring attention to this important

Data privacy laws sometimes take root in unlikely locations. Nepal, one of the poorest countries in the world, has an unstable parliamentary democracy with coalitions led by various Marxist parties. Nepal has very limited privacy protections in relation to the private sector, and does not have a large non-agricultural private sector as yet. But in relation to public bodies its right to information (RTI) law, while primarily concerned with ‘freedom of information’ (FOI) issues, has numerous unusual and potentially important data privacy protections. This article analyses these protections, their scope, and (to the extent possible) their application, and argues that they amount to a ‘data privacy law’ for Nepal’s public sector. Nepal is the first country in South Asia to have such a law.

based on EU secondary legislation and does not yet take into account the fundamental right to data protection enshrined in the Charter of Fundamental Rights of the European Union that has meanwhile become a binding part of EU primary law. Both legal developments raise the question of whether the fundamental right to data protection is only a subset of the right to privacy, or whether it also provides additional protection. This article discusses the relevant jurisprudence of Europe’s two highest courts, the European Court of Human Rights in Strasbourg (the Strasbourg Court or ECtHR) and the CJEU, with regard to the differences between privacy and data protection. Though both courts tend to treat data protection as an expression of the right to privacy, the specifics of each right must be respected. Before turning to the case law, it is necessary to address the two underlying systems of fundamental rights protection, as well as the specific provisions on privacy and data protection within these two systems. Afterwards we will examine the interpretation of the two rights by the two courts and highlight the differences between them. Finally, we will attempt to illustrate the differences and overlaps between privacy and data protection using the example of the pending Google and Google Spain case. The Convention and the Charter

The US Supreme Court has written a great deal about ‘privacy’ in a wide variety of contexts. Between 1970 and 2011, the Court used the term ‘privacy’ in 631 opinions. In just over half (328 opinions) did an opinion significantly address some aspect of privacy. The breakdown of those 328 opinions offers insight into the contexts in which the Supreme Court concerns itself with privacy (Figure 1). Not surprisingly, most of these opinions addressed privacy rights that the Court has found are protected by the US Constitution. The largest single category by far was cases involving a ‘reasonable expectation of privacy’ under the Fourth Amendment to the Constitution (210, or 64 per cent of opinions), including the extent to which privacy rights are implicated, or violated, by searches or seizures that are initiated or conducted by private parties with some degree of government involvement. Opinions involving the First Amendment and freedom of expression and association issues accounted for 18 per cent (59), a large portion of which involved reviews of obscenity regulations and prosecutions. Fourteen opinions (4 per cent) involved what the Court has come to call ‘decisional privacy’, namely the privacy rights the Court has found implied in the Constitution that protect the rights of adults to make decisions about activities such as reproduction, contraception, the education of their children, and sexual intimacy. A handful of opinions (16, or 5 per cent) involve the privacy-related characteristics of the Fifth Amendment’s protection against self-incrimination. Aside from constitutional privacy issues, 20 (6 per cent) of the Court’s opinions involving privacy addressed the application of the two privacy exemptions to the Freedom of Information Act. A significant number of opinions (69, or 21 per cent) did not fit neatly within any single discrete category, but reflect a

The proposal for reform of the data protection legal framework, recently made public by the European Commission (EC), specifically enshrines a ‘right to data portability’, which is designed to reduce the difficulties for individuals to stay in control of their personal data, along with the provision of a ‘right to be forgotten’ and a ‘right to rectification’.The debates surrounding these privacy concerns, especially related to cloud computing (another ubiquitous concept), have not enjoyed a clear, unitary discourse, as IT developments have almost out-run the rhythm in which legal scholars were analysing recent threats to privacy, and especially internet privacy.This paper aims to reveal the characteristics of data portability as a legal concept in the modern world of privacy and data protection; it focuses on a few aspects of the reform proposed by the Commission, highlighting the detailed provisions of the right to data portability in the larger context of the reform.It also discusses data portability’s impact on competition and its links to international data transfers, as they will be regulated in the new EU data protection law. It concludes that data portability is a right of the data subject strongly connected with a fundamental right to the free development of human personality, and is also a function that cloud computing services worldwide will have to provide in order to increase users’, customers’ or consumers’ trust.

