EU Privacy Framework Michael Lamb LexisNexis Risk Solutions Vice President and Lead Counsel: Regulatory, Privacy & P

1. EU Privacy Framework Michael Lamb LexisNexis Risk Solutions Vice President and Lead Counsel: Regulatory, Privacy & Policy May 19, 2011

2. EU versus US: Privacy Philosophy • United States – Most data privacy laws and • rules arise out of consumer protection concepts rather than a right of the individual. • European Union – privacy and protection of personal information is treated as a human right. • Thus one will see requirements in the EU that give an individual control over data about them even though they were not the source of the data in any way.

3. EU Data Protection:The Basics • What is personal information in the EU? • “Personal data shall mean any information relating • to an identified or identifiable natural person (“data • subject”); an identifiable person is one who can be • identified, directly or indirectly, in particular by • reference to an identification number or to one or more • factors specific to his physical, physiological, mental, • economic, cultural or social identity”. (1995 Data Directive)

4. EU Data Protection:The Basics (cont’d) • Some personal information elements are considered more • sensitive than others. The definition of what is considered • sensitive may vary depending on jurisdiction and particular • regulations. • EU: Sensitive personal information called special categories of data. This refers to: • racial or ethnic origin, • political opinions, • religious or philosophical beliefs, • trade-union membership, • data concerning health or sex life, and • data relating to offenses, or criminal convictions.

5. Processing • “Processing” is anything you can do with personal information. • Processing includes: • Collection Recording • Organization Storage • Updating Modification • Retrieval Consultation • Use Disclaoure • Transmission Dissemination • Linking Erasure • Destruction

6. Controllers and Processors • Controller - A Controller is the person or entity that determines the purposes and means of the processing of personal information. • Processor - A Processor processes personal data on behalf of the Controller and at the direction of the Controller. • Controllers and Processors have different obligations.

7. EU Directive Basics • Processing of personal information is prohibited unless: • Notice to and consent of the data subject; • Other exemptions; • Special processing rules for sensitive data. • Ensure data security and quality. • Give data subject the right to access and object/correct. • Controls on automated decisions. • Transfer restrictions.

8. UK DPA Law Example • For example, UK law (DPA, Section 4(4) and Schedule 1) provides that personal data shall be: (a) processed fairly and lawfully; (b) processed for one or more specified and lawful purposes; (c) adequate, relevant and not excessive; (d) accurate and up to date; (e) not kept for longer than necessary; (f) processed in accordance with individuals’ rights; (g) afforded appropriate technical and organizational security; and (h) not transferred outside the EEA unless adequate data protection is assured.

9. Processing Grounds • Processing must be based on legitimate grounds, including one or more of the following: • Data subject has given unambiguous consent • Processing is necessary to perform a contract to which the data subject is a party or to take step sat the request of the data subject prior to entering into a contract. • The processing is necessary to comply with a legal obligation to which that party is subject. • The processing is necessary to protect the vital interests of the data subject. OR

10. Processing Grounds (cont’d) • The processing is necessary for the purposes of • the legitimate interests pursued by a party or by a third party to whom the data are disclosed. • except where the processing is “unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.” (quoting UK law) • This last ground is more open-ended . . . • CCTV example • Watch lists

11. EU Special Categories • Stricter Criteria for Processing Sensitive Data: • Data subject has given explicit consent. • Data subject is physically and legally incapable of giving consent and processing is necessary to protect vital interests. • Necessary for the establishment, exercise or defense of legal claims. • Information has been made public by the data subject. • Processing is necessary to carry out the obligations and specific rights.

12. Data Transfers • Transfers of personal data from the EEA to other countries are prohibited unless to a country with “adequate” protection (e.g., Canada) they qualify for an exception: • the data subject freely and unambiguously provides specific consent, • the transfer is necessary on various grounds (i.e., performance or conclusion of a contract, legally required for the public interest or legal claims or protection of the vital interests of the data subject) or • the transfer is made from a register intended to provide information to the public in accordance with law.

13. Data Transfers (cont’d) • If no exception is available, a company may utilize one of the following methods to comply: • uses a model contract signed by both the EU data exporter and U.S. data importer; • adopts binding corporate rules approved by the EU countries from which personal data is to be transferred (within a corporate family); or • self-certifies under the Safe Harbor framework.

14. EU Hot Topics • Expanding Scope and Protections • Viviane Reding, the European Commissioner for Justice: promised to "expand data protection to other areas" in a proposal by the end of the year. • "We're looking at...localization data services, behavioral advertising, basically anything that's dealing with new technology.“ • She supports the “right to be forgotten”.

15. EU Geo-Location Data • Geo-location data on the agenda of the “Article 29 Working Party” last December; report expected by early June. • Expected Proposal: treat information collected by phone and Internet companies on customer locations same as “personal data” (that is, treated the same as names, birthdays and other personal data).   • Article 29 Working Party opinions, working documents and recommendations are not legally binding, but they often become the “EU standard.” • France, Germany, Italy, Ireland and the U.K. have already opened their own investigations into geo-location data.

16. Issues Arising Elsewhere • India: Just published new privacy rules (in April Ministry of Communications and Information Technology issued the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.) • New rules are arguably stricter than the EU rules, addressing consent, opt out, limits on use, data security, etc. • Definitely requires a review of operations outsourced to India to confirm compliance.

17. Issues Arising Elsewhere • Philippines – Proposed Privacy Legislation (already passed their House (H. No. 4115)) • Adopted to SUPPORT outsourcing industry and become an acceptable country for the EU. • Undercuts that goal by creating data rights and restrictions that may not otherwise apply to that data (e.g., requires notice, express consent, access, security, breach notification). • Trade Assoc in Ph is hearing concerns from very few US firms (www.bpap.org).