How to maintain data privacy

Data privacy refers to the evolving relationshipConvention on Human Rights (ECHR) provides a right
between technology and the legal right to, or publicto respect for one's "private and family life, his home
expectation of privacy in the collection and sharing ofand his correspondence", subject to certain restrictions.
data.The European Court of Human Rights has given this
Privacy problems exist wherever uniquely identifiablearticle a very broad interpretation in its jurisprudence.
data relating to a person or persons are collected andAccording to the Court's case law the collection of
stored, in digital form or otherwise. Improper orinformation by officials of the state about an individual
non-existent disclosure control can be the root causewithout his consent always falls within the scope or
for privacy issues. The most common sources of dataarticle 8. Thus, gathering information for the official
that are affected by data privacy issues are:census, recording fingerprints and photographs in a
* Health information.police register, collecting medical data or details of
* Criminal justice.personal expenditures and implementing a system of
* Financial information.personal identification have been judged to raise data
* Genetic information.privacy issues. Any state interference with a person's
* Location information.privacy is only acceptable for the Court if three
The challenge in data privacy is to share data whileconditions are fulfilled: (1) the interference is in
protecting the personally identifiable information.accordance with the law, (2) pursues a legitimate goal
Consider the example of health data which areand (3) is necessary in a democratic society. For more
collected from hospitals in a district; it is standardinformation, please refer to Human Rights Handbook
practice to share this only in the aggregate. The ideano. 1 (PDF) or the Council of Europe data protection
of sharing the data in the aggregate is to ensure thatpage.
only non-identifiable data are shared.The government isn't the only one who might pose a
The legal protection of the right to privacy in generalthreat to data privacy, far from it. Other citizens, and
and of data privacy in particular varies greatly aroundprivate companies most importantly, engage in far
the world.more threatening activities, especially since the
The Universal Declaration of Human Rights states in itsautomated processing of data became widespread.
article 12 that:The Convention for the Protection of Individuals with
No one shall be subjected to arbitrary interference withregard to Automatic Processing of Personal Data was
his privacy, family, home or correspondence, nor toconcluded within the Council of Europe in 1981. This
attacks upon his honour and reputation. Everyone hasconvention obliges the signatories to enact legislation
the right to the protection of the law against suchconcerning the automatic processing of personal data,
interference or attacks.which many duly did.
Protecting privacy in information systemsAs all the member states of the European Union are
Increasingly, as heterogeneous information systemsalso signatories of the European Convention on
with different privacy rules are interconnected,Human Rights and the Convention for the Protection
technical control and logging mechanisms (policyof Individuals with regard to Automatic Processing of
appliances) will be required to reconcile, enforce andPersonal Data, the European Commission was
monitor privacy policy rules (and laws) as information isconcerned that diverging data protection legislation
shared across systems and to ensure accountabilitywould emerge and impede the free flow of data within
for information use. There are several technologies tothe EU zone. Therefore the European Commission
address privacy protection in enterprise IT systems.decided to harmonize data protection regulation and
These fall into two categories: communication andproposed the Directive on the protection of personal
enforcement.data, which member states had to transpose into law
Policy Communicationby the end of 1998.
P3P - The Platform for Privacy Preferences. P3P is aThe directive contains a number of key principles
standard for communicating privacy practices andwhich must be complied with. Anyone processing
comparing them to the preferences of individuals.personal data must comply with the eight enforceable
Policy Enforcementprinciples of good practice.
XACML - The eXtensible Access Control MarkupThey say that data must be:
Language together with its Privacy Profile is a* Fairly and lawfully processed.
standard for expressing privacy policies in a* Processed for limited purposes.
machine-readable language which a software system* Adequate, relevant and not excessive.
can use to enforce the policy in enterprise IT systems.* Accurate.
EPAL - The Enterprise Privacy Authorization* Not kept longer than necessary.
Language is very similar to XACML, but is not yet a* Processed in accordance with the data subject's
standard.rights.
WS-Privacy - "Web Service Privacy" will be a* Secure.
specification for communicating privacy policy in web* Not transferred to countries without adequate
services. For example, it may specify how privacyprotection.
policy information can be embedded in the SOAPPersonal data covers both facts and opinions about
envelope of a web service message.the individual. It also includes information regarding the
North Americaintentions of the data controller towards the individual,
Data privacy is not highly legislated or regulated in thealthough in some limited circumstances exemptions will
U.S.. In the United States, access to private data isapply. With processing, the definition is far wider than
culturally acceptable in many cases, such as creditbefore. For example, it incorporates the concepts of
reports for employment or housing purposes. Although'obtaining', 'holding' and 'disclosing'. For more details on
partial regulations exist, for instance the Children'sthese data principles, read the article about the
Online Privacy Protection Act and HIPAA, there is nodirective on the protection of personal data or visit the
all-encompassing law regulating the use of personalEU data protection page.
data. The culture of free speech in the U.S. may be aAll EU member states adopted legislation pursuant this
reason for the reluctance to trust the government todirective or adapted their existing laws. Each country
protect personal information. In the U.S. the firstalso has its own supervisory authority to monitor the
amendment protects free speech and in manylevel of protection.
instances privacy conflicts with this amendment. In* In the United Kingdom the Data Protection Act 1984
many countries privacy has been used as a tool towas repealed by the Data Protection Act 1998. For
suppress free speech.details, visit U.K. data protection page or read the
The safe harbor arrangement was developed by thearticle about the Information Commissioner
US Department of Commerce in order to provide a* France adapted its existing law (law no. 78-17 of 6
means for US companies to demonstrate complianceJanuary 1978 concerning information technology, files
with European Commission directives and thus toand civil liberties). More information is available on the
simplify relations between them and Europeanwebsite of the CNIL CNIL (in French only) (Commission
businesses.Nationale de l'Informatique et des Libertés)
Very few states recognize an individual's right to* In Germany both the federal government and the
privacy, a notable exception being California. Anstates enacted legislation. For details, visit the page of
inalienable right to privacy is enshrined in the Californiathe Federal Data Protection Commissioner
Constitution's article 1, section 1, and the California(Bundesbeauftragter für den Datenschutz).
legislature has enacted several pieces of legislationSafe Harbor Program
aimed at protecting this right. The California OnlineThe US Department of Commerce created the Safe
Privacy Protection Act (OPPA) of 2003 requiresHarbor certification program in response to the 1995
operators of commercial web sites or online servicesDirective on Data Protection (Directive 95/46/EC) of
that collect personal information on California residentsthe European Commission. Directive 95/46/EC
through a web site to conspicuously post a privacydeclares in Chapter IV Article 25 that personal data
policy on the site and to comply with its policy.may only be transferred from the EU to countries
In Canada, the Personal Information Protection andwhich provide a level of privacy protection equivalent
Electronic Documents Act (PIPEDA) went into effectto that of the EU. This introduced a legal risk to
in relation to federally regulated organizations on 1organizations which transfer the personal data of
January 2001, and in relation to all other organizationsEuropean citizens to servers in the USA. Such
on 1 January 2004. It brings Canada into complianceorganizations could be penalized under EU laws if the
with the requirements of the European Commission'sprivacy protection of the USA were to be deemed
directive. For more information, visit the website of theweaker than that of the EU. The Safe Harbor
Privacy Commissioner of Canada.program addresses this issue. Under this program, the
EuropeEuropean Commission agreed to forbid European
The right to data privacy is heavily regulated and rigidlycitizens from suing US companies for transmitting
enforced in Europe. Article 8 of the Europeanpersonal data into the USA.