† How Japan has shaped and evolved the concept of data privacy is examined and how, in this context, it has overcome its culture of respecting the community and the public at the cost of private interests. † The tradition and history of the Japanese culture of privacy is rooted in Bushi-do, which values public interests. After the right to protect private life was judicially recognized in the 1960s, the rapid growth of technology which threatened privacy and personal data led to a new concept of privacy as controlling personal information, as well as to new legislation on protecting personal information.

Smart metering systems require an early awareness of their massive implications with data protection and privacy issues. Consideration from the outset enables the development of special architectures designed for privacy, which may decisively reduce privacy risks.The requirement for the obligatory consent of consumers to the installation of smart meters should be avoided, since it threatens the goals—improvements in energy and cost efficiency as well as consumer information—of the new technology.The collection and processing of the detailed consumption data of consumers could be based on various other legal foundations, of which the existence of a specific and valid legal obligation is the most favourable and firmly based as far as it reasonably balances the needs of the utility providers and the privacy rights of the consumers.Consumer's privacy rights may not be overridden, since their positive acceptance of and active use and involvement in the new technology are key concerns and parameters for achieving its very creditable goals.

† Discusses the key concepts of the provision for applicability of EU data protection laws to nonEU websites and provides for a uniform interpretation thereof based on the legislative history of the Directive. † Discusses the differences in the manner in which the applicability rule is implemented in the Member States and the resulting divergent interpretations by the national Data Protection Authorities.

The Italian Marxist theorist Antonio Gramsci once wrote (in translation) that ‘the old is dying and the new cannot be born; in this interregnum, a great variety of morbid symptoms appear’. Although Gramsci was not speaking about data privacy, it seems to us that this statement could apply to the current state of data protection regulation around the world, which is marked by a realization that existing regulatory models are not working effectively, the lack of political will to explore alternatives, and general frustration about how to improve the situation. This has led to a credibility gap between the objectives of data protection law and how personal data are protected in practice. It should not be this way. The importance of data privacy has never been greater, and countries and regional organizations around the world are enacting legislation in an attempt to protect it. Much of this legislation has been based on the EU Data Protection Directive 95/46, which will be replaced by the proposed EU General Data Protection Regulation if the EU can ever finalize its interminable legislative process. Even the White House, which for years had seemed to oppose any large-scale federal legislation to deal with data processing in the private sector, has called for enactment of a Consumer Privacy Bill of Rights Act to grant increased protection to the online processing of personal data. Regional organizations such as Asia-Pacific Economic Cooperation, the Council of Europe, the Organization of American States, the Economic Community of West African States, the Organisation for Economic Co-operation and Development, and others have also done extensive work to enact new privacy instruments or amend their existing ones. All this activity has also had an effect at the global level, with the UN General Assembly passing a resolution that affirms the ‘right to privacy in the digital age’. But the increasing amount of new data protection regulation raises an important point: is all of this making any difference in increasing the protection of data privacy in practice? There are three aspects to this question that we would like to discuss briefly here. First of all, there is general confusion about the correct approach to regulating the collection, processing, and use of personal data. Among the issues about which there is no global consensus are how effective the law can be in regulating online data processing; the correct balance between legal regulation and private sector selfregulation; and how best to enforce the law. To a large extent, these questions are not unique to data protection and tend to arise in any area that involves the regulation of technology. But coming to a consensus about them has proved intractable, as they often reflect differences in national and regional laws and cultures. Secondly, the globalization of data processing creates major problems for applying and enforcing the law. The fact that it is increasingly difficult to determine the location where data are collected and processed gives rise to confusion on the part of individuals about what their rights are and how they can exercise control over their data in a meaningful way. Data controllers are similarly frustrated by the application of multiple laws to a particular database or online service, and regulators and governments are often unable to apply and enforce their laws across national borders, which can lead to international tensions. Thirdly, questions arise about how data protection regulation is enforced. Recent years have witnessed what could be called the ‘FTC-ization’ of data privacy enforcement, which reflects the strategy of the US Federal Trade Commission to concentrate on enforcement in highprofile cases, in order to make examples of the corporations involved and frighten others into compliance. Other regulators, such as European data protection authorities, have adopted a similar approach, at least in part because they lack the resources to enforce the law on a more widespread scale. However, while this may generate enforcement efficiencies, it raises questions

