1. Copyright, 2002 © Michael Sonntag E-Mail: sonntag@fim.uni-linz.ac.at WWW: http://www.fim.uni-linz.ac.at/staff/sonntag.htm Mag. Dipl.-Ing. Dr. Michael Sonntag Privacy (and other) issues of e-Government in one-stop portals Wroclaw Summer School on a Legal Framework for Information Society Wroclaw, 19.9.-21.9.2002

2. Michael Sonntag2 Privacy issues of e-Government Content l Motivation l Federalism and One-Stop-Portals l Official help between administrative branches l Data exchange between authorities l Automated decisions l Conclusions

3. Michael Sonntag3 Privacy issues of e-Government Motivation l Public administration should be model of excellence l Changing status of portals Information  Few personal data Transactions  Lots of personal data l Largest advantage AND largest risks by integrating data from many sources èDifferent ministries, health data, tax information, … l Reason for interest: eGOV project

4. Michael Sonntag4 Privacy issues of e-Government Federalism and One-Stop-Portals (1) l Federalism = »Loose definition; only used here èDifferent entities »Federal / state / municipal / autonomous level èDifferent rules of procedure (possibly) èNo super-/subordination AND no common supervisor l One-stop portal = èSimple for citizens: Fully integrated / details hidden èCentralized: management / administration / backup / … èData from many entities used (also for parts of others!)

5. Michael Sonntag5 Privacy issues of e-Government Federalism and One-Stop-Portals (2) l Different roles: Controller  Processor èPortal operator - own proceedings: No problem èPortal operator - proceedings of other entities »Serves as a processor - Contract on each process required »Data access: How, when, for what? l Example: Filling in forms with external data èUser asks for own data and transmits it to another entity èPortal is here processor for the user l DIFFERENT: Portal uses data to decide what to present the user (personalization)!

6. Michael Sonntag6 Privacy issues of e-Government Official help between administrative branches l Usually no threat for privacy èFormal procedure èIn writing: Each instance leaves traces behind èIndividual reason needed »„Official“ ones: Needed for decision or other „content“ èChecking, whether this information may be passed on l One-stop portals: èNo formal procedure: Done automatically èOnly general reason: „In such cases it‘s allowed“ »Typical case only; individual circumstance NOT verified! èUsed for other („non-official“) reasons too: »Personalization, advice, filling in forms,...

7. Michael Sonntag7 Privacy issues of e-Government Data exchange between authorities (1) l If exchange is allowed, how will it be done? èVerification: Who requests, which data, for what? »Definition required which data may be sent for which reasons, who might send requests with certain reasons èSending: Data must be masked »Only the authorized data may be sent, not the whole file/record »Therefore huge number of different data sets »Identification of data set per transaction, not unique »Encryption, partner server identification, … èStorage: Bound to single purpose »May be stored/used only for the purpose it was acquired for »Problem: Personalization requires relating it to other data

8. Michael Sonntag8 Privacy issues of e-Government Data exchange between authorities (2) l Probably best solution: XML-based language èShould be a large solution: Not confined to small area l Organizational issues also important èHow to place requests èIdentification of users / Logging l Processes must be adapted èInterfaces in electronic record handling systems èRetirement of old / definition of new requests / responses èPerson responsible for privacy èUser education

9. Michael Sonntag9 Privacy issues of e-Government Automated decisions (1) l Simple procedure & everything available online »(El. Signed or from secure sources) documents, databases, … èAutomated decisions are possible »Examples: Dog tax, prolongations, etc. »Example: Register of residency (see e. g. Swiss project) l Problems: èIdentification of the citizen: Easy in portal! èGathering of evidence needed: Which sources? èPayment should be anonymous èOfficial decisions/notifications possible without any human intervention? èState/Local/… proceedings done by a federal system

10. Michael Sonntag10 Privacy issues of e-Government Automated decisions (2) l Must there be a signature? èNo autonomous (legally binding) el. signatures! l Is a human decision required? èOr is the decision to use a certain program sufficient? l May an entity “produce” decisions for others? èUsually no problem èDecision about content must remain by the authority! l How fast can changes be made to the program? èMust be possible immediately l What is to be done with the data involved? èStored at the portal, moved to the authority, …? H

11. Michael Sonntag11 Privacy issues of e-Government Conclusions l Integrated one-stop portals are VERY helpful èThey pose legal problems: Privacy èComplicated and difficult to explain èUse implied consent where possible l Data exchange between authorities necessary in such portals to bring advantages èPrinciple of minimalism èMany (legally) different roles of the operator l Automated decisions usually possible èOnly for severely restricted areas èSource data and resulting data: Special care needed!

12. Copyright, 2002 © Michael Sonntag E-Mail: sonntag@fim.uni-linz.ac.at WWW: http://www.fim.uni-linz.ac.at/staff/sonntag.htm Mag. Dipl.-Ing. Dr. Michael Sonntag Questions? Thank you for your attention! ? ? ? ? ? ?