1. Generalny Inspektor Ochrony Danych Osobowych ul. Stawki 2, 00-193 Warszawa www.giodo.gov.pl kancelaria@giodo.gov.pl Seoul, June 18th, 2014 THE EU DATA PROTECTION REGULATION WOJCIECH WIEWIÓROWSKI PhD Inspector General for Personal Data Protection, Poland Laboratory of Legal Informatics, Faculty of Law and Administration, University of Gdansk PHAEDRA Third Workshop The EU Data Protection Regulation and regional perspectives on improving international cooperation between DPAs, PCs and PEAs Wednesday, 18 June 2014, 13:20 – 15:20, Seoul, South Korea Westin Chosun Hotel Seoul, 106 Sogong-ro, Jung-gu, Seoul

2. www.giodo.gov.pl © M. Narojek for GIODO 2011

3. www.giodo.gov.pl Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data Recognising that it is necessary to reconcile the fundamental values of the respect for privacy and the free flow of information between peoples Article 1 – Object and purpose The purpose of this convention is to secure in the territory of each Party for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him ("data protection"). PRIVACY AND DATA PROTECTION Seoul, June 18th, 2014

4. www.giodo.gov.pl Treaty on The Functioning Of The European Union Article 16 (ex Article 286 TEC) 1. Everyone has the right to the protection of personal data concerning them. 2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities. The rules adopted on the basis of this Article shall be without prejudice to the specific rules laid down in Article 39 of the Treaty on European Union. PRIVACY AND DATA PROTECTION Seoul, June 18th, 2014

5. www.giodo.gov.pl Seoul, June 18th, 2014 HOW DOES DPA LOOK LIKE ? Austria - 20 Belgium - 56 Bulgaria - 67 Cyprus- 11 Czech Republic - 97 Denmark - 35 Estonia - 17 Finland - 21 France -148 Germany - 81 (fed.) Greece - 27 Hungary - 48 Ireland - 22 Italy - 118 Latvia - 19 Lithuania - 30 Luxembourg -13 Malta - 8 Netherlands - 88 Poland -123 Portugal - 28 Romania - 46 Slovenia - 34 Slovakia - 33 Spain- 154 (nat.) Sweden - 44 United Kingdom - 380 (incl. regional offices) EDPS- 50 Iceland- 4 Liechtenstein- 4 Norway- 40

6. www.giodo.gov.pl Seoul, June 18th, 2014 Special Eurobarometer 359, “Attitudes on Data Protection and Electronic Identity in the European Union”, European Commission, Brussels June 2011, p. 147

7. www.giodo.gov.pl Communication from the Commission to the European Parliament and the Council - ”A comprehensive approach on personal data protection in the European Union” KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

8. www.giodo.gov.pl COPERNICAN REVOLUTION ?

9. www.giodo.gov.pl COM(2012) 11/4 draft Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

10. www.giodo.gov.pl COM(2012) 10 final 2012/0010 (COD) Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

11. www.giodo.gov.pl STATE OF PLAY Seoul, June 18th, 2014 Council DAPIX Group - Working Party on Information Exchange and Data Protection Member States represented by governments: Minister (usually Justice or Interior, but in PL – Digitisation) Experts: Some governments invite Data Protection Authority Instruction: Council of Ministers

12. www.giodo.gov.pl STATE OF PLAY Seoul, June 18th, 2014 Council - Latest developments The Council agreed on a partial general approach for specific issues of the data protection regulation, including the territorial scope (Article 3(2)) and the transfer of data to third countries or international organisations (Chapter V). The ministers also debated further the "one stop shop mechanism". The presidency briefed the Council on the state of play of the proposal for a directive on the protection of individuals with regard to the processing of personal data for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

13. www.giodo.gov.pl STATE OF PLAY Seoul, June 18th, 2014 European Parliament Raporteurs EP: Jan Phillipp Albrecht (D – Greens) – regulation Dimitrios Droutsas (GR – Socialists) – directive

14. www.giodo.gov.pl STATE OF PLAY Seoul, June 18th, 2014 European Parliament The European Parliament voted the draft in plenary with 621 votes in favour, 10 against and 22 abstentions for the Regulation and 371 votes in favour, 276 against and 30 abstentions for the Directive). "The message the European Parliament is sending is unequivocal: This reform is a necessity, and now it is irreversible. Europe's directly elected parliamentarians have listened to European citizens and European businesses and, with this vote, have made clear that we need a uniform and strong European data protection law, which will make life easier for business and strengthen the protection of our citizens," said Vice-President Viviane Reding, the EU's Justice Commissioner. "Data Protection is made in Europe. Strong data protection rules must be Europe's trade mark. Following the U.S. data spying scandals, data protection is more than ever a competitive advantage. I want to thank Mr Albrecht and Mr Droutsas for their committed and tireless work on the data protection reform. Today's vote is the strongest signal that it is time to deliver this reform for our citizens and our businesses.”