In his seminal article ‘The Limits of Antitrust’, Easterbrook argued that ‘when everything is relevant, nothing is dispositive’; therefore, when applying competition law, judges should resort to clear presumptions rather than balancing the proand anti-competitive effects of particular conduct. In the intervening 20 years, much ink has been spilled on the issue of whether competition law should take into consideration wider policy objectives. This discussion has been given renewed impetus in recent months following the publication of a ‘preliminary opinion on the intersection of data protection, consumer protection and competition law’ in March of this year by the European Data Protection Supervisor (EDPS). The publication of this report was followed by a workshop held under Chatham House rules in Brussels in June, a summary of which was published by the EDPS in July. The report reflects lively discussions on several issues familiar to data protection experts, such as the role of personal data in the digital economy and how to foster privacy as a competitive advantage. However, it also serves to launch a debate regarding matters which have been overlooked or unsubstantiated thus far. Most significantly, the report queries whether the traditional tools of competition law, which focus on parameters such as price, quality, and choice can explain the impact of certain business practices on data protection and privacy. It also questions ‘wider issues’ in competition law enforcement, for instance whether the Commission’s current case-by-case approach is correct in the digital environment or whether specific guidelines or a study should be introduced to inform authorities dealing with antitrust and merger cases involving personal data. These are queries which need to be addressed and the EDPS is to be applauded for kick-starting this discussion, whatever its outcome. Many of web 2.0’s datacentric services are two-sided platforms which are characterised by network effects: the more users they have, the more users they acquire. This leads to winnertakes-all markets which makes the application of key data protection concepts, such as consent, more difficult. Quite simply, individual control over personal data (or ‘informational self-determination’) becomes illusory when individuals are dealing with monopolies. For this reason, competition law is frequently depicted as the silver bullet which will render data protection rules more effective by injecting competition into monopolised markets and facilitating individual choice. However, that competition law can or even should play this role is contested by experts in that field. A discussion on the potential—and limits—of competition law was therefore conspicuously lacking until the EDPS initiative in March. Nevertheless, it is not yet apparent whether, and if so how, the two fields actually intersect. In recent years, the enforcement activity of DG Competition has been guided by a consumer welfare standard, according to which competition law should seek to deliver benefits to consumers in the form of ‘lower prices, better quality and a wider choice of new or improved goods and services’. This approach assumes that consumer welfare is negatively affected only when a particular practice has the effect of foreclosing an equally efficient competitor

Back in 1996, Rotenberg noted that: ‘Privacy will be to the information economy of the next century what consumer protection and environmental concerns have been to the industrial society of the 20th century.’ This prophecy has largely been fulfilled. However, one aspect of data privacy law that has yet to gain the attention it deserves is the extraterritorial scope of data privacy laws. In a world so characterized by globalization, it is highly surprising that this issue has gained so little attention. Thus, our prophecy is that the extraterritorial application of data privacy laws will emerge more clearly as one of the most significant and urgent cross-border law questions over the coming years. This point of view is supported by the fact that data privacy laws with extraterritorial reach are currently being enacted (e.g. Singapore and Malaysia), or revised (e.g. Australia and the EU), around the world (due in no small part to a desire to better address online privacy concerns) and their role is growing in importance, not least due to

