Privacy Rights and Risks of Massive Data Processing
Explore the significant changes in personal data processing, risks of massive processing and profiling, and the balance between protection and exceptions. Understand the implications of de-contextualization, surveillance, and identity loss in a predictive society. Discover the main general interests invoked to justify data processing and the need for safeguarding personal data protection rights.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
EJTN Administrative on Data Administrative Law Data Protection EJTN Protection and Law Project Privacy Rights Project Rights Judicial Training Judicial Training on and Privacy Filipa Calv o - CNPD Lisboa,23.03.2017
Significant change in personal data processing (increase of the capacity to collect, store and analyze data; Internet and globalization of data processing) Consequence: growth of personal data processing and greater (worldwide) impact of processing Several sources of personal data available on the Internet: public data bases, social media networks, blogs, search engines; new technologies, such as the wearable devices, provide new types of personal information > Big Data; profiling Big Data; profiling
Risks of massive processing and profiling De-contextualization of data (risk of being judged out of context ) and discrimination; Surveillance and Predictive Society: lost of freedom and self-determination; Lost of identity: reducing the person identity and individuality to a profile; Reducing our choices to what the profile determines; Future individual actions conditioned by fear of non-compliance with the normal profile Risks of massive processing and profiling [Y. Poullet]:
And this is becoming the rule of personal data processing Can the protection be the Can the exception to rule? exception to data data protection be the rule? Main General Interests invoked to justify massive data processing: security, efficiency and transparency However, apart from the emergency situations recognized by Charter of Fundamental Rights and national Constitutions, there are not, there cannot be, exceptions to protection of personal data
All other cases in which security, efficiency or transparency are at stake (and demand data processing) may justify the restriction of data protection right but not its total sacrifice There may be: special special data protection cases special cases of data protection special data protection cases cases of data protection restriction, restriction, or
2.1 protection Concrete balancing of interests and rights must be renewed in each case; judgment cannot be crystalized. 2.1. Dynamic process of application of data protection law . Dynamic process of application of data law
Sensitive opinions, religious or philosophical beliefs, trade-union membership, genetic data, health or sex life (Art. 8 Directive 95/46/CE) AND: sexual orientation; biometric data specifically processed to uniquely identify a person (Art. 9 Regulation (EU) 2016/679); Sensitive data data: racial or ethnic origin, political
Sensitiveness of data depends on the concrete context of processing; mainly connected to susceptibility of discrimination Increase of data processing that might conduct to a similar result: nationality, place of birth, place of birth of the data subjects parents Can it be classified as sensitive data? nationality, place of birth, place of birth of the data subjects parents.
Massive processing of data by commercial companies with legitimate aims imposed by law but beyond what is adequate or necessary Examples: Data retention; PNR (Passenger Name Record); The case of cities covered by video surveillance systems
Adequacy: most of the times creates a sensation of security, but is not able to ensure security (e.g., video surveillance) Necessity: even if adequate, collection of more data then those needed to achieve the aim (Data Retention: CJUE Digital Rigths Ireland, (C-293/12 e C- 594/12); Tele2 Sverige AB (C-203/2015); PNR vs. API Advanced Passenger Information: exact information of the identification of passengers send by airline companies to authorities; the extra data are related to food restrictions, means of payment )
Besides: no precise grounds are invoked to justify restrictive legislative measures; No effective or relevant use of the date collected; Disproportionality of data mining and predictive analysis to prevent crimes.
3.1 3.1. Duty of banks to report to Tax Administration all bank transfers a a certain Massive communication of data to Financial Intelligence Units; profiling in order to detect a suspicious behavior 3.2 Massive possessing of data (localization, driving behavior), allowing profiling and monitorization, when the original aim is to provide efficient help in emergency cases . Duty of banks to report to Tax Administration all bank transfers over certain amount over amount (e.g., 1000,00) (e.g., 1000,00) 3.2. e . e- -Call Call 3.3 3.3. . Wi Wi- -fi fi Networks Wi-fi hotspots provided by companies that collect at least the localization of the user of mobile device, even when it is not on-line - Tracking the users; allowing the combination of data through IMEI (International Mobile Equipment Identification) - - relevance of privacy restriction in public spaces Networks