15. www.giodo.gov.pl Norms derived from European law can be: - directly binding - directly applicable - directly effective vertically and/or horizontally KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

16. www.giodo.gov.pl One continent, one law: The Regulation will establish a single, pan-European law for data protection, replacing the current inconsistent patchwork of national laws. Companies will deal with one law, not 28. The benefits are estimated at €2.3 billion per year. One-stop-shop: The Regulation will establish a 'one-stop-shop' for businesses: companies will only have to deal with one single supervisory authority, not 28, making it simpler and cheaper for companies to do business in the EU. The same rules for all companies – regardless of their establishment: Today European companies have to adhere to stricter standards than their competitors established outside the EU but also doing business on our Single Market. With the reform, companies based outside of Europe will have to apply the same rules. European regulators will be equipped with strong powers to enforce this: data protection authorities will be able to fine companies who do not comply with EU rules with up to 2% of their global annual turnover. European companies with strong procedures for protecting personal data will have a competitive advantage on a global scale at a time when the issue is becoming increasingly sensitive. KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

17. www.giodo.gov.pl There is a clear need to close the growing rift between individuals and the companies that process their data: Nine out of ten Europeans (92%) say they are concerned about mobile apps collecting their data without their consent. Seven Europeans out of ten are concerned about the potential use that companies may make of the information disclosed. KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

18. www.giodo.gov.pl The data protection reform will strengthen citizens' rights and thereby help restore trust. Better data protection rules mean you can be more confident about how your personal data is treated, particularly online. The new rules will put citizens back in control of their data, notably through: A right to be forgotten: When you no longer want your data to be processed and there are no legitimate grounds for retaining it, the data will be deleted. This is about empowering persons, not about erasing past events or restricting freedom of the press. Easier access to your own data: A right to data portability will make it easier for you to transfer your personal data between service providers. Putting you in control: When your consent is required to process your data, you must be asked to give it explicitly. It cannot be assumed. Saying nothing is not the same thing as saying yes. Businesses and organisations will also need to inform you without undue delay about data breaches that could adversely affect you. Data protection first, not an afterthought: ‘Privacy by design’ and ‘privacy by default’ will also become essential principles in EU data protection rules – this means that data protection safeguards should be built into products and services from the earliest stage of development, and that privacy-friendly default settings should be the norm – for example on social networks. KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

19. www.giodo.gov.pl risky processing instead of sensitive data KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

20. www.giodo.gov.pl KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

21. www.giodo.gov.pl Privacy by design Privacy impact assessments KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

22. www.giodo.gov.pl International transfers KEY ISSUES FOR THE EUROPEAN DEBATE Seoul, June 18th, 2014

23. www.giodo.gov.pl PRIVACY BY DESIGN Seoul, June 18th, 2014 Privacy by Design Resolution 27-29 October 2010, Jerusalem, Israel 32nd International Conference of Data Protection and Privacy Commissioners Privacy by Design: The 7 Foundational Principles 1. Proactive not Reactive; Preventative not Remedial 2. Privacy as the Default Setting 3. Privacy Embedded into Design 4. Full Functionality: Positive-Sum, not Zero-Sum 5. End-to-End Security — Full Lifecycle Protection 6. Visibility and Transparency — Keep it Open 7. Respect for User Privacy — Keep it User-Centric

24. www.giodo.gov.pl CONSULTATIONS Seoul, June 18th, 2014

25. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

26. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

27. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

28. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

29. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

30. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

31. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

32. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

33. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

34. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

35. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

36. www.giodo.gov.pl

37. Seoul, June 18th, 2014 MAIN PROBLEMS …

38. www.giodo.gov.pl Seoul, June 18th, 2014 MAIN PROBLEMS …

39. www.giodo.gov.pl THANKS FOR YOUR ATTENTION desiwm@giodo.gov.pl http://edugiodo.giodo.gov.pl