Over the last decade, privacy has become big business. Company executives hobnob with data protection regulators at conferences held all over the world; associations of privacy officers are experiencing exponential growth in membership; data protection has become a money-maker for consultancies and law firms (as well as for academics who provide consulting services); and lobbyists engage policy-makers in an effort to influence data protection and privacy regulation. In the past, data protection was seen mainly as a cost factor, but now it is increasingly becoming a way to make money, and to ensure the continued trust of customers, employees, and business partners. The economic importance of data processing makes it natural that the business of privacy would expand as well. Viewing privacy as a business opportunity can result in increased attention and resources being devoted to its protection. In recent years, governments and regulators have emphasized that respect for data protection and privacy should be seen as a way to strengthen confidence in online commerce, and have encouraged the growth of the professional side of privacy; indeed, there is evidence that viewing privacy as a business enabler can itself be a powerful factor to encourage respect for regulation. All of this has led more and more companies to take steps to protect privacy as a way to strengthen their brands and enhance customer confidence through measures such as appointing internal privacy compliance officers and taking the impact of business decisions on privacy into account before they are implemented, developments that are all to the good. At the same time, these developments raise questions. Most countries with data protection laws regard privacy as a fundamental right, and viewing the protection of a fundamental right as a money-making opportunity may seem distasteful. The number and cost of conferences and seminars covering privacy issues often seems excessive (not to mention the environmental implications of privacy experts travelling all over the world to attend them). The increasing number of professional firms offering consulting or legal services may have contributed to the emerging view of privacy compliance as a complex and costly exercise. And many smalland medium-sized companies struggle to afford the high cost of the privacy compliance industry, with the result that many simply ignore compliance altogether. It would be hypocritical for the editors to paint the ‘privacy industry’ in too negative a light, since each of us is involved in it in one way or another. On the contrary, we believe that creating economic incentives is one of the most effective ways to further privacy and data protection, and that the growth of privacy as a business area holds the potential to motivate compliance with privacy regulation and individual expectations not just as a matter of law, but for pragmatic economic reasons as well. We see nothing wrong per se with making money from data protection and privacy, as long as the monetary rewards are kept in proportion to the reasons that privacy is protected in the first place. Data protection is not purely a money-making activity like investment banking, but exists to protect fundamental values cherished by societies around the world. This means that everyone involved in the business of data privacy should ask not just how to make it more profitable for themselves, but also how they can use it to give something back to society. Making such contributions need not be a grandiose endeavour, and can include things such as writing articles to explain complicated legal issues to a wider audience; teaching data privacy law to students; and engaging in pro bono activities on behalf of individuals and small organizations. Indeed, we regard IDPL as a forum for discussing important issues of data protection and privacy law, and thus as a way to give something back to what we regard as one of the most fascinating and important areas of law.

The constant development of technology gives rise to an equally constant stream of privacy issues. One of the most interesting recent developments is what we can call face-to-data (F2D). F2D refers to at least partially automated processes for accessing personal information about a person based on an image of that person’s face. Ground-breaking research by a team of researchers from Carnegie Mellon University has highlighted that advances in face recognition technology, combined with the widespread posting of images linked to names on, for example, social media sites, and the processing power provided by advances in cloud computing, create a new set of privacy issues, similar to, but also distinct from, traditional privacy issues associated with facial recognition. The Carnegie Mellon University team ran a series of experiments. For example, using a search tool, they built up a database of images and names collected from publicly available Facebook profiles. They then captured images of consenting students and ran those images through off-the-shelf face-recognition software, linking in the data gained from the Facebook profiles. In the test, about a third of the students were identified. The Carnegie Mellon work is striking because it uses commonly available devices (ie an iPhone) to perform highly effective facial recognition using candid photographs, and then links those to a series of databases to generate an immediate response. So, for example, a person may use a phone on a street, take a picture, and within seconds have back the Social Security Number and street addresses of the people photographed. Information that can then be used to, manually or through automated processes, extract further personal data about those people. In light of this, the facial recognition aspect is only one part of the overall process of concern here, and facial recognition as such is a broader phenomenon than F2D. Thus, to properly understand the phenomenon we are dealing with, it is undesirable to discuss F2D merely as a facial recognition issue. F2D can of course serve a variety of goals ranging from government surveillance, to business use and to satisfy personal curiosity, and it is interesting to consider how current data privacy laws address F2D. And with privacy laws being developed or changed in so many parts of the world, it is even more interesting to consider how the next generation of data privacy laws will address F2D. As is well known, the privacy regulation of today is largely focused on data use that falls outside the private sphere; that is, in those countries that do have some form of privacy regulation in place, there is typically some form of exemption for data use in the context of the ‘private affairs’ of individuals. This means that in most countries, while F2D for business purposes may be regulated, personal use would typically be unregulated. Furthermore, even in those countries, such as within the European Union, where commercial use may fall under applicable data protection schemes, it may be possible to circumvent the regulatory impact by placing a simple notice onsite informing potential customers of the use of F2D at that location, and then assuming that their failure to object to the processing should legitimize it. The conclusion is that traditional data protection regulation provides limited comfort for those concerned about the impact of F2D. While there have been some improvements to the rules governing consent in the EU General Data Protection Regulation proposed by the European Commission in January 2012, it seems unlikely that even the world’s most modern and protective legislative initiative will satisfy fully those fearing the privacy impact of F2D.

In the European Union, compliance with data protection requirements is overseen by public authorities (ie data protection authorities or DPAs), who ‘shall act with complete independence in exercising the functions entrusted to them’. Given the growing number of countries around the world that have adopted data protection legislation based on the EU model, the requirement of having an independent data protection authority has spread to other regions as well. This requirement has recently been reinforced by the judgment of the European Court of Justice (ECJ) in the case Commission v Germany, where the Court found that the DPAs of the German federal states (Lander) were structured so as to be subject to governmental oversight, and that Germany had thus failed to properly implement Article 28(1) of the EU Data Protection Directive. These developments lead to reflection on the concept of ‘independence’. As the ECJ found, the basis for requiring independence is that it helps ensure the effectiveness and reliability of supervision by allowing the authorities to carry out their tasks free from external influence. The experience in Europe shows the need for such regulatory independence, given that governments sometimes have sought to influence the work of the data protection authorities (one such example is the resignation en masse of the entire Greek Data Protection Commission in 2007 for alleged political interference). However, the issue of independence is more complex than it may seem at first glance. While independence is indeed an indispensable requirement for the work of DPAs, complete and total independence is never possible, or even desirable, on the part of any public authority. Principles of accountability and transparency require that a supervisory authority be answerable for its actions (eg through the possibility of judicial review), and that it be subject to controls in order to ensure its integrity. There are also different types of independence. The ECJ decision concentrates on legal independence, that is how the DPAs are set up and structured so as to be free of undue governmental influence. However, just as important is independence in terms of financial and personnel resources. Indeed, many European data protection commissioners complain that they have insufficient resources to do their jobs properly (a view supported by a recent study of the European Agency for Fundamental Rights). Indeed, one European DPA even had to shut down its operations for several months toward the end of 2010 because it had completely run out of funds. Some European governments have used structural independence as a ‘poisoned chalice’, freeing their DPAs from being part of government ministries but also making it clear that from that point the DPA is required to provide for its own budget. It is therefore welcome that the European Commission has taken a broad view of the concept of independence of the DPAs in its current review of the EU data protection framework. Independence may also be viewed differently in different legal cultures. For instance, one non-EU DPA has stated privately that in its country, being part of a government ministry gives it more ‘clout’ and results in it being taken more seriously than if it were set up as a free-standing, independent regulatory authority. It may therefore be necessary to consider the complete legal and political structure of a country before determining whether its data protection regulator is independent.

Balboni, P.(2013)Legitimate interest of the data controller New data protection paradigm: legitimacygrounded on appropriate protection, International Data Privacy Law, Volume 3, Issue 4, November 2013, Pages 244–261